| # | Executive Summary | Report Topic Domains | Publisher | Year | Org Type | |
|---|---|---|---|---|---|---|
| 1 | 2020 SANS Cyber Threat Intelligence (CTI) Survey | Bottom Line Up Front (BLUF) The 2020 SANS CTI Survey shows that cyber threat intelligence is becoming more mature, collaborative, and operationally useful, but many organizations still struggle with staffing, repeatable processes, and measuring value. For SMBs and insurance teams, the key takeaway is that threat intelligence is most useful when it is tied to clear business and security requirements, not simply purchased as feeds or reports. Top 3-5 Most Notable Statistics •1,006 respondents participated in the 2020 survey, up from 505 in 2019. •Almost 44% of respondents reported having a formal process for gathering CTI requirements, a 13% increase from the prior year. •89% of respondents use CTI for threat detection, followed by 77% for threat prevention, 72% for threat response, and 59% for threat mitigation. •82% of respondents said CTI improved security and response efforts, while only 4.2% reported measuring CTI effectiveness. •57% cited lack of trained staff and skills as an inhibitor to effective CTI implementation, and 52% cited the time required to implement proper intelligence processes. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs For SMBs, the report’s findings point to a practical challenge: threat intelligence can improve detection, response, prevention, and mitigation, but only if the business can turn information into action. The report emphasizes that simply collecting threat feeds or receiving reports is not enough. Organizations need to know what questions they want CTI to answer, what data sources are useful, and who needs to receive the intelligence. SMBs with limited staff may struggle most with the same issues identified in the survey: lack of trained personnel, manual processes, and difficulty implementing consistent intelligence workflows. |
| SANS Institute | 2020 | Education / Academic |
| 2 | 2020 Unit 42 IoT Threat Report | Bottom Line Up Front (BLUF) IoT devices are a major weak point because many are unencrypted, unpatched, poorly segmented, or not visible to IT teams. For SMBs and insurance teams, the key takeaway is that everyday connected devices such as printers, cameras, routers, and medical systems can become entry points for data theft, ransomware, cryptojacking, lateral movement, and operational disruption. Top 3-5 Most Notable Statistics •98% of all IoT device traffic observed was unencrypted, exposing personal and confidential data on the network. •57% of IoT devices were vulnerable to medium- or high-severity attacks. •30% of network-connected endpoints at the average enterprise were IoT devices, excluding mobile devices. •72% of healthcare VLANs mixed medical IoT, generic IoT, and IT devices, lowering the barrier for lateral movement. •83% of medical imaging devices ran on unsupported operating systems. Top 3-5 Exploitable Technology Risks •Unencrypted IoT traffic can allow attackers who already gained access to a network to listen to traffic and collect confidential information. •Default or weak passwords on IoT devices remain a major attack path, especially where OT device practices are not aligned with IT password policies. •Unpatched and end-of-life operating systems expose devices to older, well-known exploits that still work. |
| Palo Alto Networks Unit 42 | 2021 | Network Security Vendor |
| 3 | 2021 Cyberthreat Defense Report | Bottom Line Up Front (BLUF) The report’s central message is that successful cyberattacks became more common, security teams became more pessimistic, and ransomware continued to create serious business risk. For SMB owners and insurance teams, the most important takeaway is that prevention alone is not enough; organizations need practical controls for awareness, vulnerability reduction, incident response, and ransomware recovery. Top 3-5 Most Notable Statistics •86% of responding organizations experienced at least one successful cyberattack in the prior 12 months. •76% of security professionals believed a successful attack was more likely than not in the coming year. •69% of organizations were victimized by ransomware, and 57% paid the ransom. •87% of organizations reported an IT security skills shortfall. •91% of organizations were affected by cyberattacks targeting web and mobile applications. Top 3-5 Exploitable Technology Risks •Mobile devices and BYOD: Mobile devices were rated the most challenging IT domain to secure, driven by work-from-home and bring-your-own-device adoption. •Third-party risk: Third-party risk management was rated the most challenging IT security function, reflecting exposure through partners, suppliers, and contractors. •Vulnerabilities, patching, and configuration gaps: “Attack surface reduction” was the second-biggest challenge and includes vulnerability management, patch management, security configuration management, and penetration testing. |
| ISC2 | 2021 | Education / Academic |
| 4 | 2021 Mid-Year Threat Landscape Report | Bottom Line Up Front (BLUF) Deep Instinct’s mid-year 2021 report identifies ransomware, phishing, and banking trojans as major threats, with ransomware showing sharp growth and more aggressive extortion tactics. For SMBs and insurance teams, the key issue is not only data encryption, but also stolen sensitive information, downtime, reputational damage, and increasing pressure on cyber insurance costs and terms. Top 3-5 Most Notable Statistics •Ransomware increased by 800% between January-June 2019 and the same period in 2021. •STOP/Djvu represented 66.3% of the top ransomware campaigns highlighted for H1 2021. •DarkSide represented 18.3% of the top ransomware campaigns highlighted for H1 2021. •Average ransom amounts rose from $115,123 in 2019 to $312,493 in 2020. •Colonial Pipeline paid $4.4 million after being targeted by DarkSide ransomware. Top 3-5 Exploitable Technology Risks •Ransomware with network-spreading capabilities, such as Ryuk, which gained worm-like functionality to find vulnerable machines on a network and encrypt them. •Ransomware attacks that move laterally through networks and attempt to reach domain controllers, as described in DarkSide operations. •Phishing emails using COVID-19 vaccine themes, including messages disguised as vaccine manufacturers or health providers to steal credentials or deliver malware. |
| Deep Instinct | 2021 | Endpoint / MDR / XDR Vendor |
| 5 | 2021 Software Vulnerability Snapshot | Bottom Line Up Front (BLUF) Synopsys found that nearly all tested software targets had vulnerabilities, and more than one-third of tests contained high or critical severity issues. For SMBs and insurance teams, the key takeaway is that software risk is business risk: web, mobile, and business applications can expose sensitive data, disrupt operations, and create avoidable loss if vulnerabilities are not tested and remediated. Top 3-5 Most Notable Statistics •97% of tests uncovered some form of vulnerability. •36% of tests had high or critical severity vulnerabilities. •28,501 total vulnerabilities were discovered across the tested targets. •76% of discovered vulnerabilities fell into a 2021 OWASP Top 10 category. •28% of total test targets had exposure to reflected, stored, or DOM-based cross-site scripting vulnerabilities. Top 3-5 Exploitable Technology Risks •Cross-site scripting: found across reflected, stored, and DOM-based forms, this can allow attackers to access application resources and data. •SQL injection: identified as the top critical vulnerability; it can allow attackers to insert database queries through application input and access sensitive data. •Broken access control: issues such as insecure direct object references can allow attackers to manipulate references and gain unauthorized access to data. |
| Synopsys | 2021 | Threat Intelligence Vendor |
| 6 | 2021 Trustwave SpiderLabs Telemetry Report | Bottom Line Up Front (BLUF) Trustwave’s telemetry shows that many Internet-facing systems remained vulnerable weeks or months after patches were released for major 2021 vulnerabilities. For SMBs and insurance teams, the key issue is not just the existence of critical flaws, but delayed patching, unsupported software, and exposed remote access services that give attackers practical paths into business systems. Top 3-5 Most Notable Statistics •More than 50% of servers reviewed had a weak security posture weeks or months after security updates were released. •~18,352 new security vulnerabilities were reported in 2020, a 6% increase from 2019 and 184.66% increase from 2016. •~13,000 vulnerabilities had been reported in 2021 as of September 1, with approximately 20% classified as High severity. •~45,000 Microsoft Exchange instances were verified as vulnerable to ProxyShell as of August 31, 2021. •At least 3 reviewed vulnerabilities had over 50% of Internet-accessible instances still vulnerable after patch release. Top 3-5 Exploitable Technology Risks •Microsoft Exchange ProxyShell and ProxyLogon vulnerabilities: exposed Exchange servers allowed serious exploitation, including arbitrary code execution and attack chains involving backdoors and malware. •Apache Tomcat CVE-2021-33037: many public-facing Tomcat instances were vulnerable or running end-of-life versions that no longer receive security updates. •QNAP NAS CVE-2021-28800: legacy QTS versions exposed command injection risk, allowing attackers to execute arbitrary commands. |
| Trustwave | 2021 | MSP / MSSP / SOC Provider |
| 7 | 2022 Cyber Threat Landscape Report | Bottom Line Up Front (BLUF) Deep Instinct’s 2022 report shows that malware volume remained well above pre-pandemic levels, while attackers became faster, more evasive, and more focused on business disruption. For SMBs and insurance teams, the key takeaway is that common entry points—email attachments, unpatched servers, cloud misconfigurations, remote access, and script-based malware—can quickly lead to ransomware, credential theft, data loss, and operational downtime. Top 3-5 Most Notable Statistics •Overall threat types increased by 125% in 2021. •Office droppers increased by 170%, highlighting continued abuse of malicious documents and macros. •Ransomware grew by 15.8%, even though growth slowed compared with the early COVID-19 surge. •More than 1,500 companies were infected with REvil following the Kaseya VSA supply chain attack. •Script-based attacks were estimated at 40% or more of global cyberattacks. Top 3-5 Exploitable Technology Risks •Microsoft Office droppers, Excel 4.0 macros, malicious Word documents, PDFs, and JavaScript attachments that can launch malware when opened or enabled. •Microsoft Exchange vulnerabilities, including ProxyShell and other Exchange zero-days, which attackers used to gain remote code execution, deploy webshells, persist, and exfiltrate data. •PrintNightmare vulnerabilities in Windows Print Spooler, including remote code execution scenarios and patch-bypass concerns under certain configurations. |
| Deep Instinct | 2022 | Endpoint / MDR / XDR Vendor |
| 8 | 2022 Cyberthreat Defense Report | Bottom Line Up Front (BLUF) The report shows sustained, high cyber pressure on organizations, with successful attacks, ransomware, and staffing shortages all at elevated levels. For SMBs and insurance teams, the key takeaway is that loss prevention depends less on buying more tools and more on closing practical gaps in identity, employee awareness, patching, application security, and response capability. Top 3-5 Most Notable Statistics •85.3% of organizations experienced at least one successful cyberattack in the past 12 months. •40.7% of organizations experienced six or more successful cyberattacks, a new high in the report. •76.1% of respondents said a successful attack is somewhat or very likely in the coming year. •71.0% of organizations were affected by ransomware, while 62.9% of victimized organizations paid ransoms. •84.1% of organizations reported a shortfall in skilled IT security personnel. Top 3-5 Exploitable Technology Risks •Ransomware, including double extortion attacks that encrypt data and also exfiltrate it for potential publication. •Account takeover and credential abuse attacks, including credential stuffing, which rose sharply in concern. •Malware and phishing, which remain central to many attacks and continue to exploit user weakness and detection gaps. |
| ISC2 | 2022 | Education / Academic |
| 9 | 2022 DNS Discoveries: Using DNS to Uncover Trends and Protect Against Threats | Bottom Line Up Front (BLUF) Cisco’s report highlights DNS as an underused control point for stopping common cyberattacks earlier, including malware, phishing, command-and-control activity, cryptomining, and DNS tunneling. For SMBs and insurance teams, the key takeaway is that DNS visibility and blocking can reduce exposure before malicious connections are fully established. Top 3-5 Most Notable Statistics •Cisco reports visibility into more than 620 billion daily DNS requests. •1 in 3 breaches could have been contained by DNS, according to the Global Cyber Alliance report cited by Cisco. •70% of organizations had users served malicious browser ads. •48% of businesses found information-stealing malware activity. •86% of organizations had at least one user try to connect to a phishing site, and phishing attacks account for 90% of data breaches. Top 3-5 Exploitable Technology Risks •Email-delivered malware attachments, such as RAR files containing malicious compiled HTML files, can install information stealers that collect credentials from browsers, email clients, VPN tools, FTP clients, and messaging apps. •Phishing emails with malicious JavaScript files can lead to ransomware infection, data exfiltration, lateral movement, and encryption of systems. •Command-and-control traffic enables attackers to remotely control compromised systems, download additional payloads, execute scripts, and deploy ransomware or information stealers. |
| Cisco | 2022 | Network Security Vendor |
| 10 | 2022 Penetration Testing Report | Bottom Line Up Front (BLUF) Fortra’s 2022 Penetration Testing Report shows that phishing, ransomware, misconfigurations, poor passwords, and patching gaps remain the most pressing practical risks organizations are trying to validate through penetration testing. For SMBs and insurance teams, the key takeaway is that regular testing is not just a compliance exercise; it helps identify which weaknesses could actually be exploited before they become claims, downtime, or recovery-cost events. Top 3-5 Most Notable Statistics •80% of respondents listed phishing as a top security concern. •68% listed ransomware as a top security concern. •57% listed misconfigurations as a top concern, and 55% listed poor passwords. •75% perform penetration tests for compliance or external mandates, and 75% do so to measure security posture. •42% conduct penetration testing only one to two times per year, while 86% regularly test external infrastructure and 46% regularly test cloud infrastructure. Top 3-5 Exploitable Technology Risks •Phishing and social engineering: The report identifies phishing as the leading concern and connects it to ransomware entry, making employee deception a high-impact attack path. •Ransomware exposure: Ransomware remains a major concern, especially where phishing, weak passwords, or unpatched systems give attackers a foothold. •Misconfigurations: Complex IT environments, including those used by smaller organizations, create opportunities for attackers when systems and tools are not maintained properly. |
| Fortra | 2022 | Threat Intelligence Vendor |
| 11 | 2022 ThreatLabz State of Ransomware Report | Bottom Line Up Front (BLUF) Ransomware continued to grow sharply in 2021–2022, with attackers increasingly using data theft, supply chain compromise, and ransomware-as-a-service to increase pressure on victims. For SMBs and insurance teams, the key takeaway is that ransomware risk is no longer limited to file encryption; it can also involve stolen data, business interruption, vendor exposure, and public extortion. Top 3-5 Most Notable Statistics •Ransomware attacks increased by 80% year over year based on ransomware payloads observed in the Zscaler cloud. •Double extortion ransomware victims increased by 117%, showing wider use of data theft as an extortion tactic. •Manufacturing was the most targeted industry for the second straight year, representing 19.5% of double extortion ransomware attacks. •Healthcare double extortion ransomware attacks increased by 643%, though from a low baseline. •Ransomware-as-a-service was used by 8 of the top 11 ransomware families reviewed in the report. Top 3-5 Exploitable Technology Risks •Internet-exposed applications and public-facing systems, which attackers scan for weaknesses before launching ransomware campaigns. •Weak, stolen, or brute-forced Remote Desktop Protocol credentials, which are used for initial access. •Vulnerable VPN and remote administration tools, which can provide attackers a path into the network. |
| ThreatLabz | 2022 | Research Organization |
| 12 | 2022 Vulnerability Intelligence Report | Bottom Line Up Front (BLUF) Rapid7’s 2022 report shows that attackers are exploiting important vulnerabilities extremely quickly, often before or immediately after public disclosure. For SMBs and insurance teams, the key takeaway is that routine patching alone is not enough; organizations need emergency patching and incident response procedures for widely exploited vulnerabilities in internet-facing and business-critical systems. Top 3-5 Most Notable Statistics •Rapid7 examined 50 vulnerabilities that posed considerable risk to organizations of all sizes. •45 vulnerabilities in the report were exploited in the wild in 2022. •44% of exploited vulnerabilities in the report arose from zero-day exploits. •56% of vulnerabilities in the report were exploited within seven days of public disclosure, up 12% from 2021 and 87% from 2020. •Only 14 vulnerabilities in the dataset were confirmed as used in ransomware attacks, a 33% decrease from 2021 despite continued ransomware activity. Top 3-5 Exploitable Technology Risks •Internet-facing network edge devices, including firewalls, VPN-related appliances, and security gateways, remained high-value targets because attackers can use them as network pivots. •Microsoft Exchange Server continued to present serious risk through widely exploited vulnerabilities, including the “ProxyNotShell” chain. •VMware products, including Workspace ONE Access / Identity Manager, vCenter, Horizon, and Cloud Foundation, were highlighted in widespread or impending exploitation scenarios. |
| Rapid7 | 2022 | Threat Intelligence Vendor |
| 13 | 2022 Vulnerability Statistics Report | Bottom Line Up Front (BLUF) Edgescan’s 2022 report shows that many serious security weaknesses are not exotic: they are known, patchable vulnerabilities, exposed remote access services, weak authentication, outdated systems, and common web application flaws. For SMBs and insurance teams, the key issue is operational discipline: organizations are taking weeks to remediate vulnerabilities while attackers continue to exploit exposed systems, weak access controls, and legacy technology. Top 3-5 Most Notable Statistics •20.4% of all discovered full-stack vulnerabilities were rated High or Critical risk. •86.3% of all full-stack vulnerabilities resulted in potential PCI failures. •The average remediation time was 63.8 days for Web App/API issues and 57 days for Device/Host issues. •57% of discovered vulnerabilities were more than two years old, and circa 17% were older than five years. •Remote access exposures accounted for 5% of total attack surface exposures in 2021. Top 3-5 Exploitable Technology Risks •Exposed remote access services, including RDP, SSH, VPN, Telnet, rlogin, rsh, and rexec, which can become entry points into private networks. •Exposed databases and data stores, including MySQL, PostgreSQL, MS SQL, Pervasive SQL, and Interbase DB, which are susceptible to credential and authentication-based attacks. •Web application flaws such as SQL injection, cross-site scripting, malicious file upload, server-side request forgery, authorization issues, and OS command injection. |
| Edgescan | 2022 | Security Research Vendor |
| 14 | 2023 Manufacturing Threat Landscape | Bottom Line Up Front (BLUF) Manufacturers face a high-impact cyber threat environment where ransomware, phishing, credential abuse, supply chain compromise, and IT/OT convergence can directly disrupt production. For SMB manufacturers and insurance teams, the key concern is not only data loss but operational downtime, safety exposure, and costly business interruption. Top 3-5 Most Notable Statistics •Only 19% of manufacturing industry leaders expressed confidence in their cyber defense mechanisms. •The average cost of a manufacturing breach reached $4.7M. •LockBit 3.0 represented over 30% of purported manufacturing ransomware victims observed in Trustwave research. •The US accounted for 63% of documented ransomware victims in Trustwave’s manufacturing ransomware research. •HTML files made up 72% of malicious attachment types observed in Trustwave’s manufacturing client base. Top 3-5 Exploitable Technology Risks •Phishing and business email compromise using malicious attachments, links, credential theft, and payment-change lures. •Weak, reused, default, or exposed credentials, including clear-text passwords in scripts and compromised RDP or VPN access. •Known vulnerability exploitation, including Apache Log4J, MOVEit, Microsoft Exchange Server remote code execution, and cross-site scripting attempts. |
| Trustwave | 2023 | MSP / MSSP / SOC Provider |
| 15 | 2023 Mid-Year Threat Report | Bottom Line Up Front (BLUF) Ransomware activity accelerated sharply in the first half of 2023, with victim counts already exceeding the full year of 2022. For SMBs and insurance teams, the most important takeaway is that attackers are increasingly using exposed systems, stolen credentials, and fast-changing delivery methods to create large-scale incidents, data theft, downtime, and extortion pressure. Top 3-5 Most Notable Statistics •Ransomware victims in 2023 H1 reached 2,987, exceeding 2,835 victims recorded across all of 2022. •2023 H1 ransomware victims were more than double 2022 H1, rising from 1,472 to 2,987. •2023 H1 also exceeded 2022 H2, which had 1,547 ransomware victims. •LockBit3 was the leading ransomware threat group in 2023 H1, with the report’s chart showing it near 700 victims. •WormGPT was advertised with over 1,110 users, showing attacker interest in AI-assisted malicious tooling. Top 3-5 Exploitable Technology Risks •Internet-facing vulnerable systems, including MOVEit and Zimbra, were tied to large ransomware spikes because attackers can scan for exposed servers and rapidly exploit them. •Microsoft Exchange vulnerabilities were used by ransomware groups including BlackCat and Play as entry points into organizations. •Valid Remote Desktop Protocol credentials were used by groups such as BianLian and Royal, making exposed or poorly controlled remote access a practical path into business systems. |
| Deep Instinct | 2023 | Endpoint / MDR / XDR Vendor |
| 16 | 2023 Mid-Year Threat Review | Bottom Line Up Front (BLUF) Rapid7’s 2023 mid-year review shows that attackers are succeeding through a mix of basic control failures and active exploitation of public-facing systems. For SMBs and insurance teams, the clearest takeaway is that missing or weak multi-factor authentication, exposed remote access, unpatched edge technologies, and ransomware-driven data theft remain major drivers of loss. Top 3-5 Most Notable Statistics •Nearly 40% of incidents Rapid7 managed services teams saw in the first half of 2023 resulted from missing or lax enforcement of multi-factor authentication, especially for VPNs and virtual desktop infrastructure. •Rapid7 incident responders saw a 69% year-over-year increase in caseload in the first half of 2023. •Ransomware gangs claimed at least 1,500 victims worldwide in the first half of 2023. •Remote access accounted for 39% of initial access vectors in Rapid7 MDR incident response data, followed by vulnerability exploitation at 27% and phishing payloads at 13%. •Rapid7 tracked 79 known state-sponsored threat actor attacks in the first half of 2023, with at least 24% leveraging exploits against public-facing applications. Top 3-5 Exploitable Technology Risks •VPNs, VDI, and SaaS products without consistently enforced MFA, which attackers used for remote access through brute forcing, credential stuffing, or valid account abuse. •Public-facing applications and network edge devices, including VPNs, routers, switches, internet-facing load balancers, security appliances, and file transfer appliances. •Widely exploited vulnerabilities in products such as Fortra GoAnywhere MFT, Progress MOVEit Transfer, Barracuda ESG, PaperCut MF/NG, Zyxel ZyWALL/USG, Zoho ManageEngine, VMware Aria Operations for Networks, Fortinet Fortigate, and Veeam Backup & Replication. |
| Rapid7 | 2023 | Threat Intelligence Vendor |
| 17 | 2023 Penetration Testing Report | Bottom Line Up Front (BLUF) Fortra’s 2023 Penetration Testing Report shows that organizations continue to view penetration testing as important, but many struggle to act on findings and validate fixes. For SMBs and insurance teams, the key takeaway is that testing alone does not reduce risk unless it leads to remediation, retesting, and practical controls against common entry points like phishing, ransomware, and misconfigurations. Top 3-5 Most Notable Statistics •94% of respondents said penetration testing is at least somewhat important to their security posture. •72% cited ransomware as a top security concern, followed by phishing at 70% and misconfigurations at 58%. •58% reported lack of resources to act on penetration test findings or perform remediation. •69% perform penetration tests for risk assessment and remediation prioritization, while 62% use them to support vulnerability management. •78% use third-party penetration testing teams in some capacity. Top 3-5 Exploitable Technology Risks •Phishing and social engineering remain major entry points because attackers exploit human mistakes, convincing emails, texts, and other messages. •Misconfigurations in hardware, software, or network settings can “open the door” for attackers and are a major concern as IT environments become more complex. •Weak passwords, lack of patching, orphaned accounts, and lost or stolen devices were all identified as security risks or entry points of concern. |
