Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 10th - August 16th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Cloud Security

2026 Cloud Security Index (Intruder)

How misconfigurations differ across AWS, Azure, and Google Cloud. 

Key stats:

• More than two-thirds of organizations operate multi-cloud environments.
• 83% of AWS accounts have IAM policies that allow privilege escalation.
• 75% of Google Cloud accounts are missing OS Login controls.

Read the full report here.

DDoS

Cloudflare DDoS Threat Report H1 2026 (Cloudflare)

Cloudflare's mid-year DDoS report. 

Key stats:

• 96.62% of network-layer DDoS attacks remained under 500 Mbps in the first half of 2026.
• 90.60% of network-layer DDoS attacks ended in under 10 minutes.
• Brazil was the top DDoS source country in H1 2026 at 14.9%, overtaking the United States at 13.4%.

Read the full report here.

Enterprise Perspective

2026 State of Secure AI Access (NetFoundry)

A survey of CISOs and CTOs about how AI is changing their security posture. 

Key stats:

• 100% of CISOs and CTOs at enterprises say AI is expanding their organization's attack surface.
• 15% are very confident their current security solutions adequately protect their AI deployments.
• 58% have experienced security events due to lack of machine identity oversight.

Read the full report here.

Consumer Scams

Love/hate relationship: The AI affair (Malwarebytes)

Young people are particularly susceptible to AI scams.

Key stats:

• 70% of young adults ages 18 to 22 experienced an AI-related scam in the past year, compared to 50% of the general population.
• 19% of young adults have been a victim of a deepfake or virtual kidnapping scam, compared to 8% of the general population.
• 14% of young adults have been a victim of an impersonation scam, compared to 10% of the general population.

Read the full report here.

Industry-Specific

2026 Professional Services Protect Brief (SonicWall)

Professional services are being targeted far more than any other industry, at least according to SonicWall.

Key stats:

• 3 billion IPS events in the first half of 2026, the largest absolute attack volume of any industry tracked.
• 69.9 million ransomware hits in the first half of 2026, more than any other vertical.
• Ten active ransomware families operated simultaneously against the professional services sector, including Filecoder (19.1 million hits across 113 organizations), Gandcrab (11.9 million) and Ryuk (10.5 million).

Read the full report here.

Industrial Ransomware Analysis for Q2 2026 (Dragos)

Who's getting hit by ransomware in the industrial sector (and by whom).

Key stats:

• 1,140 ransomware incidents affected industrial organizations worldwide in Q2 2026, a 12% increase over the 1,020 incidents recorded in Q1.
• Manufacturing was the most affected sector with 747 incidents (65%) across all subsectors.
• The US was the country most impacted, with 431 incidents (38% of all incidents).

Read the full report here.

Regional Spotlight

Cyber Security In Manufacturing (Make UK)

A UK-specific look at how cyber incidents are disrupting manufacturers, and how few have a tested plan for when it happens.

Key stats:

• 30% of manufacturers experienced a cyber incident in the past year, either directly or through their supply chain.
• More than one in five manufacturers (22.7%) believe available cybersecurity solutions are not relevant to their business, while 18.2% report that providers lack a sufficient understanding of manufacturing operations.
• Firewalls are the most widely adopted measure (92%) among manufacturers, followed by malware protection (80%), secure configuration (67%) and access controls (61%).

 

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 3rd - August 9th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

2026 Threat Hunting Report (CrowdStrike)

CrowdStrike's annual threat hunting report. 

Key stats:

• Vishing intrusions increased by 2x in 1H 2026.
• Monthly device code phishing attempts increased 15x in 1H 2026.
• China-nexus adversaries exploited critical vulnerabilities within 24 hours of public proof-of-concept release, and in 1H 2026, 88% of observed exploitation of vulnerabilities with a public PoC occurred within 48 hours of release.

Read the full report here.

Why Trust is the New Attack Surface: Darktrace's Mid-Year Threat Update 2026 (Darktrace)

A mid-year update on how phishing and AI misuse are evolving. 

Key stats:

• In the first half of 2026, 67% of phishing emails passed DMARC.
• VIP users were targeted in 25.8% of phishing attacks.
• 39% of phishing messages featured novel social engineering techniques.

Read the full report here.

AI Governance & Agents

When AI leaves the chat and enters the workflow (Optro)

A good (i.e., detailed and useful)  report on why output-focused AI governance breaks down once agents start taking actions.

Key stats:

• 85% of organizations have integrated AI into core operations.
• Only 18% of leaders have active risk mitigations in place for AI.
• 40% reported inaccurate AI outputs in the past 12 months, and 27% reported data breaches tied to AI use.

Read the full report here.

Security Incident INC-2026-07-28-01 (AISI)

The UK AI Safety Institute's (AISI) incident report on what happened when they tested frontier AI models. 

Key stats:

• A total of 19 distinct unsanctioned actions were catalogued during a routine evaluation of frontier AI models.
• Seventeen of the 19 unsanctioned actions came from Anthropic's Mythos 5, and two came from OpenAI's GPT-5.6-Sol with cyber classifiers disabled.
• In 10 of 122 evaluation runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations.

Read the full report here.

Top 10 for LLM Applications 2026 (OWASP)

OWASP's annual top 10 list for LLM applications is out.

Key stats:

• Practitioners rank prompt injection as the number one security challenge from GenAI tools for a third consecutive year.
• Sensitive information disclosure ranks as the second biggest LLM threat for a second consecutive year.
• Excessive agency moves from sixth place to third place.

Read the full report here.

AI Code

The shrinking validation window (Pentest Tools)

A look at how AI-assisted coding is outpacing vulnerability testing, and the security gaps that this leaves behind.

Key stats:

• 76.4% of developers at enterprises use AI coding tools always (41.5%) or usually (34.9%).
• 30.3% disagree or strongly disagree with the statement that they have sufficient time to thoroughly review AI-generated code before deployment.
• Only 8.7% say vulnerability testing keeps pace completely with AI-generated code.

Read the full report here.

Voice Attacks

2026 Voice Threat Survey (Mutare)

Findings from a survey of technology and cybersecurity leaders on how they view voice as an attack vector. 

Key stats:

• 93% of organizations believe voice security should be included in cybersecurity and risk management programs.
• 79% are not highly confident their current defenses could stop an executive or vendor impersonation attack.
• 67% are concerned about GenAI-based voice attacks and deepfake impersonation.

Read the full report here.

Enterprise Perspective

State of Agentic Adoption 2026 (Opsin)

What else is new? AI agents are being created faster than companies are learning how to securely control their access and permissions.

Key stats:

• Enterprise environments now average one AI agent, live or in draft mode, for every employee.
• 60% of agents provisioned beyond default settings are granted allow-all access rather than being scoped to the permissions their tasks require.
• 60% of AI agents are judged to have configured capabilities that exceed their original stated intent.

Read the full report here.

Regional Spotlight

African Cyberthreat Assessment Report 2026 (INTERPOL)

INTERPOL's assessment of cybercrime across Africa. 

Key stats:

• AI enabled 55% of reported cybercrimes across Africa.
• Cybercrime-related losses in Africa increased from USD 192 million to USD 484 million since 2024.
• 17% of reported cybercrime cases in Africa in 2025 involved online scams, including phishing, and 14% involved identity theft and financial fraud.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between July 27th - August 2nd.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

2026 Cost of a Data Breach Report (IBM)

IBM's annual breach cost report, with interesting data points on how much AI is now involved in attacks, and how much more expensive that makes breaches. 

Key stats:

• 25% of malicious breaches were AI-enabled.
• AI-enabled breaches cost an average of $6 million, roughly $1 million more than the global average of $4.99 million.
• AI-enabled malicious breaches increased by 56% over the previous year.

Read the full report here.

IR Trends Q2 2026 (Cisco Talos)

Cisco Talos on what showed up in their incident response engagements this quarter. 

Key stats:

• Phishing was the primary means of gaining initial access in over half of engagements this quarter, up from approximately one-third last quarter.
• Authentication abuse was observed in 65% of engagements this quarter, up from 35% last quarter.
• Insufficient logging and visibility was observed in 42% of engagements this quarter, up from 18% last quarter.

Read the full report here.

Ransomware

Q2 2026 Ransomware Trends Report (BlackFog)

BlackFog's Q2 numbers on ransomware. 

Key stats:

• 93 ransomware groups were active in Q2 2026, including 28 newly formed groups.
• 97% of disclosed ransomware incidents in Q2 2026 involved data exfiltration, the highest rate recorded.
• Undisclosed ransomware attacks increased 40% year on year to 2,027 attacks in Q2 2026 from 1,446 in Q2 2025.

Read the full report here.

Ransomware Evolution Report Q2 2026 (Halcyon)

Halcyon's Q2 ransomware numbers. 

Key stats:

• Q2 2026 recorded 1,988 ransomware attack claims from 89 groups across 101 countries.
• The US accounted for 42.5% of ransomware claims, Canada for 5% and Germany for 4.8%.
• Manufacturing (19.8%) was the most targeted industry, followed by construction (10.1%) and business services (9.0%).

Read the full report here.

AI Governance

The AI Governance Gap Report (Pathlock)

If you were wondering whether AI governance is keeping up with how quickly AI agents are being embedded in business systems, this report has the answer.  

Key stats:

• 38% of organizations allow AI agents to create and modify business records.
• 51% are not confident they know all the AI agents operating in their systems.
• 79% have no dedicated AI governance team or officer.

Read the full report here.

AI Code Security

2026 GenAI Code Security Report (Veracode)

Veracode tested 11 AI coding models to see how often they write secure code. 

Key stats:

• The average security pass rate for AI-generated code across tracked models was 56%.
• AI-generated code fails security checks nearly 44% of the time when given no security-specific guidance.
• The best model available (OpenAI's GPT-5.5, at 68%) still failed nearly one in three security tasks.

Read the full report here.

Credentials

Credential Risk Report (Enzoic)

How much do you care about stolen credentials? If you're like most orgs, probably a lot. But do you actually do anything about it? Again, if you're like most orgs, probably not.

Key stats:

• 85% of organizations view stolen credentials as a top threat.
• Only 19% continuously monitor credential integrity and automatically remediate exposure.
• 73% of organizations have found their workforce's credentials in breach, Dark Web, or infostealer data in the past year.

Read the full report here.

Autonomous Defense

2026 State of Autonomous Defense Report (Kai)

Attackers are moving at machine speed. Defenders are… not. 

Key stats:

• 89% of security leaders say their organization is prepared for AI-driven attacks, but only 28% describe themselves as very prepared.
• 63% believe attackers currently have the advantage because of AI.
• 52% identify lack of trust in automated decisions as the biggest barrier to broader automation adoption.

Read the full report here.

Action1 2026 Survey Report: AI Impact on Sysadmins (Action1)

An interesting survey of sysadmins about how much AI they're using versus how much they thought they'd be using by now.

Key stats:

• In 2024, 52% of sysadmins predicted full automation within two years.
• In 2026, AI use is highest among sysadmins in log analysis (50%) and troubleshooting (47%).
• 23% report never using AI professionally.

Read the full report here.

Vulnerability Management

VulnCheck State of Exploitation 1H-2026 (VulnCheck)

VulnCheck's mid-year look at what's actually getting exploited, how fast, and whether AI really is finding vulnerabilities faster than everyone else. 

Key stats:

• The median time from CVE publication to KEV fell from 120 days in 2025 to 80 days in the first half of 2026.
• In the first half of 2026, 23.43% of Known Exploited Vulnerabilities showed evidence of exploitation on or before the day the CVE was published.
• Across Anthropic and Berkeley datasets, 1,061 vulnerabilities were attributed to AI-assisted discovery, but only 14 (1.3%) were confirmed as exploited in the wild.

Read the full report here.

Infrastructure

State of CPS Security: Data Center Exposures (Claroty)

Scary research on how badly exposed data center physical infrastructure is. 

Key stats:

• Nearly 1 in 5 data center CPS assets are one hop away from systems making outbound connections that could provide attackers a pathway.
• 88% of building management systems in data centers are exposed via communication over insecure protocols.
• More than 80% of OT control systems, power monitoring systems, and IoT systems in data centers communicate over legacy, insecure protocols such as BACnet and MODBUS.

Read the full report here.

Enterprise Perspective

State of Enterprise AI Failures 2026 (ChatSee.ai)

What's going wrong with enterprise AI. 

Key stats:

• Hallucination-related failures accounted for less than 10% of observed enterprise AI failure events.
• Resolution and escalation breakdowns represented 31.1% of observed enterprise AI failures.
• Action and execution failures increased by approximately 62% relative to the Q2 2024 baseline.

Read the full report here.

The State of AI, Security and ERP (Onapsis)

A survey of cybersecurity leaders at large US organizations running SAP, Oracle, or Salesforce to see how fast AI is being pushed into ERP systems and how far behind the security is (very).

Key stats:

• 86% of organizations have already integrated, or will shortly integrate, AI directly into their ERP code.
• 22% of organizations experienced a security incident in the last twelve months where bad actors used AI to exploit their critical business platforms.
• 70.6% of senior cybersecurity leaders have only some or no trust in AI applications and agents to secure their organization's most business-critical data.

Read the full report here.

2026 Global Mobile Threat Report (Zimperium)

A look at mobile attacks on enterprises. 

Key stats:

• Phishing events detected on employee mobile devices have grown 380% since January 2025.
• The number of mobile devices where employees clicked a malicious link grew 110% in 2025 compared to 2024.
• AI adoption within mobile applications has grown 14x on Android and 7x on iOS.

Read the full report here.

