Supply Chain vs Insider Threat

66% of incidents involve the supply chain or a third party, up from 45% in 2024.

In MCP registries, for every server provided by a verified technology vendor there are up to 15 lookalike servers from untrusted sources.

Top AI-related cybersecurity concerns are data leakage through copilots and agents (22%), third-party and supply chain risks (21%), evolving regulations (20%), shadow AI (18%), and prompt injection attacks (18%).

Confidence in data security falls to 40% when data passes through third-party provider networks.

32% of leaders do not know the locations of all of their data centers, rising to 49% when including third-party providers.

11% of leaders say they are aware of definite weak points when their data travels across third-party infrastructures.

63% of respondents that prioritize SBOM validation say they're highly prepared to evaluate third-party software.

70% of organizations experienced at least one material third-party cyber incident in the past year.

97% of organizations reported negative impacts from supply chain breaches over the past twelve months, an increase from 81% in 2024.

47% of retail executives reported having very low to moderate visibility into their software supply chain.

33% of leaders at financial services firms say they are unprepared to recover effectively from a Supply chain attack.

Supply chain attacks against healthcare organizations decreased significantly from 68% in 2024 to 44% in 2025.

44% of healthcare organizations say their organizations experienced an attack against its supply chains, which is a significant decline from 68% in 2024.

Healthcare organizations that experienced supply chain attacks, on average, experienced four supply chain attacks in the past two years.

57% of healthcare organizations say their organizations are very or highly vulnerable to supply chain attacks.

60% of insider threat incidents involved personal cloud application instances in 2025.

93% of cybersecurity leaders reported incidents caused by cybercriminals exploiting employees.

Malicious insiders accounted for incidents at 36% of organizations.

58% of organizations attribute their most significant data loss events to careless employees or third-party contractors.

Only 15% of organizations feel fully prepared to handle the movement of sensitive data through SaaS and Shadow IT tools.

77% of organizations experienced insider-driven data loss in the past 18 months.

43% of security professionals are concerned about disgruntled employees.

55% of security professionals are concerned about departing employees.

• 21% of organizations faced more than 20 insider-related data loss incidents in the past 18 months.

17% of insider incidents involved personal healthcare information.

73% of security professionals are concerned about careless, negligent, or uninformed employees.

53% of insider incidents involved customer records.

47% of insider incidents involved personal information or Personally Identifiable Information (PII).

12% of detected insider incidents could not be attributed, underscoring challenges in detection.

40% of insider incidents involved business-sensitive financial and strategic information.