| Fortra | 2023 | Threat Intelligence Vendor |
| 18 | 2023 Qualys TruRisk Research Report | Bottom Line Up Front (BLUF) Qualys’ 2023 TruRisk Research Report shows that SMBs cannot treat vulnerability management as a simple “patch everything” exercise. Attackers weaponize a small but dangerous subset of vulnerabilities quickly, while common misconfigurations in web applications, cloud services, passwords, and remote access create practical entry points for ransomware and initial access brokers. Top 3-5 Most Notable Statistics •Qualys detected more than 2.3 billion vulnerabilities globally in 2022. •More than 25,000 vulnerabilities received a unique CVE in 2022. •Weaponized vulnerabilities were exploited by attackers in an average of 19.5 days, while organizations remediated them in an average of 30.6 days, leaving 11.1 days of exposure. •Qualys scanned 370,000 web applications and found more than 25 million vulnerabilities; 33% were classified as misconfiguration. •Ransomware-related configuration checks passed only 49.4% of scans in 2022. Top 3-5 Exploitable Technology Risks •CVE-2022-30190, Follina: A Microsoft-related remote code execution issue that can allow attackers to run PowerShell commands, install programs, modify data, or create accounts. •CVE-2022-26134, Atlassian Confluence remote code execution: An unauthenticated attack path against Confluence Server and Data Center, with risk increased by internet exposure and ease of exploitation. •CVE-2022-22954, VMware Workspace ONE server-side template injection: A remote code execution vulnerability exploitable through a crafted HTTP request by anyone with network access to a vulnerable instance. |
| Qualys | 2023 | Security Research Vendor |
| 19 | 2023 Retail Threat Landscape | Bottom Line Up Front (BLUF) Retail businesses are attractive cyber targets because they hold payment data, customer accounts, loyalty value, and operational systems that directly affect revenue. For SMBs and insurance teams, the most important takeaway is that common entry points—phishing, weak or stolen credentials, vulnerable software, third parties, and remote access—can quickly lead to fraud, ransomware, data theft, and business interruption. Top 3-5 Most Notable Statistics •Retail data breaches averaged $2.9 million, compared with $4.4 million across all other industries. •The e-commerce market surpassed $1.09 trillion in 2022, a 209% increase from 2019 levels. •Trustwave observed that 70% of phishing links contained embedded victim email addresses to make fraudulent login pages more convincing. •IPFS accounted for over 30% of identified phishing links in retail, while Google services appeared in over 15% of email phishing link attempts. •Credential Access accounted for 30% of reported incident tactics in Trustwave’s retail client base, with brute-force activity making up 90% of observed credential access techniques. Top 3-5 Exploitable Technology Risks •Phishing and BEC: Attackers use credential phishing, malicious attachments, hijacked email threads, and increasingly convincing AI-assisted lures to gain initial access. •Weak or exposed credentials: Default passwords, weak passwords, exposed credentials in scripts, SFTP command lines, and credentials sold in underground forums allow attackers to simply log in. •Vulnerability exploitation: Trustwave observed retail attacks involving ZeroLogon, Apache Log4J, MOVEit Transfer, Exchange Server remote code execution, cross-site scripting, and SQL injection. |
| Trustwave | 2023 | MSP / MSSP / SOC Provider |
| 20 | 2023 Software Vulnerability Snapshot | Bottom Line Up Front (BLUF) Synopsys’ three-year analysis shows that web, mobile, and software applications still commonly contain exploitable vulnerabilities, even as the overall percentage of tests finding issues declined. For SMBs and insurance teams, the key takeaway is that application risk is not limited to code defects: misconfigurations, weak transport protection, access control failures, and vulnerable third-party libraries can expose data, disrupt operations, and create urgent remediation needs. Top 3-5 Most Notable Statistics •92% of tests across 2020–2022 uncovered vulnerabilities in target applications. •27% of tests found high-severity vulnerabilities, and 6.2% found critical-severity vulnerabilities. •In 2022, 70% of total test targets had weak SSL/TLS configuration. •In 2022, 43% had a missing Content-Security-Policy header, and 37% exposed verbose server banners. •In 2022, 25% of tests flagged vulnerable third-party libraries in use. Top 3-5 Exploitable Technology Risks •SQL injection: identified as the leading critical-risk vulnerability in 2022, allowing attackers to inject commands through application inputs. •Cross-site scripting: consistently one of the top high-risk vulnerabilities, enabling malicious scripts to run in a user’s browser. •Server and application misconfiguration: can expose sensitive data, enable unauthorized access, or contribute to complete system compromise. |
| Synopsys | 2023 | Threat Intelligence Vendor |
| 21 | 2023 Vulnerability Statistics Report | Bottom Line Up Front (BLUF) Edgescan’s 2023 report shows that many organizations are still exposed through basic, known, and often exploitable vulnerabilities across web applications, APIs, internet-facing services, and internal systems. For SMBs and insurance teams, the key issue is not only finding vulnerabilities, but prioritizing and fixing the ones most likely to enable breach, ransomware movement, or data theft. Top 3-5 Most Notable Statistics •More than 33% of discovered full-stack vulnerabilities were critical or high severity. •Mean Time to Remediate critical vulnerabilities was 65 days across the full stack. •35.5% of infrastructure, hosting, cloud, and network-layer vulnerabilities were critical or high severity. •12% of web application and API vulnerabilities were critical or high severity. •12% of risk-accepted vulnerabilities in 2022 were considered critical risk when viewed in isolation. Top 3-5 Exploitable Technology Risks •SQL injection remained the leading critical web application issue, representing 23.4% of critical web application vulnerabilities, and can allow attackers to read, modify, or manipulate application data. •Malicious file upload represented 22.7% of critical web application vulnerabilities and can create opportunities for malware, ransomware, and internal network pivoting. •API injection attacks were the most common critical and high API issue at 27.3%, showing continued weakness in API security assessment and controls. |
| Edgescan | 2023 | Security Research Vendor |
| 22 | 2023 Year in Review: Proactive Cybersecurity Unleashed | Bottom Line Up Front (BLUF) Horizon3’s 2023 review finds that the most damaging exposure is often not exotic hacking, but common, exploitable weaknesses: weak or default credentials, unpatched or misconfigured systems, and security tools that are not tuned to detect, alert, stop, and log attacks. For SMBs and insurance teams, the key takeaway is that regular validation matters: organizations need to find, fix, and verify the issues that can actually lead to domain compromise, host compromise, sensitive data exposure, critical infrastructure compromise, or ransomware exposure. Top 3-5 Most Notable Statistics •Horizon3 customers ran nearly 30K pentests in 2023. •Those tests covered 2.05M assets, including 110K assets related to critical impacts. •The report identified 450K impact paths and 1.5M discovered weaknesses. •In one customer environment, NodeZero found nearly 1,400 discovered credentials, with almost half in a critical category, enabling access to 4.6M restricted and sensitive files. •In one legacy vulnerability example, EternalBlue exposure led to sensitive data exposure affecting about 14M protected files. Top 3-5 Exploitable Technology Risks •Weak, reused, default, or exposed credentials, including password spray, credential stuffing, captured hashes, and cleartext credentials. •Unpatched and misconfigured software, including vulnerabilities from CISA’s routinely exploited and Known Exploited Vulnerabilities lists. •DevOps and deployment tools such as Jenkins, GitLab, Kubernetes, and Docker, where compromise can expose code repositories, production environments, and operational continuity. |
| Horizon3 | 2023 | Threat Intelligence Vendor |
| 23 | 2024 Attack Intelligence Report | Bottom Line Up Front (BLUF) Rapid7’s 2024 Attack Intelligence Report shows that attackers are exploiting critical vulnerabilities faster, often before patches exist, and are increasingly targeting internet-facing systems such as VPNs, security gateways, file transfer tools, and remote access platforms. For SMBs and insurance teams, the key takeaway is that basic controls like enforced MFA, asset visibility, rapid patching, logging, and resilient backups are now central to reducing both breach likelihood and claim severity. Top 3-5 Most Notable Statistics •53% of new widespread threat vulnerabilities through early 2024 were exploited before software producers could implement fixes. •41% of Rapid7 MDR incidents observed in 2023 resulted from missing or unenforced MFA on internet-facing systems, especially VPNs and virtual desktop infrastructure. •Rapid7 Labs tracked more than 5,600 ransomware incidents across 2023 and early 2024. •Mass compromise events involving network edge devices nearly doubled since the start of 2023, with 36% of widely exploited vulnerabilities occurring in network perimeter technologies. •The number of new ransomware families fell from 95 in 2022 to 43 in 2023, suggesting existing ransomware models remained effective. Top 3-5 Exploitable Technology Risks •Network edge devices, including VPNs, firewalls, security gateways, and network appliances, remain high-value targets because they can provide attackers a path into internal networks. •Internet-facing remote access systems without enforced MFA are a major initial access risk, particularly VPNs and virtual desktop infrastructure. •File transfer products such as MOVEit Transfer, GoAnywhere MFT, WS_FTP, ShareFile, and Aspera Faspex were attractive to financially motivated attackers because they often store sensitive data and can support rapid data theft. |
| Rapid7 | 2024 | Threat Intelligence Vendor |
| 24 | 2024 Cato CTRL Threat Report | Bottom Line Up Front (BLUF) Cato Networks’ report shows that many organizations remain exposed through basic, preventable weaknesses: insecure internal protocols, old unpatched vulnerabilities, weak visibility into suspicious traffic, and brand-spoofing threats. For SMBs and insurance teams, the key takeaway is that loss prevention should focus less on rare zero-days and more on patching, asset visibility, safer protocols, and monitoring activity inside the network. Top 3-5 Most Notable Statistics •Cato analyzed traffic from more than 2,200 customers, covering 1.26 trillion network flows and 21.45 billion blocked attacks. •Reputation-based detections made up 91% of inbound threats. •Network scans accounted for 87% of outbound threats and 84% of WANbound threats. •Many enterprises still used insecure protocols: 62% of web application traffic was HTTP, 54% of traffic was Telnet, and 46% of traffic was SMB v1 or v2 rather than SMBv3. •Only 1% of DNS traffic used Secure DNS, and 44% of organizations had outbound traffic to dynamic DNS services. Top 3-5 Exploitable Technology Risks •Unpatched known vulnerabilities, including older issues such as Log4J, Microsoft Exchange, Oracle WebLogic, Apache HTTP Server, Grafana, Atlassian Confluence, Spring Cloud, and Adobe ColdFusion vulnerabilities. •Insecure protocols inside networks, including HTTP, Telnet, SMB v1/v2, LLMNR, and NetBIOS, which can support credential theft, relay attacks, lateral movement, and information gathering. •Network scanning and SMB port scanning, which the report identifies as common outbound and WANbound threat activity. |
| Cato Networks | 2024 | Network Security Vendor |
| 25 | 2024 Education Threat Landscape | Bottom Line Up Front (BLUF) Trustwave’s report shows that education organizations are highly exposed because they combine sensitive data, broad online access, third-party dependence, BYOD use, legacy systems, and constrained cybersecurity resources. For SMBs and insurance teams, the core lesson is that ransomware, phishing, exposed systems, and vendor failures can rapidly translate into downtime, data loss, legal exposure, and major recovery costs. Top 3-5 Most Notable Statistics •Trustwave identified over 1.8 million education-related devices publicly exposed. •In 2023, Trustwave monitored 352 ransomware claims against educational institutions. •82% of top malicious attachment filetypes observed in education were HTML files. •The MOVEit vulnerability was tied to breaches at 13 major universities. •Trustwave researchers found over 2,500 public file shares containing potentially sensitive data. Top 3-5 Exploitable Technology Risks •Publicly exposed systems and devices, including file servers, printers, collaboration systems, and systems storing sensitive data, create direct paths for unauthorized access and data breaches. •Phishing emails using HTML attachments, fake university communications, RFQ-themed lures, malicious links, and credential-harvesting pages remain a major initial access route. •Known vulnerabilities, including Apache Log4j, Microsoft Exchange Server remote code execution, SpringShell, SQL injection, and cross-site scripting, are being targeted against education environments. |
| Trustwave | 2024 | MSP / MSSP / SOC Provider |
| 26 | 2024 InsurSec Rankings: Email Security and Financial Fraud Edition | Bottom Line Up Front (BLUF) Email remains the dominant entry point for costly attacks, especially financial fraud, and SMBs can face severe losses when payment processes are manipulated through compromised or impersonated email accounts. The report’s most important takeaway is that email platform choice, security gateway performance, correct configuration, and payment verification processes materially affect claims outcomes. Top 3-5 Most Notable Statistics •Email claims frequency increased 24% in 2023, after rising 19% from 2021 to 2022. •Financial fraud accounted for 61% of email-related claims in 2023 and 72% in the first half of 2024. •92% of financial fraud incidents occurred via email. •The average financial fraud incident involved $219K in stolen funds, with severe cases exceeding $5M. •Companies using Google Workspace experienced 3X lower claims frequency than companies using Microsoft 365. Top 3-5 Exploitable Technology Risks •Misconfigured MX records: 7% of claims had MX record misconfigurations that could allow attackers to bypass email security tools and send unfiltered mail directly to users. •Business email compromise: 63% of financial fraud incidents involved BEC, where attackers compromise an email account and use legitimate-looking communications to redirect payments. •Email-based vendor or partner impersonation: threat actors frequently impersonated known third parties to redirect payments during expected transactions. |
| At-Bay | 2024 | Cyber Insurance Carrier |
| 27 | 2024 Malware and Ransomware Defense Report | Bottom Line Up Front (BLUF) Ransomware risk remains high, and SpyCloud’s report ties that risk closely to infostealer malware, stolen credentials, stolen session cookies, and third-party access. For SMBs and insurance teams, the key takeaway is that stopping malware on a device is not enough; organizations must also remediate the identity and access data attackers may have already stolen. Top 3-5 Most Notable Statistics •75% of surveyed organizations were affected by ransomware more than once in the past 12 months, up from 61% the prior year. •92% of organizations were affected by ransomware at least once, leaving only 8% reporting no ransomware impact. •The most common ransomware entry points were phishing/social engineering (25.1%), third-party access (16.7%), and stolen cookies or tokens enabling session hijacking (14.9%). •Only 57.5% of teams routinely invalidate or terminate open application sessions after malware infection, and 55.1% review logs of potentially exposed applications. •The report cites an average ransomware attack cost of $4.91 million, average recovery costs of $2.73 million in 2024, and a 64% increase in ransomware insurance claims data in 2023. Top 3-5 Exploitable Technology Risks •Stolen session cookies and tokens that allow attackers to hijack already-authenticated sessions and bypass MFA. •Infostealer malware that captures credentials, cookies, identity data, and device details from infected endpoints. •Third-party and unmanaged devices with limited visibility or control, which can expose access to business applications. |
| SpyCloud | 2024 | Threat Intelligence Vendor |
| 28 | 2024 Open Source Malware Report | Bottom Line Up Front (BLUF) Open source malware is becoming a major software supply chain risk because malicious packages are intentionally designed to look like legitimate development components and enter build pipelines before traditional tools can detect them. For SMBs and insurance teams, the key concern is that one unvetted dependency can expose credentials, sensitive data, development systems, or customer-facing applications. Top 3-5 Most Notable Statistics •Sonatype estimates 50% of unprotected repositories already have cached open source malware. •Sonatype reported a 156% year-over-year increase in malicious packages identified over the past year. •Sonatype has identified 778,529 pieces of open source malware since tracking began in 2019. •npm represented 98.5% of malicious packages Sonatype identified in the past year. •Shadow downloads reached more than 63 billion in November, a 32.8% increase over the same month of the prior year. Top 3-5 Exploitable Technology Risks •Malicious open source packages that disguise themselves as legitimate components and target developers during dependency installation. •Shadow downloads that bypass repository managers, security review, governance processes, and release integrity checks. •npm and PyPI package ecosystems, where open publishing, minimal verification, dependency confusion, typosquatting, spam, and maintainer account takeovers can enable malicious package distribution. |
| Sonatype | 2024 | Security Research Vendor |
| 29 | 2024 Penetration Testing Report | Bottom Line Up Front (BLUF) Fortra’s 2024 report shows that penetration testing is most valuable when it leads to prioritized remediation, not when it is treated as a compliance checkbox. For SMBs and insurance teams, the key issue is that many organizations identify risks but lack the people, funding, or follow-through to fix them before attackers exploit them. Top 3-5 Most Notable Statistics •72% of respondents said penetration testing has prevented a breach at their organization. •82% use penetration testing to assess risk and prioritize vulnerabilities for remediation validation. •80% cited phishing and 72% cited ransomware as top security concerns. •66% identified lack of patching as a major concern, up from the prior year. •62% said their biggest penetration testing challenge is lack of resources to act on findings or perform remediation. Top 3-5 Exploitable Technology Risks •Phishing and social engineering: The report identifies phishing as the top concern and notes that it remains a common delivery method for ransomware. •Ransomware: Respondents continue to rank ransomware as a leading concern because it is widespread, financially motivated, and often tied to human error. •Unpatched vulnerabilities: Lack of patching is a major concern because known vulnerabilities can be exploited if updates are not applied promptly. |
| Fortra | 2024 | Threat Intelligence Vendor |
| 30 | 2024 Professional Services Threat Landscape | Bottom Line Up Front (BLUF) Professional services firms are attractive cyber targets because they hold sensitive client data, financial records, legal documents, and intellectual property. For SMBs and insurance teams, the main takeaway is that common attack paths—phishing, exposed applications, third-party vendors, malware, and ransomware—can quickly lead to data theft, business interruption, recovery costs, legal exposure, and reputational damage. Top 3-5 Most Notable Statistics •142 professional services and legal firms reportedly fell victim to ransomware over the past year. •93% of observed initial access techniques in Trustwave’s professional services client base involved phishing, compared with 7% involving exploitation of public-facing applications. •65% of top malicious attachment filetypes for professional services were HTML, followed by PDF at 14% and executable files at 12%. •IPFS represented 35% of phishing links observed, using its decentralized nature to evade detection. •In ransomware victim distribution by firm type, law firms represented 46%, while engineering firms and accounting firms each represented 13%. Top 3-5 Exploitable Technology Risks •Phishing and business email compromise, including fake legal documents, payroll diversion, request-for-contact scams, AI-generated phishing, QR code phishing, and credential-harvesting pages. •Third-party and supply chain exposure, especially file transfer services such as MOVEit and managed file transfer platforms used by vendors, contractors, and professional services firms. •Public-facing applications and services, including exposed web services, FTP, SSH, network management interfaces, and vulnerable managed file transfer systems. |
| Trustwave | 2024 | MSP / MSSP / SOC Provider |
| 31 | 2024 Public Sector Threat Landscape | Bottom Line Up Front (BLUF) Trustwave’s report shows that public sector cyber risk is driven by familiar but highly effective attack paths: phishing, exposed systems, unpatched vulnerabilities, weak third-party security, and ransomware. For SMBs and insurance teams, the key takeaway is that smaller vendors, contractors, service providers, and technology partners can become entry points into larger organizations and may face serious claims from data exposure, downtime, and recovery costs. Top 3-5 Most Notable Statistics •A ransomware attack on the UK’s national library is expected to cost 40% of its financial reserves to recover after it refused to pay the ransom. •The Xplain breach affecting the Swiss government leaked over 65,000 sensitive documents. •A ransomware attack on the Lanka Government Cloud affected nearly 5,000 email accounts and involved a shared environment serving 160+ tenants and 200+ government organizations. •Trustwave SpiderLabs research indicates that 93% of database attacks target MS-SQL. •A breach involving Canadian government moving services contractors led LockBit to leak over 1.5TB of stolen documents. Top 3-5 Exploitable Technology Risks •Phishing and social engineering, including QR-code phishing and AI-generated phishing emails, remain major initial access methods. •Public-facing applications and services with exploitable vulnerabilities, including Log4J, MOVEit, CitrixBleed, Apache, PHP, Drupal, OpenSSL, and HTTP/2-related flaws. •Misconfigured or unsupported databases, including older MySQL, PostgreSQL, MariaDB, MongoDB, and MS-SQL instances. |
| Trustwave | 2024 | MSP / MSSP / SOC Provider |
| 32 | 2024 Ransomware Holiday Risk Report | Bottom Line Up Front (BLUF) Semperis’ 2024 report shows ransomware attackers commonly strike when organizations are least prepared: holidays, weekends, and major corporate transitions. For SMBs and insurance teams, the key takeaway is that reduced staffing, weak identity recovery planning, and underprotected Active Directory environments can turn an attack into prolonged downtime and a major claims event. Top 3-5 Most Notable Statistics •86% of organizations that experienced ransomware were targeted on a holiday or weekend. •85% of organizations with a year-round, 24-hour SOC reduced staffing on holidays and weekends by as much as 50%. •63% of respondents experienced a ransomware attack following a material corporate event such as a merger, acquisition, IPO, or workforce restructuring. •81% of respondents believed they had the expertise to protect against identity-related attacks, yet 83% suffered a successful ransomware attack within the past 12 months. •61% of organizations with an identity recovery plan did not include dedicated, Active Directory-specific backup systems. Top 3-5 Exploitable Technology Risks •Active Directory and related identity systems are highlighted as high-value targets because attackers can use them to move laterally, escalate privileges, and access sensitive resources. •Reduced SOC staffing during holidays and weekends creates a detection and response gap when attackers are likely to act. •Weak or incomplete identity recovery plans, especially those lacking Active Directory-specific backups, can slow recovery from ransomware. |
| Semperis | 2024 | Identity Security Vendor |
| 33 | 2024 Ransomware Risk Report | Bottom Line Up Front (BLUF) Ransomware should be treated as a continuous business risk, not a one-time IT incident. Semperis’ survey shows attacks are frequent, repeatable, disruptive, and often still damaging even when ransom is paid, making recovery planning and identity-system resilience especially important for SMBs and insurance teams. Top 3-5 Most Notable Statistics •83% of responding organizations were targeted by ransomware in the past 12 months. •74% of ransomware victims were attacked multiple times, often within a week. •87% of attacks caused business disruption, including data loss and systems being taken offline. •78% of attacked organizations paid ransom, and 72% of those paid multiple times. •35% of organizations that paid ransom did not receive decryption keys or could not recover files and assets. Top 3-5 Exploitable Technology Risks •Microsoft Active Directory and other identity systems are highlighted as top targets because they control access to users, applications, and resources. •Lack of dedicated Active Directory, Entra ID, and identity-control recovery systems leaves organizations dependent on slower or incomplete recovery. •Hybrid environments, mobile devices, IoT devices, on-premises servers, remote data centers, and cloud environments create a broad attack surface. |