Industry-specific

Global Automotive Threat Intelligence Report Q2 2026 (PCA Cyber Security) 

Analysis of the automotive threat landscape for Q2 2026, tracking vulnerability data alongside underground forums, ransomware leak sites, and criminal marketplaces.

Key stats:

• 345 unique automotive vulnerabilities in Q2 2026, a 30% rise on Q1 and 220% up year on year.
• High severity findings more than doubled, from 75 to 161.
• Qilin ransomware listed a major Japanese Tier-1 automotive components manufacturer, hitting its European and North African subsidiaries.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between July 20th - July 26th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

2026H1 Threat Review Report (Forescout)

What was the threat landscape like in H1 2026, and how does it compare to 2025? This report answers that. 

Key stats:

• Published vulnerabilities increased 51% year-over-year to 37,137 during the first half of 2026, with more than half rated high or critical severity.
• Ransomware attack claims increased 25% to 4,544 incidents during the first half of 2026, averaging 25 attacks per day.
• 46% of additions to CISA's Known Exploited Vulnerabilities catalog were CVEs that were published prior to 2026.

Read the full report here.

ITRC H1 2026 Data Breach Report (Identity Theft Resource Center)

ITRC's mid-year data breach numbers. 

Key stats:

• There were 1,803 data compromises in the first half of 2026.
• Insider wrongdoing events totaled 21 in the first half of 2026, a sevenfold increase over the three incidents in 2025.
• Zero-day attacks rose to 14 events in H1 2026, nearly matching the 17 events recorded in all of 2025.

Read the full report here.

The State of Continuous Security Validation (Synack)

How often do serious vulnerabilities show up between scheduled security tests? Constantly - at least according to Synack.

Key stats:

• 15% of enterprise security leaders describe their security testing and validation program as continuous.
• 95% discovered high or critical vulnerabilities outside scheduled testing windows in the past year.
• 38% report that at least one-quarter of their critical attack surface had not been independently tested or validated in the previous 90 days.

Read the full report here.

Q2 2026 Brand Phishing Report (Check Point)

Attackers' favorite brands to impersonate. Mostly predictable with an interesting new entrant. 

Key stats:

• Microsoft was the most impersonated brand in Q2 2026, appearing in 23% of all brand phishing attempts.
• The top five impersonated brands- Microsoft, LinkedIn, Google, Apple, and Amazon- together accounted for more than 50% of all brand phishing attempts this quarter.
• OpenAI's ChatGPT entered the top ten most impersonated brands for the first time.

Read the full report here.

Ransomware

2026 Ransomware Report (Black Kite)

Annual report analyzing 7,551 ransomware victims by where they are, what industry they're in, and how big they are. Plus, what security weaknesses or exposed systems remained after each attack.

Key stats:

• Ransomware activity accelerated 60% in the second half of the reporting period and closed with 861 victims in March 2026, the highest monthly total in four years.
• Qilin claimed more than 1,300 victims, nearly twice as many as its nearest rival.
• 43.5% of victims still carried critical patch vulnerabilities in the latest assessment.

Read the full report here.

2026 AI-Era Ransomware Report (Proofpoint)

AI is making ransomware attacks more effective. 

Key stats:

• 65% of global organizations affected by ransomware report that AI increased the attack's effectiveness.
• 28% reported that AI significantly increased the attack's effectiveness.
• 34% of ransomware incidents begin with phishing emails or other email-based social engineering.

Read the full report here.

AI Security & Governance

Path to the Autonomous Digital Workplace (TeamViewer)

General workplace productivity research with an interesting section on what users say would help them trust autonomous AI.

Key stats:

• 61% of survey participants prefer AI to take no independent action.
• 56% often or always verify AI outputs before relying on them.
• 51% say they do not always know when to trust AI and when to verify it.

Read the full report here.

OT Security

State of AI in OT Cybersecurity 2026 Report (Nozomi Networks)

The people working in OT security on what they are actually doing with AI. 

Key stats:

• 87.7% of surveyed OT and ICS cybersecurity professionals are using, evaluating, piloting, or planning AI for OT cybersecurity.
• Only 7.9% have deployed AI for multiple OT cybersecurity functions.
• Only 11.9% have formally mapped and reviewed which AI-driven decisions could directly affect physical processes, safety systems, or operational continuity.

Read the full report here.

State of Industrial Remote Access 2026 (Secomea)

How manufacturers are handling third-party vendor access to OT environments. 

Key stats:

• 57% of North American organizations manage six or more external vendors with remote access into operational technology (OT) environments.
• 46% of North American organizations with OT environments report full auditability of vendor sessions.
• 23% review vendor credentials monthly or more frequently.

Read the full report here.

Enterprise Perspective

2026 State of Threat Exposure Management Report (Vectra AI)

Vectra used telemetry across customer environments to figure out how quickly assets, identities, and AI agents come and go in enterprise environments. 

Key stats:

• The typical enterprise environment contains 1.17 AI agents per device.
• 35% of enterprise environments contain more AI agents than devices.
• 98% of enterprise environments contain at least one attacker-relevant exposure condition.

Read the full report here.

The Third Annual State of Data Compliance and Security Report (Perforce)

Everyone has the policies, so why do breaches, failed audits, and compliance gaps keep happening? 

Key stats:

• 98% of enterprise leaders report confidence in their ability to protect sensitive data.
• 99% of enterprises have data masking mandates in place, but 84% allow compliance exceptions to those mandates.
• 34% report their organizations have experienced data breaches or theft.

Read the full report here.

Road to AI in IT (Fleet Device Management)

How IT teams are handling the AI rollout (they're mostly not).

Key stats:

• The average enterprise runs 14 AI applications while IT has visibility into only four of them.
• 78% of employees use personal AI tools at work.
• 79% of organizations take more than a day to deploy critical security patches.

Read the full report here.

Industry-Specific

Education Ransomware Roundup: H1 2026 (Comparitech)

Comparitech tracked ransomware attacks against schools and universities specifically. The Gentlemen have decided higher education is their thing.

Key stats:

• There were 104 ransomware attacks in total against educational institutions in H1 2026.
• The Gentlemen's attacks on education increased 275% from H2 2025 to H1 2026, and 80% of their attack claims were against higher education institutions.
• The median ransom demand in the education sector is $420,620, a 53% increase from $275,000 in H2 2025.

Read the full report here.

2026 Cyber Protect Report (SonicWall)

SonicWall's mid-year data on manufacturing. 

Key stats:

• Manufacturing recorded 474 million intrusion prevention events in the first half of 2026.
• IoT attacks generated 46.2 million hits in manufacturing, making IoT the sector's second-largest attack category by volume.
• Ten ransomware families were active against manufacturing networks in H1 2026.

Read the full report here.

Velocity V5: Reimagining Cyber for a Faster Fight (Booz Allen)

Data on how federal agencies are handling AI deployment.

Key stats:

• 58% of federal IT and cybersecurity decision makers report their agencies have deployed or are piloting AI agents.
• Only 28% express high confidence in their ability to deploy AI agents securely.
• 36% are confident that cyber defenses can keep pace with AI-enabled attackers.

Read the full report here.

Regional Spotlight

Data Health Check 2026 (Databarracks)

500 UK IT professionals on what went wrong last year, what they are doing about it, and what they expect to be dealing with over the next five years.

Key stats:

• 26% of businesses have suffered a cyber incident that originated in their supply chain in the last year.
• 43% of organisations that knowingly work with risky suppliers experienced a supplier-originated cyber incident, compared with 10% of organisations that did not.
• 48% of organisations continue working with suppliers despite known resilience or security concerns.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between July 20th - July 26th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

2026H1 Threat Review Report (Forescout)

What was the threat landscape like in H1 2026, and how does it compare to 2025? This report answers that. 

Key stats:

• Published vulnerabilities increased 51% year-over-year to 37,137 during the first half of 2026, with more than half rated high or critical severity.
• Ransomware attack claims increased 25% to 4,544 incidents during the first half of 2026, averaging 25 attacks per day.
• 46% of additions to CISA's Known Exploited Vulnerabilities catalog were CVEs that were published prior to 2026.

Read the full report here.

ITRC H1 2026 Data Breach Report (Identity Theft Resource Center)

ITRC's mid-year data breach numbers. 

Key stats:

• There were 1,803 data compromises in the first half of 2026.
• Insider wrongdoing events totaled 21 in the first half of 2026, a sevenfold increase over the three incidents in 2025.
• Zero-day attacks rose to 14 events in H1 2026, nearly matching the 17 events recorded in all of 2025.

Read the full report here.

The State of Continuous Security Validation (Synack)

How often do serious vulnerabilities show up between scheduled security tests? Constantly - at least according to Synack.

Key stats:

• 15% of enterprise security leaders describe their security testing and validation program as continuous.
• 95% discovered high or critical vulnerabilities outside scheduled testing windows in the past year.
• 38% report that at least one-quarter of their critical attack surface had not been independently tested or validated in the previous 90 days.

Read the full report here.

Q2 2026 Brand Phishing Report (Check Point)

Attackers' favorite brands to impersonate. Mostly predictable with an interesting new entrant. 

Key stats:

• Microsoft was the most impersonated brand in Q2 2026, appearing in 23% of all brand phishing attempts.
• The top five impersonated brands- Microsoft, LinkedIn, Google, Apple, and Amazon- together accounted for more than 50% of all brand phishing attempts this quarter.
• OpenAI's ChatGPT entered the top ten most impersonated brands for the first time.

Read the full report here.

Ransomware

2026 Ransomware Report (Black Kite)

Annual report analyzing 7,551 ransomware victims by where they are, what industry they're in, and how big they are. Plus, what security weaknesses or exposed systems remained after each attack.

Key stats:

• Ransomware activity accelerated 60% in the second half of the reporting period and closed with 861 victims in March 2026, the highest monthly total in four years.
• Qilin claimed more than 1,300 victims, nearly twice as many as its nearest rival.
• 43.5% of victims still carried critical patch vulnerabilities in the latest assessment.

Read the full report here.

2026 AI-Era Ransomware Report (Proofpoint)

AI is making ransomware attacks more effective. 

Key stats:

• 65% of global organizations affected by ransomware report that AI increased the attack's effectiveness.
• 28% reported that AI significantly increased the attack's effectiveness.
• 34% of ransomware incidents begin with phishing emails or other email-based social engineering.

Read the full report here.

AI Security & Governance

Path to the Autonomous Digital Workplace (TeamViewer)

General workplace productivity research with an interesting section on what users say would help them trust autonomous AI.

Key stats:

• 61% of survey participants prefer AI to take no independent action.
• 56% often or always verify AI outputs before relying on them.
• 51% say they do not always know when to trust AI and when to verify it.

Read the full report here.

OT Security

State of AI in OT Cybersecurity 2026 Report (Nozomi Networks)

The people working in OT security on what they are actually doing with AI. 

Key stats:

• 87.7% of surveyed OT and ICS cybersecurity professionals are using, evaluating, piloting, or planning AI for OT cybersecurity.
• Only 7.9% have deployed AI for multiple OT cybersecurity functions.
• Only 11.9% have formally mapped and reviewed which AI-driven decisions could directly affect physical processes, safety systems, or operational continuity.

Read the full report here.

State of Industrial Remote Access 2026 (Secomea)

How manufacturers are handling third-party vendor access to OT environments. 

Key stats:

• 57% of North American organizations manage six or more external vendors with remote access into operational technology (OT) environments.
• 46% of North American organizations with OT environments report full auditability of vendor sessions.
• 23% review vendor credentials monthly or more frequently.

Read the full report here.

Enterprise Perspective

2026 State of Threat Exposure Management Report (Vectra AI)

Vectra used telemetry across customer environments to figure out how quickly assets, identities, and AI agents come and go in enterprise environments. 

Key stats:

• The typical enterprise environment contains 1.17 AI agents per device.
• 35% of enterprise environments contain more AI agents than devices.
• 98% of enterprise environments contain at least one attacker-relevant exposure condition.

Read the full report here.

The Third Annual State of Data Compliance and Security Report (Perforce)

Everyone has the policies, so why do breaches, failed audits, and compliance gaps keep happening? 

Key stats:

• 98% of enterprise leaders report confidence in their ability to protect sensitive data.
• 99% of enterprises have data masking mandates in place, but 84% allow compliance exceptions to those mandates.
• 34% report their organizations have experienced data breaches or theft.

Read the full report here.

Road to AI in IT (Fleet Device Management)

How IT teams are handling the AI rollout (they're mostly not).

Key stats:

• The average enterprise runs 14 AI applications while IT has visibility into only four of them.
• 78% of employees use personal AI tools at work.
• 79% of organizations take more than a day to deploy critical security patches.

Read the full report here.

Industry-Specific

Education Ransomware Roundup: H1 2026 (Comparitech)

Comparitech tracked ransomware attacks against schools and universities specifically. The Gentlemen have decided higher education is their thing.

Key stats:

• There were 104 ransomware attacks in total against educational institutions in H1 2026.
• The Gentlemen's attacks on education increased 275% from H2 2025 to H1 2026, and 80% of their attack claims were against higher education institutions.
• The median ransom demand in the education sector is $420,620, a 53% increase from $275,000 in H2 2025.

Read the full report here.

2026 Cyber Protect Report (SonicWall)

SonicWall's mid-year data on manufacturing. 

Key stats:

• Manufacturing recorded 474 million intrusion prevention events in the first half of 2026.
• IoT attacks generated 46.2 million hits in manufacturing, making IoT the sector's second-largest attack category by volume.
• Ten ransomware families were active against manufacturing networks in H1 2026.

Read the full report here.

Velocity V5: Reimagining Cyber for a Faster Fight (Booz Allen)

Data on how federal agencies are handling AI deployment.

