Collection of cybersecurity reports, surveys, research papers, market studies, and industry intelligence.
725 articles
Picus analyzed over 338 million attack simulations from January–June 2026. Overall prevention reached 69%, but only 37% of post-compromise actions were blocked, while the alert rate remained at 14%.
Saviynt’s 2026 report, based on a survey of 235 security and IT leaders, finds widespread AI identity access but limited visibility, monitoring, and governance. It recommends identity inventories, least privilege, and continuous oversight.
Zscaler ThreatLabz’s 2026 executive report covers AI security risks in Australia and New Zealand, citing red-team tests in which all tested AI systems failed and recommending stronger governance, continuous testing, and least-privilege access.
NMFTA’s 2026 transportation cybersecurity report links credential compromise and social engineering to cargo theft, warns of shared-vendor risks, and anticipates greater reliance on data theft for extortion rather than encryption.
Microsoft's 2026 Digital Defense Report describes faster AI-assisted intrusions, agent identity and memory risks, and persistent cloud espionage. It urges rapid patching, least-privilege access, and monitoring of AI activity.
GuidePoint’s GRIT tracked 7,515 publicly posted ransomware and extortion victims in 2025, up 58%, across 124 groups. Its annual report examines perimeter exploitation, payment outcomes and growing BYOVD adoption; victim claims were not validated by victims.
SANS | GIAC's survey of 947 global respondents finds skills gaps outweigh staffing shortages as a workforce concern. AI is reshaping security roles, while training constraints and demand for experienced hires complicate workforce development.
Beazley Security's Q1 2026 report links 74% of investigated ransomware intrusions to compromised remote-access credentials, details TeamPCP's supply chain campaign, and reports a 43% quarterly rise in CISA KEV additions.
Datadog’s DevSecOps report analyzes tens of thousands of applications and finds widespread exploitable vulnerabilities, aging dependencies, and risky rapid software adoption. It recommends safeguards including dependency cooldowns and pinning GitHub Actions to commit SH
Expel's analysis of nearly a million alerts from 2025 found identity involved in 68.6% of customer incidents. The report highlights stolen credentials, ClickFix malware delivery, trojanized productivity apps, and exposed cloud secrets.
Latio’s 2026 application security report finds developer experience leads tool-selection priorities, while 56% want better cloud and runtime context. It examines AI code guardrails, supply chain protection and remediation challenges.
RedHelix’s 2026 outlook covers AI-enabled threats, identity compromise, ransomware, expanding cloud, IoT and supply-chain exposure, and tighter regulation. It recommends stronger identity controls, AI governance, monitoring and resilience.
Black Duck’s 2026 OSSRA report analyzed 947 commercial codebases and found average vulnerability counts rose 107% to 581. It also identified widespread outdated dependencies and gaps in component visibility and AI-generated code governance.
INTERPOL’s 2026 assessment draws on responses from 36 African countries and vendor telemetry to examine 2025 cybercrime trends, highlighting mobile money fraud, critical-infrastructure ransomware and gaps in cross-border investigations.
Datadog’s 2026 study of thousands of organizations using AWS, Azure and Google Cloud finds persistent long-lived credentials and excessive permissions, alongside uneven adoption of cloud security guardrails.
Surveys cited by Gravitee report limited visibility and access controls for enterprise AI agents, with organizations reporting unauthorized behavior and security incidents. The article recommends agent inventories, scoped authorization, monitoring, and audit trails.
TAG’s 2026 report models cloud-security savings from Orca through tool consolidation, reduced contractor spending and lower incident-response budgets. Its headline ROI estimate conflicts with its calculation footnote.
Imperva’s analysis of 32,725 API endpoints found nearly 40% had multiple authentication risks. Sensitive data in JWTs remained the most common risk, while access with expired tokens rose from 5.0% to 8.5%.
The 2026 NASCIO-Deloitte study finds declining state CISO confidence in protecting public data, tighter cybersecurity budgets and widening skills gaps as AI expands threats and governance responsibilities.
Verizon’s 2026 DBIR analyzes over 22,000 confirmed breaches across 145 countries. Vulnerability exploitation led initial access at 31%, while ransomware and third-party involvement each appeared in 48% of breaches.
Strike48’s survey of 100 security leaders found that trust concerns and limited log access are barriers to AI agent adoption in security operations; 36% reported agents in production for at least one use case.
A CSA-branded whitepaper argues that AI-assisted exploitation and pre-disclosure attacks make patching alone insufficient. It recommends continuous exposure management, behavioral detection, and containment. The document has not undergone official CSA review.
HiddenLayer’s April–June 2026 threat update examines malicious agent skills, prompt injection, AI-assisted cybercrime, and software supply chain compromises, recommending tighter controls on agent permissions and dependencies.
Coalition’s report analyzes about 1,400 claims with realized financial losses from 100,000+ policyholders. In 2025, claims frequency rose 3% while average severity fell 19%; business email compromise was the most common claim type.
