TAG’s 2026 report models cloud-security savings from Orca through tool consolidation, reduced contractor spending and lower incident-response budgets. Its headline ROI estimate conflicts with its calculation footnote.
Imperva’s analysis of 32,725 API endpoints found nearly 40% had multiple authentication risks. Sensitive data in JWTs remained the most common risk, while access with expired tokens rose from 5.0% to 8.5%.
The 2026 NASCIO-Deloitte study finds declining state CISO confidence in protecting public data, tighter cybersecurity budgets and widening skills gaps as AI expands threats and governance responsibilities.
Verizon’s 2026 DBIR analyzes over 22,000 confirmed breaches across 145 countries. Vulnerability exploitation led initial access at 31%, while ransomware and third-party involvement each appeared in 48% of breaches.
Strike48’s survey of 100 security leaders found that trust concerns and limited log access are barriers to AI agent adoption in security operations; 36% reported agents in production for at least one use case.
A CSA-branded whitepaper argues that AI-assisted exploitation and pre-disclosure attacks make patching alone insufficient. It recommends continuous exposure management, behavioral detection, and containment. The document has not undergone official CSA review.
HiddenLayer’s April–June 2026 threat update examines malicious agent skills, prompt injection, AI-assisted cybercrime, and software supply chain compromises, recommending tighter controls on agent permissions and dependencies.
Coalition’s report analyzes about 1,400 claims with realized financial losses from 100,000+ policyholders. In 2025, claims frequency rose 3% while average severity fell 19%; business email compromise was the most common claim type.
Okta’s Businesses at Work 2026 report finds that 91% of surveyed organizations use AI agents, but only 32% govern them as rigorously as human identities. Platform data also shows rising adoption of high-assurance authentication and automated governance.
A Microsoft–Accenture report examines AI-enabled cyber threats and quantum risks to encryption, combining survey findings and economic modeling with recommendations for national AI assurance, post-quantum migration and coordinated resilience.
A survey of 795 GRC practitioners finds spreadsheets remain a leading tool, while 59.1% use no commercial GRC platform. It also identifies technical skills gaps and differences in tool adoption by team size and seniority.
Thales reports that bad bots generated 40% of observed web traffic in 2025, while 27% of bot attacks targeted APIs. Daily blocked AI-driven requests rose to 25 million, though expanded detection coverage complicates year-over-year comparisons.
Kroll’s 2026 survey of 1,000 cybersecurity decision-makers finds 72% report frequent misalignment between business and security priorities. Rising budgets coexist with gaps in AI governance and post-incident response planning.
Reco’s 2026 report combines company telemetry with analysis of 500 public MCP servers, reporting widespread lack of IT oversight, risky tool capabilities, and 525 agent and LLM-tooling vulnerabilities disclosed in 18 months.
PwC’s survey of 3,887 executives across 72 countries finds cybersecurity readiness gaps despite rising budgets. Only 24% report spending significantly more on prevention than response, while quantum preparedness and data protection lag.
Rapid7’s 2026 threat report finds confirmed exploitation of newly disclosed CVSS 7–10 flaws rose 105% in 2025. Weak MFA remained a leading intrusion factor, while ransomware leak posts increased 46.4%.
A Torq-commissioned Sapio Research survey of 450+ security leaders finds AI use in SOCs is fragmented: teams average seven AI solutions, while respondents cite trust and explainability concerns and favor unified platforms.
A Sapio Research survey of 400 US and UK CISOs and senior IT leaders finds SOC teams face heavy alert loads, information overload, staffing constraints and compliance friction; the report advocates proactive threat hunting and better investigative context.
Thales’ 2026 survey of 3,120 IT and security professionals finds growing AI security pressures, incomplete data visibility and cloud protection gaps. Respondents report that an average of 47% of sensitive cloud data is encrypted.
Cloudflare’s 2026 Security Signals Report identifies risks in AI governance, autonomous systems, supply chains, threat intelligence, legacy architecture, and cloud dependencies, urging continuous controls and failure containment.
Zscaler ThreatLabz reports 896.2 TB in reported leaks across the top 10 ransomware groups by data volume, up 275.8%. Its April 2025–March 2026 analysis also examines Teams vishing, employee targeting and declining known ransom payments.
BioCatch’s 2026 report, based on data from 292 U.S. financial institutions, describes rising impersonation, phishing and job scams, more account-takeover activity, and a remote-access-enabled case study. It calls for real-time interbank fraud intelligence sharing.
Fortinet’s survey of 2,750 IT and cybersecurity decision-makers found 71% see skills shortages as a cyber risk and 60% struggle to recruit AI-experienced security talent. Meanwhile, 91% use or experiment with AI-powered security tools.
VulnCheck identified 884 CVEs with first-time exploitation evidence in 2025; 28.96% were exploited on or before CVE publication. Its annual report also highlights ransomware zero-days and growing volumes of unreliable AI-generated exploit code.