Key stats:

• 58% of federal IT and cybersecurity decision makers report their agencies have deployed or are piloting AI agents.
• Only 28% express high confidence in their ability to deploy AI agents securely.
• 36% are confident that cyber defenses can keep pace with AI-enabled attackers.

Read the full report here.

Regional Spotlight

Data Health Check 2026 (Databarracks)

500 UK IT professionals on what went wrong last year, what they are doing about it, and what they expect to be dealing with over the next five years.

Key stats:

• 26% of businesses have suffered a cyber incident that originated in their supply chain in the last year.
• 43% of organisations that knowingly work with risky suppliers experienced a supplier-originated cyber incident, compared with 10% of organisations that did not.
• 48% of organisations continue working with suppliers despite known resilience or security concerns.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between July 13th - July 19th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Ransomware

The State of Ransomware 2026 (Sophos)

Now in its seventh straight year, this is the definitive look at ransomware trends worldwide.

Key stats:

• 79% of ransomware attacks start with an identity-based approach.
• 67% of root causes across 661 incident response and MDR cases are identity-related.
• 97% of victims where compromised credentials are identified as the root cause have MFA enabled in some form at the time of the attack.

Read the full report here.

Ransomware and Cyber Extortion in Q2 2026 (ReliaQuest)

ReliaQuest's Q2 numbers on ransomware activity. The big takeaway: The Gentlemen is the group everyone should be watching. Plus, it looks like Deadlock is back. 

Key stats:

• The Gentlemen surged 588% quarter-over-quarter to 179 posts in Q1.
• Deadlock emerged in June 2026 with 75 named victims in a single month, after being absent from public data-leak sites for 11 months.
• The US absorbed 1,094 ransomware victim data leak posts in Q2, roughly 49% of observed activity and nine times the volume of the next country.

Read the full report here.

Vulnerability Management

The 2026 State of Vulnerability Remediation (Vicarius)

A look at how security leaders are fixing vulnerabilities. 

Key stats:

• 79% of organizations experienced a security incident in the past 12 months involving a vulnerability that was already known and sitting in their inventory.
• 75% of critical vulnerability responses initiate administrative workflows (like ticket creation or routing) rather than immediately fixing the underlying flaw.
• 58% of all vulnerability remediation activities require direct human intervention.

Read the full report here.

AI Security

AI Agents Are Entering Critical Workflows. Who's Governing Them? (JumpCloud)

AI agents are moving into real work, but 800 IT leaders admit governance hasn't caught up.

Key stats:

• More than 60% of organizations run AI agents in production.
• Organizations have adopted fewer than one-third of standard AI governance and security practices.
• The share of organizations requiring human review before high-risk AI actions dropped from 40% to 25% in six months.

Read the full report here.

The AI Security Report 2026 (Check Point)

A breakdown of how AI has gone from cyber assistant to active attacker. 

Key stats:

• High-risk enterprise AI prompts doubled over the year, increasing from about 1 in every 50 interactions to 1 in every 25 interactions.
• The average organization runs ten AI applications per month.
• Between 87% and 93% of organizations experienced at least one high-risk AI interaction each month.

Read the full report here.

The Year Agents Entered the Workforce (Straiker)

Straiker put AI agents through adversarial testing to see where they fail.

Key stats:

• More than 1,700 successful exploits occurred across production coding, productivity, and first-party AI agents during adversarial testing.
• 36% of successful attacks on coding agents reached remote code execution on the developer's machine.
• 91% of successful attacks on productivity agents ended in silent data exfiltration.

Read the full report here.

Rethinking AI's Impact on Cybersecurity Roles (ISC2)

ISC2 on how AI is changing the day-to-day of cybersecurity work.

Key stats:

• 89% of cybersecurity professionals report having experienced AI recommendations that lead to incorrect outcomes at their organizations.
• 62% list over-reliance on AI as a top concern.
• 50% say their organizations hold human decision-makers ultimately accountable when AI-recommended actions lead to incorrect outcomes.

Read the full report here.

Executive Risk

2026 Executive Trends Report (Nisos)

Scary insight into how exposed executives are on the internet. 

Key stats:

• 100% of executives have breach data linking their name to at least one current email address.
• 94% have at least one plaintext password exposed in breach data.
• 94% have home addresses publicly linked to their name in public records or people-search sites.

Read the full report here.

Industry-Specific

Government Ransomware Roundup: H1 2026 (Comparitech)

Comparitech tracked ransomware attacks specifically against government entities in the first half of 2026.

Key stats:

• From January to June 2026, an average of one ransomware attack on a government entity occurred every day.
• The median ransom demand in H1 2026 was $100,000, one-fifth of the H2 2025 median of $500,000.
• The most prolific ransomware strains against government were The Gentlemen (22), Qilin (21), LockBit (14), APT73/BASHE (12), and INC (10).

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between July 13th - July 19th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Ransomware

The State of Ransomware 2026 (Sophos)

Now in its seventh straight year, this is the definitive look at ransomware trends worldwide.

Key stats:

• 79% of ransomware attacks start with an identity-based approach.
• 67% of root causes across 661 incident response and MDR cases are identity-related.
• 97% of victims where compromised credentials are identified as the root cause have MFA enabled in some form at the time of the attack.

Read the full report here.

Ransomware and Cyber Extortion in Q2 2026 (ReliaQuest)

ReliaQuest's Q2 numbers on ransomware activity. The big takeaway: The Gentlemen is the group everyone should be watching. Plus, it looks like Deadlock is back. 

Key stats:

• The Gentlemen surged 588% quarter-over-quarter to 179 posts in Q1.
• Deadlock emerged in June 2026 with 75 named victims in a single month, after being absent from public data-leak sites for 11 months.
• The US absorbed 1,094 ransomware victim data leak posts in Q2, roughly 49% of observed activity and nine times the volume of the next country.

Read the full report here.

Vulnerability Management

The 2026 State of Vulnerability Remediation (Vicarius)

A look at how security leaders are fixing vulnerabilities. 

Key stats:

• 79% of organizations experienced a security incident in the past 12 months involving a vulnerability that was already known and sitting in their inventory.
• 75% of critical vulnerability responses initiate administrative workflows (like ticket creation or routing) rather than immediately fixing the underlying flaw.
• 58% of all vulnerability remediation activities require direct human intervention.

Read the full report here.

AI Security

AI Agents Are Entering Critical Workflows. Who's Governing Them? (JumpCloud)

AI agents are moving into real work, but 800 IT leaders admit governance hasn't caught up.

Key stats:

• More than 60% of organizations run AI agents in production.
• Organizations have adopted fewer than one-third of standard AI governance and security practices.
• The share of organizations requiring human review before high-risk AI actions dropped from 40% to 25% in six months.

Read the full report here.

The AI Security Report 2026 (Check Point)

A breakdown of how AI has gone from cyber assistant to active attacker. 

Key stats:

• High-risk enterprise AI prompts doubled over the year, increasing from about 1 in every 50 interactions to 1 in every 25 interactions.
• The average organization runs ten AI applications per month.
• Between 87% and 93% of organizations experienced at least one high-risk AI interaction each month.

Read the full report here.

The Year Agents Entered the Workforce (Straiker)

Straiker put AI agents through adversarial testing to see where they fail.

Key stats:

• More than 1,700 successful exploits occurred across production coding, productivity, and first-party AI agents during adversarial testing.
• 36% of successful attacks on coding agents reached remote code execution on the developer's machine.
• 91% of successful attacks on productivity agents ended in silent data exfiltration.

Read the full report here.

Rethinking AI's Impact on Cybersecurity Roles (ISC2)

ISC2 on how AI is changing the day-to-day of cybersecurity work.

Key stats:

• 89% of cybersecurity professionals report having experienced AI recommendations that lead to incorrect outcomes at their organizations.
• 62% list over-reliance on AI as a top concern.
• 50% say their organizations hold human decision-makers ultimately accountable when AI-recommended actions lead to incorrect outcomes.

Read the full report here.

Executive Risk

2026 Executive Trends Report (Nisos)

Scary insight into how exposed executives are on the internet. 

Key stats:

• 100% of executives have breach data linking their name to at least one current email address.
• 94% have at least one plaintext password exposed in breach data.
• 94% have home addresses publicly linked to their name in public records or people-search sites.

Read the full report here.

Industry-Specific

Government Ransomware Roundup: H1 2026 (Comparitech)

Comparitech tracked ransomware attacks specifically against government entities in the first half of 2026.

Key stats:

• From January to June 2026, an average of one ransomware attack on a government entity occurred every day.
• The median ransom demand in H1 2026 was $100,000, one-fifth of the H2 2025 median of $500,000.
• The most prolific ransomware strains against government were The Gentlemen (22), Qilin (21), LockBit (14), APT73/BASHE (12), and INC (10).

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between July 6th - July 12th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Ransomware

GRIT Q2 2026 Ransomware & Cyber Threat Insights Report (GuidePoint Security)

We’ve read and written about the ups and downs of ransomware, but according to GuidePoint, ransomware is not as bad as ever. It's actually much worse than ever.

Key stats:

• 91 active ransomware groups operated across 108 countries in Q2 2026, a record high.
• Q2 2026 recorded 2,279 reported ransomware victims, a 7% increase from Q1 2026 and a 43% increase from Q2 2025.
• Weekly victim postings never fell below 150 during the quarter.

Read the full report here.

AI Security

2026 State of AI Security Report (Orca Security)

How AI security is actually going in the cloud, based on real telemetry from more than 1,200 production organizations. 

Key stats:

• 99.9% of AI vulnerabilities with an available fix remain unpatched.
• 81% of organizations using AI packages have at least one known vulnerability, up from 62% in 2024.
• 50% of AI package vulnerabilities have a publicly available exploit, a 250-fold increase over 2024.

Read the full report here.

Phishing & Social Engineering

Phishing by Industry Benchmarking Report 2026 Edition (KnowBe4)

You should probably invest in security awareness training. 

Key stats:

• The global average Phish-prone Percentage (PPP) is 33.2% before training. After one year of consistent training, it falls to 4.2%.
• Organizations reduce phishing susceptibility by 40% within the first 90 days and by 79% after one year.
• The three industries with the highest baseline PPP are Healthcare & Pharmaceuticals at 42.7%, Insurance at 38.1%, and Retail & Wholesale at 36%.

Read the full report here.

Fraud and Impersonation

2026 State of Executive Impersonation (Outtake)

Good data on how attackers are using AI to impersonate company executives online. 

Key stats:

• 53% of organizations had an executive or employee impersonated.
• 53.83% of executive impersonation alerts originated from social platforms, and 35.05% from video and visual platforms.
• Only 3.57% originated from executive lookalike domains.

Read the full report here.

Fraud & Security Trends Report 2026 (Infobip)

The numbers here are just AI vs AI. Fraudsters use it to send more attacks, and businesses use it to catch them.

Key stats:

• Detected threats increased by 77% as fraudsters use AI to scale and personalize harmful messaging.
• Adoption of AI-powered fraud detection grew by 71% year-on-year, and pattern-based detection increased by 105%.
• Phishing accounted for 49% of blocked harmful content, and phishing volume grew 94% year-on-year.

Read the full report here.

Industry-Specific

Cyber Risk, Supersized: 2026 Quick Service & Fast Casual Restaurant Report (VikingCloud)

Rare data on restaurant cybersecurity. 

Key stats:

• 94% of leaders describe themselves as confident or very confident in their ability to prevent or detect a cyberattack, yet 80% experienced at least one cyber incident in the past 12 months.
• 76% had sensitive data leaked in the past 12 months, including payment card data (40%) and customer personal information (32%).
• 10% of restaurant chains have temporarily or permanently closed a location following a cyberattack.

Read the full report here.

The state of financial services cybersecurity in 2026 (SonicWall)

A briefing on how financial services got attacked in the first half of 2026, based on data from their global network of security sensors.

Key stats:

• Financial services saw 132,378 IPS hits per device in the first half of 2026, the highest attack intensity of any tracked industry and more than double the cross-sector average.
• Malware activity averaged 39,341 hits per firewall, the second-highest per-device malware intensity of any industry, behind only healthcare.
• Ten ransomware families were active against the sector, including REvil (Sodinokibi) and Prometheus.

Read the full report here.

2026 State of Identity Security in Financial Organizations (Secret Double Octopus)

How identity and access management is actually working (or not working) at financial institutions in the US and Canada.

Key stats:

• 94% of IAM leaders and stakeholders at financial services firms report that phishing attacks increased over the past year.
• Only 28% of the MFA used for workforce authentication is phishing-resistant.
• 54% of financial organizations report that at least half of their applications and infrastructure are legacy, and those legacy systems are protected by MFA at a rate of just 50%.

Read the full report here.

Regional Spotlight

78% of CISOs say C-level do not fully understand employee-driven cyber risk (MetaCompliance)

CISOs in Europe see employees as their biggest risk, but are finding it difficult to convince their bosses.

Key stats:

• 68% of CISOs identify employees as their organization's biggest security risk as AI amplifies human-targeted attacks.
• More than three-quarters of CISOs across Europe say C-level senior decision-makers do not fully understand the cyber risk posed by employees.
• 40% of CISOs fear that employees are sharing sensitive information with generative AI platforms.

Read the full report here.

The State of Secure Collaboration Report 2026 (Wire)

How teams across European enterprises use collaboration tools to share sensitive data (hint: it’s not great from a security perspective). 

Key stats:

• 84% rate their collaboration environment as secure, yet 48% share sensitive information through collaboration tools not built for it.
• 75% rely on email as their primary external collaboration, 45% on file-sharing links, and 42% on messaging apps like WhatsApp and Signal.
• 61% say access to shared files stays active longer than intended.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between July 6th - July 12th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Ransomware

GRIT Q2 2026 Ransomware & Cyber Threat Insights Report (GuidePoint Security)

We’ve read and written about the ups and downs of ransomware, but according to GuidePoint, ransomware is not as bad as ever. It's actually much worse than ever.

