ExtraHop

31% of security and IT leaders identify agentic/API logic failures as security incidents tied to AI systems.

27% of security and IT leaders report undetermined baseline behavior enables anomalous actions to go undetected, delaying critical alerts.

Average ransom payment dropped to $2.8 million, down from $3.6 million in 2025.

33.3% of government sector threats were attributed to DarkSide in 2024.

39.92% of manufacturing and construction organizations reported limited visibility into their entire environment.

Midnight was detected in 23.3% of cybersecurity incidents over the last 12 months.

83% of ransomware victims paid a ransom, up from 70% previously.

Downtime per incident averaged almost 30 hours.

85% of security and IT leaders identify security incidents, data exposures, or near misses where the root cause is an AI system.

35% of security and IT leaders identify shadow AI exposure as security incidents tied to AI systems.

38% of security and IT leaders report attacker activity mirrors legitimate, authorized workflows and processes, delaying critical alerts.

30% of security and IT leaders report alert fatigue causes initial detections to be deprioritized, delaying critical alerts.

Security teams require mid-to-high levels of manual intervention for detection, at 42%.

Security teams require mid-to-high levels of manual intervention for alert triage, at 43%.

Security teams require mid-to-high levels of manual intervention for investigation, at 49%.

SOC analysts spend just 44% of their time on proactive efforts like threat hunting and detection engineering.

30% of security and IT leaders report AI-generated alerts produce false positives that negatively impact investigation timelines.

40% of security and IT leaders identify AI-enhanced external attacks as security incidents tied to AI systems.

38% of security and IT leaders identify compromised AI identity and session theft as security incidents tied to AI systems.

36% of security and IT leaders identify third-party vendor or supply chain breaches involving integrated AI or agents as security incidents tied to AI systems.

Adversaries maintained access to enterprise networks for nearly 2.5 weeks on average before being detected in ransomware incidents.

49% of organizations did not detect the threat until after data is stolen, up from 31% the previous year.

14% of organizations were unaware of an attack until they receive a ransom demand, compared to 6% the previous year.

34% of security and IT leaders report adversaries use valid, high-privilege account permissions, delaying critical alerts.

55% of security and IT leaders cite AI agents, agentic infrastructure, and Gen AI applications as the biggest cybersecurity risk to their organization.

Security teams require mid-to-high levels of manual intervention for response, at 47%.

41% of security and IT leaders report attackers use encrypted channels to bypass detection, delaying critical alerts.

41.9% of organizations surveyed perceived generative AI applications as a risk, ranking third compared to legacy systems at 23.5% and endpoint devices at 30.6%.

29.27% of ransomware incidents involved initial access as the detected phase.

25.6% of government sector threats were attributed to RansomHub in 2024.

10% of organizations in the government sector experienced ransomware incidents annually.

13.4% of IT and security decision-makers indicated third-party/supply chain compromise as a common entry point for attackers.

70% of organizations reported that they paid the ransom in 2023

The percentage of organizations that never paid a ransom increased from 9% last year to 30% this year

Unnamed Fortune 50 company reported a ransom payment of $75 million

42.22% of finance organizations reported limited visibility into their entire environment.

33.3% of government sector threats were attributed to LockBit in 2024.

4.83% of organizations reported average downtime of one week after a cyber incident.

23.26% of organizations reported average downtime of 11-24 hours after a cyber incident.

5.53% of ransomware incidents involved a ransom demand as the detected phase.

37.50% of agriculture organizations reported limited visibility into their entire environment.

23.08% of government organizations reported limited visibility into their entire environment.

55% of organizations reported experiencing 11 or more hours of downtime on average after a cyber incident.

2.33% of organizations reported average downtime of more than a week after a cyber incident.

On average, organizations take just over 2 weeks to respond to and contain a security alert from initial detection to resolution.

In August 2024, the Rhysida ransomware group attacked the Port of Seattle, causing systems to be offline for more than three weeks.

At least 165 Snowflake customers were affected by the 2024 Snowflake data breach, including major technology organizations like Pure Storage and AT&T

59% of organizations in France expressed the highest level of concern regarding risks, while 36.8% in the UAE exhibited the lowest level of concern.

The finance sector had an average ransom payment of $3.8 million

The government sector had an average ransom payment just below $7.5 million