ExtraHop

30% of security and IT leaders report alert fatigue causes initial detections to be deprioritized, delaying critical alerts.

Security teams require mid-to-high levels of manual intervention for detection, at 42%.

34% of security and IT leaders report adversaries use valid, high-privilege account permissions, delaying critical alerts.

Organizations cited an average dwell time of nearly 2 weeks for threat actors prior to a ransomware incident.

The average ransomware payout was $3.6 million

70% of organizations experienced ransomware incidents in the last year

36% of security and IT leaders identify third-party vendor or supply chain breaches involving integrated AI or agents as security incidents tied to AI systems.

55% of security and IT leaders cite AI agents, agentic infrastructure, and Gen AI applications as the biggest cybersecurity risk to their organization.

31% of security and IT leaders identify agentic/API logic failures as security incidents tied to AI systems.

83% of ransomware victims paid a ransom, up from 70% previously.

27% of security and IT leaders report undetermined baseline behavior enables anomalous actions to go undetected, delaying critical alerts.

Average ransom payment dropped to $2.8 million, down from $3.6 million in 2025.

Downtime per incident averaged almost 30 hours.

85% of security and IT leaders identify security incidents, data exposures, or near misses where the root cause is an AI system.

35% of security and IT leaders identify shadow AI exposure as security incidents tied to AI systems.

38% of security and IT leaders report attacker activity mirrors legitimate, authorized workflows and processes, delaying critical alerts.

Security teams require mid-to-high levels of manual intervention for alert triage, at 43%.

Security teams require mid-to-high levels of manual intervention for investigation, at 49%.

SOC analysts spend just 44% of their time on proactive efforts like threat hunting and detection engineering.

30% of security and IT leaders report AI-generated alerts produce false positives that negatively impact investigation timelines.

40% of security and IT leaders identify AI-enhanced external attacks as security incidents tied to AI systems.

38% of security and IT leaders identify compromised AI identity and session theft as security incidents tied to AI systems.

Adversaries maintained access to enterprise networks for nearly 2.5 weeks on average before being detected in ransomware incidents.

49% of organizations did not detect the threat until after data is stolen, up from 31% the previous year.

14% of organizations were unaware of an attack until they receive a ransom demand, compared to 6% the previous year.

Security teams require mid-to-high levels of manual intervention for response, at 47%.

41% of security and IT leaders report attackers use encrypted channels to bypass detection, delaying critical alerts.

At least 165 Snowflake customers were affected by the 2024 Snowflake data breach, including major technology organizations like Pure Storage and AT&T

25.6% of government sector threats were attributed to Akira in 2024.

22.00% of ransomware incidents involved lateral movement and privilege escalation as the detected phase.

23.99% of organizations reported average downtime of 2 days after a cyber incident.

5.53% of ransomware incidents involved a ransom demand as the detected phase.

Unnamed Fortune 50 company reported a ransom payment of $75 million

33.3% of government sector threats were attributed to DarkSide in 2024.

39.92% of manufacturing and construction organizations reported limited visibility into their entire environment.

The average length of time to respond to and contain a security alert was 2 weeks

LockBit registered a 37% detection rate in Germany, indicating a significantly elevated threat compared to other regions in 2024.

Organizations in the UAE faced an average of 7 ransomware incidents, the highest number globally

Midnight was detected in 23.3% of cybersecurity incidents over the last 12 months.

41.9% of organizations surveyed perceived generative AI applications as a risk, ranking third compared to legacy systems at 23.5% and endpoint devices at 30.6%.

29.27% of ransomware incidents involved initial access as the detected phase.

25.6% of government sector threats were attributed to RansomHub in 2024.

The Ticketmaster/Live Nation breach exposed the personal and financial information of 560 million customers.

10% of organizations in the government sector experienced ransomware incidents annually.

13.4% of IT and security decision-makers indicated third-party/supply chain compromise as a common entry point for attackers.

70% of organizations reported that they paid the ransom in 2023

The percentage of organizations that never paid a ransom increased from 9% last year to 30% this year

42.22% of finance organizations reported limited visibility into their entire environment.

33.3% of government sector threats were attributed to LockBit in 2024.

4.83% of organizations reported average downtime of one week after a cyber incident.