Fortinet

71% of organizations reported between one and nine intrusions, up from 47% the previous year.

2% of organizations reported more than 10 intrusions, unchanged from the previous year.

89% of organizations expect increased regulation within five years or less, up from 66% in 2025.

There were 7,831 confirmed ransomware victims globally, a 389% year-over-year increase from approximately 1,600 victims previously.

Brute force attempts decreased 22% year-over-year.

Within dark web "database" activity, stealer logs comprised 67.12% of advertised/shared datasets, combolists 16.47%, and leaked credentials 5.96%.

Only 15% of organizations feel fully prepared to handle the movement of sensitive data through SaaS and Shadow IT tools.

21% of security professionals are concerned about whistleblowers sharing or exposing data.

35% say insufficient budget is the biggest barrier to maturing their insider risk program.

In 2025, 78% of organisations in the critical sector use four or fewer OT vendors for cybersecurity.

81% of organisations in the critical sector self-assess their OT cybersecurity maturity at Level 3 or 4 on a five-level scale (0–4).

Among critical sector organisations at Level 4 maturity, 65% reported zero intrusions in the past year.

In cloud environments, in 70% of observed incidents, attackers gained access through logins from unfamiliar geographies.

Over 100 billion compromised records were shared on underground forums in 2024. This represents a 42% year-over-year spike.

1.7 billion stolen credential records were shared in underground forums.

Approximately 23% of organizations have visibility into about half of their OT environment.

24% of organizations reported intrusions in both IT and OT systems, down from 60% in 2025 and the lowest since 2022.

60% of organizations report the CISO has ultimate responsibility for OT cybersecurity, down from 69% in 2025.

81% of organizations plan to assign OT cybersecurity to the CISO within the next year, up from 80% in 2025.

Organizations' OT cybersecurity maturity ratings at Level 0 increased to 5%, up from 1% in 2025.

Organizations' OT cybersecurity maturity ratings at Level 1 increased to 17%, up from 5% in 2025.

Organizations' OT cybersecurity maturity ratings at Level 4 fell to 17%, down from 49% in 2025.

Level 4 maturity for OT security solutions declined to 14%, down from 19% in 2025.

76% of organizations reported phishing as an intrusion.

50% of organizations reported ransomware intrusions, down from 54% in 2025.

There is a 20-point increase in organizations expecting new regulations within two to five years rather than beyond five years.

40% of organizations report their ICS systems are less than five years old, up from 20% in 2025.

Organizations' OT cybersecurity maturity ratings at Level 2 increased to 27%, up from 13% in 2025.

14% of organizations have full visibility into OT systems, up from 5% in 2025.

Credential-stealer infections were dominated by RedLine with 911,968 infections (50.80%), Lumma with 499,784 infections (27.84%), and Vidar with 236,778 infections (13.19%).

The top three targeted sectors by ransomware victims were manufacturing (1,284), business services (824), and retail (682).

Ransomware victims concentrate geographically with the U.S. at 3,381, Canada at 374, and Germany at 291.

Global exploitation attempts increased 25.49% year-over-year.

Time-to-exploit (TTE) is 24–48 hours for critical outbreaks, compared to 4.76 days previously.

72% of organizations say their budgets for insider risk or data protection are increasing.

77% of organizations experienced insider-driven data loss in the past 18 months.

When asked which egress channels for the outflow of sensitive data does your organization worry most about, 56% said Generative AI tools like ChatGPT.

43% of security professionals are concerned about disgruntled employees.

42% say organizational silos (e.g., Security vs HR vs Legal) is the biggest barrier to maturing their insider risk program.

55% of security professionals are concerned about departing employees.

• 21% of organizations faced more than 20 insider-related data loss incidents in the past 18 months.

When asked which egress channels for the outflow of sensitive data does your organization worry most about, 44% said messaging apps.

17% of insider incidents involved personal healthcare information.

73% of security professionals are concerned about careless, negligent, or uninformed employees.

53% of insider incidents involved customer records.

43% of security professionals are concerned about third-party partners or contractors with access to their environment.

12% of detected insider incidents could not be attributed, underscoring challenges in detection.

When asked which egress channels for the outflow of sensitive data does your organization worry most about, 69% said email.

40% of insider incidents involved business-sensitive financial and strategic information.

47% of insider incidents involved personal information or Personally Identifiable Information (PII).