Insider Threat vs Cyber Attack

Insider wrongdoing events totaled 21 in the first half of 2026, a sevenfold increase over the three incidents in 2025.

50% of federal IT and cybersecurity decision makers list preventing unauthorized actions as a top concern for agentic AI deployments

41% of CISOs are concerned about malicious insiders using AI to support fraud, cybercrime or data theft.

68% of CISOs identify employees as their organisation’s biggest security risk as AI amplifies human-targeted attacks.

40% of CISOs fear employees are sharing sensitive information with generative AI platforms.

38% of security and IT leaders report attacker activity mirrors legitimate, authorized workflows and processes, delaying critical alerts.

12% of organizations maintain direct user-to-server administrative pathways, meaning a single compromised employee device can provide immediate access to high-value systems.

80% of organizations report shadow AI (employees connecting AI tools without security or IT review).

17% of Nordic CISOs cited insiders & human error as their primary concern.

Over a third of employees commonly source their own agentic AI tools when options are unavailable or restrictive.

Shadow AI is now the third most common non-malicious insider action detected in Verizon's data loss prevention (DLP) dataset in 2025

13% of employees say they’ve sold or know someone who has sold company login details – often under the belief it’s harmless

90% of organizations experienced at least one insider incident in the past 12 months.

74% of organizations rank negligent insiders as their top concern, surpassing compromised accounts (65%) and malicious insiders (59%).

45% of organizations classify AI copilots and generative AI tools as insider risk.

34% of U.S. organizations experienced a confirmed cyberattack in the past year, compared with 32% globally.

Across the global sample, one in three businesses reported a confirmed cyberattack in the past year.

6% of reported cybercrime cases in Africa in 2025 involved cyber attacks on critical infrastructure.

10% of restaurant chains have temporarily or permanently closed a location following a cyberattack.

80% of leaders at quick service and fast casual restaurant chains experienced at least one cyber incident in the past 12 months.

84% of security decision-makers and practitioners agree that cyberattacks exploit known risks that are not prioritized.

1 in 5 suffered a serious incident linked to AI code

71% say AI has made security incidents harder to detect, investigate, or fix

Cyber is the leading cause of both IT downtime and data loss for the fourth consecutive year.

30% of organisations cite cyber incidents as their biggest cause of IT downtime over the last 12 months, ahead of hardware failure at 19%.

43% of large organisations reported losing data as a result of a cyber attack.

Downtime per incident averaged almost 30 hours.

85% of security and IT leaders identify security incidents, data exposures, or near misses where the root cause is an AI system.

61% of healthcare practices expect a fatal cyberattack within five years.

Over the past 12–18 months, 57% of enterprise CISOs report their enterprises experienced an attack that originated on a remote, mobile, or hybrid device.