SOC analysts spend just 44% of their time on proactive efforts like threat hunting and detection engineering.

44% of organizations test their security biannually or less, or not at all.

Only 29% of organizations conduct continuous simulation testing.

The median security team spends 20 minutes dismissing a single junk alert.

43% of a security team's investigation time is consumed by manual context gathering.

Organizations that use more than five disconnected security tools are twice as likely to miss critical threats compared to organizations with an integrated toolset.

For 25% of organizations, manual triage requires 214 hours per week, equivalent to 5.3 full-time employees.

92% of CISOs say AI enables their teams to review more security events.

87% of defenders expect to increase AI use, primarily to replace legacy detection and response tools.

76% of defenders say AI agents or AI assistants now handle more than 10% of their workload.

71% of defenders set aside important security tasks at least two days per week.

69% of organizations use more than 10 detection and response tools.

67% of defenders say AI-powered tools have positively impacted threat identification and response.

63% of defenders want AI agents to handle alert triage and investigations.

63% of security alerts go unaddressed.

Only 58–60% of security teams report full or near-full visibility across endpoints, on-premises networks, cloud environments, and identities.

Organizations receive an average of 2,992 security alerts per day, down from 3,832 the year prior.

39% of organizations use more than 20 detection and response tools.

44% of defenders say they are losing the battle to prioritize real threats.

6% of companies completely cut their security operation center (SOC) staffing during holidays and weekends.