Beazley Security

Compromised credentials accounted for 67% of ransomware intrusions investigated by Beazley Security, down from 74% in Q1.

Vulnerabilities confirmed as actively exploited and added to CISA's Known Exploited Vulnerabilities catalog increased 10% in Q2 2026 compared to the previous quarter.

Newly disclosed software vulnerabilities increased 36% in Q2 2026 compared to the previous quarter.

Beazley Security Labs recorded a 15% increase in critical zero-day advisories issued to clients in Q1 2026.

More than 15,200 new software vulnerabilities were disclosed in Q1 2026, including nearly 3,900 classified as high risk.

Compromised credentials accounted for 74% of ransomware intrusions observed by Beazley Security investigators in Q1 2026.

In Q3 2025, Akira, Qilin, and INC Ransomware accounted for 65% of all ransomware cases investigated by Beazley Security.

In Q3 2025, the Akira ransomware group claimed 167 posts on their public leak site.

In Q3 2025, over 200,000 passwords, hundreds of credit card records, and more than 4 million browser cookies were harvested by the PXA Stealer campaign.

Disclosure volume historically moved within a 10% band quarter-to-quarter, but rose 18.5% in Q1 2026 and 36% in Q2 2026.

Public ransomware leak-site postings totaled 2,268, remaining nearly 60% above Q2 2025.

Beazley Security Labs issued 40% more critical zero-day advisories to clients than in the previous quarter.

Vulnerabilities added to CISA's Known Exploited Vulnerabilities catalog increased 43% in Q1 2026 compared with Q4 2025.

Exploited vulnerabilities rose 43% in the first three months of 2026.

In Q3 2025, leak site posts increased by 11% from Q2 to Q3.

In Q3 2025, Beazley Security published 11 critical zero-day advisories, marking a 38% increase from Q2.

In Q3 2025, Qilin ransomware claimed 271 posts on their public leak site.

In Q3 2025, the 'Others' category of ransomware actors decreased from 40% to 16% of cases compared to the previous quarter.

In Q3 2025, Qilin ransomware accounted for approximately 18% of Beazley Security incident response cases.

In Q3 2025, the number of newly published vulnerabilities reached over 11,700, with nearly 1,800 classified as high-risk.

In Q3 2025, INC Ransomware claimed 119 posts on their public leak site.

In Q3 2025, INC Ransomware accounted for approximately 8% of Beazley Security incident response cases.

In Q3 2025, 29 vulnerabilities were confirmed to be actively exploited in the wild, representing a 26% decrease from the previous quarter.

In Q3 2025, the majority of MDR incidents were contained within the early and middle stages of attack, with early-stage attacks at 44% and middle-stage attacks at 44%.

In Q3 2025, the Akira ransomware group accounted for approximately 39% of Beazley Security incident response cases.