Key stats:

• 91 active ransomware groups operated across 108 countries in Q2 2026, a record high.
• Q2 2026 recorded 2,279 reported ransomware victims, a 7% increase from Q1 2026 and a 43% increase from Q2 2025.
• Weekly victim postings never fell below 150 during the quarter.

Read the full report here.

AI Security

2026 State of AI Security Report (Orca Security)

How AI security is actually going in the cloud, based on real telemetry from more than 1,200 production organizations. 

Key stats:

• 99.9% of AI vulnerabilities with an available fix remain unpatched.
• 81% of organizations using AI packages have at least one known vulnerability, up from 62% in 2024.
• 50% of AI package vulnerabilities have a publicly available exploit, a 250-fold increase over 2024.

Read the full report here.

Phishing & Social Engineering

Phishing by Industry Benchmarking Report 2026 Edition (KnowBe4)

You should probably invest in security awareness training. 

Key stats:

• The global average Phish-prone Percentage (PPP) is 33.2% before training. After one year of consistent training, it falls to 4.2%.
• Organizations reduce phishing susceptibility by 40% within the first 90 days and by 79% after one year.
• The three industries with the highest baseline PPP are Healthcare & Pharmaceuticals at 42.7%, Insurance at 38.1%, and Retail & Wholesale at 36%.

Read the full report here.

Fraud and Impersonation

2026 State of Executive Impersonation (Outtake)

Good data on how attackers are using AI to impersonate company executives online. 

Key stats:

• 53% of organizations had an executive or employee impersonated.
• 53.83% of executive impersonation alerts originated from social platforms, and 35.05% from video and visual platforms.
• Only 3.57% originated from executive lookalike domains.

Read the full report here.

Fraud & Security Trends Report 2026 (Infobip)

The numbers here are just AI vs AI. Fraudsters use it to send more attacks, and businesses use it to catch them.

Key stats:

• Detected threats increased by 77% as fraudsters use AI to scale and personalize harmful messaging.
• Adoption of AI-powered fraud detection grew by 71% year-on-year, and pattern-based detection increased by 105%.
• Phishing accounted for 49% of blocked harmful content, and phishing volume grew 94% year-on-year.

Read the full report here.

Industry-Specific

Cyber Risk, Supersized: 2026 Quick Service & Fast Casual Restaurant Report (VikingCloud)

Rare data on restaurant cybersecurity. 

Key stats:

• 94% of leaders describe themselves as confident or very confident in their ability to prevent or detect a cyberattack, yet 80% experienced at least one cyber incident in the past 12 months.
• 76% had sensitive data leaked in the past 12 months, including payment card data (40%) and customer personal information (32%).
• 10% of restaurant chains have temporarily or permanently closed a location following a cyberattack.

Read the full report here.

The state of financial services cybersecurity in 2026 (SonicWall)

A briefing on how financial services got attacked in the first half of 2026, based on data from their global network of security sensors.

Key stats:

• Financial services saw 132,378 IPS hits per device in the first half of 2026, the highest attack intensity of any tracked industry and more than double the cross-sector average.
• Malware activity averaged 39,341 hits per firewall, the second-highest per-device malware intensity of any industry, behind only healthcare.
• Ten ransomware families were active against the sector, including REvil (Sodinokibi) and Prometheus.

Read the full report here.

2026 State of Identity Security in Financial Organizations (Secret Double Octopus)

How identity and access management is actually working (or not working) at financial institutions in the US and Canada.

Key stats:

• 94% of IAM leaders and stakeholders at financial services firms report that phishing attacks increased over the past year.
• Only 28% of the MFA used for workforce authentication is phishing-resistant.
• 54% of financial organizations report that at least half of their applications and infrastructure are legacy, and those legacy systems are protected by MFA at a rate of just 50%.

Read the full report here.

Regional Spotlight

78% of CISOs say C-level do not fully understand employee-driven cyber risk (MetaCompliance)

CISOs in Europe see employees as their biggest risk, but are finding it difficult to convince their bosses.

Key stats:

• 68% of CISOs identify employees as their organization's biggest security risk as AI amplifies human-targeted attacks.
• More than three-quarters of CISOs across Europe say C-level senior decision-makers do not fully understand the cyber risk posed by employees.
• 40% of CISOs fear that employees are sharing sensitive information with generative AI platforms.

Read the full report here.

The State of Secure Collaboration Report 2026 (Wire)

How teams across European enterprises use collaboration tools to share sensitive data (hint: it’s not great from a security perspective). 

Key stats:

• 84% rate their collaboration environment as secure, yet 48% share sensitive information through collaboration tools not built for it.
• 75% rely on email as their primary external collaboration, 45% on file-sharing links, and 42% on messaging apps like WhatsApp and Signal.
• 61% say access to shared files stays active longer than intended.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between June 29th - July 5th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

Bitdefender Cybersecurity Assessment 2026

1,000+ IT and security professionals tell Bitdefender what's really happening inside their organizations. 

Key stats:

• 55.2% of IT and security professionals who experienced a security incident in the past 12 months were told to keep it confidential despite believing it should have been reported.
• 47.4% of IT and security professionals acknowledge only partial or no visibility into individual shadow AI tools or personal accounts used for work.
• The top barriers to reducing the attack surface: high overhead in maintaining hardening rules and exceptions (38%), fear of operational disruption (35.4%), and resource constraints (34.6%).

Read the full report here.

State of Threat Management 2026 (Filigran)

Security teams have more visibility and tooling than ever, but still can't work out which exposures are actually exploitable.

Key stats:

• 42% of security team time goes to investigating risks that later prove low priority or non-exploitable.
• Organizations deploy an average of 14 different threat intelligence feeds.
• 61% of organizations say they cannot determine which vulnerabilities are most likely to be exploited in real-world attacks.

Read the full report here.

Vulnerability and Exposure Management

Under Pressure: The 2026 Exposure Gap Report (Check Point)

Vulnerabilities increased, but most of them don't actually matter. 

Key stats:

• 42.6% of all critical exposures are vulnerabilities, more than double the 18.7% recorded the year before.
• Only 7.8% of vulnerability alerts warrant Critical or High attention after exploitability validation.
• Phishing websites account for 10.5% of critical exposures, up from 1.0% the year before.

Read the full report here.

AI Coding

AI Code Generation Reality Check (Flux)

A timely follow-up to last week's batch of AI coding reports. 

Key stats:

• 44.7% of organizations already run AI-generated code in production.
• 35% use AI to write code, but do not ship that AI-generated code to production.
• 49.2% report security issues related to AI-generated code are hard to catch week-to-week.

Read the full report here.

Regional Spotlight

From Agentic Risk to Human Wins Report (UK) (KnowBe4)

A month or so ago, KnowBe4 published a report on how organisations are adapting their security cultures for a workforce that now includes AI agents. This is the UK version. 

Key stats:

• 51% of leaders at UK organisations admit that AI usage within their perimeter is entirely unapproved or lacks formal corporate governance.
• 58% of cybersecurity decision-makers report that the unsanctioned use of external software and rogue AI applications has directly degraded or actively compromised their security posture over the past 12 months.
• 21% of UK employees say they don't always use official corporate AI tools provided by their organisation.

Read the full report here.

From Agentic Risk to Human Wins Report (UAE & Saudi Arabia) (KnowBe4)

And the UAE and Saudi Arabia edition, where shadow AI looks like an even bigger headache.

Key stats:

• 52% of cybersecurity decision-makers report that the unsanctioned use of external software and rogue AI has directly degraded or actively compromised their security posture.
• 41% of local workers will actively source their own unapproved agentic AI tools to bypass administrative blocks if official tools are restricted or too slow.
• 44% confess that time constraints, cognitive overload, and workplace distractions drive them to cut corners and make critical security errors.

Read the full report here.

Don't pay the ransom: Warning to organisations to protect themselves (City of London Police)

UK ransomware numbers. 

Key stats:

• 323 UK organisations reported a ransomware attack between April 2025 and March 2026.
• More than 50% were from small and medium enterprises, meaning 175 SME reports.
• Financial losses totalling around £270,000 were reported by UK organisations that experienced ransomware, a 50% increase compared to the previous year.

Read the full report here.

Cybercrime in Australia 2025 (Australian Institute of Criminology)

In Australia's big annual cybercrime survey, the small and medium enterprise numbers caught our eye.

Key stats:

• 25% of small to medium enterprise owners said their business was negatively impacted by cybercrime in the last 12 months.
• 33.9% of SME owners or managers reported experiencing malware.
• 28.7% of cybercrime victims said cybercrime impacted the everyday function of their business.

Read the full report here.

Industry-Specific

2026 Higher Education Third-Party Cyber Risk Report (UpGuard)

US universities rely on a lot of vendors. Maybe too many? 

Key stats:

• 28% of the top 100 vendors most commonly used by universities have experienced a data breach since 2024.
• 11% of the top 100 vendors most commonly used by universities currently show evidence of active infostealer malware infections.
• 95% of universities have at least one vendor with embedded AI exposure.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between June 29th - July 5th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

Bitdefender Cybersecurity Assessment 2026

1,000+ IT and security professionals tell Bitdefender what's really happening inside their organizations. 

Key stats:

• 55.2% of IT and security professionals who experienced a security incident in the past 12 months were told to keep it confidential despite believing it should have been reported.
• 47.4% of IT and security professionals acknowledge only partial or no visibility into individual shadow AI tools or personal accounts used for work.
• The top barriers to reducing the attack surface: high overhead in maintaining hardening rules and exceptions (38%), fear of operational disruption (35.4%), and resource constraints (34.6%).

Read the full report here.

State of Threat Management 2026 (Filigran)

Security teams have more visibility and tooling than ever, but still can't work out which exposures are actually exploitable.

Key stats:

• 42% of security team time goes to investigating risks that later prove low priority or non-exploitable.
• Organizations deploy an average of 14 different threat intelligence feeds.
• 61% of organizations say they cannot determine which vulnerabilities are most likely to be exploited in real-world attacks.

Read the full report here.

Vulnerability and Exposure Management

Under Pressure: The 2026 Exposure Gap Report (Check Point)

Vulnerabilities increased, but most of them don't actually matter. 

Key stats:

• 42.6% of all critical exposures are vulnerabilities, more than double the 18.7% recorded the year before.
• Only 7.8% of vulnerability alerts warrant Critical or High attention after exploitability validation.
• Phishing websites account for 10.5% of critical exposures, up from 1.0% the year before.

Read the full report here.

AI Coding

AI Code Generation Reality Check (Flux)

A timely follow-up to last week's batch of AI coding reports. 

Key stats:

• 44.7% of organizations already run AI-generated code in production.
• 35% use AI to write code, but do not ship that AI-generated code to production.
• 49.2% report security issues related to AI-generated code are hard to catch week-to-week.

Read the full report here.

Regional Spotlight

From Agentic Risk to Human Wins Report (UK) (KnowBe4)

A month or so ago, KnowBe4 published a report on how organisations are adapting their security cultures for a workforce that now includes AI agents. This is the UK version. 

Key stats:

• 51% of leaders at UK organisations admit that AI usage within their perimeter is entirely unapproved or lacks formal corporate governance.
• 58% of cybersecurity decision-makers report that the unsanctioned use of external software and rogue AI applications has directly degraded or actively compromised their security posture over the past 12 months.
• 21% of UK employees say they don't always use official corporate AI tools provided by their organisation.

Read the full report here.

From Agentic Risk to Human Wins Report (UAE & Saudi Arabia) (KnowBe4)

And the UAE and Saudi Arabia edition, where shadow AI looks like an even bigger headache.

Key stats:

• 52% of cybersecurity decision-makers report that the unsanctioned use of external software and rogue AI has directly degraded or actively compromised their security posture.
• 41% of local workers will actively source their own unapproved agentic AI tools to bypass administrative blocks if official tools are restricted or too slow.
• 44% confess that time constraints, cognitive overload, and workplace distractions drive them to cut corners and make critical security errors.

Read the full report here.

Don't pay the ransom: Warning to organisations to protect themselves (City of London Police)

UK ransomware numbers. 

Key stats:

• 323 UK organisations reported a ransomware attack between April 2025 and March 2026.
• More than 50% were from small and medium enterprises, meaning 175 SME reports.
• Financial losses totalling around £270,000 were reported by UK organisations that experienced ransomware, a 50% increase compared to the previous year.

Read the full report here.

Cybercrime in Australia 2025 (Australian Institute of Criminology)

In Australia's big annual cybercrime survey, the small and medium enterprise numbers caught our eye.

Key stats:

• 25% of small to medium enterprise owners said their business was negatively impacted by cybercrime in the last 12 months.
• 33.9% of SME owners or managers reported experiencing malware.
• 28.7% of cybercrime victims said cybercrime impacted the everyday function of their business.

Read the full report here.

Industry-Specific

2026 Higher Education Third-Party Cyber Risk Report (UpGuard)

US universities rely on a lot of vendors. Maybe too many? 

Key stats:

• 28% of the top 100 vendors most commonly used by universities have experienced a data breach since 2024.
• 11% of the top 100 vendors most commonly used by universities currently show evidence of active infostealer malware infections.
• 95% of universities have at least one vendor with embedded AI exposure.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between June 22nd - June 28th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

The 2026 ExtraHop Global Threat Landscape Report (ExtraHop)

A global threat report on top attack surfaces, the most prolific threat actors, the ransomware economy, and more.

