Proofpoint

28% of global organizations that experienced a ransomware attack report that AI significantly increases the attack's effectiveness.

37% of global organizations that experienced a ransomware attack report that AI somewhat increases the attack's effectiveness.

Only 9% of global organizations affected by ransomware report no evidence of AI use in the attack.

Resolving a data loss incident can take between one and four weeks for more than one in five organizations (21%).

Just 1% of users are responsible for 76% of data loss events.

31% of organizations say redundant or obsolete data poses significant risk.

Supply chain attacks against healthcare organizations decreased significantly from 68% in 2024 to 44% in 2025.

Healthcare organizations that experienced cloud/account compromises had an average of 21 such compromises in the past two years.

25% of healthcare organizations cite employees sending PII or PHI to an unintended recipient via email as a primary root cause of incidents.

In the U.S., 80% of CISOs express concern over potential customer data loss via public GenAI platforms.

Despite this, 68% of CISOs believe employees understand cybersecurity best practices.

Despite near-universal adoption of Data Loss Prevention (DLP) tools, one-third say their data remains inadequately protected.

54% of organizations affected by ransomware pay a ransom.

37% of organizations that pay a ransom face a second extortion demand.

60% of US organizations confirm sensitive data theft during ransomware incidents.

40% of organizations say employees did not suspect the attack because it appeared authentic.

Credential harvesting is identified as the initial threat in 36% of ransomware incidents.

93% of US organizations affected by ransomware pay a ransom.

Phishing emails and other email-based social engineering are the initial entry vector in 34% of ransomware incidents.

US organizations report AI-enhanced attack effectiveness at 81%.

User interaction as a bypass factor is highest in Japan (49%), India (49%), and Singapore (48%).

Malicious links are identified as the initial threat in 47% of ransomware incidents.

38% of organizations report that employees interact with malicious content.

34% of ransomware incidents begin with phishing emails or other email-based social engineering.

65% of global organizations affected by ransomware report that AI increases the attack's effectiveness.

Malicious links are identified as the initial threat in 47% of incidents, malicious attachments in 46%, credential harvesting in 36%, and Business Email Compromise in 35%.

Almost two-thirds of organizations confirm that data is stolen during ransomware incidents.

49% of organizations in Japan report user interaction as the reason ransomware bypassed controls.

49% of organizations in India report user interaction as the reason ransomware bypassed controls.

48% of organizations in Singapore report user interaction as the reason ransomware bypassed controls.

38% of organizations attribute ransomware incidents to users interacting with malicious content.

28% of organizations that experienced a ransomware attack say AI significantly increased the attack’s effectiveness.

37% of organizations that experienced a ransomware attack say AI somewhat increased the attack’s effectiveness.

65% of global organizations affected by ransomware say AI increased the effectiveness of the attack.

Only 9% of organizations report no evidence of AI use in their ransomware incidents.

Malicious attachments are identified as the initial threat in 46% of ransomware incidents.

60% of US organizations confirm sensitive data theft in ransomware incidents.

40% of organizations report that employees trust AI-powered attacks.

93% of US organizations affected by ransomware pay the ransom.

Business Email Compromise is identified as the initial threat in 35% of ransomware incidents.

37% of organizations that paid a ransom face a second extortion demand.

81% of US organizations report AI-enhanced attack effectiveness in ransomware incidents.

40% of organizations report that employees do not suspect the ransomware attack because it appears authentic.

46% of organizations cite cloud and SaaS data sprawl as a top challenge. ).

32% of organizations flag unsupervised data access by agents as a critical threat.

Over a quarter (29%) of organizations saw their data grow 30% or more over the past year.

32% of organizations attribute their most significant data loss events to malicious insiders.

Among enterprises with over 10,000 employees, 41% manage more than a petabyte of data.

44% of organizations lack sufficient visibility and controls over GenAI tools.

Respondents reported an average of 11 data loss incidents per year, with some organizations experiencing multiple incidents each month.