| Semperis | 2024 | Identity Security Vendor |
| 34 | 2024 Software Vulnerability Snapshot | Bottom Line Up Front (BLUF) Black Duck’s 2024 analysis shows that web applications commonly contain exploitable weaknesses that can expose sensitive data, enable account or session compromise, and disrupt operations. For SMBs and insurance teams, the key takeaway is that smaller and medium-complexity sites can carry serious application risk, especially when critical vulnerabilities remain open for long periods. Top 3-5 Most Notable Statistics •Black Duck analyzed more than 200,000 DAST scans across approximately 1,300 applications in 19 industry sectors. •The scans identified 96,917 total vulnerabilities. •Security Misconfiguration accounted for 36,321 vulnerabilities and appeared in 98% of clients. •Cryptographic Failures accounted for 30,726 vulnerabilities, including 4,882 critical-risk instances, and affected 86% of clients. •Finance and Insurance had 1,299 critical vulnerabilities, followed by Healthcare and Social Assistance with 992 and Information Services with 446. Top 3-5 Exploitable Technology Risks •Cryptographic Failures, including insufficient transport layer protection, can allow sensitive data to be intercepted, exposed, or mishandled. •Injection vulnerabilities, including SQL Injection and Cross-Site Scripting, can allow attackers to insert malicious commands or scripts, leading to data theft, unauthorized manipulation, session hijacking, or system compromise. •Security Misconfiguration can disclose system details such as installed software, open ports, and operational information that may help attackers plan further exploitation. |
| Black Duck | 2024 | Application / API Security Vendor |
| 35 | 2024 Technology Threat Landscape | Bottom Line Up Front (BLUF) Trustwave’s report shows that technology organizations face elevated risk from ransomware, vulnerable public-facing systems, phishing, and third-party supplier compromise. For SMBs and insurance teams, the most important takeaway is that a single weak vendor, exposed application, or successful phishing event can create business interruption, data theft, extortion, and downstream client impact. Top 3-5 Most Notable Statistics •Trustwave monitored over 1,000 ransomware claims against technology organizations in 2023. •The top three ransomware groups accounted for over 60% of ransomware activity in the technology sector. •LockBit 3.0 represented 25% of ransomware attack claims among tracked ransomware groups. •Apache Log4j CVE-2021-44228 accounted for 55% of the most common exploit attempts detected through Trustwave monitoring of technology-sector clients. •After active exploitation of MOVEit, Trustwave identified over 500 publicly accessible MOVEit systems via service headers and over 2,500 systems using the MOVEit favicon. Top 3-5 Exploitable Technology Risks •Third-party supplier compromise: Attackers target trusted vendors, software providers, IT outsourcers, and infrastructure partners to reach many downstream customers through one compromise. •Public-facing vulnerabilities: Log4j, SQL injection, cross-site scripting, remote code execution attempts, MOVEit, Nextcloud, Owncloudx, and Kaseya VSA are highlighted as exploitable paths into organizations. •Ransomware with data theft: Modern ransomware can encrypt systems, delete backups or shadow copies, steal data, and use double or triple extortion. |
| Trustwave | 2024 | MSP / MSSP / SOC Provider |
| 36 | 2024 Vulnerability Statistics Report | Bottom Line Up Front (BLUF) Edgescan’s 2024 report shows that organizations are still carrying many basic, exploitable vulnerabilities across web applications, APIs, networks, hosts, and cloud-facing infrastructure. For SMBs and insurance teams, the key issue is not just the number of vulnerabilities, but slow remediation, poor visibility, and exposed services that give attackers time and opportunity. Top 3-5 Most Notable Statistics •More than 33% of full-stack vulnerabilities were critical or high severity. •34.4% of infrastructure, hosting, cloud, and network-layer vulnerabilities were critical or high severity; 19% had an EPSS score above 0.8, indicating an estimated exploitation probability above 80%. •Across web application and API layers, 12.8% of discovered vulnerabilities were critical or high severity. •SQL injection accounted for 19.47% of all high and critical severity web application vulnerabilities. •Mean time to remediate critical web application vulnerabilities was 35 days, while internet-facing host/cloud critical severity vulnerability MTTR was 61 days. Top 3-5 Exploitable Technology Risks •SQL injection remains the most common critical web application weakness and is described as potentially devastating. •Malicious file upload represented 7.25% of high and critical web application vulnerabilities and can support ransomware, malware, and internal pivoting. •Public internet-facing vulnerabilities in technologies such as OpenSSH, Microsoft Exchange Server, Apache HTTP Server, PHP, OpenSSL, and SSL/TLS configurations were repeatedly highlighted. |
| Edgescan | 2024 | Security Research Vendor |
| 37 | 2025 Advanced Persistent Bots Report | Bottom Line Up Front (BLUF) Persistent bots remain a material online fraud and abuse risk even after bot defenses are deployed, especially against login, scraping, add-to-cart, sign-up, and mobile API flows. For SMBs and insurance teams, the key takeaway is that bot risk is not only a technical issue; it can affect account takeover exposure, customer access, inventory availability, payment abuse, and the effectiveness of common controls such as IP reputation checks. Top 3-5 Most Notable Statistics •F5 analyzed more than 200 billion web and API transactions from protected customers. •Across all sectors and platforms, an average of 10.2% of HTTP requests were bots or other automation. •4.8% of all transactions, equal to 9.98 billion, were unwanted bots mitigated by F5. •Hospitality web platforms saw almost 45% of transactions come from unauthorized automation, mainly driven by scraping. •With bot mitigation in place, malicious login attempts represented 10.6% of web login traffic and 5.2% of mobile API login traffic across all industries. Top 3-5 Exploitable Technology Risks •Credential stuffing against login endpoints, where bots test compromised username and password pairs to enable account takeover. •Web scraping against content, search, product, rates, and quote flows, which can extract pricing, inventory, or other business data at scale. •Reseller bots targeting add-to-cart flows, automating more than 1 in 5 web add-to-cart transactions observed in the report. |
| F5 | 2025 | Network Security Vendor |
| 38 | 2025 AI Threat Report: Now cybercriminals are weaponizing AI technology | Bottom Line Up Front (BLUF) Kela’s report shows that cybercriminals are rapidly adopting AI to make phishing, fraud, malware development, vulnerability research, and automated attacks faster and easier. For SMBs and insurance teams, the key issue is not future AI risk but near-term operational risk: lower-skilled attackers can now use AI tools to create more convincing scams and scale attacks against ordinary businesses. Top 3-5 Most Notable Statistics •200% increase in mentions of malicious AI tools in cybercrime forums in 2024 compared to 2023. •Mentions of “Dark AI” tools grew from 1,632 in 2023 to 5,214 in 2024. •Mentions of jailbreak-related keywords grew from 2,747 in 2023 to 4,167 in 2024. •AI-automated phishing attacks were reported to reduce phishing costs by more than 95% while achieving equal or greater success rates. •WormGPT was advertised at prices ranging from EUR100 to EUR5000, while some AI vishing tools were offered starting at USD 2000. Top 3-5 Exploitable Technology Risks •AI jailbreaking and prompt injection, which can bypass safety restrictions in public GenAI tools and generate harmful or unauthorized outputs. •Dark AI tools such as WormGPT, FraudGPT, DarkGPT, and EvilAI, which are used to automate phishing, malicious code generation, fraud, and vulnerability discovery. •AI-generated phishing, vishing, and deepfake impersonation, including scams that mimic executives to request urgent wire transfers. |
| Kela | 2025 | Threat Intelligence Vendor |
| 39 | 2025 Annual Crimeware Report | Bottom Line Up Front (BLUF) Arete’s 2025 incident response data shows ransomware and extortion remained highly opportunistic, with attackers repeatedly exploiting exposed VPN/firewall systems, stolen credentials, and social engineering rather than narrowly targeting specific victims. For SMBs and insurance teams, the key lesson is that missed patch steps, weak identity controls, and user-assisted attacks can quickly become six-figure extortion events. Top 3-5 Most Notable Statistics •Akira accounted for over 28% of Arete’s ransomware and extortion engagements in 2025 and over 41% during Q3. •In August 2025, Akira was responsible for over 50% of ransomware and extortion events Arete responded to. •The median ransom demand increased to $600,000 in 2025, while the median ransom payment was $152,750. •Ransom payments were made in 31.6% of ransomware and extortion incidents in 2025. •The most impacted sectors were Professional, Scientific, and Technical Services at 21.4% of engagements and Manufacturing at 19.1%. Top 3-5 Exploitable Technology Risks •SonicWall SSL VPN vulnerabilities, especially CVE-2024-40766, were heavily exploited to gain unauthorized VPN access, particularly where administrators missed required local password resets after patching. •Internet-exposed perimeter devices without timely patching or multi-factor authentication were repeatedly abused by ransomware groups including Akira, Qilin, INC, and WhiteRabbit. •Social engineering techniques, including email bombing, Microsoft Teams abuse, ClickFix, FileFix, help desk impersonation, MFA fatigue, SIM swapping, and executive pretexting, were used to obtain access without exploiting software flaws. |
| Arete | 2026 | Consulting / Analyst Firm |
| 40 | 2025 Annual Cyber Report | Bottom Line Up Front (BLUF) Pinsent Masons’ 2025 report shows ransomware remained the dominant cyber incident in its 2024 matters, but business email compromise rose sharply and should now be treated as a major loss driver. For SMBs and insurance teams, the key takeaway is that cyber risk is not limited to system encryption: data theft, fraudulent payments, third-party disruption, regulatory scrutiny, and commercial claims all feature prominently. Top 3-5 Most Notable Statistics •Ransomware accounted for 48% of Pinsent Masons’ 2024 cyber matters, down from 58% in 2023. •Business email compromise accounted for 26% of 2024 matters, up from 5% in 2023. •Data was exfiltrated in 83% of ransomware cases, up from 51% in 2023. •Encryption occurred in 100% of ransomware cases handled in 2024. •78% of clients in 2024 matters had cyber insurance in place, and 25% of ransomware victim clients paid the ransom demanded. Top 3-5 Exploitable Technology Risks •Vulnerability exploitation was the most prominent root cause in 2024 matters, making patching and exposure management a priority. •Business email compromise using compromised or spoofed email accounts enabled fraudulent fund transfer requests and sensitive information theft. •Credential-related attacks, including exposed credentials, credential stuffing, brute force, and recycled passwords, appeared across the incident root causes and incident types. |
| Pinsent Masons | 2025 | Consulting / Analyst Firm |
| 41 | 2025 Arctic Wolf Labs Predictions | Bottom Line Up Front (BLUF) Arctic Wolf’s main message for 2025 is that attackers will keep adapting faster than many defenders, with a heavy focus on gaining initial access through exposed edge devices, stolen credentials, social engineering, and identity weaknesses. For SMBs and insurance teams, this means ransomware, data theft, and business interruption risk remain closely tied to basic control quality: patching, MFA, logging, segmentation, backups, and recovery readiness. Top 3-5 Most Notable Statistics •Manufacturing represented 32% of intrusions investigated in a recent ransomware threat event involving SonicWall SSL VPN access. •Manufacturing represented 44% of Arctic Wolf Incident Response cases investigated in 2024. •Akira affiliates took less than 2 hours from exploiting a SonicWall vulnerability to detonating ransomware. •The Energy sector saw a 70% year-over-year increase in attacks against utilities, as reported by Check Point. •Surveys cited by Sophos suggested two-thirds of Healthcare and Public Health organizations were impacted by ransomware attacks. Top 3-5 Exploitable Technology Risks •VPN gateways and remote access tools, including misconfigured or vulnerable SSL VPNs, are highlighted as major initial access paths. •Other edge and on-premises perimeter devices, including IP cameras, VoIP devices, industrial IoT gateways, medical devices, and other IoT systems, can be leveraged by attackers if unpatched or poorly secured. •Identity and access management weaknesses, including overprivileged access, orphaned accounts, shadow directories, and insecure Active Directory configurations, create opportunities for unauthorized access. |
| Arctic Wolf | 2025 | MSP / MSSP / SOC Provider |
| 42 | 2025 Cato CTRL Threat Report | Bottom Line Up Front (BLUF) Cato Networks’ 2025 threat report shows that AI risk is already practical, not theoretical: a researcher with no prior malware coding experience used jailbreaking techniques against popular large language models to create a working Google Chrome infostealer in a controlled test environment. For SMBs and insurance teams, the key takeaway is that AI can lower the skill needed to create credential-stealing malware while AI tool adoption inside organizations is rising quickly, increasing data exposure and governance risks. Top 3-5 Most Notable Statistics •Cato CTRL analyzed 1.46 trillion network flows across more than 3,000 enterprise customers globally in 2024. •Adoption increased from Q1 to Q4 2024 for Copilot, ChatGPT, Gemini, Perplexity, and Claude by 34%, 36%, 58%, 115%, and 111%, respectively. •Chrome has more than 3 billion users, making Chrome-focused credential theft especially relevant. •From Q1 to Q2 2024, AI application adoption increased by 58% in entertainment, 43% in hospitality, and 37% in transportation. •Manufacturing, technology, finance, consumer goods, and medical/healthcare were identified as the top 5 industries using AI applications. Top 3-5 Exploitable Technology Risks •LLM jailbreaking: Cato CTRL’s “Immersive World” technique used narrative prompts to bypass LLM safety controls and generate malicious code. •Browser credential theft: The generated infostealer extracted test credentials from Chrome Password Manager in a controlled environment. •Shadow AI: Unauthorized or unsanctioned AI application use can occur without IT or security team approval. |
| Cato Networks | 2025 | Network Security Vendor |
| 43 | 2025 CISO Engagement and Decision Drivers Study | Bottom Line Up Front (BLUF) Cyentia’s 2025 study shows that cybersecurity buyers, including SMB users, are concentrating attention on AI, ransomware, cloud security, identity, and OT security. For SMB owners and insurance teams, the main takeaway is that market interest is aligning around practical, operational risks that affect resilience, incident response, and security decision-making. Top 3-5 Most Notable Statistics •Total cybersecurity content asset production increased 235% from Q1 2015 to Q1 2025. •Quarterly sponsored cybersecurity assets increased 323% from Q1 2015 to Q1 2025. •55.7% of users interacted with artificial intelligence and machine learning content, the highest-ranked topic overall. •Among SMB users, 11.8% interacted with artificial intelligence and machine learning content, followed by cyberwarfare/nation-state attacks at 7.8% and ransomware at 7.3%. •In one large financial institution account, non-sponsored content generated 580 views compared with 43 views for sponsored assets. Top 3-5 Exploitable Technology Risks •Ransomware: The report repeatedly identifies ransomware as a high-engagement and enduring topic, including for SMBs and critical infrastructure sectors, where disruption can be costly. •AI-based attacks, synthetic media, and deepfakes: AI-related risks are rising alongside interest in AI-driven defenses, showing that buyers are tracking both offensive and defensive uses of AI. •API security: API security is listed among the fastest-rising sponsored topics and appears in CISO-focused content, reflecting concern about exposed or poorly managed application interfaces. |
| Cyentia | 2025 | Research Organization |
| 44 | 2025 Cloud-Native Security and Usage Report | Bottom Line Up Front (BLUF) Cloud-native environments move too fast for slow security processes: Sysdig reports that cloud attacks can unfold in 10 minutes or less, while many containers live for only one minute or less. For SMBs and insurance teams, the key takeaway is that identity hygiene, real-time detection, container security, and AI workload exposure are now central loss-prevention issues. Top 3-5 Most Notable Statistics •Cloud attacks can happen in 10 minutes or less, making delayed detection and manual response risky. •Machine identities are 7.5x more risky than human identities, with organizations managing far more service accounts than users. •Organizations average 41,605 service accounts versus 915 users; after filtering outliers, the average is still 5,330 service accounts versus 152 users. •Workloads using AI/ML packages grew by nearly 500%, while public exposure of AI workloads fell to less than 13%. •60% of containers live for 1 minute or less, and 74% live for 5 minutes or less. Top 3-5 Exploitable Technology Risks •Risky service accounts with administrator-level access and non-rotating access keys, which can create paths for initial access and lateral movement. •Excessive permissions, including the report’s prior finding that 98% of granted permissions went unused, increasing breach impact if credentials are compromised. •Publicly exposed AI workloads, which may place sensitive proprietary or customer information at unnecessary risk. |
| Sysdig | 2025 | Threat Intelligence Vendor |
| 45 | 2025 Comcast Business Cybersecurity Threat Report | Bottom Line Up Front (BLUF) Comcast’s report shows that attackers are operating at massive scale while using stealthier methods to bypass traditional defenses, especially phishing, drive-by compromise, botnets, proxy abuse, credential theft, and DDoS. For SMBs and insurance teams, the key takeaway is that basic control failures—unpatched systems, weak credentials, poor monitoring, and user mistakes—remain highly exploitable and can lead to downtime, data theft, ransomware, and reputational harm. Top 3-5 Most Notable Statistics •Comcast Business analyzed 34.6 billion cybersecurity events from June 1, 2024 through May 31, 2025. •Comcast Business detected 19.5 billion resource development events related to botnet activity. •Comcast Business detected 9.7 billion drive-by compromise events attempting to install malware. •Comcast Business detected 4.7 billion phishing events attempting to compromise credentials or deliver malware. •Comcast Business detected 44,069 DDoS events, including increased short-burst attacks, with 405 lasting less than 5 minutes and 56 lasting less than 10 seconds. Top 3-5 Exploitable Technology Risks •Drive-by compromise: Users visiting compromised or malicious websites can be infected without meaningful interaction beyond browsing. •Phishing across email, text, voice, and workplace collaboration tools: Attackers use deceptive messages to steal credentials or persuade users to install malware or remote access tools. •Weak credential and identity controls: Valid accounts, credential dumping, brute force, unsecured credentials, and password stores are highlighted as key paths for attackers to expand access. |
| Comcast | 2025 | Telco / Network Operator |
| 46 | 2025 Crypto Crime Report: Key Trends That Shaped the Illicit Crypto Market in 2024 | Bottom Line Up Front (BLUF) Crypto crime declined as a share of total crypto activity in 2024, but the threat remains material because ransomware, fraud, hacks, sanctions exposure, and AI-enabled scams continue to evolve. For SMBs and insurance teams, the most important takeaway is that crypto-related losses are not limited to crypto companies: ransomware, invoice fraud, cloud credential theft, vendor compromise, and extortion can affect ordinary businesses. Top 3-5 Most Notable Statistics •Total crypto transaction volume grew to over USD 10.6 trillion, up 56% from 2023. •Illicit crypto volume was estimated at USD 45 billion, down 24% from 2023, representing 0.4% of overall crypto volume. •Ransomware reached 5,635 publicly reported attacks in 2024, exceeding 5,223 in 2023; one payment to Dark Angels reached USD 75 million. •Crypto-related hacks and exploits stole USD 2.2 billion in 2024, a 17% increase from 2023. •Funds sent to fraud amounted to at least USD 10.7 billion, down 40% from 2023, though TRM expects fraud figures to rise as delayed reporting emerges. Top 3-5 Exploitable Technology Risks •Private key and seed phrase compromise: These infrastructure attacks accounted for nearly 70% of stolen crypto funds, often through poor storage, phishing, or malware. •Ransomware-as-a-Service: This model enables less-skilled actors to conduct high-impact attacks using established ransomware platforms. •Cloud service and credential compromise: Attacks against customers of the Snowflake cloud data platform involved login credentials obtained through infostealer malware. |
| TRM | 2025 | Crypto / Blockchain Security Vendor |
| 47 | 2025 Cyber Threat Report | Bottom Line Up Front (BLUF) Huntress reports that attackers are now applying enterprise-grade tactics against non-enterprise businesses, narrowing the gap between large-company and SMB risk. For SMB owners and insurance teams, the key takeaway is that ransomware, credential theft, remote access abuse, and phishing are no longer “advanced” edge cases; they are common operational risks requiring fast detection, patching, identity controls, and employee awareness. Top 3-5 Most Notable Statistics •Infostealers represented 24% of observed incidents, making them the most common threat category. •Malicious scripts accounted for 22% of incidents, showing heavy attacker reliance on scripting for persistence, downloads, and evasion. •Healthcare and education made up 38% of all observed incidents. •RansomHub, Lynx, and Akira were linked to 54% of ransomware incidents. •The average time-to-ransom was almost 17 hours, with some groups deploying ransomware in around six hours. Top 3-5 Exploitable Technology Risks •Remote access trojans such as AsyncRAT, NetSupport, Jupyter, Trickbot, and NewCoreRAT, which attackers used to gain and maintain remote control. •Remote monitoring and management tools such as ConnectWise ScreenConnect, TeamViewer, and LogMeIn, which attackers abused to blend into normal administration activity, move laterally, and persist. •Malicious scripting through PowerShell, JavaScript, VBScript, WMI, and related components, used for persistence, downloads, obfuscation, and system analysis. |
| Huntress | 2025 | MSP / MSSP / SOC Provider |
| 48 | 2025 Data Security Incident Response Report | Bottom Line Up Front (BLUF) BakerHostetler’s 2025 report shows that many serious incidents still come from familiar, preventable causes: phishing, social engineering, unpatched vulnerabilities, weak access controls, misconfigurations, and vendor exposure. For SMBs and insurance teams, the main takeaway is that practical controls—MFA, EDR, logging, tested response plans, payment verification, and vendor management—remain central to reducing loss severity. Top 3-5 Most Notable Statistics •BakerHostetler handled 1,250+ incidents in 2024. •Network intrusions made up 47% of incidents, and business email compromise made up 31%. •Phishing was the root cause in 24% of all incidents; unpatched vulnerabilities accounted for 16%. •Fraudulent wire transfers totaled $109,341,352, with an average wire transfer of $1,256,797. •27% of incidents involved a vendor. Top 3-5 Exploitable Technology Risks •Phishing and social engineering, including spear phishing, vishing, help-desk manipulation, and MFA bombing, remain major paths into organizations. •Unpatched vulnerabilities, especially in network intrusion matters, continue to provide attackers with an entry point. •Weak or missing MFA for remote access, privileged accounts, and administrator accounts increases the risk of unauthorized access. |
| BakerHostetler | 2025 | Consulting / Analyst Firm |
| 49 | 2025 DNS Threat Landscape Report | Bottom Line Up Front (BLUF) DNS is now a major deception layer for attackers, not just basic internet plumbing. Infoblox reports that threat actors are rapidly using throwaway domains, malicious adtech, hijacked domains, lookalikes, DNS tunneling, and AI-enabled deception to evade controls, which matters to SMBs and insurers because these techniques can lead to phishing, credential theft, malware, scams, and harder investigations. Top 3-5 Most Notable Statistics •Infoblox identified 100.8 million newly observed domains over the past 12 months. •25.1% of newly observed domains were classified as malicious or suspicious, including over 25 million domains. •95% of threat-related domains were observed in only one customer environment, showing how attackers use one-time or highly targeted domains to avoid detection. •82% of customer environments queried domains that were part of traffic distribution systems. •Infoblox discovered over 1 million domains used by 168 malicious adtech operators within traffic distribution system infrastructure. Top 3-5 Exploitable Technology Risks •One-time-use and newly registered domains that bypass blocking tools and leave limited forensic evidence. •Traffic distribution systems that redirect users through multiple layers, profile victims, deliver scams, phishing, infostealers, malware, or fake browser notifications, and send researchers to decoy sites. •Domain hijacking through Sitting Ducks attacks and dangling CNAME records, allowing attackers to abuse trusted domains and decommissioned cloud resources. |