Key stats:

• Adversaries maintained access to enterprise networks for nearly 2.5 weeks on average before being detected in ransomware incidents.
• Phishing and other forms of social engineering (35.8%) remain the most common point of entry for attackers targeting organizations.
• 40% of organizations were targeted by AI-enhanced external attacks that used AI-driven automation for reconnaissance, phishing, or rapid lateral movement.

Read the full report here.

AI Security

Quantifying Shadow AI Risk in the Browser (Neon Cyber)

The gap between AI policy and what actually happens in the browser.

Key stats:

• 63% of U.S. knowledge workers report having a clear AI policy that they understand.
• Nearly 50% of workers who understand their organization's AI policy knowingly violate that policy by using unapproved AI tools.
• 63% of workers rate AI as either absolutely essential or very necessary to their jobs.

Read the full report here.

The 2026 AI Accountability Report (GitLab)

Everyone's generating AI code faster than they can review it. 

Key stats:

• 80% of developers and technology buyers say their organization adopted AI tools faster than it developed policies to govern them.
• 92% report some form of governance challenge with AI-generated code.
• 34% of organizations that experienced a production incident in the past year cannot determine whether AI-generated code contributed to it.

Read the full report here.

2026 Infrastructure Automation Report: The AI Readiness Gap (Spacelift)

Most infrastructure leaders think they're ready for AI. The actual data doesn’t agree. 

Key stats:

• 93% of organizations have experienced AI-caused infrastructure incidents.
• 86% of infrastructure leaders say they are confident in their organization's ability to govern AI, but only 30% have a formal AI governance policy in place.
• 33% of infrastructure teams would apply AI-generated infrastructure-as-code directly to production without any review.

Read the full report here.

The Emerging Patch Gap (Tuskira)

AI is finding vulnerabilities faster than anyone can fix them. 

Key stats:

• In the first 63 days of the Anthropic Claude Mythos Preview, Mythos disclosed 1,596 verified vulnerabilities across 281 open-source projects.
• AI-driven discovery outpaces visible remediation by roughly 16.5 times, with about 25.3 disclosures per day versus about 1.5 patches per day.
• Only 6.1% of Mythos disclosures are marked as patched, despite 90.9% maintainer acknowledgment.

Read the full report here.

AI and Security Testing

AI and Pentesting Pulse Report 2026 (Cobalt)

Automated scanning tools are missing critical vulnerabilities, so organizations are turning back to humans.

Key stats:

• 78% of organizations experienced fully automated scanning tools missing critical vulnerabilities and returning false negatives.
• 42% of security professionals plan to increase human-led red team operations.
• The mean time to resolve AI and LLM security issues is 36 days, up from 19 days in 2025.

Read the full report here.

State of AI in Pentesting (Aikido)

Everything you wanted to know about pen testing in the age of AI, from 400 security and engineering leaders.

Key stats:

• 20% suffered a serious incident linked to AI code.
• 71% say AI has made security incidents harder to detect, investigate, or fix.
• 79% are concerned about missing vulnerabilities introduced between scheduled tests.

Read the full report here.

Quantum Readiness

PQC Adoption Gaps: 90% of Systems Are Still Not Quantum-Safe (Forescout)

Post-quantum cryptography adoption is moving, but it’s not moving fast enough. 

Key stats:

• Nearly 90% of SSH servers remain non-PQC-capable.
• Only 3% of identified servers running Dropbear (common in embedded devices) support PQC.
• In enterprise networks, IT devices most commonly support PQC on TLS at 8%, while IoT and IoMT are at 5.6% and OT is at 0.8%.

Read the full report here.

Industry Specific

2026 Healthcare IT Landscape Report (Omega Systems)

A report that benchmarks where healthcare organizations really stand on cybersecurity, compliance, vendor risk, and AI governance. 

Key stats:

• 85% of healthcare practices experienced at least one operational disruption caused by a third-party or vendor-of-a-vendor failure in the past 12 months.
• 61% of healthcare practices expect a fatal cyberattack within five years.
• 76% say they are not ready for the proposed 2026 HIPAA Security Rule.

Read the full report here.

Regional Spotlight

2026 European Cyber Risk Report: Ransomware Is Escalating and Your Third Parties Are the Entry Point (Black Kite)

The fastest way into a European business right now? Third parties.

Key stats:

• Ransomware attacks rose 55.1% year-over-year in the first four months of 2026.
• The Qilin ransomware group was linked to incidents in 26 of the 31 countries analyzed.
• Manufacturing was the most-affected sector at 27.9% of ransomware victims.

Read the full report here.

Data Health Check 2026 (Databarracks)

500 UK organisations on what's threatening their data and uptime. 

Key stats:

• 30% of organisations cite cyber incidents as their biggest cause of IT downtime, ahead of hardware failure at 19%.
• 43% of large organisations reported losing data as a result of a cyber attack.
• 65% think a serious cyber attack could threaten their survival.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between June 22nd - June 28th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

The 2026 ExtraHop Global Threat Landscape Report (ExtraHop)

A global threat report on top attack surfaces, the most prolific threat actors, the ransomware economy, and more.

Key stats:

• Adversaries maintained access to enterprise networks for nearly 2.5 weeks on average before being detected in ransomware incidents.
• Phishing and other forms of social engineering (35.8%) remain the most common point of entry for attackers targeting organizations.
• 40% of organizations were targeted by AI-enhanced external attacks that used AI-driven automation for reconnaissance, phishing, or rapid lateral movement.

Read the full report here.

AI Security

Quantifying Shadow AI Risk in the Browser (Neon Cyber)

The gap between AI policy and what actually happens in the browser.

Key stats:

• 63% of U.S. knowledge workers report having a clear AI policy that they understand.
• Nearly 50% of workers who understand their organization's AI policy knowingly violate that policy by using unapproved AI tools.
• 63% of workers rate AI as either absolutely essential or very necessary to their jobs.

Read the full report here.

The 2026 AI Accountability Report (GitLab)

Everyone's generating AI code faster than they can review it. 

Key stats:

• 80% of developers and technology buyers say their organization adopted AI tools faster than it developed policies to govern them.
• 92% report some form of governance challenge with AI-generated code.
• 34% of organizations that experienced a production incident in the past year cannot determine whether AI-generated code contributed to it.

Read the full report here.

2026 Infrastructure Automation Report: The AI Readiness Gap (Spacelift)

Most infrastructure leaders think they're ready for AI. The actual data doesn’t agree. 

Key stats:

• 93% of organizations have experienced AI-caused infrastructure incidents.
• 86% of infrastructure leaders say they are confident in their organization's ability to govern AI, but only 30% have a formal AI governance policy in place.
• 33% of infrastructure teams would apply AI-generated infrastructure-as-code directly to production without any review.

Read the full report here.

The Emerging Patch Gap (Tuskira)

AI is finding vulnerabilities faster than anyone can fix them. 

Key stats:

• In the first 63 days of the Anthropic Claude Mythos Preview, Mythos disclosed 1,596 verified vulnerabilities across 281 open-source projects.
• AI-driven discovery outpaces visible remediation by roughly 16.5 times, with about 25.3 disclosures per day versus about 1.5 patches per day.
• Only 6.1% of Mythos disclosures are marked as patched, despite 90.9% maintainer acknowledgment.

Read the full report here.

AI and Security Testing

AI and Pentesting Pulse Report 2026 (Cobalt)

Automated scanning tools are missing critical vulnerabilities, so organizations are turning back to humans.

Key stats:

• 78% of organizations experienced fully automated scanning tools missing critical vulnerabilities and returning false negatives.
• 42% of security professionals plan to increase human-led red team operations.
• The mean time to resolve AI and LLM security issues is 36 days, up from 19 days in 2025.

Read the full report here.

State of AI in Pentesting (Aikido)

Everything you wanted to know about pen testing in the age of AI, from 400 security and engineering leaders.

Key stats:

• 20% suffered a serious incident linked to AI code.
• 71% say AI has made security incidents harder to detect, investigate, or fix.
• 79% are concerned about missing vulnerabilities introduced between scheduled tests.

Read the full report here.

Quantum Readiness

PQC Adoption Gaps: 90% of Systems Are Still Not Quantum-Safe (Forescout)

Post-quantum cryptography adoption is moving, but it’s not moving fast enough. 

Key stats:

• Nearly 90% of SSH servers remain non-PQC-capable.
• Only 3% of identified servers running Dropbear (common in embedded devices) support PQC.
• In enterprise networks, IT devices most commonly support PQC on TLS at 8%, while IoT and IoMT are at 5.6% and OT is at 0.8%.

Read the full report here.

Industry Specific

2026 Healthcare IT Landscape Report (Omega Systems)

A report that benchmarks where healthcare organizations really stand on cybersecurity, compliance, vendor risk, and AI governance. 

Key stats:

• 85% of healthcare practices experienced at least one operational disruption caused by a third-party or vendor-of-a-vendor failure in the past 12 months.
• 61% of healthcare practices expect a fatal cyberattack within five years.
• 76% say they are not ready for the proposed 2026 HIPAA Security Rule.

Read the full report here.

Regional Spotlight

2026 European Cyber Risk Report: Ransomware Is Escalating and Your Third Parties Are the Entry Point (Black Kite)

The fastest way into a European business right now? Third parties.

Key stats:

• Ransomware attacks rose 55.1% year-over-year in the first four months of 2026.
• The Qilin ransomware group was linked to incidents in 26 of the 31 countries analyzed.
• Manufacturing was the most-affected sector at 27.9% of ransomware victims.

Read the full report here.

Data Health Check 2026 (Databarracks)

500 UK organisations on what's threatening their data and uptime. 

Key stats:

• 30% of organisations cite cyber incidents as their biggest cause of IT downtime, ahead of hardware failure at 19%.
• 43% of large organisations reported losing data as a result of a cyber attack.
• 65% think a serious cyber attack could threaten their survival.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between June 15th - June 21st.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

State of Log Management in 2026 (Dynatrace)

AI workloads are straining traditional log management on cost, scale, and complexity.

Key stats:

• AI workloads drive a 93% increase in log volume over the last twelve months.
• Organizations exclude an average of 86% of log data to manage costs and system limitations.
• Technology teams spend an average of nearly $2.5 million annually on logging solutions.

Read the full report here.

The CISO Outlook 2026: Authentic intelligence in the age of AI (CSC)

Security leaders think AI is an opportunity. But also a big threat. 

Key stats:

• 73% of security leaders view AI as an opportunity rather than a risk.
• 86% cite AI-powered domain generation algorithms as a cybersecurity threat.
• 79% are concerned that suppliers' and partners' AI tool use poses a cybersecurity risk.

Read the full report here.

Life and Times of The Cybersecurity Professional VIII (ISSA & Omdia)

Interesting read for anyone in a security role. Now in its eighth year, The Life and Times of Cybersecurity Professionals, Volume VIII looks at how your peers are feeling about their roles, and what the orgs they’re in are doing (yes, including how many of them are adopting AI). 

Key stats:

• 68% of cybersecurity professionals say the job has become harder over the past two years.
• 25% increased AI spending without a defined strategy.
• 57% of cybersecurity professionals who considered leaving their role in the past eighteen months have considered leaving cybersecurity entirely.

Read the full report here.

AI Security and Governance

The State of AI Governance in 2026 (Retool)

If you’re worried about vibe coding and the lack of governance around it, this report will at least make you feel less alone.

Key stats:

• 93% of CTOs, CISOs, and CIOs are concerned about vibe-coded tools running in production.
• 8% describe their organization's AI governance as strong.
• 22% indicate their organizations have had at least one AI-caused production incident.

Read the full report here.

Shadow AI Has Become a Behavioral Data-Movement Risk (Teramind)

Employees are using AI tools on corporate devices and either not telling you about it or outright hiding it. 

Key stats:

• 67% of enterprise AI usage occurs through unmanaged personal accounts on corporate devices.
• 69% of C-suite leaders prioritize speed over security when using AI tools.
• 62% of Gen Z employees are actively hiding their AI use at work.

Read the full report here.

What 687 IT and Security Leaders Revealed About Governing AI (Jamf)

Apple-first orgs won't want to hear this: more organizations are experiencing AI incidents as they deploy AI deeper. 

Key stats:

• Organizations with deeply integrated AI are 40% more likely to report an AI-related incident than those still exploring.
• 22% of organizations have already experienced an AI-related incident involving unexpected costs or a security issue.
• 36.7% identify establishing AI governance as a top AI priority for the next twelve months.

Read the full report here.

The Data & AI Trust Gap (Veeam)

What’s the difference between AI ambition and results? This report will tell you.

Key stats:

• 99% agree data sovereignty is critical.
• 72.5% are actively deprioritizing data sovereignty to accelerate AI.
• 88% of enterprises are running AI agents, but only 7% are fully prepared to manage them.

Read the full report here.

AI-Powered Attacks Become Top Concern for Security Professionals (Filigran)

AI-powered attacks at scale are apparently the biggest security concern now. 

Key stats:

• 41% of cybersecurity professionals identify AI-powered attacks at scale as their biggest security concern.
• 32% say AI-driven threats are the top issues boards most often ask about.
• 52% say threat intelligence helps inform decisions but still requires significant human judgment.

Read the full report here.

Mid-Market Outlook

The Mid-Market AI Readiness Report (Netrio)

An AI readiness report, but focused on mid-market orgs.

Key stats:

• 82% of mid-market IT leaders say AI is already in production somewhere or in widespread use.
• 26% say AI is scaled and governed enterprise-wide.
• 73% have either confirmed an AI-related security incident or experienced a near-miss in the past twelve months.

Read the full report here.

