Bitdefender

44% of IT and security professionals identify cloud infrastructure and application environments as a primary security concern.

33.3% of IT and security professionals identify identity and access management (IAM) systems as a top security concern.

0.5% of IT and security managers report zero visibility into AI tool usage versus 4.5% of practitioners.

14% of consumers report falling victim to a scam in the past year.

Approximately 5.2% of SMS messages (about 1 in 20) exhibit characteristics consistent with scam infrastructure or coordinated fraud activity.

More than 23 million incoming calls are classified as unwanted, meaning about 1 in 6 calls reaching protected devices is fraudulent or unsolicited.

48% of consumers do not use a third-party security solution on their phone, despite 53% conducting sensitive transactions such as bill payments or online shopping in 2025.

37% of consumers worldwide identified the use of artificial intelligence in sophisticated scams, such as deepfakes, as their top concern in 2025.

37% of consumers worldwide still write down passwords, while 32% reuse the same password across multiple accounts in 2025.

In the U.S., 73.8% of surveyed IT/security professionals reported being pressured to keep a breach confidential, even when they believed it should be reported to authorities.

In Germany, 48.4% of surveyed IT/security professionals reported being pressured to keep a breach confidential, even when they believed it should be reported to authorities.

84% of major attacks now involve legitimate tools already present in the environment (Living-Off-the-Land or LOTL tactics).

February 2025 was the single worst month in ransomware history based on the total number of claimed victims.

February 2025 saw a total of 962 victims claimed by ransomware groups.

Out of the 962 victims claimed in February 2025, 335 were claimed by the Clop (Cl0p) group.

47.4% of IT and security professionals acknowledge only partial or no visibility into individual Shadow AI tools or personal accounts used for work.

57.8% of IT and security managers believe they have full visibility into AI tool usage compared to 45.9% of practitioners.

45% of IT and security professionals identify internal AI systems and large language models (LLMs) as their primary security concern.

55.2% of IT and security professionals who experienced a security incident or breach in the past 12 months state they were told to keep it confidential despite believing it should have been reported.

The 55.2% of IT and security professionals told to keep breaches confidential is slightly down from 57.6% in 2025 and substantially higher than 42% in 2023.

68.6% of IT and security professionals in the U.S. who experienced a breach report being told to keep it confidential, the highest regional rate.

57.2% of IT and security professionals in both Germany and the U.K. who experienced a breach report being told to keep it confidential.

56.8% of IT and security managers and 53.5% of practitioners who experienced a breach report pressure to stay silent.

35.9% of IT and security professionals report experiencing business email compromise (BEC) resulting in financial or data loss in the past 12 months.

54.7% of IT and security professionals in the U.S. report experiencing BEC incidents, nearly 19 percentage points above the overall average.

59.2% of IT and security professionals confirm experiencing AI-driven social engineering attacks in the past 12 months.

The top barriers to reducing the attack surface reported by IT and security professionals are high overhead in maintaining hardening rules and exceptions (38%), fear of operational disruption (35.4%), and resource constraints (34.6%).

Difficulty securing legacy systems is reported by 34.5% of IT and security professionals and visibility gaps are reported by 33.8%.

87% of IT and security professionals in the U.S., 85% in the U.K., and 77% in Germany say they would likely switch cybersecurity vendors due to data sovereignty concerns.

51.8% of IT and security professionals report full visibility into sanctioned and unsanctioned AI tool usage.

IT and security professionals rate attackers using AI to generate self-mutating malware as a high or extreme risk at 55.9%, employees leaking sensitive data into public LLMs at 53.5%, AI-driven evasion techniques at 52.5%, and deepfakes or voice cloning used in fraud or BEC at 51.9%.

25.6% of IT and security professionals report experiencing ransomware in the past 12 months.

20.4% of IT and security professionals rate employees leaking sensitive data into public LLMs as a low or extremely low risk.

48.8% of IT and security professionals in the U.S. report marked gaps in visibility compared to the overall average of 33.8%.

64% of IT and security professionals in Singapore and 61.6% in the U.S. view agentic AI expanding the attack surface as a regional flashpoint.

79.4% of IT and security managers and 72.8% of practitioners say they would likely switch vendors due to data sovereignty concerns.

76.1% of IT and security professionals say they would likely switch cybersecurity vendors due to concerns about data sovereignty, jurisdiction, or foreign government access to their data.

41.8% of IT and security professionals report experiencing a cloud infrastructure or application breach in the past 12 months.

Losses due to scams globally reach nearly half a billion US dollars in 2025.

Younger consumers are twice as likely to fall victim to scams as adults aged 55 and older, with victimization rates of 20% versus 9.7%.

Respondents reported managing an average of five online accounts, with nearly two-thirds holding at least three accounts in 2025.

48% of consumers accept all cookies by default, while only 36% manually manage them and 16% reject all cookies in 2025.

Social media is the leading medium for successful scams at 34%, surpassing email (28%), phone calls (25%), text messages (24%), and online ads (21%) in 2025.

14% of consumers reported falling victim to a scam in the past year, with an average loss of $545, resulting in over $534,000 lost among survey participants.

31% of respondents cited tool complexity as a challenge with current security solutions.

29% of respondents cited extending protection across environments as a challenge with current security solutions.

44.7% of respondents cited phishing/social engineering as a top concerning threat.

Germany reported the highest difficulty with tool complexity at 41%.

20.3% of respondents view AI-powered malware as an extremely significant risk. This concern for AI-powered malware climbs to 25% among senior management, compared to just 15% of middle management.

One in four (25%) flagged compliance navigation as their biggest challenge with security solutions.