| Infoblox | 2025 | Network Security Vendor |
| 50 | 2025 Email Threat Intelligence Report | Bottom Line Up Front (BLUF) Fortra’s report shows that the biggest email risk is no longer malware delivery; it is credential theft and social engineering that reaches user inboxes without obvious malicious payloads. For SMBs and insurance teams, this matters because these attacks can bypass traditional email defenses and lead directly to account takeover, fraudulent payments, data exposure, and other costly losses. Top 3-5 Most Notable Statistics •99% of email threats reaching corporate user inboxes in 2024 were response-based social engineering attacks or contained phishing links without delivering malware. •In Q4 2024, 58% of inbox threats were credential theft, 41% were social engineering, and only 1% delivered malware. •49% of Q4 credential theft attacks targeted Microsoft 365 credentials. •Misuse of developer tools increased by more than 200% in 2024. •Hybrid vishing accounted for 40% of response-based email threats in Q4 2024, and one in three hybrid vishing attacks impersonated PayPal. Top 3-5 Exploitable Technology Risks •Microsoft 365 credential phishing, because stolen credentials can provide access to organizational data and services and enable account takeover. •Docuphishing, where phishing links are placed inside email attachments, making users less suspicious and bypassing training focused only on email body content. •Abuse of legitimate services such as e-signature platforms, including DocuSign and YouSign, to send malicious emails, host fake documents, and harvest credentials. |
| Fortra | 2025 | Threat Intelligence Vendor |
| 51 | 2025 Exposure Management Index | Bottom Line Up Front (BLUF) Intruder’s 2025 Exposure Management Index shows that SMBs face the same serious vulnerability landscape as larger enterprises, but with fewer resources to detect, prioritize, and fix issues quickly. The key takeaway for SMB owners and insurance teams is that attackers are increasingly exploiting internet-facing systems and older known vulnerabilities, making fast, focused remediation a practical business necessity. Top 3-5 Most Notable Statistics •3,000+ small and midsize companies were analyzed, covering organizations with 1-2,000 employees. •The volume of high-severity issues is nearly 20% higher in 2025, while critical vulnerabilities remain broadly stable. •89% of critical vulnerabilities identified in 2025 were remediated within 30 days, up from 75% in 2024. •North America’s average remediation time improved from 37 days to 16 days. •Software companies reduced average critical vulnerability fix times from 24 days in 2024 to 13 days in 2025. Top 3-5 Exploitable Technology Risks •Apache Tomcat remote code execution, CVE-2025-24813, rated CVSS 9.8, was the most commonly occurring critical CVE across customer estates in 2025. •Fortinet perimeter vulnerabilities in FortiOS and FortiVoice affected internet-facing appliances that control network access. •Apache HTTP Server mod_rewrite, CVE-2024-38475, remained relevant in 2025 because vulnerable instances persisted after disclosure. |
| Intruder | 2025 | Security Research Vendor |
| 52 | 2025 Gartner Magic Quadrant for Endpoint Protection Platforms | Bottom Line Up Front (BLUF) Gartner’s 2025 Magic Quadrant excerpt indicates that endpoint protection platforms are now mature, mainstream security controls, so buyers should evaluate them as part of a broader workspace security strategy rather than as isolated endpoint tools. For SMBs and insurance teams, the key takeaway is that endpoint protection decisions should consider vendor trust, customer experience, centralized policy management, and the ability to reduce attack surface over time. Top 3-5 Most Notable Statistics •By 2029, 30% of midsize organizations are expected to converge workspace, data security, and identity security capabilities into a workspace security platform. •By 2030, 25% of enterprises are expected to adopt a continuous assessment and optimization process for workspace security controls. •The report is a 2025 Gartner Magic Quadrant focused on endpoint protection platforms. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs For a typical small or medium-sized business, the report points to endpoint protection as a core, mainstream cybersecurity capability rather than an optional add-on. Gartner emphasizes that customer experience and vendor trust are key drivers in provider selection, which matters for SMBs that may have limited internal security staff and need tools that are reliable, manageable, and well-supported. The report also highlights a shift toward integrated workspace security, combining endpoint, workspace, data security, and identity-related controls under more centralized management. For SMBs, this suggests that fragmented security tools may become harder to manage effectively over time. Centralized policy management and targeted remediation of security controls can help reduce the attack surface, although the excerpt does not quantify cost, downtime, claim frequency, or breach likelihood. Insurance & Risk Management Implications |
| Gartner | 2025 | Consulting / Analyst Firm |
| 53 | 2025 Global Cyber Risk Report (Executive Report) | Bottom Line Up Front (BLUF) Cyber claims are rising, but stronger controls and a buyer-friendly insurance market are improving outcomes for prepared organizations. For SMBs and insurance teams, the central issue is no longer just ransomware; it is the combined risk of third-party dependence, business interruption, weak basic controls, and systemic technology failures. Top 3-5 Most Notable Statistics •Reported cyber incidents across Aon U.S. broking clients increased 22% year over year in 2024. •Ransomware claims frequency increased, while the average ransom payment amount for Aon broking clients declined by 77%. •Midsized organizations filed more cyber claims than any other group, accounting for over half of all incidents. •Supply chain issues contributed to 28.5% of reported cyber incidents in 2024. •For middle-market and small to mid-sized enterprises, 59% reported no annual tabletop exercises and 49% reported backups not stored in a secondary data center. Top 3-5 Exploitable Technology Risks •Lack of multifactor authentication across key systems, especially among some middle-market companies and SMBs, remains a direct path for account compromise and ransomware access. •Third-party and supply chain dependencies create exposure to vendors, managed service providers, technology platforms, and other single points of failure outside the company’s direct control. •Weak backup and business resilience practices, including backups not stored in a secondary data center, increase the risk that ransomware or outages create extended downtime. |
| Aon | 2025 | Cyber Insurance Carrier |
| 54 | 2025 Global Digital Trust Insights: Bridging the Gaps to Cyber Resilience — The C-suite Playbook | Bottom Line Up Front (BLUF) PwC’s 2025 Global Digital Trust Insights shows that most organisations recognise cyber risk, but very few have implemented resilience across the business. For SMBs and insurance teams, the key takeaway is that exposure is growing across cloud, AI, connected devices and third parties, while many organisations still lack the measurement, leadership involvement and recovery readiness needed to reduce loss. Top 3-5 Most Notable Statistics •2% of executives say their company has implemented cyber resilience actions across the organisation in all areas surveyed. •42% of executives rank cloud-related threats as their most concerning cyber threat. •$3.32 million is the estimated average data breach cost. •15% of organisations measure the financial impact of cyber risks to a significant extent. •67% of security executives say GenAI has increased their attack surface over the last year. Top 3-5 Exploitable Technology Risks •Cloud-related threats, including data access misconfigurations, data breaches and integration challenges in hybrid and multi-cloud environments. •Third-party breaches, which are among the threats organisations find most concerning and least prepared to address. •Connected product and operational technology attacks, especially as more devices become interconnected. |
| PwC | 2025 | Consulting / Analyst Firm |
| 55 | 2025 Global Threat Intelligence Report: Data, Insights, and Strategies for Navigating Today's Hybrid Threat Landscape | Bottom Line Up Front (BLUF) Flashpoint’s 2025 report shows that stolen credentials, infostealers, exploitable vulnerabilities, data breaches, and ransomware are reinforcing each other into a single attack cycle. For SMBs and insurance teams, the key takeaway is that attackers do not need highly advanced methods when exposed credentials, weak access controls, and unpatched systems can provide a fast path to data theft, extortion, and downtime. Top 3-5 Most Notable Statistics •Flashpoint found over 3.2 billion credentials were compromised in 2024, a 33% increase from the prior year. •Infostealers accounted for 2.1 billion stolen credentials, or 75% of the 2024 total, and infected 23 million hosts and devices. •Flashpoint recorded 6,670 publicly reported data breaches in 2024, exposing over 16.8 billion records. •Flashpoint aggregated 37,302 vulnerabilities in 2024, and over 39% had publicly available exploit code. •Flashpoint identified 5,742 ransomware attacks in 2024, a 10% year-over-year increase following an 84% increase the prior year. Top 3-5 Exploitable Technology Risks •Compromised credentials: stolen usernames and passwords are used for account takeover, brute-force attempts, lateral movement, ransomware deployment, and data theft. •Information-stealing malware: low-cost infostealers such as Redline, RisePro, StealC, Lumma Stealer, and Meta Stealer are used to steal credentials and bypass common security measures. •Publicly exploitable vulnerabilities: attackers scan for exposed systems, use available exploit code, and can abuse remotely exploitable flaws such as remote code execution vulnerabilities. |
| Flashpoint | 2025 | Threat Intelligence Vendor |
| 56 | 2025 H1 Data Breach Report | Bottom Line Up Front (BLUF) Data breaches remained frequent in H1 2025, with cyberattacks driving most reported compromises and supply chain incidents affecting large numbers of entities and individuals. For SMBs and insurance teams, the key issue is not only breach volume, but also limited transparency in notices, which makes root-cause analysis, vendor risk assessment, and loss prevention harder. Top 3-5 Most Notable Statistics •1,732 total data compromises were reported in H1 2025, affecting 165,745,452 individuals. •Cyberattacks accounted for 1,348 incidents and 114,582,621 victim notices. •69% of breach notices, or 1,191 notices, did not include attack vector details. •Supply chain attacks accounted for 79 breaches or exposures, affected 690 entities, and generated 78,320,240 victim notices. •The most targeted sectors were financial services with 387 compromises and healthcare with 283 compromises. Top 3-5 Exploitable Technology Risks •Supply chain vulnerabilities: third-party and vendor-related incidents affected hundreds of entities and produced a large share of victim notices. •Previously Compromised Data: reused or recirculated stolen logins and passwords can be used to access mission-critical systems for ransom attacks or data exfiltration. •Phishing and smishing: the report identifies these as attack vectors and recommends training employees to recognize sophisticated phishing attempts. |
| ITRC | 2025 | Research Organization |
| 57 | 2025 Health Sector Cyber Threat Landscape | Bottom Line Up Front (BLUF) Health-ISAC’s report shows that ransomware, third-party compromise, exposed remote access, and vulnerable healthcare technologies are the central cyber risks facing the health sector in 2025. For SMB healthcare organizations and insurance teams, the key takeaway is that cyber incidents are not only data events; they can disrupt payments, patient care, scheduling, records access, and critical suppliers. Top 3-5 Most Notable Statistics •Health-ISAC tracked 458 ransomware events in the health sector in 2024. •Change Healthcare processes about one in three healthcare transactions in the United States, and its ransomware outage disrupted payment access for millions of patients. •Ascension’s ransomware incident disrupted operations across 140 hospitals and 40 senior care facilities in 19 states. •Health-ISAC distributed 4,904 member-provided indicators of compromise in 2024; 85% related to malware. •Health-ISAC issued 861 targeted alerts in 2024, with Remote Desktop Protocol exposure the top alert category at 105 alerts. Top 3-5 Exploitable Technology Risks •Exposed Remote Desktop Protocol: Internet-accessible RDP allows attackers to remotely connect to Windows systems and interact with them if not properly secured. •Ivanti Connect Secure and Policy Secure vulnerabilities: Reported flaws enabled authentication bypass, arbitrary command execution, backdoor installation, credential harvesting, and lateral movement. •Fortinet FortiOS SSL VPN vulnerability: A critical remote code execution issue affected FortiOS SSL VPN devices, with Health-ISAC urging immediate patching. |
| Health-ISAC | 2025 | ISAC / Industry Consortium |
| 58 | 2025 IT Risk and Compliance Benchmark Report: The Reader's Digest Issue | Bottom Line Up Front (BLUF) GRC maturity is becoming a practical security and business resilience issue, not just a compliance exercise. The report shows that organizations using reactive, siloed risk management are more likely to experience data breaches, while centralized teams, common controls, automated tools, and stronger third-party oversight are associated with more proactive risk management. Top 3-5 Most Notable Statistics •91% of respondents have a centralized team managing GRC, the highest level Hyperproof has seen in six years. •60% of respondents managing risk ad hoc or only after a negative event experienced a data breach in 2024, compared with 41% using integrated and automated GRC tools. •55% of respondents experienced supply chain disruptions related to cybersecurity, and 46% reported third-party data or privacy breaches. •79% of respondents now use cyber supply chain risk assessments, up from 61% the prior year. •90% of respondents use generative AI tools in GRC workflows, while only 39% reported adding employee training on responsible generative AI use in 2024. Top 3-5 Exploitable Technology Risks •Third-party vendors and supply chains: external providers can create data, privacy, compliance, and operational disruption risk. •Reactive or siloed IT risk management: fragmented risk practices are linked in the report to higher breach rates. •AI and generative AI tools: the report highlights cybersecurity threats, ethical concerns, operational disruptions, and the need for monitoring, audits, policies, and training. |
| Hyperproof | 2025 | Compliance / GRC Vendor |
| 59 | 2025 Latin America Threat Landscape Report | Bottom Line Up Front (BLUF) Latin America remained a growing target for regional and global cybercriminals in 2024, with ransomware, data extortion, stolen credentials, access brokers, phishing, and vulnerable internet-facing systems standing out as the most important risks. For SMBs and insurance teams, the main takeaway is that attackers do not need sophisticated entry points when they can buy access, reuse stolen credentials, exploit exposed systems, or trick users through convincing phishing. Top 3-5 Most Notable Statistics •CrowdStrike tracks six named adversaries either based in or primarily targeting Latin America. •CrowdStrike documented 291 Latin America-based victims named on data extortion and ransomware leak sites in 2024, a 15% increase from 254 in 2023. •Brazil had 119 listed ransomware or extortion victims, followed by Mexico with 45 and Argentina with 29. •In 2024, 107 access brokers advertised network access to 428 Latin America-based entities, up from 93 brokers and 311 entities in 2023. •CrowdStrike recovered more than 1 billion credentials belonging to Latin America-based individuals and organizations from data leaks and malware stealer logs. Top 3-5 Exploitable Technology Risks •Stolen credentials and access broker listings that allow attackers to enter networks without needing to break in directly. •Internet-facing systems exposed to common exploits, brute-force attacks, and misconfigurations. •Vulnerable web servers used by SQUAB SPIDER to gain initial access and deploy webshells. |
| CrowdStrike | 2025 | Endpoint / MDR / XDR Vendor |
| 60 | 2025 Microsoft Vulnerabilities Report | Bottom Line Up Front (BLUF) Microsoft vulnerabilities reached a record high in 2024, but the most severe “critical” vulnerabilities continued to decline. For SMBs and insurance teams, the key takeaway is that Microsoft environments remain highly targetable, and the most practical risk reduction comes from timely patching, least privilege, and tighter control of remote access and identities. Top 3-5 Most Notable Statistics •Total Microsoft vulnerabilities rose to 1,360 in 2024, the highest total since the report began. •Microsoft-classified critical vulnerabilities fell to 78 in 2024, down from 84 in 2023. •Elevation of Privilege accounted for 40% of all vulnerabilities, totaling 554 issues. •Remote Code Execution vulnerabilities increased 22% to 435 in 2024. •Microsoft Edge vulnerabilities increased 17% to 292, including 9 critical vulnerabilities. Top 3-5 Exploitable Technology Risks •Elevation of Privilege vulnerabilities, which attackers can use to gain higher access after initial compromise and expand the impact of an intrusion. •Remote Code Execution vulnerabilities, which allow attackers to run code on affected systems and remain a core path for exploitation. •Security Feature Bypass vulnerabilities, including bypasses of Office macro blocks and Mark of the Web protections, which can support phishing-based attacks. |
| BeyondTrust | 2025 | Identity Security Vendor |
| 61 | 2025 Mid-Year Snapshot: Vulnerability Statistics Report | Bottom Line Up Front (BLUF) Edgescan’s mid-year data shows that SMB attack surfaces are spread across network/cloud, web application, and API layers, so focusing on only one area leaves material exposure. The most practical takeaway for SMBs and insurance teams is to prioritize validated, exploitable vulnerabilities across the full stack, then confirm remediation through retesting. Top 3-5 Most Notable Statistics •40,000+ assessments and 1,000+ penetration tests informed the report’s findings. •47% of discovered vulnerabilities were in network/cloud, 33% in web applications, and 20% in APIs. •Across the full stack, vulnerability severity was 13% critical, 13% high, and 33% medium. •Web/API findings showed a higher critical concentration: 25% critical, 10% high, and 38% medium. •56% of vulnerabilities discovered between January and June 2025 were retested and verified as closed. Top 3-5 Exploitable Technology Risks •SQL injection accounted for 31.4% of the most common critical web application vulnerabilities, creating a direct risk of unauthorized data access or manipulation. •File path traversal represented 29.6% of common critical web application findings, which can expose sensitive files or system paths. •Out-of-band resource load represented 12.5%, indicating risks where applications may be induced to interact with external resources. |
| Edgescan | 2025 | Security Research Vendor |
| 62 | 2025 MSP Threat Report | Bottom Line Up Front (BLUF) ConnectWise reports that attackers are increasingly targeting MSPs and SMB customers through exploitable remote access tools, edge devices, drive-by compromise, and post-compromise EDR evasion. For SMBs and insurance teams, the key takeaway is that smaller organizations are not just incidental victims; attackers are deliberately shifting toward midsized and less prominent targets that may have weaker defenses and slower patching. Top 3-5 Most Notable Statistics •78% of surveyed MSPs said they were worried that a serious attack could put them out of business. •83% of surveyed MSPs said they plan to invest more in cybersecurity in the next 12 months. •The FBI released more than 7,000 Lockbit decryption keys after law enforcement disruption of the group. •ConnectWise observed more than 84,000 alerts targeting edge-device vulnerabilities across major brands such as Cisco, SonicWall, Palo Alto, Citrix, Check Point, and Ivanti. •Drive-by compromise was identified as a component of initial access in 22% of reviewed incidents. Top 3-5 Exploitable Technology Risks •ScreenConnect versions 23.9.7 and prior were affected by CVE-2024-1708 and CVE-2024-1709, enabling path traversal, authentication bypass, remote code execution, and unauthorized access to critical systems. •Edge devices such as VPNs, firewalls, RDP gateways, cloud edge solutions, and IoT devices were heavily targeted, especially when unpatched, outdated, exposed, or misconfigured. •Exposed remote access services, including RDP, VPN, and SSH, were frequent targets for brute-force attacks, compromised credentials, default credentials, and weak or missing MFA. |
| ConnectWise | 2025 | MSP / MSSP / SOC Provider |
| 63 | 2025 Open Source Security and Risk Analysis Report | Bottom Line Up Front (BLUF) Open source software is present in nearly every audited codebase, and most risk-assessed codebases contained vulnerable open source, including high- or critical-risk vulnerabilities. For SMBs and insurance teams, the central issue is visibility: businesses cannot patch, prioritize, insure, or value software risk effectively if they do not know which open source components and dependencies are inside their applications. Top 3-5 Most Notable Statistics •97% of evaluated codebases contained open source. •86% of risk-assessed codebases contained at least one vulnerable open source component. •81% of risk-assessed codebases contained high- or critical-risk vulnerabilities. •64% of identified open source components were transitive dependencies, meaning they were pulled in indirectly by other components. •91% of all codebases contained outdated open source components, and 90% contained components more than 10 versions behind the current version. Top 3-5 Exploitable Technology Risks •Outdated jQuery components were the most prominent risk: eight of the top 10 high-risk vulnerabilities were found in jQuery, including cross-site scripting issues that can allow malicious script execution. •CVE-2020-11023 affected vulnerable jQuery versions and was found in about one-third of scanned codebases; it is listed by CISA as a known exploited vulnerability. •Transitive dependencies create hidden exposure because indirect components can contain vulnerabilities, license conflicts, and maintenance issues that are difficult to locate manually. |
| Black Duck | 2025 | Application / API Security Vendor |
| 64 | 2025 Ransomware and Cyber Threat Report | Bottom Line Up Front (BLUF) Ransomware remained highly active in 2024 despite major disruptions to LockBit and Alphv, with attackers shifting across a broader set of groups rather than disappearing. For SMBs and insurance teams, the main takeaway is that stolen credentials, vulnerable internet-facing systems, and weak post-compromise detection continue to create fast-moving loss scenarios involving data theft, encryption, downtime, and extortion. Top 3-5 Most Notable Statistics •4,848 publicly posted ransomware victims were observed in 2024. •88 distinct ransomware groups were tracked, up 42% from 62 in 2023. •Year-over-year victim volume grew 8.72%, far below the 76.8% growth observed from 2022 to 2023. •The United States accounted for 51.53% of observed ransomware attacks. •GRIT observed 40 Emerging ransomware groups in 2024, double the 20 observed in 2023. Top 3-5 Exploitable Technology Risks •Stolen valid credentials and compromised VPN accounts, which remained common initial access paths. •Exploitation of new and historical vulnerabilities, especially where organizations lack active vulnerability management. •Internet-facing remote access and infrastructure tools, including SSL VPNs, Managed File Transfer tools, and exposed systems. |
| GuidePoint Security | 2025 | Consulting / Analyst Firm |
| 65 | 2025 Ransomware Trends and Proactive Strategies | Bottom Line Up Front (BLUF) Ransomware remains a serious operational and financial threat, and attackers are increasingly shifting toward faster attacks, data theft, and smaller targets with weaker defenses. For SMBs and insurance teams, the main takeaway is that resilience depends less on paying ransoms and more on tested recovery plans, protected backups, clear decision-making, and coordinated incident response. Top 3-5 Most Notable Statistics •Veeam surveyed 1,300 organizations globally, including 900 that experienced ransomware involving encryption or data exfiltration in the prior 12 months. •The share of companies impacted by at least one ransomware attack declined from 75% to 69% compared with the prior year. •36% of affected organizations did not pay a ransom, and 25% did not pay but still recovered their data. •89% of organizations had backup repositories targeted by the threat actor, with an average of 34% of repositories modified or deleted. •69% of organizations that paid a ransom were attacked more than once. Top 3-5 Exploitable Technology Risks •Poorly secured cloud-based applications and cloud infrastructure, which the report links to data exfiltration attacks. •Remote access compromise, phishing, and software vulnerabilities, identified as common initial access vectors. •Lateral movement inside victim networks after initial compromise, allowing attackers to seek easier data theft or specific targets. |
