Supply Chain vs Insider Threat

37% of security leaders cited "detecting more than we can fix" as their organization's single biggest obstacle to improving software supply chain security

54% of CVE instances observed in third-party production code come from CVEs published more than a year ago.

Small and midsize companies carry 414 unsanctioned AI tools per 1,000 employees.

79% of third-party applications are authorized.

31% of manufacturers affected by supplier cyber attacks reported delays to customer deliveries.

30% of manufacturers experienced a cyber incident in the past year, either directly or through their supply chain.

DPRK-nexus adversaries injected malicious packages into AI frameworks, poisoning 131 trusted AI framework packages.

In 1H 2026, 87% of identified software registry threats involved malicious npm packages.

eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments.

Supply chain attacks generated 280.6 million victim notices from 38 initial breach events, impacting 206 entities.

Organisations that knowingly work with risky suppliers are more than four times as likely to experience a supplier-originated cyber incident.

48% of organisations continue working with suppliers despite known resilience or security concerns.

26% of organisations identify dependence on suppliers as a main barrier to improving resilience.

Nearly a quarter (24%) of 17,651+ tracked Model Context Protocol (MCP) servers carry at least one vulnerability.

28.6% of 130,667 cataloged tools are classified as high risk.

69% of UK CISOs identify human risk as their organisation's biggest cyber vulnerability, up from 60% in 2025.

Among UK organisations that experienced material data loss, compromised insiders were the leading cause at 48%, with malicious or criminal insiders cited by 44% and careless insiders by 37%.

95% of UK CISOs at organisations experiencing material data loss say departing employees played a role.

Insider wrongdoing events totaled 21 in the first half of 2026, a sevenfold increase over the three incidents in 2025.

50% of federal IT and cybersecurity decision makers list preventing unauthorized actions as a top concern for agentic AI deployments

41% of CISOs are concerned about malicious insiders using AI to support fraud, cybercrime or data theft.

68% of CISOs identify employees as their organisation’s biggest security risk as AI amplifies human-targeted attacks.

40% of CISOs fear employees are sharing sensitive information with generative AI platforms.

38% of security and IT leaders report attacker activity mirrors legitimate, authorized workflows and processes, delaying critical alerts.

12% of organizations maintain direct user-to-server administrative pathways, meaning a single compromised employee device can provide immediate access to high-value systems.

80% of organizations report shadow AI (employees connecting AI tools without security or IT review).

17% of Nordic CISOs cited insiders & human error as their primary concern.

Over a third of employees commonly source their own agentic AI tools when options are unavailable or restrictive.

Shadow AI is now the third most common non-malicious insider action detected in Verizon's data loss prevention (DLP) dataset in 2025

13% of employees say they’ve sold or know someone who has sold company login details – often under the belief it’s harmless