Enterprise Perspective

The State of Physical and Digital Identity in the Enterprise (FIDO Alliance & HID)

How fast do you think you can remove an ex-employee’s access? According to this report, probably very fast. Also according to this report, you cannot actually move that fast…

Key stats:

• 94% claim they can revoke all access within twenty-four hours of an employee leaving.
• 35% actually experience delays or failures revoking access within that timeframe.
• 70% of organizations experience at least one identity-related security incident.

Read the full report here.

The 2026 Vulnerability Forecast Update: Navigating the AI Epoch (FIRST)

Vulnerability disclosures are completely out of control. 

Key stats:

• Annual vulnerability disclosures are on pace to approach 70,000 for the first time in history.
• The 2026 projected total of CVE disclosures is approximately 66,000, up from a February median projection of 59,427.
• Actual CVE disclosures are running 46.3% above projections published four months earlier.

Read the full report here.

Regional Spotlight

60% of UK Orgs Report Cyberattacks Beyond Email (KnowBe4)

Threats are no longer confined to your employees’ email inboxes. 

Key stats:

• 60% of UK cybersecurity professionals say threats are already moving beyond email.
• 50% of UK organizations lack strong confidence in detecting threats across messaging and social platforms.
• Only 41% of organizations regularly train employees on threats beyond email.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between June 15th - June 21st.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

State of Log Management in 2026 (Dynatrace)

AI workloads are straining traditional log management on cost, scale, and complexity.

Key stats:

• AI workloads drive a 93% increase in log volume over the last twelve months.
• Organizations exclude an average of 86% of log data to manage costs and system limitations.
• Technology teams spend an average of nearly $2.5 million annually on logging solutions.

Read the full report here.

The CISO Outlook 2026: Authentic intelligence in the age of AI (CSC)

Security leaders think AI is an opportunity. But also a big threat. 

Key stats:

• 73% of security leaders view AI as an opportunity rather than a risk.
• 86% cite AI-powered domain generation algorithms as a cybersecurity threat.
• 79% are concerned that suppliers' and partners' AI tool use poses a cybersecurity risk.

Read the full report here.

Life and Times of The Cybersecurity Professional VIII (ISSA & Omdia)

Interesting read for anyone in a security role. Now in its eighth year, The Life and Times of Cybersecurity Professionals, Volume VIII looks at how your peers are feeling about their roles, and what the orgs they’re in are doing (yes, including how many of them are adopting AI). 

Key stats:

• 68% of cybersecurity professionals say the job has become harder over the past two years.
• 25% increased AI spending without a defined strategy.
• 57% of cybersecurity professionals who considered leaving their role in the past eighteen months have considered leaving cybersecurity entirely.

Read the full report here.

AI Security and Governance

The State of AI Governance in 2026 (Retool)

If you’re worried about vibe coding and the lack of governance around it, this report will at least make you feel less alone.

Key stats:

• 93% of CTOs, CISOs, and CIOs are concerned about vibe-coded tools running in production.
• 8% describe their organization's AI governance as strong.
• 22% indicate their organizations have had at least one AI-caused production incident.

Read the full report here.

Shadow AI Has Become a Behavioral Data-Movement Risk (Teramind)

Employees are using AI tools on corporate devices and either not telling you about it or outright hiding it. 

Key stats:

• 67% of enterprise AI usage occurs through unmanaged personal accounts on corporate devices.
• 69% of C-suite leaders prioritize speed over security when using AI tools.
• 62% of Gen Z employees are actively hiding their AI use at work.

Read the full report here.

What 687 IT and Security Leaders Revealed About Governing AI (Jamf)

Apple-first orgs won't want to hear this: more organizations are experiencing AI incidents as they deploy AI deeper. 

Key stats:

• Organizations with deeply integrated AI are 40% more likely to report an AI-related incident than those still exploring.
• 22% of organizations have already experienced an AI-related incident involving unexpected costs or a security issue.
• 36.7% identify establishing AI governance as a top AI priority for the next twelve months.

Read the full report here.

The Data & AI Trust Gap (Veeam)

What’s the difference between AI ambition and results? This report will tell you.

Key stats:

• 99% agree data sovereignty is critical.
• 72.5% are actively deprioritizing data sovereignty to accelerate AI.
• 88% of enterprises are running AI agents, but only 7% are fully prepared to manage them.

Read the full report here.

AI-Powered Attacks Become Top Concern for Security Professionals (Filigran)

AI-powered attacks at scale are apparently the biggest security concern now. 

Key stats:

• 41% of cybersecurity professionals identify AI-powered attacks at scale as their biggest security concern.
• 32% say AI-driven threats are the top issues boards most often ask about.
• 52% say threat intelligence helps inform decisions but still requires significant human judgment.

Read the full report here.

Mid-Market Outlook

The Mid-Market AI Readiness Report (Netrio)

An AI readiness report, but focused on mid-market orgs.

Key stats:

• 82% of mid-market IT leaders say AI is already in production somewhere or in widespread use.
• 26% say AI is scaled and governed enterprise-wide.
• 73% have either confirmed an AI-related security incident or experienced a near-miss in the past twelve months.

Read the full report here.

Enterprise Perspective

The State of Physical and Digital Identity in the Enterprise (FIDO Alliance & HID)

How fast do you think you can remove an ex-employee’s access? According to this report, probably very fast. Also according to this report, you cannot actually move that fast…

Key stats:

• 94% claim they can revoke all access within twenty-four hours of an employee leaving.
• 35% actually experience delays or failures revoking access within that timeframe.
• 70% of organizations experience at least one identity-related security incident.

Read the full report here.

The 2026 Vulnerability Forecast Update: Navigating the AI Epoch (FIRST)

Vulnerability disclosures are completely out of control. 

Key stats:

• Annual vulnerability disclosures are on pace to approach 70,000 for the first time in history.
• The 2026 projected total of CVE disclosures is approximately 66,000, up from a February median projection of 59,427.
• Actual CVE disclosures are running 46.3% above projections published four months earlier.

Read the full report here.

Regional Spotlight

60% of UK Orgs Report Cyberattacks Beyond Email (KnowBe4)

Threats are no longer confined to your employees’ email inboxes. 

Key stats:

• 60% of UK cybersecurity professionals say threats are already moving beyond email.
• 50% of UK organizations lack strong confidence in detecting threats across messaging and social platforms.
• Only 41% of organizations regularly train employees on threats beyond email.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between June 8th - June 14th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

Q1 2026 Cyber Risk Report: Insights from 2.1 Million Malware and Phishing Investigations (ANY.RUN)

Insights into how attacks are evolving based on over 2.1 million malware and phishing investigations from Q1 2026. 

Key stats:

• There's been a 14.7% increase in attacks targeting user credentials in Q1 2026.
• LOLBAS attacks leveraging JavaScript rose by 58.4%. 
• The median time to persistence establishment was just 21 seconds while the median time to begin living-off-the-land (LOTL) execution was 16 seconds.

Read the full report here.

ThreatLabz 2026 Phishing and Initial Access Report (Zscaler)

Phishing activity dropped overall, but it's targeting services relentlessly. Worse, most of it is now encrypted, meaning it's invisible to your defenses.

Key stats:

• Phishing activity declined by approximately 20% year-over-year in both 2024 and 2025.
• Services industry phishing hits surged 65.5% year-over-year from 330.9 million to 547.7 million hits.
• 95.2% of phishing activity is delivered over encrypted channels.

Read the full report here.

Vulnerability Management

2026 Software Vulnerability Ratings Report (Action1)

Where security risk grew fastest across software categories in 2025. 

Key stats:

• Total disclosed software vulnerabilities in enterprise environments increased 92% year-over-year in 2025.
• Remote code execution (RCE) vulnerabilities surged 128% year-over-year in 2025.
• In 2025, macOS vulnerabilities increased by more than 1,000% across enterprise environments.

Read the full report here.

AI Security

Solving for the Mobile AI Blind Spot: Executive Confidence Meets Technical Reality (Lookout)

We tend to get a lot of AI reports, but this one is interesting because it looks at AI in mobile devices. 

Key stats:

• 52% of all generative AI usage occurs on mobile endpoints.
• 59% of mobile AI traffic is hidden from traditional network-discovery tools, routing directly between local apps and external clouds without ever crossing a corporate gateway.
• 72% of organizations are structurally incapable of auditing embedded AI Software Development Kits (SDKs) hidden inside everyday mobile applications.

Read the full report here.

AI-Generated Code

The State of AI-Powered Software Development (Black Duck)

Everyone's using AI to code, and almost nobody's got governance in place. What else is new? Well, this: the teams that do have full governance are way more likely to see real efficiency gains.

Key stats:

• AI coding assistants have 97% adoption among enterprise development teams.
• 30% of development teams have full governance in place for AI coding assistant adoption and oversight.
• Teams with full governance for AI coding assistants in place are 55% more likely to report a major improvement in efficiency.

Read the full report here.

The 2026 State of AI Coding Report (New Relic)

AI code looks great in code review, but falls apart in production. 

Key stats:

• 78% of organizations report more incidents after deploying AI-generated code in the past 12 months.
• 82% of organizations experienced at least one production failure tied to AI-generated code in the past six months.
• 86% of organizations report an increase in the time senior staff spend fixing AI-generated code in the past 12 months.

Read the full report here.

2027 Outlook Report: The Future of Application Security in the Era of AI (Checkmarx)

Most CISOs know they're shipping vulnerable code. Obviously, they would rather not ship vulnerable code, but business gets in the way.

Key stats:

• 95% of CISOs feel pressure to suppress or delay compliance-related security issues when business deadlines are at stake.
• 75% of organizations knowingly deploy vulnerable code at some point.
• Companies with 81-100% AI-generated production code ship software with known security vulnerabilities at a 47% rate compared with 14% for companies with 1-20% AI-generated production code.

Read the full report here.

Identity Security

2026 Data and Identity Security Report (Netwrix)

You already know AI adoption is outpacing AI readiness (we've featured reports saying so before). Here's what you might not know: organizations where AI significantly expanded identity access saw breach rates nearly four times higher than those where access patterns stayed the same.

Key stats:

• 88% of organizations say AI deployment is outpacing their identity and security infrastructure.
• Among organizations where AI significantly expanded identities requiring access, breach rates reached 43% over the past twelve months. Where AI hadn't materially changed access patterns, breach rates were 11%.
• 76% of organizations do not fully govern or monitor non-human identities.

Read the full report here.

2026 State of AI and Identity Report (FusionAuth)

The organizations that say they're most confident in their AI security are the ones getting breached. 

Key stats:

• 65% of organizations experienced a confirmed AI identity-related security incident in the past 12 months.
• 84% of organizations that rate themselves "extremely confident" in their AI security posture have experienced a confirmed AI identity incident.
• 88% of organizations say AI is a trigger for reevaluating identity infrastructure.

Read the full report here.

OT Security

2026 State of Operational Technology and Cybersecurity (Fortinet)

A (pretty rare) look into the state of OT security.

Key stats:

• Organizations' OT cybersecurity maturity ratings at Level 4 fell to 17%, down from 49% in 2025.
• Level 4 maturity for OT security solutions declined to 14%, down from 19% in 2025.
• 89% of organizations expect increased regulation within five years or less, up from 66% in 2025.

Read the full report here.

Consumer Scams

ITRC 2026 Trends in Identity Report (Identity Theft Resource Center)

Latest trends in identity theft crimes. 

Key stats:

• 25.6% of identity crime victims managed two or more concurrent incidents, up from 23.5% the previous year.
• Unauthorized access to computers and mobile devices accounted for 27.2% of identity compromises, a 78% increase from 15.3% the previous year.
• 53% of victims with no financial loss reported a resolution.

Read the full report here.

Face Value: How AI is reshaping trust, identity, and scams (Malwarebytes)

AI is making scams harder to tell apart. 

Key stats:

• 84% of adults aged 18+ in surveyed countries say convincing video evidence no longer feels like proof.
• 85% of adults say it is hard to tell a scam apart from the real thing, up from 66% in 2025.
• 50% of adults have experienced some form of AI fraud or scam.

Read the full report here.

2026 Global Scam Intelligence Report (Bitdefender)

Research into how scams have grown into a $450 billion omnichannel underground economy.

Key stats:

• 14% of consumers report falling victim to a scam in the past year.
• Younger consumers are twice as likely to fall victim to scams as adults aged 55 and older, with victimization rates of 20% versus 9.7%.
• Approximately 5.2% of SMS messages (about 1 in 20) exhibit characteristics consistent with scam infrastructure or coordinated fraud activity.

Read the full report here.

Enterprise Perspective

2026 Security Training Trends: How Enterprises are Strengthening Their Cybersecurity Teams Through Training (ISC2)

The latest data on how enterprise teams are training for cybersecurity.

Key stats:

• 73% of security leaders report their enterprise's cybersecurity training budget has increased over the past 12 months.
• 47% of security leaders at enterprises say AI is the most pressing skill their organization is addressing through cybersecurity training.
• 94% feel they are keeping up or are ahead of the curve in adapting training to emerging technologies.

Read the full report here.

2026 Lateral Movement Exposure Report (Zero Networks)

Analysis of 54 trillion activities across 312 live enterprise environments. 

Key stats:

• 80% of enterprise servers are reachable from anywhere inside the network, creating greenfield conditions for ransomware.
• 87% of enterprise servers accept inbound RDP or SSH connections from broad internal sources.
• 78% of enterprise servers are reachable over SMB or WinRM, administrative protocols commonly exploited for ransomware spread.

Read the full report here.

2026 State of Browser Security Threat Report (Menlo Security)

The browser-based threats Menlo Security blocked across enterprise environments in Q1 2026, including thousands of zero-day attacks, threats from sites already classified as safe, and evasive phishing campaigns. 