| Veeam | 2025 | Backup & Recovery Vendor |
| 66 | 2025 SaaS Security Risks Report | Bottom Line Up Front (BLUF) Grip Security’s report shows that SaaS and AI adoption are expanding faster than many organizations can govern them, creating large blind spots around unmanaged apps, unmanaged identities, and abandoned accounts. For SMBs and insurance teams, the main issue is not simply how many tools are used, but whether the business can see them, secure access to them, and remove access when it is no longer needed. Top 3-5 Most Notable Statistics •85-90% of SaaS tools were unmanaged in baseline data before Grip adoption. •SaaS portfolios grew by an average of 40% in 2023. •73% of provisioned users never used their managed application license. •91% of AI tools were unmanaged. •16% of managed applications were abandoned in 2023 yet remained connected to core systems. Top 3-5 Exploitable Technology Risks •Shadow SaaS: employee-adopted applications outside IT oversight can bypass security reviews and leave business data exposed. •Shadow AI: AI tools are being adopted quickly, often without governance, creating blind spots around what data users share and where it goes. •Weak identity controls: many SaaS apps are not centrally managed or federated, leaving users to create their own credentials. |
| Grip Security | 2025 | Application / API Security Vendor |
| 67 | 2025 State of Cyber | Bottom Line Up Front (BLUF) IT Harvest’s 2025 State of Cyber is primarily a cybersecurity market snapshot, not an incident or threat report. The most important takeaway for SMBs and insurance teams is that AI Security is a major growth theme across the vendor landscape, while overall market growth appears mixed, making vendor selection, stability, and clear product fit important risk-management considerations. Top 3-5 Most Notable Statistics •52% of global security solutions mention AI, based on IT Harvest’s analysis of 11,340 security solutions. •91% of solutions from vendors founded after 2022 mention AI. •The global security space is concentrated by location, with the USA at 52%, Israel at 7%, the UK at 7%, Germany at 4%, and Canada at 4%. •By company size, the market is heavily weighted toward smaller vendors: 76% small, 19% mid-sized, and 5% large. •Among startups, there are 924 startups worldwide, 49% grew in 2025, and 30% shrank by at least 5% in 2025. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs For a typical SMB, this report is most useful as a guide to the cybersecurity vendor market rather than as a guide to specific attacks or vulnerabilities. The data shows a crowded and rapidly changing market, especially around AI Security, with many smaller companies and startups competing for attention. This can create opportunity, but it also means SMBs may face difficulty distinguishing mature, stable security products from newer offerings that are still developing. The report also shows that not all vendors are growing; among startups, nearly half grew in 2025 while a significant share shrank by at least 5%. For SMBs that depend on third-party security tools, vendor viability and product clarity should be part of purchasing decisions. |
| IT Harvest | 2025 | Threat Intelligence Vendor |
| 68 | 2025 State of Cyber Risk Management Report: From Compliance to Competitive Advantage: The Quantified Value of Cybersecurity | Bottom Line Up Front (BLUF) Cyber risk management is moving from a compliance exercise to a business decision tool, especially when organizations quantify risk, automate workflows, and connect cyber risk to executive governance. For SMBs and insurance teams, the key takeaway is that better risk data and financial framing can improve prioritization, spending decisions, third-party oversight, and conversations about acceptable risk. Top 3-5 Most Notable Statistics •402 qualified cyber risk management professionals participated in the global survey. •72% of organizations have mostly or completely automated their cyber risk management systems. •48% of organizations are already using AI for cyber risk management, and 34% are actively experimenting with it. •99% of respondents have defined cyber risk appetite and tolerance levels, and 90% have had them formally approved by the board. •24% currently use FAIR, 22% plan to adopt it, and 90% of FAIR adopters report success. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs The report’s sample reflects organizations with established cyber risk management programs, so its findings should not be treated as representative of all SMBs. However, the lessons are directly relevant: organizations that manage cyber risk in business terms report better alignment of cybersecurity resources with priorities, greater risk reduction, optimized cybersecurity spending, and improved credibility of security teams. For a smaller business, this means cyber risk management should help answer practical questions: which risks matter most, where limited budget should go, which vendors create meaningful exposure, and what level of cyber loss the business can tolerate. The report also emphasizes that data from endpoint tools, threat intelligence, compliance audits, logs, vulnerability findings, incident records, cloud systems, third-party assessments, and asset inventories supports better risk decisions. |
| FAIR Institute | 2025 | Compliance / GRC Vendor |
| 69 | 2025 State of Identity Security: Challenges and Strategies from IT and Security Leaders | Bottom Line Up Front (BLUF) Identity security is becoming a core business risk because attackers are exploiting weak authentication, fragmented identity systems, poor visibility, and third-party access gaps. For SMBs and insurance teams, the key takeaway is that identity controls are no longer just an IT issue; failures are already producing measurable financial losses and should be treated as a priority risk-control area. Top 3-5 Most Notable Statistics •85% of companies are adopting security-first identity strategies to counter AI-driven threats. •Only 33% of security leaders are confident their identity provider protects against identity-based attacks. •69% are worried that MFA is not deployed across all devices and applications. •87% prioritize phishing-resistant MFA, but only 19% have fully implemented FIDO2 tokens. •51% of organizations have suffered financial losses due to identity breaches. Top 3-5 Exploitable Technology Risks •Incomplete MFA coverage across devices and applications, leaving gaps that can be exploited in credential-based attacks. •AI-driven phishing and identity spoofing, which are increasing pressure on organizations to adopt phishing-resistant authentication. •Fragmented visibility into identity vulnerabilities, including limited visibility into privileged and admin access. |
| Duo | 2025 | Identity Security Vendor |
| 70 | 2025 State of Ransomware Report | Bottom Line Up Front (BLUF) Ransomware is rising while the nature of attacks is shifting toward credential abuse, data theft, and AI-enabled social engineering. For SMBs and insurance teams, the key issue is no longer just whether backups exist, but whether the business can prevent unauthorized access, limit attacker movement, and recover operations quickly. Top 3-5 Most Notable Statistics •69% of organizations were breached by ransomware actors in the last year. •27% of firms were breached more than once. •60% of ransomware victims experienced a data breach, and 85% were threatened with having data published or sold. •57% of organizations paid a ransom, but 26% of those that paid did not get their data back. •75% of victims took up to two weeks to recover, while only 18% recovered within 24 hours. Top 3-5 Exploitable Technology Risks •Compromised credentials: The report identifies stolen credentials as a primary path for initial access, privilege escalation, and lateral movement. •Weak identity and access controls: Only 34% of respondents have adopted least privilege, leaving users, accounts, applications, and services with unnecessary access. •Ransomware-as-a-service and initial access brokers: These lower the skill required to launch attacks and make access to corporate networks and cloud accounts easier to buy. |
| Delinea | 2025 | Identity Security Vendor |
| 71 | 2025 Threat Report: The Changing Face of Global Threats (2024 Year in Review & 2025 Predictions) | Bottom Line Up Front (BLUF) Deep Instinct’s 2025 threat report shows ransomware, AI-enabled attacks, exploited vulnerabilities, and IoT targeting becoming more scalable and harder to detect. For SMBs and insurance teams, the key issue is that attackers are increasingly using repeatable business models, automation, stolen credentials, phishing, and exposed systems to create higher downtime, data theft, and extortion risk. Top 3-5 Most Notable Statistics •Global cyberattacks increased by 30% in Q2 2024 compared with Q2 2023. •France reported ransomware incidents affecting upwards of 74% of organizations in 2024; South Africa, Italy, and Austria each reported 69%. •The report identified 186 known exploited vulnerabilities in 2024. •Microsoft product vulnerabilities represented nearly 20% of all known exploited vulnerabilities. •IoT devices account for more than 30% of all network-connected business endpoints, and attacks on IoT devices have quadrupled in the past two years. Top 3-5 Exploitable Technology Risks •Ransomware-as-a-Service operations that let affiliates use ready-made tools, infrastructure, and negotiation portals to scale attacks against organizations of many sizes. •Phishing and social engineering, including AI-generated phishing, fake technical support calls, and abuse of legitimate tools such as Microsoft Teams, AnyDesk, and Microsoft Quick Assist. •Exposed or weak remote access paths, including valid Remote Desktop Protocol credentials, exposed applications such as Citrix and RDP, and compromised Remote Monitoring and Management tools. |
| Deep Instinct | 2025 | Endpoint / MDR / XDR Vendor |
| 72 | 2025 USA Consumer Expectations of Mobile App Security | Bottom Line Up Front (BLUF) US consumers now treat mobile app security, fraud prevention, and privacy as basic requirements, not optional features. For SMBs that rely on mobile apps, weak protection can directly drive customer abandonment, while insurance and risk teams should view mobile fraud, identity theft, and social engineering as important loss-prevention priorities. Top 3-5 Most Notable Statistics •89.4% of US consumers say mobile apps must protect against deepfakes, bots, impersonation, and account takeovers. •Only 10.6% feel “very confident” that their mobile apps have robust protections against AI-driven threats. •63.7% cite synthetic fraud as their top fear, with 44.7% naming identity theft as the leading cause of mobile app abandonment. •54.2% of US consumers have abandoned a mobile app because of security or privacy concerns. •87.7% prioritize preventing fraud before it occurs over reimbursement after the fact. Top 3-5 Exploitable Technology Risks •AI-driven threats, including deepfakes, bots, impersonation, and account takeovers, are highlighted as major risks consumers expect mobile apps to address. •Synthetic fraud, identity theft, and fraudulent transactions are identified as leading fraud concerns that can cause users to abandon mobile apps. •Social engineering scams, including email phishing, smishing, vishing, and brand impersonation, are described as gateways to broader fraud. |
| Appdome | 2025 | Application / API Security Vendor |
| 73 | 2025H1 Threat Review: Vulnerabilities, Threat Actors, and Ransomware | Bottom Line Up Front (BLUF) Forescout’s 2025H1 review shows that attackers are exploiting a wider range of internet-facing and under-managed assets, including network infrastructure, IP cameras, BSD systems, IoT, and OT devices. For SMBs and insurance teams, the key takeaway is that ransomware, infostealers, and exposed infrastructure remain practical paths to business interruption, data theft, and costly recovery. Top 3-5 Most Notable Statistics •3,649 ransomware attacks were observed in 2025H1, a 36% increase over 2024H1. •63 vulnerabilities were exploited as zero-days in 2025H1, up from 43 in 2024H1, a 46% increase. •132 CVEs were added to the CISA Known Exploited Vulnerabilities catalog in 2025H1, an 80% increase from 2024H1. •21% of new known exploited vulnerabilities targeted network infrastructure and security appliances. •The U.S. accounted for 53% of global ransomware attacks, and ransomware victims were recorded in 112 countries. Top 3-5 Exploitable Technology Risks •Internet-facing network infrastructure and security appliances, including firewalls and routers, remain high-risk because they are often exposed, under-managed, and useful for lateral movement and persistent access. •Known exploited vulnerabilities, including older CVEs and end-of-life products with no patches available, continue to create active risk. •IP cameras are being used in ransomware attack chains, including as a path to deploy ransomware onto Windows endpoints. |
| Forescout | 2025 | Network Security Vendor |
| 74 | 2026 Agentic Coding Trends Report | Bottom Line Up Front (BLUF) Agentic coding is expected to shift software development from humans writing most code to humans orchestrating AI agents that write, test, review, and document code. For SMBs and insurance teams, the key issue is not just productivity; it is whether organizations can maintain human oversight, secure design, and quality control as AI-generated work scales. Top 3-5 Most Notable Statistics •Developers use AI in roughly 60% of their work, but report being able to fully delegate only 0-20% of tasks. •One enterprise customer using Augment Code completed a project initially estimated at 4 to 8 months in two weeks. •Fountain reported 50% faster screening, 40% quicker onboarding, and 2x candidate conversions using hierarchical multi-agent orchestration. •Rakuten tested Claude Code on a 12.5 million-line open-source library task; it completed the job in seven hours with 99.9% numerical accuracy. •TELUS created over 13,000 custom AI solutions, shipped engineering code 30% faster, and saved over 500,000 hours. Top 3-5 Exploitable Technology Risks •AI coding agents can support offensive cyber activity as well as defense, allowing threat actors to scale attacks using the same capabilities defenders use. •AI-generated code may introduce security vulnerabilities, architectural inconsistency, or quality issues if review and validation do not scale with output. •Long-running agents that build systems with minimal human intervention can create risk when human checkpoints are insufficient for high-impact decisions. |
| Anthropic | 2026 | Research Organization |
| 75 | 2026 Cato CTRL Threat Report | Bottom Line Up Front (BLUF) Cato Networks’ 2026 Cato CTRL Threat Report finds that AI has become a practical attack surface, not just a productivity tool. For SMBs and insurance teams, the most important takeaway is that everyday AI use can expose sensitive data, enable fraud, and create new paths to ransomware when tools ingest untrusted inputs or operate outside governance. Top 3-5 Most Notable Statistics •Cato CTRL analyzed 6.7 trillion network flows across more than 4,000 customers globally in 2025. •AI adoption was effectively universal, with 20 out of 25 verticals showing adoption rates of 90% or higher by Q4 2025. •Average AI adoption across industries reached 92% in Q4 2025. •Top AI applications increased from Q1 to Q4 2025: Copilot by 33%, OpenAI by 39%, Gemini by 72%, Grammarly by 24%, and Perplexity by 63%. •Claude Skills had more than 77,000+ GitHub stars after launch, and the report cites an average ransomware incident cost of $5.08 million. Top 3-5 Exploitable Technology Risks •Shadow AI: employees using consumer AI tools can paste proprietary code, financial data, legal documents, or personally identifiable information into services outside company controls. •Prompt injection in AI workflows: malicious support tickets, URLs, metadata, or file fragments can cause AI tools to leak or alter internal data when processed with internal permissions. •AI browser assistants: HashJack hides malicious instructions after the “#” in legitimate URLs, enabling attacks such as data exfiltration, credential theft, and phishing. |
| Cato Networks | 2026 | Network Security Vendor |
| 76 | 2026 Cybersecurity Market Report Q4 2025 | Bottom Line Up Front (BLUF) Cybersecurity Ventures’ main message is that cybersecurity spending is expanding rapidly because cybercrime risk is growing across both traditional IT and connected physical systems. For SMBs and insurance teams, the key takeaway is that cyber risk is no longer limited to laptops, servers, and cloud systems; it increasingly includes IoT devices, industrial systems, payment terminals, vehicles, and AI-enabled fraud. Top 3-5 Most Notable Statistics •Global cybersecurity product and services spending is predicted to reach $1 trillion annually by 2031. •Global cybersecurity spending is predicted to hit $454 billion annually in 2025, up from $260 billion in 2021. •Cybersecurity Ventures predicts cybersecurity spending will reach $522 billion in 2026. •Cybercrime is expected to cost the world $10.5 trillion annually by 2025, up from $3 trillion in 2015. •Nearly 15 percent of corporate cybersecurity spending now comes from outside the CISO organization, and that non-CISO spending is expected to grow at a 24 percent CAGR over the next three years. Top 3-5 Exploitable Technology Risks •AI-enabled cybercrime, including deepfake videos and phone calls, which the report says will make fraud more effective and harder to stop. •Internet of Things and Industrial Internet of Things environments, which expand the number of connected devices attackers may target. •Industrial control systems, including PLCs, SCADA, and distributed control systems, which support manufacturing, machinery, power plants, and other operational environments. |
| Cybersecurity Ventures | 2025 | Threat Intelligence Vendor |
| 77 | 2026 Cybersecurity Threat Detections | Bottom Line Up Front (BLUF) Splunk’s 2026 report emphasizes that attackers are moving faster across endpoints, cloud services, identity systems, network devices, and emerging AI platforms. For SMBs and insurance teams, the key takeaway is that visibility and detection coverage mapped to real attacker behaviors are critical to reducing business disruption, data theft, and delayed response. Top 3-5 Most Notable Statistics •Splunk reports 1,781 detections mapped across MITRE ATT&CK techniques. •MITRE ATT&CK now contains 877 pieces of software, 170 groups, and 50 campaigns across Enterprise, Mobile, and ICS domains. •Splunk Threat Research Team content is released every two weeks. •Splunk detection content is mapped across 14 ATT&CK tactics. •The report identifies 72% as the largest data source coverage category, with endpoint telemetry described as the largest coverage area. Top 3-5 Exploitable Technology Risks •Cloud identity abuse, including Azure AD service principal creation, admin consent bypass, and AWS multi-factor authentication being disabled. •Phishing and malicious document execution, including Microsoft Office spawning uncommon child processes. •Public-facing and network infrastructure exposure, including scanning, blocked connection attempts, suspicious ports, and Cisco Secure Firewall intrusion events. |
| Splunk | 2026 | SIEM / Security Analytics Vendor |
| 78 | 2026 Global Health Sector Threat Landscape | Bottom Line Up Front (BLUF) Health-ISAC’s 2026 landscape shows that ransomware, phishing, third-party compromise, and business interruption remain the most important cyber risks for health sector organizations and their vendors. For SMBs and insurance teams, the core takeaway is that smaller organizations can be targeted directly or used as a gateway into larger healthcare operations, making basic resilience, vendor risk management, and access controls critical. Top 3-5 Most Notable Statistics •Health-ISAC surveyed nearly 250 executives and cybersecurity professionals across the health sector. •Health-ISAC tracked 455 ransomware events across the health sector in 2025. •Hospitals and healthcare represented 49.6% of 2025 health sector ransomware victims, followed by medical practices at 25.7%. •Health-ISAC shared more than 1,200 targeted alerts in 2025, including 407 related to Dangling DNS exposure. •In a Health-ISAC survey on the CrowdStrike outage, 69% of respondents said their organization was affected, and 64% of impacted respondents experienced disruptions lasting longer than one day. Top 3-5 Exploitable Technology Risks •Ransomware access through stolen credentials, social engineering, supply chain compromise, and exploitation of public-facing applications. •Phishing-as-a-service tools such as RaccoonO365 that steal Microsoft Office 365 usernames, passwords, and one-time login tokens. •Exposed Remote Desktop Protocol services, which can give attackers remote control of systems and support ransomware deployment. |
| Health-ISAC | 2026 | ISAC / Industry Consortium |
| 79 | 2026 Global Incident Response Report | Bottom Line Up Front (BLUF) Unit 42’s 2026 incident response data shows that most serious intrusions were enabled by preventable gaps, especially weak identity controls, fragmented visibility, and inconsistent security coverage. For SMBs and insurance teams, the key takeaway is that attackers do not need exotic methods when stolen credentials, phishing, exposed applications, SaaS integrations, and excessive permissions can quickly turn access into business disruption and extortion. Top 3-5 Most Notable Statistics •87% of intrusions involved activity across multiple attack surfaces. •More than 90% of breaches were materially enabled by preventable gaps such as limited visibility, inconsistent controls, or excessive identity trust. •Identity weaknesses played a material role in nearly 90% of investigations, and 65% of initial access was identity-driven. •Phishing and software/API vulnerabilities each accounted for 22% of initial access in 2025 incidents. •Median initial ransom demands rose from $1.25 million in 2024 to $1.5 million in 2025, while median ransom payments rose from $267,500 to $500,000. Top 3-5 Exploitable Technology Risks •Identity systems and access paths: attackers used stolen credentials, hijacked sessions, MFA bypass, over-permissioned accounts, and IAM misconfigurations to log in, escalate privileges, and move laterally. •Software and API vulnerabilities: exploitation remained one of the top initial access paths, tied with phishing. •SaaS integrations and OAuth/API permissions: compromised third-party integrations can inherit permissions to read data, manage users, or modify records. |
| Palo Alto Networks Unit 42 | 2026 | Network Security Vendor |
| 80 | 2026 Global Threat Intelligence Report | Bottom Line Up Front (BLUF) Flashpoint’s 2026 report shows a threat landscape where attackers increasingly “log in” with stolen identities, move faster through public exploits, and use AI to scale attacks. For SMBs and insurance teams, the key takeaway is that losses are likely to come not only from malware, but from compromised credentials, social engineering, exposed SaaS access, vulnerable internet-facing systems, and ransomware extortion. Top 3-5 Most Notable Statistics •Flashpoint observed a 1,500% rise in AI-related illicit discussions between November and December 2025. •Infostealers infected over 11.1 million machines in 2025, producing 3.3 billion stolen credentials, session cookies, cloud tokens, and personal data. •Flashpoint aggregated 44,509 vulnerabilities in 2025, with 14,593 having publicly available exploits. •Ransomware attacks increased 53% year over year, with 8,835 total attacks observed in 2025. •Ransomware-as-a-service groups were responsible for over 87% of all ransomware attacks in 2025. Top 3-5 Exploitable Technology Risks •Stolen credentials, session cookies, and cloud tokens that allow attackers to access systems as legitimate users and bypass traditional perimeter defenses. •Publicly available exploits for vulnerabilities, especially remotely exploitable and solvable flaws, which shorten the time available for remediation. •AI-connected workflows, APIs, plugins, identity services, and internal tools that expand exposure when linked into production environments. |
| Flashpoint | 2026 | Threat Intelligence Vendor |
| 81 | 2026 IT Risk and Compliance Benchmark Report | Bottom Line Up Front (BLUF) Hyperproof’s 2026 benchmark shows that GRC maturity is increasingly defined by repeatable, integrated, and automated execution—not by policies alone. For SMBs and insurance teams, the key takeaway is that ad-hoc risk management and manual third-party oversight are associated with weaker outcomes, including higher reported breach experience and heavier post-incident workload. Top 3-5 Most Notable Statistics •50% of respondents managing risk ad-hoc or only after a negative event experienced a breach in 2025, compared with 27% using an integrated, automated tool. •97% of respondents are using AI to streamline workflows. •86% of respondents have a centralized team to manage GRC. •34% of respondents are still using spreadsheets to identify and manage third-party risks. •58% of companies that experienced a breach anticipate spending more time on IT risk management and compliance in 2026. Top 3-5 Exploitable Technology Risks •Ad-hoc IT risk management, which the report links to materially higher breach experience than integrated, automated approaches. •Fragmented systems and siloed tools, which make it harder to find risk information, track remediation, maintain evidence, and identify critical risks. •Weak or inconsistent user permission management and user access reviews, identified as a recurring struggle for teams managing internal security and privacy risks. |
| Hyperproof | 2026 | Compliance / GRC Vendor |
