Sonatype reports identifying 454,648 malicious open-source packages in 2025. Its annual study also highlights gaps in vulnerability intelligence, persistent downloads of vulnerable dependencies, and unsafe AI-generated upgrade recommendations.
Sophos surveyed 2,158 ransomware victims across 17 countries. Email-based attacks accounted for half of reported root causes, while data encryption rose to 56%. Median ransom payments fell to $769,000, but average recovery costs reached $1.7 million.
Omada’s survey of 577 U.S. enterprise identity and security professionals finds gaps in risk reporting, integration, and AI-agent controls. Some 85% report using or piloting agentic AI, while governance practices remain uneven.
HUMAN’s 2026 benchmark report says AI-driven traffic rose 187% during 2025 and post-login compromise attempts more than quadrupled. Its customer dataset also shows rising malicious scraping, carding and fake-account activity.
SpyCloud’s report reviews 2025 identity-threat trends and forecasts more commoditized identity attacks, identity sprawl, insider and supply-chain risks, AI-enabled fraud, and evolving MFA bypasses in 2026. It includes exposure and survey findings.
HYPR’s surveys of 500 US HR leaders and 950 global security decision-makers describe gaps in hiring-fraud detection and identity-risk ownership. HR respondents said 68% of fraud was found through human instinct, not automated controls.
Kiteworks' survey of 225 leaders finds widespread AI containment gaps: 63% lack purpose binding and 60% lack kill switches. Its 2026 forecast prioritizes containment, training-data governance and third-party visibility.
The World Economic Forum’s 2026 outlook finds rising concern over AI risks, fraud and geopolitical threats. Based on 804 qualified participants across 92 countries, it also highlights uneven cyber resilience and persistent skills shortages.
Thinkst’s Q1 2026 review surveys browser deception, AI-assisted vulnerability discovery, agent compromise and cloud configuration risks. AI featured in over 33% of reviewed talks, up from 11% the previous quarter.
Genetec’s survey of 7,368 physical security professionals examines cyber risks, IT collaboration, and modernization. Among end users, 36% prioritize cybersecurity tools for 2026, while 70% report employee cybersecurity training.
Seqrite reports 265.52 million detections across more than 8 million Indian endpoints from October 2024 to September 2025. Findings highlight persistent legacy malware, ransomware campaigns, cloud identity abuse, and security-readiness gaps.
The International AI Safety Report 2026 describes AI use in phishing, fraud and cyber operations, alongside persistent safeguard weaknesses. It says autonomous attacks remain limited and evidence of real-world mitigation effectiveness is sparse.
SANS’s 2026 CTI survey finds 91% of surveyed CISOs value threat intelligence, but only 26% say it significantly influences decisions. Findings highlight resource constraints, rising AI adoption, and gaps in feedback and sharing governance.
F5 models continued API growth and examines how unmanaged endpoints, exposed credentials and webhook abuse increase security risks. The report recommends lifecycle security, unified discovery and an inter-cluster proxy approach.
OrcaRouter’s 2026 AI Threat Report synthesizes public research on prompt injection, agent data theft, poisoned tools and runaway spending, recommending scoped identities, action controls and run-level monitoring.
ESET’s H1 2026 report found over 3,000 malicious AI skills among nearly 900,000 scanned, a 108% rise in ClickFix detections and growing QR phishing. It also examines PromptSpy’s Gemini use and tools that disable endpoint defenses.
VulnCheck analyzed 181 network-edge vulnerabilities added to its KEV in 2025: 42.5% affected end-of-life or likely end-of-life devices, and only 23.7% appeared in CISA KEV. The report highlights botnet targeting and support gaps.
ProcessUnity and Ponemon Institute’s survey of 1,465 practitioners finds gaps between confidence in third-party risk assessments and reported outcomes, including frequent incidents, slow reviews, limited coverage and incomplete remediation.
Anthropic’s September 2026 report describes disrupted Claude misuse spanning espionage, credential theft, fraud and surveillance. It reports growing use of autonomous attack workflows and stolen AI credentials between December 2025 and August 2026.
A global survey of 851 professionals found 82% consider Universal ZTNA essential, but only 17% have fully implemented it. The HPE report highlights fragmented tools, excessive privileges, and inconsistent enforcement as Zero Trust challenges.
Checkmarx’s survey of 1,519 security and development professionals found 98% reported breaches linked to vulnerable applications. The report highlights knowingly shipped vulnerabilities, limited security-tool adoption and gaps in AI coding governance.
ITRC recorded 1,803 data compromises and 471.2 million victim notices in H1 2026. Its report highlights mega-breaches, rising insider wrongdoing and declining disclosure of attack methods; notices do not represent unique individuals.
Pentera’s survey of 300 U.S. security leaders found widespread enterprise AI use but limited visibility and few dedicated AI security budgets. Respondents also reported frequent unauthorized access and plans to increase security and pentesting spending.
ManageEngine’s survey of 515 identity and security professionals finds machine identities far outnumber humans, but only 12% report comprehensive automated lifecycle management. AI deployment and IAM consolidation also face execution gaps.