Key stats:

• One in three highly evasive threats originated from sites classified as 'safe'.
• 52,185 threats were hosted on domains that enterprise security stacks are configured to trust, including Google Drive, Dropbox, and SharePoint.
• One in five phishing links clicked by users went completely undetected by legacy URL filtering.

Read the full report here.

Blind Spots (Axiad)

Great (and concerning) insight into the gap between how well organizations think they see identity risk and their actual ability to assess and act on it, with most unable to measure a compromised account's blast radius or quantify their financial exposure.

Key stats:

• 38% of senior security and IT leaders at U.S. enterprises with 500+ employees have experienced an identity-related security incident with measurable financial or operational impact.
• 41% have no defensible, methodology-backed dollar estimate of their identity risk exposure.
• 85% express concern that AI-accelerated vulnerability discovery is outpacing their ability to prioritize and respond.

Read the full report here.

Sector-Specific

CrowdStrike 2026 Technology Threat Landscape Report

A report analyzing how eCrime and state-sponsored adversaries (China, North Korea, and Iran-nexus actors) are targeting the global technology sector in 2026. 

Key stats:

• China-nexus adversaries drove more than 58% of state-sponsored targeted intrusions against the technology sector.
• Financially motivated attacks accounted for 65% of all interactive operations against the technology sector.
• Big game hunting adversaries named 572 technology entities on dedicated leak sites for extortion.

Read the full report here.

Regional Spotlight

2026 State of Tech Talent Europe (Linux Foundation)

Some good news if you’re a security person based in Europe.

Key stats:

• Understaffing in European cybersecurity roles is 48%, which is 14 percentage points higher than in the rest of the world.
• AI security and risk management capability gaps affect 61% of organizations globally.
• Security concerns (51%) and privacy concerns (44%) are the top barriers to new technology adoption in 2026.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between June 8th - June 14th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

Q1 2026 Cyber Risk Report: Insights from 2.1 Million Malware and Phishing Investigations (ANY.RUN)

Insights into how attacks are evolving based on over 2.1 million malware and phishing investigations from Q1 2026. 

Key stats:

• There's been a 14.7% increase in attacks targeting user credentials in Q1 2026.
• LOLBAS attacks leveraging JavaScript rose by 58.4%. 
• The median time to persistence establishment was just 21 seconds while the median time to begin living-off-the-land (LOTL) execution was 16 seconds.

Read the full report here.

ThreatLabz 2026 Phishing and Initial Access Report (Zscaler)

Phishing activity dropped overall, but it's targeting services relentlessly. Worse, most of it is now encrypted, meaning it's invisible to your defenses.

Key stats:

• Phishing activity declined by approximately 20% year-over-year in both 2024 and 2025.
• Services industry phishing hits surged 65.5% year-over-year from 330.9 million to 547.7 million hits.
• 95.2% of phishing activity is delivered over encrypted channels.

Read the full report here.

Vulnerability Management

2026 Software Vulnerability Ratings Report (Action1)

Where security risk grew fastest across software categories in 2025. 

Key stats:

• Total disclosed software vulnerabilities in enterprise environments increased 92% year-over-year in 2025.
• Remote code execution (RCE) vulnerabilities surged 128% year-over-year in 2025.
• In 2025, macOS vulnerabilities increased by more than 1,000% across enterprise environments.

Read the full report here.

AI Security

Solving for the Mobile AI Blind Spot: Executive Confidence Meets Technical Reality (Lookout)

We tend to get a lot of AI reports, but this one is interesting because it looks at AI in mobile devices. 

Key stats:

• 52% of all generative AI usage occurs on mobile endpoints.
• 59% of mobile AI traffic is hidden from traditional network-discovery tools, routing directly between local apps and external clouds without ever crossing a corporate gateway.
• 72% of organizations are structurally incapable of auditing embedded AI Software Development Kits (SDKs) hidden inside everyday mobile applications.

Read the full report here.

AI-Generated Code

The State of AI-Powered Software Development (Black Duck)

Everyone's using AI to code, and almost nobody's got governance in place. What else is new? Well, this: the teams that do have full governance are way more likely to see real efficiency gains.

Key stats:

• AI coding assistants have 97% adoption among enterprise development teams.
• 30% of development teams have full governance in place for AI coding assistant adoption and oversight.
• Teams with full governance for AI coding assistants in place are 55% more likely to report a major improvement in efficiency.

Read the full report here.

The 2026 State of AI Coding Report (New Relic)

AI code looks great in code review, but falls apart in production. 

Key stats:

• 78% of organizations report more incidents after deploying AI-generated code in the past 12 months.
• 82% of organizations experienced at least one production failure tied to AI-generated code in the past six months.
• 86% of organizations report an increase in the time senior staff spend fixing AI-generated code in the past 12 months.

Read the full report here.

2027 Outlook Report: The Future of Application Security in the Era of AI (Checkmarx)

Most CISOs know they're shipping vulnerable code. Obviously, they would rather not ship vulnerable code, but business gets in the way.

Key stats:

• 95% of CISOs feel pressure to suppress or delay compliance-related security issues when business deadlines are at stake.
• 75% of organizations knowingly deploy vulnerable code at some point.
• Companies with 81-100% AI-generated production code ship software with known security vulnerabilities at a 47% rate compared with 14% for companies with 1-20% AI-generated production code.

Read the full report here.

Identity Security

2026 Data and Identity Security Report (Netwrix)

You already know AI adoption is outpacing AI readiness (we've featured reports saying so before). Here's what you might not know: organizations where AI significantly expanded identity access saw breach rates nearly four times higher than those where access patterns stayed the same.

Key stats:

• 88% of organizations say AI deployment is outpacing their identity and security infrastructure.
• Among organizations where AI significantly expanded identities requiring access, breach rates reached 43% over the past twelve months. Where AI hadn't materially changed access patterns, breach rates were 11%.
• 76% of organizations do not fully govern or monitor non-human identities.

Read the full report here.

2026 State of AI and Identity Report (FusionAuth)

The organizations that say they're most confident in their AI security are the ones getting breached. 

Key stats:

• 65% of organizations experienced a confirmed AI identity-related security incident in the past 12 months.
• 84% of organizations that rate themselves "extremely confident" in their AI security posture have experienced a confirmed AI identity incident.
• 88% of organizations say AI is a trigger for reevaluating identity infrastructure.

Read the full report here.

OT Security

2026 State of Operational Technology and Cybersecurity (Fortinet)

A (pretty rare) look into the state of OT security.

Key stats:

• Organizations' OT cybersecurity maturity ratings at Level 4 fell to 17%, down from 49% in 2025.
• Level 4 maturity for OT security solutions declined to 14%, down from 19% in 2025.
• 89% of organizations expect increased regulation within five years or less, up from 66% in 2025.

Read the full report here.

Consumer Scams

ITRC 2026 Trends in Identity Report (Identity Theft Resource Center)

Latest trends in identity theft crimes. 

Key stats:

• 25.6% of identity crime victims managed two or more concurrent incidents, up from 23.5% the previous year.
• Unauthorized access to computers and mobile devices accounted for 27.2% of identity compromises, a 78% increase from 15.3% the previous year.
• 53% of victims with no financial loss reported a resolution.

Read the full report here.

Face Value: How AI is reshaping trust, identity, and scams (Malwarebytes)

AI is making scams harder to tell apart. 

Key stats:

• 84% of adults aged 18+ in surveyed countries say convincing video evidence no longer feels like proof.
• 85% of adults say it is hard to tell a scam apart from the real thing, up from 66% in 2025.
• 50% of adults have experienced some form of AI fraud or scam.

Read the full report here.

2026 Global Scam Intelligence Report (Bitdefender)

Research into how scams have grown into a $450 billion omnichannel underground economy.

Key stats:

• 14% of consumers report falling victim to a scam in the past year.
• Younger consumers are twice as likely to fall victim to scams as adults aged 55 and older, with victimization rates of 20% versus 9.7%.
• Approximately 5.2% of SMS messages (about 1 in 20) exhibit characteristics consistent with scam infrastructure or coordinated fraud activity.

Read the full report here.

Enterprise Perspective

2026 Security Training Trends: How Enterprises are Strengthening Their Cybersecurity Teams Through Training (ISC2)

The latest data on how enterprise teams are training for cybersecurity.

Key stats:

• 73% of security leaders report their enterprise's cybersecurity training budget has increased over the past 12 months.
• 47% of security leaders at enterprises say AI is the most pressing skill their organization is addressing through cybersecurity training.
• 94% feel they are keeping up or are ahead of the curve in adapting training to emerging technologies.

Read the full report here.

2026 Lateral Movement Exposure Report (Zero Networks)

Analysis of 54 trillion activities across 312 live enterprise environments. 

Key stats:

• 80% of enterprise servers are reachable from anywhere inside the network, creating greenfield conditions for ransomware.
• 87% of enterprise servers accept inbound RDP or SSH connections from broad internal sources.
• 78% of enterprise servers are reachable over SMB or WinRM, administrative protocols commonly exploited for ransomware spread.

Read the full report here.

2026 State of Browser Security Threat Report (Menlo Security)

The browser-based threats Menlo Security blocked across enterprise environments in Q1 2026, including thousands of zero-day attacks, threats from sites already classified as safe, and evasive phishing campaigns. 

Key stats:

• One in three highly evasive threats originated from sites classified as 'safe'.
• 52,185 threats were hosted on domains that enterprise security stacks are configured to trust, including Google Drive, Dropbox, and SharePoint.
• One in five phishing links clicked by users went completely undetected by legacy URL filtering.

Read the full report here.

Blind Spots (Axiad)

Great (and concerning) insight into the gap between how well organizations think they see identity risk and their actual ability to assess and act on it, with most unable to measure a compromised account's blast radius or quantify their financial exposure.

Key stats:

• 38% of senior security and IT leaders at U.S. enterprises with 500+ employees have experienced an identity-related security incident with measurable financial or operational impact.
• 41% have no defensible, methodology-backed dollar estimate of their identity risk exposure.
• 85% express concern that AI-accelerated vulnerability discovery is outpacing their ability to prioritize and respond.

Read the full report here.

Sector-Specific

CrowdStrike 2026 Technology Threat Landscape Report

A report analyzing how eCrime and state-sponsored adversaries (China, North Korea, and Iran-nexus actors) are targeting the global technology sector in 2026. 

Key stats:

• China-nexus adversaries drove more than 58% of state-sponsored targeted intrusions against the technology sector.
• Financially motivated attacks accounted for 65% of all interactive operations against the technology sector.
• Big game hunting adversaries named 572 technology entities on dedicated leak sites for extortion.

Read the full report here.

Regional Spotlight

2026 State of Tech Talent Europe (Linux Foundation)

Some good news if you’re a security person based in Europe.

Key stats:

• Understaffing in European cybersecurity roles is 48%, which is 14 percentage points higher than in the rest of the world.
• AI security and risk management capability gaps affect 61% of organizations globally.
• Security concerns (51%) and privacy concerns (44%) are the top barriers to new technology adoption in 2026.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between June 1st - June 7th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

The Security Maturity Benchmark Report (AlertMedia)

Data on what sets security teams that stay ahead of threats apart from the teams that always play catch-up.

Key stats:

• 92% of organizations have experienced consequences tied to security readiness gaps.
• Only 31% of organizations operate a centralized, highly automated security ecosystem.
• 47% of organizations say they would not respond to a serious security incident as quickly as they should.

Read the full report here.

General AI

CISO Pulse Check Report. AI: The New Superpower and The New Super-Risk (Sprinto)

More than a third of US organizations have already dealt with a major AI security incident (Bad). Most CISOs are at least tracking AI as a dedicated risk category now (Good). 

Key stats:

• More than 30% of US organizations report experiencing a major AI-related security incident in the past 12 months.
• Nearly 70% of US CISOs and senior security leaders say they are actively following AI-related regulations or standards.
• Over half of US CISOs track AI as a dedicated risk category.

Read the full report here.

2026 AI Maturity Report (Ivanti)

Organizations are deploying AI broadly. Governance is a long tail priority.

Key stats:

• 56% of organizations now deploy AI broadly across multiple IT workflows or at business-critical scale.
• 68% of IT professionals have personally seen AI generate hallucinations with potential operational impact.
• Only 24% of IT professionals say AI policies are followed very consistently in day-to-day work.

Read the full report here.

The State of Enterprise Agentic AI in 2026: Agentic Reality Check (Chapsvision)

AI agents sound great, but almost nobody has actually made them deliver business value at scale. Thus, most executives don't trust AI gains anymore because of all the hype.

Key stats:

• Only 10% of large-scale enterprises have successfully transitioned autonomous AI agents from pilot phases into full-scale production.
• 88% of executives say agent-washing has negatively affected their trust in AI broadly.
• 86% of enterprise leaders cite reliability, security, privacy, and accuracy as the top blockers preventing implementation of autonomous agents.

Read the full report here.

The Data & AI Trust Gap (Veeam)

Few organizations are ready for AI. Most can't even see what their AI systems are doing, can't stop a rogue AI agent, and have no idea if they have an actual inventory of all their AI systems.

Key stats:

• 88% of organizations are already using or piloting AI agents.
• Only 28% of organizations are confident they can detect AI systems operating outside approved parameters.
• Only 25% of organizations running AI today can identify, within minutes, which actions an AI took.

Read the full report here.

AI Risk Quadrant for Agent Security (AIRQ)

Turns out, most claims about AI agent defenses are completely unverifiable. 

Key stats:

• 83% of claimed AI agent defenses are not publicly verifiable.
• 38% of AI agents complete irreversible actions before any monitoring path can plausibly fire.
• More than a third of AI agents score well on logging and observability while scoring poorly across the four defense components that actually prevent or limit harm.