| 82 | 2026 MSP Threat Report | Bottom Line Up Front (BLUF) The report’s central finding is that attackers are winning by abusing trust: valid identities, VPN access, trusted software, normal user actions, and legitimate system tools. For SMBs and insurance teams, this matters because many high-impact incidents did not require advanced exploits; they relied on common weaknesses that can lead quickly to ransomware, data theft, downtime, and costly recovery. Top 3-5 Most Notable Statistics •Ransomware victim counts increased by 58% year over year on data leak sites, reaching the highest level on record. •Ransomware activity intensified in Q4 2025, making it the most dangerous period of the year. •Ivanti Connect Secure exploitation resulted in at least 17 confirmed breached organizations. •The Shai-Hulud npm campaign involved trojanized updates to hundreds of packages. •Two malicious Rust crates remained live for months and reached thousands of downloads before removal. Top 3-5 Exploitable Technology Risks •SSL VPN exposure, especially weak credential hygiene, migrated credentials, legacy MFA implementations, and misconfigured SonicWall, Fortinet, Ivanti, and Cisco appliances. •Stolen or abused credentials, including VPN accounts, maintainer tokens, cloud keys, and privileged accounts. •Software supply chain compromise through package registries, build pipelines, installers, update mechanisms, and trusted dependencies. |
| ConnectWise | 2026 | MSP / MSSP / SOC Provider |
| 83 | 2026 Ransomware and Cyber Threat Report — A GRIT Report | Bottom Line Up Front (BLUF) Ransomware activity reached record levels in 2025, with GuidePoint Security observing a 58% year-over-year increase in publicly posted victims and a record 124 named ransomware groups. For SMBs and insurance teams, the key takeaway is that ransomware remains highly active, opportunistic, and increasingly supported by easier-to-use tools, exposed perimeter systems, and extortion-only tactics. Top 3-5 Most Notable Statistics •7,515 publicly posted ransomware victims were observed in 2025. •124 distinct named ransomware groups were tracked, a 46% year-over-year increase from 2024. •Manufacturing accounted for 1,060 victims, or 14% of all observed ransomware victims. •The legal sector more than doubled from 196 victims in 2024 to 455 in 2025, a 132% year-over-year increase. •Q4 2025 reached 2,287 observed victims, the highest quarterly total since GRIT began tracking ransomware data. Top 3-5 Exploitable Technology Risks •Internet-facing perimeter devices, including VPNs, firewalls, and edge systems, were repeatedly exploited as initial access points. •SonicWall SSL VPN exploitation by Akira contributed to a surge of attacks in the second half of 2025. •Fortinet vulnerabilities affecting FortiOS, FortiProxy SSL-VPN, FortiVoice, FortiMail, and FortiNDR were used in ransomware-related campaigns. |
| GuidePoint Security | 2026 | Consulting / Analyst Firm |
| 84 | 2026 State of Exploitation: Exploring the Network Edge | Bottom Line Up Front (BLUF) VulnCheck’s report shows that attackers are heavily exploiting internet-facing network edge devices, especially unsupported or likely unsupported routers, firewalls, VPNs, and related products. For SMBs and insurance teams, the main takeaway is that old edge infrastructure and remote-work networking equipment can remain exploitable long after vendors stop issuing updates, creating risk that may not appear in CISA’s Known Exploited Vulnerabilities catalog. Top 3-5 Most Notable Statistics •42.5% of exploited network edge device vulnerabilities in 2025 affected end-of-life or likely end-of-life devices. •65% of vulnerabilities exploited by botnets affected end-of-life or likely end-of-life products. •181 known exploited network edge device vulnerabilities were analyzed by VulnCheck for 2025. •Only 23.7% of the exploited edge device vulnerabilities identified by VulnCheck appeared in CISA KEV. •7 of the 181 vulnerabilities were associated with ransomware campaigns, all tied to enterprise network edge devices. Top 3-5 Exploitable Technology Risks •End-of-life and likely end-of-life network edge devices, because unsupported products may have no available fix and remain exposed. •Consumer routers and globally distributed networking products, which accounted for a large share of exploited edge device vulnerabilities. •Wireless routers, routers, firewalls, network management tools, WAFs, SSL VPNs, and related internet-facing edge technologies. |
| VulnCheck | 2026 | Threat Intelligence Vendor |
| 85 | 2026 Transportation Industry Cybersecurity Trends Report | Bottom Line Up Front (BLUF) Transportation cybersecurity is now an operational resilience issue, not just an IT problem. For SMB fleets, brokers, logistics providers, and insurers, the biggest takeaway is that cyber compromise increasingly enables real-world cargo theft, extortion, downtime, and claims activity. Top 3-5 Most Notable Statistics •Cargo theft claims reached $111.88 million in Q3 2025. •Cargo theft growth was especially sharp in the New York City metro area, with New Jersey up 110% and eastern Pennsylvania up 33%. •Average attacker breakout time fell to 18 minutes, faster than manual human response can reliably contain. •More than 80 distinct ransomware brands or groups were observed by Q3 2025. •Newly disclosed vulnerabilities were observed being exploited within 24 hours in some incidents. Top 3-5 Exploitable Technology Risks •AI-enabled social engineering, including phishing, business email compromise, deepfake voice calls, spoofed dispatch updates, and fraudulent shipping documents. •Stolen or purchased credentials used to access dispatch systems, carrier portals, FMCSA accounts, load boards, billing tools, and email. •Legitimate remote access, remote management, and file transfer tools weaponized to encrypt data, exfiltrate data, or collect operational details. |
| NMFTA | 2026 | ISAC / Industry Consortium |
| 86 | 9th Annual OT/ICS Cybersecurity Report: Year in Review 2026 | Bottom Line Up Front (BLUF) Dragos reports that OT/ICS attackers are moving beyond access and into mapping industrial control processes, which raises the risk of real operational disruption. For SMBs with manufacturing, utilities, logistics, energy, or other operational environments, and for insurance teams assessing these risks, the key issue is not only whether attackers get in, but whether the business can see, contain, and recover before downtime occurs. Top 3-5 Most Notable Statistics •Dragos tracked 119 ransomware groups impacting more than 3,300 industrial organizations in 2025. •Ransomware groups targeting industrial organizations increased by approximately 49%, from 80 in 2024 to 119 in 2025. •Dragos estimates that fewer than 10% of OT networks worldwide have visibility and monitoring in place. •30% of Dragos incident response cases in 2025 began with unexplained operational issues rather than a confirmed cyber event. •Public exploits were weaponized in an average of 24 days, while 26% of advisories offered no patch. Top 3-5 Exploitable Technology Risks •Internet-facing remote access and perimeter devices, including VPN appliances and products from Ivanti, Palo Alto Networks, Fortinet, F5, Cisco, Citrix, and others, were repeatedly highlighted as attacker entry points. •Weak, reused, or compromised credentials enabled access through VPNs, Remote Desktop Protocol, cloud identity systems, vendor accounts, and remote access infrastructure. •Poor IT/OT segmentation allowed attackers to move from enterprise systems toward OT-adjacent assets such as engineering workstations, jump servers, historian databases, and SCADA-related systems. |
| Dragos | 2026 | OT/ICS Security Vendor |
| 87 | A Director's Guide to AI Governance | Bottom Line Up Front (BLUF) AI is already creating governance, privacy, confidentiality, cyber, regulatory, and reputational risk for organisations, especially where use is not visible to management or the board. For SMBs and insurance teams, the key takeaway is that AI risk should be governed deliberately through clear accountability, inventories, policies, vendor controls, and ongoing monitoring—not treated as a standard IT issue. Top 3-5 Most Notable Statistics •63% of surveyed IT governance professionals across Australia and New Zealand reported widespread employee use of Generative AI. •Only 36% of organisations in that poll expressly permitted Generative AI use. •Just 11% of respondents said their organisation had a comprehensive policy for Generative AI use. •The guide sets out 8 elements of safe and responsible AI governance. Top 3-5 Exploitable Technology Risks •Shadow AI: employees or contractors using unauthorised AI tools for work can create privacy and confidentiality breaches outside normal oversight. •AI-powered cyber attacks and scams: the report identifies AI-enabled cyber attacks, fraudulent use, and scams as risks arising from malicious or unlawful AI use. •Security failures or vulnerabilities in AI systems: poor controls around AI systems can create exploitable weaknesses. •Third-party and vendor AI risk: procured products and services may include AI capabilities that are not properly identified, assessed, or monitored. |
| AICD | 2025 | Research Organization |
| 88 | A Director's Introduction to AI | Bottom Line Up Front (BLUF) AI is already becoming part of core business operations, but its use is often hard for leaders to see and govern. For SMBs and insurance teams, the main takeaway is that AI can improve productivity and customer service, but unmanaged use can create privacy, cyber security, discrimination, intellectual property, regulatory, reputational, and liability risks. Top 3-5 Most Notable Statistics •Almost two-thirds of Australian organisations are already using, or actively planning to use, AI systems. •A February 2024 survey found 53 per cent of Australian professionals are actively using or experimenting with Generative AI at work. •Generative AI could add between $45 billion and $115 billion in GDP to the Australian economy annually. •Generative AI has the potential to automate or augment 44 per cent of an average worker’s tasks. •In one algorithm-related consumer law case, Trivago was ordered to pay $44.7 million in penalties after misleading representations about hotel room rates. Top 3-5 Exploitable Technology Risks •Shadow AI use: employees may use Generative AI tools in ways that are not disclosed or permitted, creating governance, confidentiality, and data protection risks. •AI security failures or vulnerabilities: AI systems rely heavily on data and can increase cyber security breach risk if not properly managed. •AI-powered cyber attacks and weaponisation: the report identifies malicious use, including AI-powered cyber attacks, scams, misinformation at scale, and fraudulent or unlawful use. |
| AICD | 2024 | Research Organization |
| 89 | Acronis Cyberthreats Report H1 2025 | Bottom Line Up Front (BLUF) Acronis reports that ransomware, phishing, credential theft, and attacks through collaboration and remote management tools remain the most important cyber risks for SMBs and service providers in H1 2025. For SMB owners and insurance teams, the key takeaway is that attackers are increasingly using trusted business systems—email, Microsoft 365, collaboration apps, RMM tools, and MSP access—to create ransomware, data theft, and fraud losses. Top 3-5 Most Notable Statistics •Publicly claimed ransomware victims reached 3,642 from January–June 2025, nearly 70% higher than the same period in 2023 and 2024. •Phishing accounted for 52% of initial access cases involving MSPs, telcos, and similar providers from January–May 2025. •Phishing in collaboration apps rose from 9% to 30.5%, while advanced attacks in those apps increased from 9% to 24.5%. •Acronis found 20,000 malicious attachments in Microsoft 365 email backups among its customers. •Manufacturing represented 15% of recorded ransomware cases in Q1 2025, making it the most targeted industry in that period. Top 3-5 Exploitable Technology Risks •Remote monitoring and management tools: Once attackers gain RMM access, they can disable backups, push ransomware to multiple endpoints, and avoid traditional alerts. •Phishing and business email compromise: Attackers use deceptive emails, fake MFA prompts, malicious attachments, QR codes, and AI-generated impersonation to steal credentials or facilitate fraud. •Unpatched third-party software: The report highlights exploitation of Cleo file transfer vulnerabilities and Atlassian Jira flaws, including remote code execution and authentication bypass paths. |
| Acronis | 2025 | Backup & Recovery Vendor |
| 90 | Active Adversary Report 2026 | Bottom Line Up Front (BLUF) Sophos’ 2026 Active Adversary Report shows that attackers are still succeeding mostly with familiar methods, especially by abusing identity rather than relying on new AI-driven techniques. For SMBs and insurance teams, the key takeaway is that strong identity controls, usable telemetry, and basic prevention remain central to reducing ransomware, data theft, business email compromise, and incident response costs. Top 3-5 Most Notable Statistics •84% of the dataset came from organizations with fewer than 1,000 employees, and 56% had 250 employees or fewer. •Compromised credentials accounted for 42.06% of identified root causes, while brute-force attacks accounted for 15.58%. •Data exfiltration reached 12.71%, the highest percentage Sophos has recorded since launching the Active Adversary reports. •Median attacker dwell time stabilized at 3 days, with MDR cases showing shorter median dwell time than incident response cases. •MFA was not enabled or not fully configured in 59.46% of incidents. Top 3-5 Exploitable Technology Risks •Compromised credentials, brute-force attacks, and phishing remain the leading identity-based paths into victim environments. •Weak or incomplete MFA configurations, including non-phishing-resistant MFA, infrequent prompts, long-lived session tokens, and delayed credential resets, can allow attackers to maintain access. •Unpatched vulnerabilities still matter; among confirmed exploited vulnerability cases, 67.31% involved CVE-2024-40766 in SonicOS. |
| Sophos | 2026 | Endpoint / MDR / XDR Vendor |
| 91 | Adversarial AI: Attacker Innovation Escalates Advanced Email Threats | Bottom Line Up Front (BLUF) AI is making email attacks harder for employees and legacy tools to detect, especially phishing, business email compromise, and vendor email compromise. For SMBs and insurance teams, the key takeaway is that smaller organizations are directly in scope: the report says companies with 1,000 inboxes or fewer faced more than a 70% weekly chance of receiving at least one BEC attack in 2024. Top 3-5 Most Notable Statistics •Phishing accounted for more than 76% of all advanced attacks. •Median monthly BEC attacks grew by more than 54% between 2023 and 2024. •BEC caused $2.9 billion in losses in 2023. •Organizations with 1,000 inboxes or fewer faced more than a 70% weekly chance of receiving at least one BEC attack in 2024. •Organizations had an average 70% weekly chance of receiving at least one VEC attack in 2024, up more than 10% from 2023. Top 3-5 Exploitable Technology Risks •AI-generated phishing emails that are grammatically clean, brand-consistent, and difficult to distinguish from legitimate communications. •File-sharing phishing using trusted platforms such as Dropbox, ShareFile, and Docusign, where malicious messages can appear identical to legitimate notifications. •Multichannel phishing that starts in email and moves to text messages, phone calls, WhatsApp, or Telegram, bypassing company-managed devices and enterprise controls. |
| Abnormal Security | 2025 | Email Security Vendor |
| 92 | African Cyberthreat Assessment Report 2021 | Bottom Line Up Front (BLUF) INTERPOL identifies online scams, business email compromise, botnets, and ransomware as major cyberthreats affecting Africa, with COVID-19 and rapid digital adoption expanding opportunities for criminals. For SMBs and insurance teams, the key takeaway is that financially motivated attacks are exploiting weak cybersecurity protocols, email trust, online banking, and unpatched systems, creating loss, downtime, and fraud exposure. Top 3-5 Most Notable Statistics •Africa has more than 500 million Internet users, representing about 38% of the population. •More than 90% of African businesses are operating without the necessary cybersecurity protocols in place. •Trend Micro recorded 679 million email threat detections, 8.2 million file detections, and 14.3 million web detections in Africa from January 2020 to February 2021. •Africa saw a 238% rise in cyberattacks on online banking platforms in 2020. •Research cited in the report found more than 1.5 million ransomware detections in Africa in 2020. Top 3-5 Exploitable Technology Risks •Phishing through emails, SMS, calls, malicious links, attachments, and phishing kits, used to steal credentials, banking details, and personal data. •Business Email Compromise, where criminals spoof or compromise legitimate email accounts to redirect invoice payments, wire transfers, or sensitive data. •Unpatched systems, including banking platforms and machines vulnerable through the Server Message Block protocol, which the report links to continued WannaCry ransomware activity. |
| INTERPOL | 2021 | Threat Intelligence Vendor |
| 93 | African Cyberthreat Assessment Report 2023 | Bottom Line Up Front (BLUF) INTERPOL identifies cybercrime in Africa as a growing business risk driven by rapid digital adoption, low-cost attack tools, and underreporting. For SMBs and insurance teams, the most important takeaway is that financially motivated attacks such as business email compromise, phishing, ransomware, banking trojans, and online scams can create direct losses, downtime, data exposure, and reputational harm. Top 3-5 Most Notable Statistics •Business email compromise caused reported U.S. company losses of USD 2.4 billion in 2021, a 28% increase from 2020. •Phishing is estimated to be linked to up to 90% of data breaches. •Lockbit2.0 accounted for approximately 38.8% of detected ransomware infections across Africa from January to September 2022, followed by Pysa at 14.3% and Lockbit3.0 at 8.2%. •Group-IB identified 5,862,188 compromised accounts located within African IPs acquired using RedLine Stealer between January and August 2022. •Data shared by 42 African countries showed only 59 ransomware reports filed with law enforcement agencies in 11 countries, indicating significant underreporting. Top 3-5 Exploitable Technology Risks •Business email compromise: attackers gain access to business email accounts, manipulate payment threads, delete payment details, and redirect transactions. •Phishing and phishing-as-a-service: low-cost phishing kits, fake domains, malicious links, and attachments allow even low-skill criminals to steal credentials and financial data. •Ransomware and ransomware-as-a-service: ready-made ransomware enables attackers to encrypt systems, steal data, and conduct double or triple extortion. |
| INTERPOL | 2023 | Threat Intelligence Vendor |
| 94 | AI at Work 2024 | Bottom Line Up Front (BLUF) AI is already inside most organizations, but executives see security, data privacy, and AI-enabled attacks as major concerns. For SMBs and insurance teams, the key takeaway is that AI adoption should not be treated only as an efficiency project; it also expands the attack surface and requires clearer controls, employee guidance, and identity-focused access management. Top 3-5 Most Notable Statistics •64% of executives said their organizations had moderate to widespread AI adoption in the past 12 months. •74% selected data privacy as a top AI concern, followed by 71% selecting security risks. •79% of executives viewed Identity and Access Management as important or very important when bringing AI capabilities into their organization. •58% of executives reported having developed employee guidance for AI usage, while 32% planned to do so in the next 12 months. •54% said their organizations were somewhat prepared to defend against AI-driven attacks, while 17% said they were somewhat or very unprepared. Top 3-5 Exploitable Technology Risks •Generative AI making phishing attacks more effective, increasing the risk that employees will be deceived by more convincing messages. •AI expanding the attack surface as organizations integrate it into products, internal systems, security operations, and workforce processes. •Rogue actors using AI to try to gain access to protected data. |
| Okta | 2025 | Threat Intelligence Vendor |
| 95 | AI Code, Security, and Trust 2023 | Bottom Line Up Front (BLUF) AI coding tools are now widely used, but the report finds that organizations are trusting them faster than they are securing them. For SMBs and insurance teams, the key issue is that AI-generated code can introduce insecure code and unsafe open source components while teams lack the automation, policy compliance, and review processes needed to catch those risks. Top 3-5 Most Notable Statistics •96% of surveyed teams use AI coding tools, and over half use them most or all of the time. •91.6% of respondents said AI coding tools generated insecure code suggestions at least some of the time. •56.4% said they encounter security issues in AI code suggestions sometimes or frequently. •79.9% reported that developers bypass security policies to use AI code completion tools. •Only 9.7% said their team automates 75% or more of security scans. Top 3-5 Exploitable Technology Risks •AI-generated insecure code suggestions that may be accepted into production applications without adequate verification. •Open source libraries and packages suggested by AI tools without sufficient validation, creating software supply chain exposure. •Low use of automated security scanning, which can allow vulnerable code to move faster than security teams can review it. |
| Snyk | 2023 | Threat Intelligence Vendor |
| 96 | AI in Identity Security: Demands a New Playbook | Bottom Line Up Front (BLUF) Delinea’s report argues that AI, especially agentic AI that can act autonomously, is becoming an identity security issue, not just an IT productivity tool. For SMBs and insurance teams, the key takeaway is that AI tools and AI agents need the same governance, access control, monitoring, and approval discipline as privileged users or machine identities. Top 3-5 Most Notable Statistics •94% of global companies use, pilot, or evaluate some form of AI in IT operations. •44% of organizations say their security architecture is fully equipped to support secure AI today. •47% of organizations name AI-generated phishing and deepfakes as a top identity security concern. •56% of firms report identifying shadow AI issues at least monthly. •Only 30% of companies with under 50 employees say they have comprehensive AI policies and controls in place. Top 3-5 Exploitable Technology Risks •Overprivileged AI agents: Agentic AI with excessive access to sensitive systems can expose data, create compliance issues, and broaden the impact of a compromise. •AI-generated phishing and deepfakes: The report identifies malicious actors’ use of AI for phishing, deepfakes, and social engineering as a leading concern. •AI-driven credential theft: AI-enabled credential theft is identified as one of organizations’ biggest identity risks. |
| Delinea | 2025 | Identity Security Vendor |
| 97 | AI Medical Device Cybersecurity: Regulations & Risks | Bottom Line Up Front (BLUF) AI-enabled medical devices create a combined cyber, safety, privacy, and regulatory risk because they are increasingly connected to hospital networks and rely on software, data, and machine-learning models that attackers can manipulate. For SMB healthcare providers, device developers, and insurance teams, the key takeaway is that medical device cybersecurity can no longer be treated as a standard IT issue; it must be managed as a patient-safety and business-continuity risk. Top 3-5 Most Notable Statistics •More than 1,000 AI-enabled medical devices had been authorized for marketing in the U.S. as of 2025. •53% of surveyed connected medical devices had at least one known critical vulnerability. •73% of IV pumps were reported to have a vulnerability that could jeopardize patient safety. •A 2024 analysis reported a 59% surge in published medical device vulnerabilities, identifying 993 vulnerabilities across 966 devices. •The healthcare sector saw an average of 830 cyberattacks per organization per week in 2021, a 71% increase over the prior year. Top 3-5 Exploitable Technology Risks •Software and firmware vulnerabilities in connected devices, including bugs that can allow attackers to crash devices, gain control, or alter operation. •Wireless and network attacks against Wi-Fi, Bluetooth, or proprietary protocols, including eavesdropping, replay, and spoofed commands. •Ransomware and malware spreading through hospital networks, which can make connected devices unavailable even when the device itself is not the direct target. |
| IntuitionLabs | 2026 | Research Organization |
| 98 | AI Risk & Readiness in the Enterprise 2025 | Bottom Line Up Front (BLUF) AI adoption is moving faster than AI governance, leaving many organizations exposed to data leaks, unauthorized AI use, compliance gaps, and weak oversight. For SMBs and insurance teams, the core issue is not whether AI is useful, but whether businesses can prove what data AI tools access, who owns the risk, and what controls are in place. Top 3-5 Most Notable Statistics •93.2% of organizations lack full confidence in securing AI-driven data. •80.2% of organizations are unprepared for AI regulatory compliance. •69.5% cite AI-powered data leaks as their top security concern in 2025. •47.2% have no AI-specific security controls in place. •Only 6.4% have an advanced AI security strategy with full visibility and control. Top 3-5 Exploitable Technology Risks •AI-powered data leaks, especially where AI systems interact with sensitive business or customer data. •Shadow AI or “Dark AI,” meaning unauthorized or unmonitored AI tools operating outside security visibility. •Unstructured data exposure, where documents, files, messages, or other less-controlled data may be accessible to AI systems. |
| BigID | 2025 | Compliance / GRC Vendor |
