Collection of cybersecurity reports, surveys, research papers, market studies, and industry intelligence.
729 articles
Google GTIG tracked 90 zero-days exploited in 2025; 43 (48%) affected enterprise technologies, a record share. OS and mobile exploitation rose, browser exploitation fell, and commercial surveillance vendors were attributed more zero-days than state groups.
Keep Aware’s sponsored 2026 report says enterprise browser security lags AI adoption. Its telemetry found sensitive web-app inputs split between corporate (54%) and personal or unverified work accounts (46%), with phishing, risky extensions and social engineering among
Google Threat Intelligence Group tracked 90 zero-day vulnerabilities exploited in 2025, up 15% from 2024. Nearly half targeted enterprise products; commercial spyware vendors surpassed state-sponsored groups, and GTIG expects exploitation to remain high in 2026.
Recorded Future’s Insikt Group assesses that the Iran war is driving influence operations and may spur retaliatory cyber activity. It identifies Iranian-aligned networks, likely tactics, and organizational risks, while noting major intrusions were not independentlyly”—
Google says 90 zero-days were exploited in 2025, including 43 affecting enterprise technology—an all-time high. Commercial surveillance vendors accounted for 15 attributed exploits, while operating systems remained the most targeted category.
Datadog’s 2026 State of DevSecOps report finds widespread exploitable vulnerabilities, stale and newly released dependencies in use, and weak GitHub Actions pinning. StepSecurity uses the findings to promote controls including SHA pinning and runtime monitoring.
Acronis H2 2025 telemetry found median Microsoft patch installation took 7.7 days, with P90 at 38.6 days. Third-party patches were faster at median but also had a long tail. Recommendations include weekly tail reviews, staged rollouts, reboot discipline and endpoint (
CloudSek’s situation report reviews cyber activity and spillover risks during the February 27–March 1, 2026 Middle East escalation, including claimed hacktivist operations, disruptions in Iran, regional threats, and defensive recommendations.
Recorded Future’s Insikt Group forecasts more coordinated Russian hybrid operations across Europe over the next two years, including cyber disruption, sabotage and influence campaigns. It assesses a direct Russian incursion into NATO as unlikely near term.
Chainalysis estimates that 28% of ransomware victims paid in 2025 despite a roughly 50% rise in claimed attacks. On-chain payments reached $820 million and may exceed $900 million as more events are attributed; the median payment rose to $59,556.
Darktrace says it detected over 32 million high-confidence phishing emails in 2025 across its global customer base. Its findings point to identity compromise overtaking vulnerability exploitation, alongside regional trends in account takeovers, ransomware and AI threats
Samsung SDS’s 2026 assessment, based on prior-year incidents and a survey of 667 Korean IT and security professionals, highlights AI threats, ransomware, cloud risks, phishing and account takeovers, and data security weaknesses.
Daniel Woods’ analysis of Coalition claims points to email-based fraud as a leading incident source and exposed VPNs and firewalls as significant ransomware risks. He cautions that unclaimed incidents may be missing from the data.
Wiz Research introduced a 257-challenge benchmark evaluating AI agents across five cybersecurity domains. Results indicate performance varies by both model and agent scaffold, with no pairing leading across every domain.
Team Cymru’s January 22–29, 2026 telemetry review found AS206728 (MediaLand), sanctioned in November 2025, remained active, with suspicious domains, Telnet scanning and traffic to UDP port 33445.
Wiz reports that tested AI agents solved 9 of 10 targeted security challenges, but performed less effectively and cost more in broad-scope tests. A real-world investigation also showed the value of human-led enumeration and strategy shifts.
MS-ISAC reported a 7% increase in malware notifications from Q3 to Q4 2025. SocGholish led detections, while the briefing details the top 10 malware families, infection vectors, and IOCs for defenders.
ThreatLabz’s analysis of nearly one trillion AI/ML transactions in 2025 found enterprise usage rose 83%, data transfers to AI tools increased 93%, and organizations blocked 39% of access attempts amid emerging security risks.
A study found weakly secured SMS sign-in links at 701 endpoints serving 177 services, exposing personal data and enabling account access through guessable tokens. Its limited sample likely understates the scope; only seven of 150 contacted providers had fixed issues.
Hunt.io’s three-month analysis identified more than 18,000 C2 servers across 48 Chinese providers, with activity concentrated in major telecom and cloud networks and led by malware families including Mozi and ARL.
DarkOwl’s 2025 dataset shows drugs and chemicals made up 68% of darknet marketplace listings, with fraud at 13%. The study also tracks leading markets, vendor and review activity, closures, and shipping patterns.
Deep Instinct’s survey of 500 U.S. IT professionals found widespread confidence in defenses against AI-generated malware, despite the company’s test showing many legacy tools missed the samples tested.
The report charts how English-speaking cybercriminal communities evolved into a decentralized, service-based ecosystem, linking social engineering, account takeovers, data theft, and extortion, and recommends stronger identity verification and phishing-resistant MFA.
Wiz says its GitHub scan found verified secret leaks at 65% of analyzed Forbes AI 50 companies, including credentials in deleted forks, gists, workflow logs, and developers’ public repositories.