Read the full report here.

What we learned mapping a year's worth of AI-enabled cyber threats (Anthropic)

Super bit of data. Anthropic analyzed 832 accounts banned for malicious cyber activity and mapped the exact attacker techniques they used to the MITRE ATT&CK framework.

Key stats:

• 67.3% of malicious accounts banned were using AI to write malware.
• The share of actors classified as medium risk or higher increased from 33% in the first six-month period to 56% in the second, a roughly sevenfold increase.
• Across the period studied, the use of AI for account discovery rose notably while AI-assisted phishing fell.

Read the full report here.

AI-Generated Code

AI Coding Assistants and the New Security Challenge (Salt Security)

Nearly every development team is using AI to write code now. As you can probably imagine, security teams hate it. 

Key stats:

• 67% of organizations report that AI coding assistants are now widely adopted across development teams.
• 38% of organizations still rely primarily on manual review for AI-generated code.
• 29% of security leaders identify insecure coding patterns as the leading risk introduced by AI coding assistants.

Read the full report here.

What's In America's Code? (Booz Allen)

Chinese AI models either intentionally introduce vulnerabilities or outright refuse to help with certain tasks. Meanwhile, some models change their behavior completely depending on whether you mention working for the US government.

Key stats:

• Three of four Chinese LLMs generate hidden security vulnerabilities when prompted with a US government persona.
• All four Chinese-built models refuse to generate code for mock US government tasks that Beijing would oppose.
• When one model was told the code was for a US government agency, it generated significantly more vulnerabilities than when given the same task without that context.

Read the full report here.

Phishing

The (Higher) Business Cost of Phishing (IRONSCALES)

Phishing is taking up more of security teams' time than ever. 

Key stats:

• Phishing consumes 36.5% of security team working hours, up from 33.5% three years ago.
• Phishing costs $51,948 per security analyst annually, a 13.6% increase from $45,726 in 2022.
• Security teams remediate phishing incidents 16% faster but spend 9% more of their annual hours remediating phishing.

Read the full report here.

Enterprise Perspective

The State of Physical Security Operations in 2026 (HiveWatch)

Is your false alarm rate closer to 28% or 44%, and are you in the 75% of mature programs using AI or the 43% that aren't? This report benchmarks you against comparable peers. 

Key stats:

• Large enterprises report false alarm rates approaching 44%.
• Nearly 30% of organizations rely on manual device health checks instead of fully automated monitoring systems.
• 97% of US-based physical security operations professionals are either currently using AI or actively evaluating it for security operations.

Read the full report here.

The 2026 State of Digital Risk Report (Outtake)

A good benchmark of how enterprises handle digital risk (sadly showing just how far behind the threat most of them are).

Key stats:

• 84% of organizations experienced material digital risk incidents in the past year.
• 44% of organizations say AI-generated attacks are already indistinguishable from legitimate activity.
• 53% of organizations had an executive or employee impersonated in the past year.

Read the full report here.

Industry-Specific

2026 State of Financial Services: The Dual Storm of Ransomware and Vendor Ecosystem Risk (Black Kite)

Direct ransomware attacks on banks increased significantly quarter over quarter. Guess what the real problem is (it’s the supply chain). 

Key stats:

• Across all financial services vendors, half carry high-severity CVEs.
• From 2024 to 2025, the number of critical vulnerabilities carried across vendors serving the financial sector increased 387%.
• Critical-level patch management failures were present in 78% of the vendors whose client base is meaningfully concentrated in finance.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between June 1st - June 7th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

The Security Maturity Benchmark Report (AlertMedia)

Data on what sets security teams that stay ahead of threats apart from the teams that always play catch-up.

Key stats:

• 92% of organizations have experienced consequences tied to security readiness gaps.
• Only 31% of organizations operate a centralized, highly automated security ecosystem.
• 47% of organizations say they would not respond to a serious security incident as quickly as they should.

Read the full report here.

General AI

CISO Pulse Check Report. AI: The New Superpower and The New Super-Risk (Sprinto)

More than a third of US organizations have already dealt with a major AI security incident (Bad). Most CISOs are at least tracking AI as a dedicated risk category now (Good). 

Key stats:

• More than 30% of US organizations report experiencing a major AI-related security incident in the past 12 months.
• Nearly 70% of US CISOs and senior security leaders say they are actively following AI-related regulations or standards.
• Over half of US CISOs track AI as a dedicated risk category.

Read the full report here.

2026 AI Maturity Report (Ivanti)

Organizations are deploying AI broadly. Governance is a long tail priority.

Key stats:

• 56% of organizations now deploy AI broadly across multiple IT workflows or at business-critical scale.
• 68% of IT professionals have personally seen AI generate hallucinations with potential operational impact.
• Only 24% of IT professionals say AI policies are followed very consistently in day-to-day work.

Read the full report here.

The State of Enterprise Agentic AI in 2026: Agentic Reality Check (Chapsvision)

AI agents sound great, but almost nobody has actually made them deliver business value at scale. Thus, most executives don't trust AI gains anymore because of all the hype.

Key stats:

• Only 10% of large-scale enterprises have successfully transitioned autonomous AI agents from pilot phases into full-scale production.
• 88% of executives say agent-washing has negatively affected their trust in AI broadly.
• 86% of enterprise leaders cite reliability, security, privacy, and accuracy as the top blockers preventing implementation of autonomous agents.

Read the full report here.

The Data & AI Trust Gap (Veeam)

Few organizations are ready for AI. Most can't even see what their AI systems are doing, can't stop a rogue AI agent, and have no idea if they have an actual inventory of all their AI systems.

Key stats:

• 88% of organizations are already using or piloting AI agents.
• Only 28% of organizations are confident they can detect AI systems operating outside approved parameters.
• Only 25% of organizations running AI today can identify, within minutes, which actions an AI took.

Read the full report here.

AI Risk Quadrant for Agent Security (AIRQ)

Turns out, most claims about AI agent defenses are completely unverifiable. 

Key stats:

• 83% of claimed AI agent defenses are not publicly verifiable.
• 38% of AI agents complete irreversible actions before any monitoring path can plausibly fire.
• More than a third of AI agents score well on logging and observability while scoring poorly across the four defense components that actually prevent or limit harm.

Read the full report here.

What we learned mapping a year's worth of AI-enabled cyber threats (Anthropic)

Super bit of data. Anthropic analyzed 832 accounts banned for malicious cyber activity and mapped the exact attacker techniques they used to the MITRE ATT&CK framework.

Key stats:

• 67.3% of malicious accounts banned were using AI to write malware.
• The share of actors classified as medium risk or higher increased from 33% in the first six-month period to 56% in the second, a roughly sevenfold increase.
• Across the period studied, the use of AI for account discovery rose notably while AI-assisted phishing fell.

Read the full report here.

AI-Generated Code

AI Coding Assistants and the New Security Challenge (Salt Security)

Nearly every development team is using AI to write code now. As you can probably imagine, security teams hate it. 

Key stats:

• 67% of organizations report that AI coding assistants are now widely adopted across development teams.
• 38% of organizations still rely primarily on manual review for AI-generated code.
• 29% of security leaders identify insecure coding patterns as the leading risk introduced by AI coding assistants.

Read the full report here.

What's In America's Code? (Booz Allen)

Chinese AI models either intentionally introduce vulnerabilities or outright refuse to help with certain tasks. Meanwhile, some models change their behavior completely depending on whether you mention working for the US government.

Key stats:

• Three of four Chinese LLMs generate hidden security vulnerabilities when prompted with a US government persona.
• All four Chinese-built models refuse to generate code for mock US government tasks that Beijing would oppose.
• When one model was told the code was for a US government agency, it generated significantly more vulnerabilities than when given the same task without that context.

Read the full report here.

Phishing

The (Higher) Business Cost of Phishing (IRONSCALES)

Phishing is taking up more of security teams' time than ever. 

Key stats:

• Phishing consumes 36.5% of security team working hours, up from 33.5% three years ago.
• Phishing costs $51,948 per security analyst annually, a 13.6% increase from $45,726 in 2022.
• Security teams remediate phishing incidents 16% faster but spend 9% more of their annual hours remediating phishing.

Read the full report here.

Enterprise Perspective

The State of Physical Security Operations in 2026 (HiveWatch)

Is your false alarm rate closer to 28% or 44%, and are you in the 75% of mature programs using AI or the 43% that aren't? This report benchmarks you against comparable peers. 

Key stats:

• Large enterprises report false alarm rates approaching 44%.
• Nearly 30% of organizations rely on manual device health checks instead of fully automated monitoring systems.
• 97% of US-based physical security operations professionals are either currently using AI or actively evaluating it for security operations.

Read the full report here.

The 2026 State of Digital Risk Report (Outtake)

A good benchmark of how enterprises handle digital risk (sadly showing just how far behind the threat most of them are).

Key stats:

• 84% of organizations experienced material digital risk incidents in the past year.
• 44% of organizations say AI-generated attacks are already indistinguishable from legitimate activity.
• 53% of organizations had an executive or employee impersonated in the past year.

Read the full report here.

Industry-Specific

2026 State of Financial Services: The Dual Storm of Ransomware and Vendor Ecosystem Risk (Black Kite)

Direct ransomware attacks on banks increased significantly quarter over quarter. Guess what the real problem is (it’s the supply chain). 

Key stats:

• Across all financial services vendors, half carry high-severity CVEs.
• From 2024 to 2025, the number of critical vulnerabilities carried across vendors serving the financial sector increased 387%.
• Critical-level patch management failures were present in 78% of the vendors whose client base is meaningfully concentrated in finance.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between May 25th - May 31st.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

ISC2 Research: Cybersecurity Professionals Want Leaders Who Have Been Through a Major Incident

No CISO wants to deal with a major security incident. But the upside of having lived through one is that they're way more likely to be seen as an effective leader. 

Key stats:

• 76% of people working in cybersecurity roles agree that previous leadership experience during a high-profile cybersecurity incident bolsters a leader's credibility.
• 95% of cybersecurity professionals mark the ability to communicate risk to senior leadership and boards as very important in a leader.
• 34% of cybersecurity professionals are very confident in the current leadership in cybersecurity.

Read the full report here.

AI Security

Proprietary Problems: How Frontier Closed Models Collapse Under Iterative Pressure (Cisco)

The new AI models that companies are building look secure in a single conversation. But if you keep pushing them with follow-up attacks, they fall apart. Some get dramatically worse with each attempt.

Key stats:

• Multi-turn attack success rate ranges from 7.89% to 88.30% across proprietary flagship models.
• GPT-5.4 moves from 2.74% single-turn attack success rate to 24.68% multi-turn, a ninefold increase.
• Grok 4.1 Fast in non-reasoning configuration records a multi-turn attack success rate of 88.30%.

Read the full report here.

Vulnerability Management

The Detection Gap: How Exploits are Outpacing Scanners (Cogent Security)

Time to exploit is basically nothing now. 

Key stats:

• AI-assisted exploit development compressed the average time from vulnerability disclosure to a working exploit from 125 days in January 2025 to half a day by April 2026.
• 62% of critical vulnerabilities with known exploits had working exploits available before scanner detection signatures were shipped.
• 55.7% of critical CVEs never received any scanner coverage.

Read the full report here.

Stop Counting CVEs: What Actually Mattered in Q1 2026 (Root Evidence)

The industry publishes tens of thousands of vulnerabilities every year. Turns out almost all of them will never actually hurt anyone. 

Key stats:

• Only 1.4% of publicly disclosed vulnerabilities are known to be exploited in real-world attacks.
• 36.5% of known-exploited vulnerabilities have a CVSS score of 9.0 or higher, while 63.5% are rated high, medium, or lower.
• Over 80% of known-exploited vulnerabilities have no Metasploit module.

Read the full report here.

Cloud Security

2026 Cloud Security Report: Securing the AI Transformation (Check Point)

Organizations want to secure AI in the cloud. What they're actually capable of doing is a different story. 

Key stats:

• Only 26% of organizations report having the architecture to enforce their AI-related cloud security strategy.
• 78% of organizations report confirmed or suspected AI-related security incidents over the past year.
• 24% of organizations say they have no AI-specific access controls.

Read the full report here.

Industry-Specific

Global Automotive Cybersecurity Report Q1 2026 (PCA Cyber Security) 

The automotive industry had a rough year.

Key stats:

• 265 unique automotive-specific vulnerabilities identified in Q1 2026 - a 102% year-on-year increase in automotive vulnerabilities (vs Q1 2025).
• Competitors at Pwn2Own Automotive 2026 in Tokyo found 76 unique zero-days.
• Ransomware groups exfiltrated nearly one terabyte of data from a major Asian vehicle manufacturer's customer and dealership environment in early January 2026 via a third-party vendor.

Read the full report here.

Regional Spotlight

Threat Labs Report: Europe 2026 (Netskope)

Almost every organization in Europe now uses AI, and employees regularly upload regulated data and source code to their personal AI accounts.

Key stats:

• About 99% of organizations in Europe use AI.
• 59% of data policy violations across AI and personal cloud applications involve regulated data.
• 15% of data policy violations involve source code.

Read the full report here.

Nordic CISO Report 2026 (Truesec)

Interesting data about Nordic CISOs and Nordic security budgets. 

Key stats:

• In 2026, only 9% of Nordic CISOs reported an increase in severe cybersecurity incidents, compared to 53% in 2025.
• The dominant range for cybersecurity budgets among Nordic organizations remains approximately 5 to 10% of the IT budget, with an average of approximately 7%.
• 32% of Nordic CISOs cited identity-related attacks as their primary concern.

Read the full report here.