Google Cloud

21% of cybersecurity intrusions investigated involved compromised trusted relationships with third-parties.

10% of intrusions investigated involved Business Email Compromise (BEC), with actors targeting banking details for wire and deposit fraud.

Threat actors exploited identity issues to gain initial access in 83% of the incidents involving major cloud and SaaS-hosted environments.

The most common cross-industry applications for AI agents reported in the study include security operations and cybersecurity (46%).

40% of agentic AI early adopters saw a good return on strengthening security operations, compared to only 30% of average users.

When choosing Large Language Model (LLM) providers, executives' top concern is now privacy and security.

59% of IT and cybersecurity leaders say it being hard to derive clear action from threat intelligence data is a challenge in actioning threat intelligence.

80% of IT and cybersecurity leaders said that threat intelligence providers should offer information sources that are both broad and deep.

Providing actionable recommendations and next steps to uplevel junior analysts was cited by 63% of IT and cybersecurity leaders as a benefit of using AI in threat intelligence.

Threat actors targeted data in 73% of cloud-related incidents.

Initial access by threat actors using misconfiguration, which accounted for 29.4% of incidents in the first half of 2025, dropped to 21% in H2 2025.

RCE increased nearly five-fold from 2.9% in H1 to 13.6% in H2

Software supply chain compromises accounted for 3% of cybersecurity intrusions investigated.

45% of intrusions resulted in data theft without immediate extortion attempts at the time of the engagement

2% of cybersecurity intrusions investigated involved vulnerability exploitation.

Exposed sensitive UI or APIs fell from 11.8% in H1 to 4.9% in H2.

28% of intrusions investigated resulted in data theft that bore indications of extortion.

Threat actors exploited third-party software-based entry (44.5%) more frequently than weak credentials—a significant increase from the 2.9% observed in H1 2025.

21% of cybersecurity intrusions investigated involved actors leveraging stolen human and non-human identities for initial access.

7% of cybersecurity intrusions investigated resulted from actors gaining access through improperly configured application and infrastructure assets.

When malicious insiders used personally controlled cloud services to exfiltrate data, 12% of those malicious insiders used multiple cloud storage services, including Google Drive, Dropbox, Microsoft OneDrive, and Apple iCloud.

17% of phishing cases involved voice-based social engineering (vishing).

In 35% of cases where data exfiltration occurred, the malicious insider absconded with data through multiple paths such as a combination of email and cloud or USB storage device and cloud.

Data privacy and security are among the top three LLM provider considerations for 37% of respondents, followed by integration with existing systems and cost.

Data privacy and security are among the top three LLM provider considerations for 37% of respondents, followed by integration with existing systems and cost.

37% of IT and cybersecurity leaders say stale information is a challenge in actioning threat intelligence.

Simplifying the process of searching and querying data for relevant information was cited by 53% of IT and cybersecurity leaders as a benefit of using AI in threat intelligence.

61% of IT and cybersecurity leaders say too many feeds is a challenge in actioning threat intelligence.

86% of IT and cybersecurity leaders agreed that they "must" use AI to improve their ability to operationalise threat intelligence.

More than 80% of organisations already use threat intelligence or are planning to across eight major use-cases.

60% of IT and cybersecurity leaders say too few analysts is a challenge in actioning threat intelligence.

Enhancing trust in the threat intelligence vendor's capabilities to gather new sources of information was cited by 47% of IT and cybersecurity leaders as a benefit of using AI in threat intelligence.

80% of IT and cybersecurity leaders said their senior leadership team underestimates threats to the organisation.

59% of IT and cybersecurity leaders say it being difficult to verify the validity and/or relevance of threats is a challenge in actioning threat intelligence.

35% of IT and cybersecurity leaders are "very concerned" that their organization might be missing real threats/incidents due to the amount of alerts and data they are faced it.

79% of IT and cybersecurity leaders said that external threat intelligence providers should help "uplevel junior staff or embed a threat intelligence (CTI) analyst" into their team.

49% of IT and cybersecurity leaders say the difficulty in determining which intelligence applies is a challenge in actioning threat intelligence.

82% of IT and cybersecurity leaders worry about missing threats due to the volume of alerts and data they are faced with.

Improving efficiency by generating easy-to-read summaries was cited most frequently (69%) by IT and cybersecurity leaders as a benefit of using AI in threat intelligence.

Making threat intelligence more accessible to different stakeholders was cited by 68% of IT and cybersecurity leaders as a benefit of using AI in threat intelligence.

44% of IT and cybersecurity leaders say there still being a lot of manual effort involved is a challenge in actioning threat intelligence.

Enabling the ability to foccus on higher-priority tasks via time saved was cited by 60% of IT and cybersecurity leaders as a benefit of using AI in threat intelligence.

86% of IT and cybersecurity leaders said that their organisation needs to improve its understanding of the threat landscape.

72% of IT and cybersecurity leaders said they are mostly reactive to threats.

Improving decision-making with more complete, accurate, relevant, and timely information was cited by 59% of IT and cybersecurity leaders as a benefit of using AI in threat intelligence.

Enhancing trust in the threat intelligence vendor's capabilities to analyze and correlate information was cited by 55% of IT and cybersecurity leaders as a benefit of using AI in threat intelligence.

47% of IT and cybersecurity leaders are "concerned" that their organization might be missing real threats/incidents due to the amount of alerts and data they are faced it.

85% of IT and cybersecurity leaders say that their organisation could focus more time and energy on emerging critical threats.

Improving the capability to prioritize threats and vulnerabilities was cited by 68% of IT and cybersecurity leaders as a benefit of using AI in threat intelligence.

66% of IT and cybersecurity leaders state that they struggle to share threat intelligence with relevant teams.