Only 66% of organisations have implemented multifactor authentication (MFA)

The average loss per on-chain security incident was $7,129,980 in H1 2025.

Phishing was the most costly attack vector, with $395,063,695 stolen across 52 on-chain security incidents in Q2 2025.

Losses on Ethereum amounted to $65,370,264 due to security incidents in Q2 2025.

Losses on Ethereum amounted to $1,634,891,832 in H1 2025.

A total of $801,315,669 was lost across 144 on-chain security incidents in Q2 2025. This represents an approximate 52.1% decrease in value lost compared to the previous quarter.

The median loss per on-chain security incident was $89,026 in H1 2025.

There were 59 fewer on-chain security incidents in Q2 2025 than the previous quarter.

80% of enterprise AI tools operate unmanaged.

ClickFix became the second most common attack method after phishing.

As a result of TPRM teams being understaffed, organisations are only managing about 40% of their vendor population.

Almost 40% of ransomware attacks in the US targeted the education sector

Nearly half (approximately 50%) of programmes cite departmental silos as a major barrier.

65% of TPRM programmes are exploring AI capabilities.

Fewer than 25% of TPRM programmes are "highly coordinated".

ClickFix was responsible for nearly 8% of all blocked attacks in H1 2025.

Before disruption, Lumma Stealer activity in H1 2025 was higher than in H2 2024 (+21%).

NFC-based fraud spiked by more than thirty-five-fold.

46% of UK HR leaders reported that security concerns directly triggered their HR software purchases last year.

The SLED sector faced 50% of droppers attacks.