| 99 | AI Security Market Report 2025 | Bottom Line Up Front (BLUF) Latio AI’s 2025 report says the AI security market is crowded, confusing, and often grouped under broad labels that hide important differences between tools and risks. For SMBs and insurance teams, the key takeaway is to focus less on hype and more on the specific AI use cases, data access, and runtime behaviors that create real exposure. Top 3-5 Most Notable Statistics •Four major AI security use-case categories are identified: End User Data Control, AI Posture Management, AI for Security, and Application Runtime. •Three factors should guide AI security decisions: the organization’s risk profile, technology stack, and priorities. •2025 is described as a year in which AI security is defined by a disjointed landscape of solutions to unclear problems. •One additional category, AI policy and compliance management, is acknowledged but excluded because the report considers it smaller and less relevant to security engineers. Top 3-5 Exploitable Technology Risks •Employee use of unauthorized AI systems, especially where sensitive or unauthorized materials may be shared outside approved channels. •AI applications connected to internal data, which increase exposure if the application can be manipulated at runtime. •Agentic AI architectures, where AI agents take actions on behalf of users and may access sensitive data. •Self-hosted models, which the report highlights as especially vulnerable to poisoning and supply chain attacks. |
| Latio AI | 2025 | AI Security Vendor |
| 100 | AI Security Readiness: Insights from 100 Cloud Architects, Engineers, And Security Leaders | Bottom Line Up Front (BLUF) AI adoption is widespread, but security readiness is lagging. For SMBs and insurance teams, the main concern is that many organizations are using AI services without enough visibility, expertise, or AI-specific controls to manage risks such as shadow AI, exposed models, data leakage, and misconfigured cloud environments. Top 3-5 Most Notable Statistics •87% of respondents are using AI services, while only 13% report no AI use. •31% cite lack of AI security expertise as their top AI security challenge. •Only 13% report using AI-specific security posture management solutions. •25% do not know what AI services are running in their environment. •45% operate in hybrid cloud environments and 33% use multi-cloud setups, while 70% still rely on endpoint detection and response. Top 3-5 Exploitable Technology Risks •Shadow AI: Unapproved or unknown AI services create visibility and governance gaps, making it difficult to secure systems the business does not know are in use. •Improper tenant isolation: In multi-tenant GenAI environments, weak segmentation can expose data between workloads and users or allow lateral movement. •Exposed AI models and endpoints: The report notes that attackers are already targeting exposed models and endpoints. |
| Wiz | 2025 | Threat Intelligence Vendor |
| 101 | AI Security Report 2026 | Bottom Line Up Front (BLUF) AI is now part of everyday business infrastructure, and the main risk is no longer only “shadow AI” but approved tools moving sensitive data at high speed. For SMBs and insurance teams, the report’s key takeaway is that common AI assistants, writing tools, coding tools, and embedded AI features can create real exposure unless usage, data flows, and access are actively governed. Top 3-5 Most Notable Statistics •Zscaler analyzed 989.3 billion AI/ML transactions from January through December 2025. •Enterprise AI/ML activity increased 83% year over year across more than 3,400 applications. •Organizations blocked 39% of AI/ML transactions, reflecting active concern over data exposure, privacy, and policy alignment. •Enterprises transferred 18,033 TB of data to AI/ML applications, a 93% year-over-year increase. •ChatGPT generated 410 million data loss prevention policy violations, while Codeium generated 242 million. Top 3-5 Exploitable Technology Risks •AI data leakage through common tools: Sensitive data such as names, national identifiers, source code, medical information, payment data, and financial records attempted to leave organizations through AI applications. •Embedded AI in SaaS and productivity platforms: Built-in AI features may have broad access to business content and can be overlooked by traditional security tools. •Lack of visibility into prompts and AI usage: Organizations often do not know which AI tools employees use, what prompts they submit, or whether regulated data is involved. |
| Zscaler | 2026 | Cloud Security Vendor |
| 102 | AI-Driven Fraud 2026 | Bottom Line Up Front (BLUF) AI-driven fraud is making phishing, impersonation, account takeover, and remote access scams more personalized, scalable, and difficult to detect. For SMBs and insurance teams, the key takeaway is that fraud risk is no longer limited to email scams or fake websites; attackers can now blend social engineering, weak authentication, session hijacking, fake identities, and malicious digital assets to cause financial loss, customer harm, and reputational damage. Top 3-5 Most Notable Statistics •FBI data cited in the report shows phishing/spoofing remained a leading reported cybercrime in 2024, with 193,407 complaints. •Extortion complaints rose to 86,415 in 2024, according to the FBI data cited in the report. •Personal data breach complaints reached 64,882 in 2024. •Frost & Sullivan forecasts fraud detection and prevention revenue to grow from $21.8 billion in 2025 to $47.1 billion in 2030, a 16.6% CAGR. •ENISA reporting cited in the brief states that more than 80% of social engineering incidents worldwide stemmed from AI-powered phishing campaigns. Top 3-5 Exploitable Technology Risks •AI-generated phishing and spoofing that mimic human tone and context, making scams more personalized and harder to detect. •Account takeover using weak authentication, hijacked active sessions, credential abuse, and adversary-in-the-middle techniques that can bypass MFA. •Man-in-the-middle variants such as DNS poisoning and evil twin Wi-Fi that imitate legitimate domains and intercept credentials or sensitive data. |
| Memcyco | 2026 | Research Organization |
| 103 | All Angles 2021 | Bottom Line Up Front (BLUF) Trend Micro’s 2021 midyear findings show that ransomware, exposed enterprise systems, and cloud abuse remained the most urgent cyber risks, with attackers using more targeted methods, data theft, and extortion pressure. For SMBs and insurance teams, the key issue is not just malware infection, but business interruption, data exposure, ransom decision-making, and whether security controls are strong enough before a claim occurs. Top 3-5 Most Notable Statistics •Trend Micro detected over 7.3 million ransomware threats in the first six months of 2021. •Colonial Pipeline reportedly paid US$4.4 million in ransom after the DarkSide attack. •After Microsoft Exchange ProxyLogon exploitation, Trend Micro reported that at least 30,000 US organizations might have been attacked and 63,000 servers remained vulnerable. •Shodan showed more than 266,000 Exchange Servers vulnerable to ProxyLogon one day after Microsoft released a patch. •A cited 2020 report found that 80% of organizations that paid ransom demands experienced a second attack. Top 3-5 Exploitable Technology Risks •Microsoft Exchange Server ProxyLogon vulnerabilities were actively exploited and used to distribute botnets, coinminers, and ransomware including DearCry and BlackKingdom. •Windows Print Spooler vulnerabilities, including PrintNightmare, allowed arbitrary code execution with system privileges. •VPN vulnerabilities, including CVE-2018-13379 and CVE-2019-11510, remained important entry points; CVE-2019-11510 had been used to deliver Sodinokibi ransomware. |
| Trend Micro | 2021 | Threat Intelligence Vendor |
| 104 | Allianz Risk Barometer 2026 | Bottom Line Up Front (BLUF) Cyber incidents remain the top global business risk for 2026 and are the leading concern across large, mid-sized, and smaller companies. For SMBs and insurance teams, the key issue is that cyber risk is increasingly tied to AI, third-party technology providers, supply chains, business interruption, regulatory exposure, and data theft. Top 3-5 Most Notable Statistics •Cyber incidents ranked #1 globally for the fifth year in a row, selected by 42% of respondents. •Artificial intelligence rose to the #2 global risk, selected by 32% of respondents, up from #10 in 2025. •Around 90% of respondents expect to make a moderate or high investment in cyber loss prevention. •Ransomware accounted for 60% of the value of large cyber claims over €1mn seen by Allianz Commercial in the first half of 2025. •Only 3% of respondents rated their supply chains as “very resilient.” Top 3-5 Exploitable Technology Risks •Ransomware attacks: The report highlights ransomware as a major driver of large cyber claims and notes that recovery can take months, especially in complex supply chains. •Third-party and supply chain technology dependence: Businesses increasingly rely on external providers for critical data and services, creating exposure when a supplier, customer, cloud provider, or digital platform is disrupted. •Data theft and sensitive data exposure: Allianz Commercial notes that data theft appeared in 40% of the value of large cyber claims in the first half of 2025, up from 25% in all of 2024. |
| Allianz | 2026 | Cyber Insurance Carrier |
| 105 | Altitude Cyber Cybersecurity Market Review 2024 | Bottom Line Up Front (BLUF) Altitude Cyber’s 2024 review shows a cybersecurity market with rising investment, active consolidation, and persistent operational risk from cloud, software supply chain, identity, phishing, ransomware, and third-party exposure. For SMBs and insurance teams, the key takeaway is that cyber risk is increasingly tied to business interruption, vendor dependency, sensitive data exposure, and the ability to prove basic controls are in place. Top 3-5 Most Notable Statistics •280 cybersecurity M&A transactions occurred in 2024, totaling $53.3B in deal volume. •892 cybersecurity financing transactions occurred in 2024, totaling $13.2B in deal volume. •CrowdStrike’s July outage affected an estimated 8.5M devices and caused an estimated $5.4B in losses for the top 500 U.S. companies. •In a cited software supply chain survey, 64% of global respondents notified of a vulnerability or attack within their supply chain reported significant financial loss in 2024, up from 49% in 2022. •In a cited enterprise security survey, 49% of firms lost credentials to phishing, 48% were compromised through a third party, and 30% had ransomware encrypt their data. Top 3-5 Exploitable Technology Risks •Software supply chain weaknesses, including limited software inventories, lack of visibility, and insufficient SBOM use, can expose organizations to vulnerable third-party components. •Cloud security gaps, including misconfigurations, policy drift, over-privileged access, and unclear visibility into sensitive cloud data, create direct data exposure risk. •Phishing and credential compromise remain major attack paths, especially where identity and access management controls are weak. |
| Altitude Cyber | 2024 | Threat Intelligence Vendor |
| 106 | Altitude Cyber Cybersecurity Market Review 2025 | Bottom Line Up Front (BLUF) Altitude Cyber’s 2025 market review shows a cybersecurity market moving into a “disciplined growth / AI-era,” with strong M&A and financing activity concentrated around risk, compliance, identity, SecOps, threat intelligence, data security, and application security. For SMBs and insurance teams, the key takeaway is that AI-enabled attacks, identity misuse, fraud, and data extortion are becoming more important risk areas while the vendor market rapidly consolidates and funds solutions to address them. Top 3-5 Most Notable Statistics •$70.2B in 2025 year-to-date cybersecurity M&A deal volume, up 41% YoY, across 238 deals. •$11.2B in 2025 year-to-date cybersecurity financing deal volume across 731 deals. •Q3 2025 included 86 M&A transactions totaling $29.2B, with deal count up 19% YoY. •Q3 2025 included 234 financing transactions totaling $3.1B, with financing deal count up 23% YoY. •Anthropic reported a data extortion case targeting at least 17 organizations, with ransom demands up to $500K+. Top 3-5 Exploitable Technology Risks •AI-enabled cyberattacks: The report highlights that AI models are being used to perform sophisticated attacks, not only advise attackers. •AI-assisted fraud and scams: Bad actors are using AI for phishing, deepfakes, stolen data analysis, credit card theft, and false identity creation. •Identity-based attacks: The report emphasizes identity threat detection and response, passwordless access, and continuous access validation as key areas of investment. |
| Altitude Cyber | 2025 | Threat Intelligence Vendor |
| 107 | Annual Appsec Report 2022 | Bottom Line Up Front (BLUF) Checkmarx’s 2022 Annual AppSec Report shows that vulnerable applications are a major breach driver, with surveyed organizations reporting frequent incidents tied to software weaknesses. For SMB owners and insurance teams, the key takeaway is that application security, cloud configuration, and software supply chain controls should be treated as core business-risk issues, not just technical concerns. Top 3-5 Most Notable Statistics •91% of respondent organizations were breached at least once in the prior 12 months as a direct result of a vulnerable application. •69% reported multiple application-related breaches in that period. •The top reported breach causes were insider data leak (41%), software supply chain attack (41%), known unpatched vulnerability (40%), and cloud application misconfiguration (39%). •54% said the shift to cloud made them more concerned about secure application development. •Less than 1% of AppSec managers and developers said they continuously test applications during development to detect exploitable vulnerabilities. Top 3-5 Exploitable Technology Risks •Software supply chain attacks, especially involving open source packages and limited visibility into what is used in custom applications. •Known, unpatched vulnerabilities that remain in applications and can be exploited after disclosure. •Cloud application misconfigurations caused during development or deployment. |
| Checkmarx | 2022 | Application / API Security Vendor |
| 108 | Annual Cyber Report 2024 | Bottom Line Up Front (BLUF) Pinsent Masons’ 2024 annual cyber review shows that ransomware, data theft, and supply chain incidents remained central cyber risks in 2023, with third-party issues becoming a major source of breach exposure. For SMBs and insurance teams, the key takeaway is that cyber risk is no longer limited to an organisation’s own systems: suppliers, software providers, credentials, and contractual responsibilities can materially affect incident response, regulatory duties, and claims outcomes. Top 3-5 Most Notable Statistics •58% of Pinsent Masons’ cyber cases involved some form of ransomware attack. •43% of matters involved data exfiltration, meaning data was stolen from company systems. •The ICO was notified in 56% of matters in 2023, down from 64% in 2022 and 72% in 2021. •Financial services represented the largest share of client instructions at 31%. •A cited survey found 90% of respondents believed they were at risk of a supply chain attack, but only 33% reported conducting robust supplier assessments. Top 3-5 Exploitable Technology Risks •Third-party and supply chain weaknesses, including breaches at processors, outsourced service providers, and software suppliers, which can affect many downstream organisations at once. •Vulnerability and configuration issues, including exploited zero-day vulnerabilities in widely used software and applications. •Phishing emails, including increasingly credible phishing enabled by generative AI and large language models. |
| Pinsent Masons | 2023 | Consulting / Analyst Firm |
| 109 | Annual Cyber Threat Report | Bottom Line Up Front (BLUF) Australia’s cyber threat environment worsened in FY2024–25, with higher reported business losses, more incidents handled by ASD’s ACSC, and continued ransomware, credential theft, phishing, DDoS, and edge-device exploitation. For SMBs and insurance teams, the key takeaway is that basic control failures remain highly exploitable and can lead to material financial loss, downtime, data theft, and extortion. Top 3-5 Most Notable Statistics •ASD’s ACSC received over 42,500 calls to the Australian Cyber Security Hotline, up 16% from the previous year. •Average self-reported cybercrime cost for businesses rose 50% overall to $80,850 per report; small businesses averaged $56,600 and medium businesses averaged $97,200. •ASD’s ACSC responded to over 1,200 cyber security incidents, an 11% increase from last year. •ASD’s ACSC responded to 138 ransomware incidents in FY2024–25. •ASD’s ACSC observed more than 120 incidents associated with attacks on edge devices, of which 96% were successful. Top 3-5 Exploitable Technology Risks •Internet-facing edge devices such as routers, firewalls, and VPN products, which attackers exploit to gain an initial foothold or hide activity through compromised devices. •Stolen or compromised credentials, including credentials harvested by information stealer malware and reused to access corporate accounts. •Phishing and social engineering, which were observed as common techniques and can trick staff into revealing credentials, opening attachments, visiting malicious sites, or transferring funds. |
| ASD | 2025 | Government / Intelligence Agency |
| 110 | Annual Cyber Threat Report 2025 | Bottom Line Up Front (BLUF) ReliaQuest’s 2025 report shows that attackers are moving quickly, often using familiar entry points: phishing, stolen credentials, exposed remote access, public-facing applications, and social engineering. For SMBs and insurance teams, the key takeaway is that basic control gaps such as inadequate logging, unmanaged devices, weak VPN protections, and help-desk process failures can turn common attacks into costly breaches involving data theft, downtime, and extortion. Top 3-5 Most Notable Statistics •85% of incidents involved compromised service accounts. •45% of hands-on-keyboard intrusions began with abuse of external remote services such as VPNs. •1 in 4 active intrusions started with exploitation of public-facing applications. •80% of breaches involved data exfiltration, compared with 20% involving encryption. •Automated response playbooks reduced the fastest mean time to contain threats to 3 minutes, compared with an average of 6.3 hours for customers without them. Top 3-5 Exploitable Technology Risks •Exposed remote access services, including VPN portals, RDP, and virtual desktop infrastructure, can be abused with stolen or purchased credentials. •Public-facing applications and internet-facing devices can provide attackers with direct entry points when vulnerabilities are not promptly addressed. •Inadequate logging and unmanaged devices create blind spots that prevent detection and investigation of malicious activity. |
| ReliaQuest | 2025 | MSP / MSSP / SOC Provider |
| 111 | Annual Cybersecurity Report 2023 | Bottom Line Up Front (BLUF) Trend Micro’s 2023 report shows attackers shifting from broad, high-volume attacks toward more targeted, harder-to-detect activity that reaches endpoints, cloud applications, and remote-work environments. For SMBs and insurance teams, the key takeaway is that lower detection counts in some areas do not mean lower risk; ransomware, business email compromise, risky cloud access, and unpatched systems remain practical loss drivers. Top 3-5 Most Notable Statistics •Trend Micro blocked 161.0B overall threats in 2023, a 10% increase from 146.4B in 2022. •File Reputation Service detections increased to 82,149,430,110 in 2023, up from 60,925,991,943 in 2022. •Business email compromise detections increased 349%, from 4,263,650 in 2022 to 19,149,460 in 2023. •SMBs accounted for 26,430 unique ransomware endpoint detections, compared with 166,069 for enterprises and 21,271 for consumers. •The top two attack surface risk events were 82,976,277,500 risky cloud app access events and 18,819,067,819 risky website access events. Top 3-5 Exploitable Technology Risks •Remote encryption in ransomware attacks, where attackers map drives and encrypt files without extensive lateral movement, reducing their footprint. •Intermittent encryption, where ransomware encrypts chunks of data quickly while still making affected data unusable and complicating recovery. •Endpoint Detection and Response bypass using unmonitored virtual machines in Windows Hyper-V environments. |
| Trend Micro | 2023 | Threat Intelligence Vendor |
| 112 | Annual Data Breach Report 2023 | Bottom Line Up Front (BLUF) ITRC reports that 2023 set a new U.S. record for publicly reported data compromises, with 3,205 events affecting more than 353 million victims. For SMBs and insurance teams, the most important takeaway is that risk is increasingly concentrated in cyberattacks and supply chain events, where one vendor or software compromise can affect hundreds or thousands of downstream organizations. Top 3-5 Most Notable Statistics •3,205 total data compromises were reported in 2023, a 78% increase over 2022 and 72% above the prior all-time high in 2021. •353,027,892 victims were impacted by reported data compromises in 2023. •Cyberattacks accounted for 2,365 breaches and 343,338,964 victims. •Supply chain attacks affected 2,769 entities and more than 54 million victims, representing 15% of all victims in 2023. •More than 1,400 public breach notices did not identify an attack vector, nearly double the 716 such notices in 2022. Top 3-5 Exploitable Technology Risks •Supply chain attacks: Attackers can target smaller vendors or shared products and services to reach customer, client, or vendor data across many organizations. •Phishing, smishing, and business email compromise: These remained a major cyberattack category, with the report noting increasingly effective social engineering tied to stolen personal information. •Ransomware: Ransomware continued to be a significant reported attack vector, with 246 incidents identified in 2023. |
| ITRC | 2023 | Research Organization |
| 113 | Annual Data Breach Report 2024 | Bottom Line Up Front (BLUF) ITRC reports that 2024 data compromises remained near record levels, with victim notices rising sharply because of a small number of very large breaches. For SMBs and insurance teams, the key takeaway is that basic control failures, limited breach transparency, and third-party exposure continue to create preventable loss scenarios. Top 3-5 Most Notable Statistics •3,158 total data compromises were reported in 2024, only 44 events below the 2023 all-time high. •1,350,835,988 victim notices were issued, a 211% year-over-year increase. •5 mega-breaches accounted for more than 1B victim notices and approximately 83% of all breach notices. •65% of all compromise notices did not contain attack vector details; for cyberattack-related notices, approximately 70% did not include attack information. •Financial Services was the most breached industry with 737 compromises, followed by Healthcare with 536. Top 3-5 Exploitable Technology Risks •Stolen credentials and weak authentication: attacks using stolen credentials were tied to major breaches, and the report states that MFA could have blocked attacks against Ticketmaster, AT&T, and Change Healthcare. •Phishing, smishing, and business email compromise: 455 compromises were attributed to these methods. •Ransomware: 188 compromises were attributed to ransomware. |
| ITRC | 2024 | Research Organization |
| 114 | Annual Data Exposure Report 2022 | Bottom Line Up Front (BLUF) Code42’s 2022 report shows that employee-driven data exposure is a major business risk, especially during turnover and hybrid work. For SMBs and insurance teams, the key issue is not only malicious insiders, but also departing or careless employees moving sensitive data into places the business cannot see or control. Top 3-5 Most Notable Statistics •98% of respondents have cybersecurity concerns about employees leaving during the Great Resignation. •71% are concerned about lack of visibility into what or how much sensitive data departing employees take to other companies. •71% are concerned about sensitive data saved on local machines, personal hard drives, personal cloud storage, or personal services. •96% of companies experience challenges protecting corporate data from Insider Risks. •63% of surveyed companies do not measure the success of Insider Risk detection. Top 3-5 Exploitable Technology Risks •Sensitive data stored on local machines or personal hard drives, where the company may have limited visibility or control. •Sensitive data saved in personal cloud storage or personal services, increasing the chance of data leaving approved business systems. •Departing employees taking intellectual property, customer data, or other sensitive information to other companies. |
| Code42 | 2022 | Endpoint / MDR / XDR Vendor |
| 115 | Annual Data Exposure Report 2023 | Bottom Line Up Front (BLUF) Code42’s 2023 report shows that insider-driven data exposure, loss, leak, and theft are increasing despite many organizations already having dedicated Insider Risk programs. For SMB owners and insurance teams, the key issue is that trusted users can move sensitive data to untrusted places through normal work activity, creating financial, operational, reputational, and competitive risk that is difficult to detect. Top 3-5 Most Notable Statistics •Insider-driven data exposure, loss, leak, and theft events increased by an average of 32% year over year. •A single insider-driven data exposure, loss, leak, or theft event could cost companies $16 million on average. •75% of respondents said data loss from insiders is a problem within their company. •72% of companies reported having a dedicated Insider Risk or insider threat program, yet 71% still expected insider-related data loss to increase in the next 12 months. •90% of companies used a combination of Insider Risk Management, Data Loss Prevention, Cloud Access Security Broker, and User and Entity Behavior Analytics tools to protect data from insider exfiltration. Top 3-5 Exploitable Technology Risks •Movement of sensitive corporate data to personal devices, personal email, or cloud destinations, where company control and visibility may be reduced. •Source code sent to repositories, identified as an area where organizations need much more visibility. •Files sent to personal email accounts, which can enable data to leave managed business systems. |
| Code42 | 2023 | Endpoint / MDR / XDR Vendor |
| 116 | Annual Data Exposure Report 2024 | Bottom Line Up Front (BLUF) Insider-driven data exposure is increasing despite widespread use of traditional data protection tools. For SMBs and insurance teams, the key takeaway is that sensitive data can leave through everyday business workflows, including cloud accounts, email, CRM systems, source code repositories, and GenAI tools, creating financial, compliance, competitive, and reputational risk. Top 3-5 Most Notable Statistics •99% of surveyed companies have data protection solutions in place, yet 78% of cybersecurity leaders say sensitive data has still been breached, leaked, or exposed. •Insider-driven data exposure, loss, leak, and theft events have increased by 28% on average from 2021 to today. •Companies experience an average of 24 insider-driven data events per month. •Cybersecurity leaders estimate a single insider-driven data event would cost their company $15 million on average. •86% of cybersecurity leaders worry employees may put sensitive data into GenAI tools that could be found by competitors. Top 3-5 Exploitable Technology Risks •Personal cloud accounts, ranked as the top exfiltration method by risk, can allow company files to move outside approved business systems. •CRM data downloads are a major visibility gap, with 90% of respondents saying they need more visibility into this activity. •Source code sent to repositories is a high-risk exposure path because theft or leakage can lead to lost intellectual property, unauthorized access, or intentionally introduced vulnerabilities. |
| Code42 | 2024 | Endpoint / MDR / XDR Vendor |
| 117 | Annual Report 2026 (Insights from our Cyber team) | Bottom Line Up Front (BLUF) Pinsent Masons’ 2026 annual cyber report shows that ransomware remains the leading incident type, but the risk is shifting toward supply chain compromise, data theft, and heavier regulatory scrutiny. For SMBs and insurance teams, the key takeaway is that cyber losses are increasingly driven not only by direct attacks, but also by vulnerable vendors, unclear incident evidence, and post-breach legal and regulatory obligations. Top 3-5 Most Notable Statistics •Ransomware accounted for 52% of matters in 2025, up from 48% in 2024. •Third-party and supply chain incidents rose from 6% in 2024 to 19% of matters in 2025. •59% of ransomware cases involved data exfiltration, while in 15% it was unclear whether data had been taken. •Business email compromise represented 17% of matters, with mailbox synchronisation in 44% of BEC cases and invoice fraud in 33%. •83% of clients held cyber insurance in 2025, up from 78% in 2024; 25% of victim clients paid a ransom. Top 3-5 Exploitable Technology Risks •Exploitation of vulnerabilities remained the leading root cause of incidents, including attacks through third-party software or applications. •Supply chain and data processor breaches created exposure where clients did not always receive clear confirmation of root cause, encryption, or data exfiltration. •Business email compromise with mailbox synchronisation created risk of data access, fraud, and invoice manipulation. |
| Pinsent Masons | 2026 | Consulting / Analyst Firm |
| 118 | Annual Research Report 2021 | Bottom Line Up Front (BLUF) NCC Group’s 2021 research points to one clear takeaway: SMBs have less time than ever to respond when vulnerabilities are disclosed, because exploitation after patch release has dropped from weeks to days. For insurers and risk teams, this makes patch speed, software supply chain visibility, and cloud/container security controls central to reducing loss potential. Top 3-5 Most Notable Statistics •NCC Group delivered over 237 research publications and conference presentations in 2021. •The report includes 139 research papers, whitepapers, technical blog posts, and advisories. •NCC Group released around 30 open source security tools, major updates, implementations, or repositories. •NCC Group delivered 8 public security audit reports across cryptographic implementations, Google One VPN, WhatsApp encrypted backups, and other systems. •In one smart home honeypot project, researchers detected more than 12,000 scanning or hacking attempts in a single week. Top 3-5 Exploitable Technology Risks •Rapid exploitation after disclosure: the report states that exploitation after patch release has fallen from several weeks to only a few days, increasing pressure on vulnerability management. •Log4Shell and related Log4j vulnerabilities: NCC Group highlighted widespread exploitation, remote code execution risk, detection rules, indicators of compromise, and mitigation tooling. •Container and Kubernetes risk: research included a containerd vulnerability resulting in full root container escape in a common configuration, plus gaps in Kubernetes hardening guidance, RBAC complexity, audit configuration, and external dependency handling. |
| NCC Group | 2021 | Threat Intelligence Vendor |
| 119 | Annual Research Report 2023 | Bottom Line Up Front (BLUF) NCC Group’s 2023 annual research report shows that the most practical cyber risk remains exploitation of weak, legacy, misconfigured, or poorly monitored technology across cloud, edge devices, remote access, CI/CD pipelines, and connected devices. For SMBs and insurance teams, the key takeaway is that ransomware, extortion, data theft, and operational disruption often stem from everyday technology gaps rather than exotic attacks. Top 3-5 Most Notable Statistics •NCC Group released 18 public reports and presented at 32+ global conferences and seminars during 2022 and 2023. •NCC Group reported 69+ security vulnerabilities across third-party products. •NCC Group released 21 open-source security tools and repositories. •Fox-IT uncovered a mass-exploitation campaign involving 2,000 backdoored Citrix NetScalers. •Research into enterprise connected devices found 1 critical and 9 high-risk vulnerabilities across 8 tested devices. Top 3-5 Exploitable Technology Risks •Legacy and unpatched systems, including cloud-hosted components, are repeatedly identified as exploitable by ransomware groups and advanced threat actors. •Remote Desktop Protocol was used for lateral movement by multiple threat actors, including those deploying ShadowPad, LockBit 3.0, Everest, and Black Basta. •Edge devices such as FortiGate, Citrix, and Cisco products are highlighted as increasingly exploited, with limited visibility often making response difficult. |
| NCC Group | 2023 | Threat Intelligence Vendor |
| 120 | Annual Security Report 2024 | Bottom Line Up Front (BLUF) DNSFilter’s 2024 Annual Security Report shows that domain-based threats remain a central path into organizations, especially through phishing, malware, botnets, and newly registered malicious domains. For SMBs and insurance teams, the key takeaway is that many attacks begin with users clicking links or systems reaching malicious domains, making DNS-layer visibility and blocking an important loss-prevention control. Top 3-5 Most Notable Statistics •DNSFilter processed over 1 million queries every second in 2023. •Roughly 65% of attacks by highlighted ransomware actors leveraged domains at some point during the attack. •90% of cyberattacks start with a phishing attack, according to the report’s cited CISA figure. •Phishing detections increased by 106%, malware detections by 40%, botnet detections by 32%, and blocks for very new malicious domains increased by 1250% compared with 2022. •The average user is likely to encounter 5 malicious queries per day, or 1,825 every year. Top 3-5 Exploitable Technology Risks •Phishing and malicious links: The report emphasizes that ransomware actors heavily rely on phishing, social engineering, and links to malicious websites. •Very new malicious domains: Domains registered within the previous 24 hours saw sharply increased blocking, showing attackers continue to use fresh infrastructure. •Domain Generation Algorithms: Randomly generated domain strings used in malware attacks are highlighted as an increasing concern as malware and ransomware grow. |
| DNSFilter | 2024 | Network Security Vendor |
| 121 | Annual Security Report 2025 (January 2025) | Bottom Line Up Front (BLUF) DNSFilter’s 2025 Annual Security Report shows that malicious DNS activity is rising, especially phishing, malware, and short-lived scam domains tied to current events. For SMBs and insurance teams, the key takeaway is that many attacks are visible at the DNS layer before they become business-impacting incidents such as ransomware, account compromise, fraud, or downtime. Top 3-5 Most Notable Statistics •DNSFilter processes an average of 170 billion DNS queries per day and stops more than 200 million daily active threats. •Threats on DNSFilter’s network grew by 36% between October 2023 and September 2024. •Phishing increased by 203%, while malware queries increased by 14% over the reporting period. •One in every 174 DNS requests was malicious, meaning an average user making 5,000 DNS requests per day could encounter up to 29 threat queries daily. •New domains made up over 68% of all unique threat domains on the DNSFilter network. Top 3-5 Exploitable Technology Risks •Phishing and deception domains: These are a major delivery path for ransomware and account compromise. •Malware domains: Malware generated the largest share of malicious blocked requests outside proxy and filter avoidance, with repeated “phone home” behavior observed. •Newly registered and very new domains: Attackers use short-lived domains to exploit breaking news, outages, disasters, and elections before traditional defenses catch up. |
| DNSFilter | 2025 | Network Security Vendor |
| 122 | Annual Security Report 2026 | Bottom Line Up Front (BLUF) DNSFilter reports that threat activity increased sharply over the past year, with users now encountering far more malicious DNS requests in day-to-day web use. For SMBs and insurance teams, the key takeaway is that phishing, malware, new domains, and event-driven scams remain practical, high-frequency risks that can lead to credential theft, malware delivery, business disruption, and claims activity. Top 3-5 Most Notable Statistics •DNSFilter processes more than 200 billion DNS queries per day and blocks roughly 7% of that traffic. •Identified threats on DNSFilter’s network grew by 30% between October 2024 and September 2025. •DNSFilter processed more than 52 trillion queries during the report period. •The average user is now likely to encounter 66 threats per day, more than double the prior report’s figure of 29. •New domains make up over 65% of all unique threat domains on the DNSFilter network. Top 3-5 Exploitable Technology Risks •New and short-lived domains: Attackers frequently use newly registered or newly observed domains as testing grounds for phishing, malware, and other threats, then discard or recycle them quickly. •Malware and infostealers: Malware remained the highest month-over-month blocked request category, and Lumma Stealer used fake CAPTCHA prompts to attempt fileless malware delivery. •Phishing-as-a-service: Tycoon 2FA showed target-specific subdomain generation, suggesting phishing infrastructure built for specific campaigns or individual targets. |
| DNSFilter | 2026 | Network Security Vendor |
| 123 | Annual State of Email Security 2024 | Bottom Line Up Front (BLUF) Email remains a primary entry point for cyberattacks, and Cofense reports that malicious emails bypassing secure email gateways increased sharply in 2023. For SMBs and insurance teams, the key takeaway is that relying only on traditional email filtering is not enough; credential theft, QR-code phishing, brand impersonation, malware, and business email compromise can still reach users and create financial, operational, and data-loss exposure. Top 3-5 Most Notable Statistics •Cofense saw a 104.5% increase in malicious emails bypassing secure email gateways per customer. •Credential phishing volume increased 67% compared with 2022 and represented 91% of active threat reports in 2023. •QR-code active threat reports increased 331% in 2023. •Healthcare and finance saw increases in malicious emails bypassing secure email gateways of 84.5% and 118%, respectively. •Cofense observed a 1,092% increase in Google AMP emails bypassing secure email gateways in the second half of 2023 compared with the first half. Top 3-5 Exploitable Technology Risks •Credential phishing: Attackers trick users into giving up login credentials, which can lead to unauthorized access, ransomware, data breaches, and business email compromise. •QR-code phishing: Attackers move users from protected corporate systems to smartphones, often using PDFs, HTM files, Word documents, embedded images, redirects, CAPTCHA pages, and link shorteners. •Brand impersonation and vishing: Attackers use trusted company branding, phone calls, or automated messages to obtain sensitive information, often without obvious malicious attachments or links. |
| Cofense | 2024 | Email Security Vendor |
| 124 | Annual State of Email Security Report 2023 | Bottom Line Up Front (BLUF) Cofense’s 2023 report shows that email remains a primary path into organizations, with credential phishing leading observed threats and contributing to downstream risks such as business email compromise and ransomware. For SMBs and insurance teams, the key takeaway is that basic inbox-level controls, employee reporting, and rapid response to suspicious emails are central to reducing financial loss and operational disruption. Top 3-5 Most Notable Statistics •Cofense Intelligence saw 569% more malicious phishing emails in 2022. •Credential phishing-related Active Threat Reports increased by 478%. •Malware identified by Cofense increased by 44%. •Web3 technologies used in phishing campaigns increased by 341%. •Telegram bots used as destinations for stolen phishing data increased by more than 800% year over year. Top 3-5 Exploitable Technology Risks •Credential phishing remains the top attack vector, allowing attackers to steal account access and support ransomware, BEC, and vendor email compromise. •Auto-forwarding rules in compromised mailboxes can let attackers monitor financial keywords such as invoices, purchase orders, and quotes. •Malicious HTML and HTM attachments are increasingly used to deliver malware or credential phishing pages and can bypass email controls. |
| Cofense | 2023 | Email Security Vendor |
| 125 | Annual State of Phishing Report 2021 | Bottom Line Up Front (BLUF) Phishing remained a practical path into organizations in 2020 because attacks routinely bypassed secure email gateways and reached user inboxes. For SMBs and insurance teams, the key takeaway is that phishing risk cannot be managed by email filtering alone; rapid user reporting, analysis, and removal of malicious emails are central to reducing compromise risk. Top 3-5 Most Notable Statistics •1 in 11 user-reported emails analyzed by Cofense were malicious. •57% of malicious reported emails were credential phishing, while 12% delivered malware and 6% involved business email compromise or CEO fraud. •45% of credential phishing attacks were Microsoft-themed, and 17% were finance-themed. •The average lifespan of a phishing URL was less than 24 hours, limiting the usefulness of static blocklists. •Cofense reported an average 10.7% click rate for credential phishing simulations, meaning roughly 11 out of 100 users may click during a real attack. Top 3-5 Exploitable Technology Risks •Secure email gateway bypass: the report states that all secure email gateways leak, allowing phishing emails to reach inboxes despite filtering. •Credential phishing pages: attackers can cheaply host and quickly change login-harvesting infrastructure, leaving few reliable indicators for defenders. •Trusted platform abuse: attackers used services such as Microsoft SharePoint, OneDrive, Office 365, Google Forms, Adobe, Dropbox, Google Docs, Constant Contact, Amazon AWS, and cloud storage to make malicious links appear legitimate. |
| Cofense | 2021 | Email Security Vendor |
| 126 | Annual State of Phishing Report 2022 | Bottom Line Up Front (BLUF) Cofense’s core finding is that phishing continues to bypass email security controls and reach users’ inboxes, with credential theft leading the threat landscape. For SMBs and insurance teams, this matters because phishing is directly tied to account compromise, business email compromise, and ransomware precursor activity before a larger loss becomes visible. Top 3-5 Most Notable Statistics •67% of observed phishing attacks were credential theft, a 10-percentage point increase from the prior year. •52% of analyzed malicious emails were Microsoft-branded. •7% of observed phishing threats were business email compromise. •Cofense observed nearly 100 malware families, though malware-delivering emails were lower than the previous year. •HTML attachments showed 150% growth in phishing attacks and represented about 30% of credential phishing attacks detected by Cofense Protect. Top 3-5 Exploitable Technology Risks •Credential phishing targeting cloud and Microsoft 365-style login workflows, where users are prompted to enter credentials into familiar-looking pages. •HTML attachments used to bypass detection because they can be difficult to block when some business applications use them legitimately. •Phishing emails that bypass Secure Email Gateways, including attacks using URLs, staged delivery, and conversation-based tactics. |
| Cofense | 2022 | Email Security Vendor |
| 127 | Annual Threat Assessment 2022 | Bottom Line Up Front (BLUF) ODNI’s 2022 assessment describes a threat environment where state cyber actors, transnational cyber criminals, and technology-enabled influence operations create persistent risk for U.S. government and private-sector networks. For SMBs and insurance teams, the most actionable takeaway is that cyber disruption, ransomware, wire-transfer fraud, and third-party technology exposure are part of a broader national security risk landscape—not isolated IT problems. Top 3-5 Most Notable Statistics •Iran has enriched uranium hexafluoride up to 60 percent U-235 and continues to accumulate material enriched up to 20 percent. •Russia would need reforms to expand growth beyond 1-3 percent per year, according to the assessment. •Illicit drug trafficking and related harms impose as much as one trillion dollars in direct and indirect economic losses. •The United States saw more than 100,000 drug-overdose deaths annually for the first time. •Transnational organized crime groups generate hundreds of billions of dollars through illicit goods, extortion, racketeering, counterfeit and stolen goods, and financial fraud. Top 3-5 Exploitable Technology Risks •Chinese cyber espionage targeting U.S. government and private-sector networks, including telecommunications firms, managed service providers, and broadly used software. •Chinese capability to launch cyber attacks that could disrupt U.S. critical infrastructure services, including oil and gas pipelines and rail systems. •Russian focus on targeting critical infrastructure, including underwater cables and industrial control systems, to demonstrate the ability to damage infrastructure during a crisis. |
| ODNI | 2022 | Government / Intelligence Agency |
| 128 | Annual Threat Assessment 2023 | Bottom Line Up Front (BLUF) ODNI assesses that nation-state cyber activity, ransomware, technology competition, and supply-chain pressure are converging into a broader risk environment for U.S. organizations. For SMBs and insurance teams, the most actionable takeaway is that cyber losses may stem not only from direct attacks, but also from compromised service providers, widely used software, critical infrastructure disruption, and data theft. Top 3-5 Most Notable Statistics •COVID-19 has caused more than 6.5 million deaths and trillions of dollars in lost economic output. •The commercial spyware industry is estimated to be worth $12 billion. •As of June 2022, China had 173 of the world’s most powerful supercomputers, compared with 128 for the United States. •High- and middle-income countries had not met Paris Agreement pledges to provide $100 billion per year to low-income countries by 2020. •More than four million Ukrainians registered for protections under the EU Temporary Protection Directive. Top 3-5 Exploitable Technology Risks •Ransomware actors are executing high-impact attacks that extort funds, disrupt critical services, and expose sensitive data. •Ransomware groups are using multiple extortion methods, including threats to release stolen data alongside encryption. •Malware capability is expanding across technical targets such as virtual machine hosts and network storage devices. |
| ODNI | 2023 | Government / Intelligence Agency |
| 129 | Annual Threat Assessment 2024 | Bottom Line Up Front (BLUF) ODNI’s 2024 assessment identifies state-backed cyber operations, disruptive technologies, malign influence, and geopolitical conflict as direct and persistent risks to U.S. government, private-sector, and critical infrastructure networks. For SMBs and insurance teams, the key takeaway is that cyber and business interruption risk is increasingly tied to nation-state activity, global instability, and fast-moving technologies such as AI and commercial spyware. Top 3-5 Most Notable Statistics •China signaled plans through a state-owned enterprise to channel at least $13.7 billion into emerging industries such as AI, advanced semiconductors, biotechnology, and new materials. •China has probably completed construction of more than 300 new ICBM silos and loaded at least some with missiles. •From 2011 to 2023, at least 74 countries contracted with private companies to obtain commercial spyware. •Iran’s inflation was likely to top 40 percent for 2023. •Since 2020, the Sahel has experienced seven irregular transfers of power. Top 3-5 Exploitable Technology Risks •State-backed cyber operations against U.S. government, private-sector, and critical infrastructure networks, especially from China, which ODNI describes as the most active and persistent cyber threat. •Iran’s aggressive and opportunistic cyber operations, including risk to U.S. infrastructure and data. •Generative AI-enabled deepfakes, misinformation, and potential AI-generated computer viruses. |
| ODNI | 2024 | Government / Intelligence Agency |
| 130 | Annual Threat Assessment 2025 | Bottom Line Up Front (BLUF) The most important takeaway for SMBs and insurance teams is that cyber threats are no longer limited to data theft: criminals and state actors are targeting services that businesses depend on, including healthcare payment processing, water utilities, telecommunications, and critical infrastructure. The report highlights a risk environment where poorly defended organizations and essential third-party providers can become points of disruption, creating business interruption, operational delays, and broader claims exposure. Top 3-5 Most Notable Statistics •52,000 U.S. deaths from synthetic opioids occurred in the 12 months ending in October 2024. •Synthetic opioid-related overdose deaths decreased by nearly 33 percent compared with the same prior reporting period. •Mexico-based transnational criminal organizations conducted nearly 1,600 IED attacks on Mexican security forces in 2024. •Law enforcement encounters with migrants at the U.S.-Mexico border were 14 percent lower in 2024 than the previous year. •U.S. Border Patrol apprehensions along the Southwest border in January 2025 dropped 85 percent from the same period in 2024. Top 3-5 Exploitable Technology Risks •Ransomware against essential service providers, including a 2024 attack on the largest payment processor for U.S. healthcare transactions that disrupted prescriptions, electronic health records, patient communications, medication ordering, and ambulance routing. •Cyber attacks against U.S. water utilities, including both large and small utilities, with concern around poorly secured control systems. •PRC cyber operations that preposition access on U.S. critical infrastructure for possible use during crisis or conflict. |
| ODNI | 2025 | Government / Intelligence Agency |
| 131 | Annual Threat Assessment 2026 | Bottom Line Up Front (BLUF) ODNI’s 2026 assessment identifies cyber actors from China, Russia, Iran, North Korea, and ransomware groups as continuing critical threats to U.S. networks, critical infrastructure, and business operations. For SMBs and insurance teams, the key takeaway is that operational disruption, data theft, financial loss, and third-party dependency failures remain central loss scenarios. Top 3-5 Most Notable Statistics •$1 billion each year: North Korean cryptocurrency heists and other financial crimes continue to generate at least this amount to fund the regime’s weapons programs. •200,000 systems and 50 terabytes: An Iranian hacktivist group claimed it erased 200,000 systems and extracted 50 terabytes of data from a U.S. medical technology company. •61 active state-based conflicts occurred globally in 2024, the highest number since the end of World War II. •129,000 battle-related deaths resulted from those conflicts in 2024. •12,000 to 18,000 ISIS members and 15,000 to 28,000 al-Qa‘ida members are assessed worldwide. Top 3-5 Exploitable Technology Risks •Ransomware groups are shifting to faster, high-volume attacks, increasing the chance of operational disruption, revenue loss, and theft of sensitive data. •North Korea’s use of IT workers with falsified credentials creates insider-access risk for companies that hire or contract remote technical staff. •Cyber attacks against satellite communications are a growing risk as reliance on digital systems expands exploitable vulnerabilities tied to space services. |
| ODNI | 2026 | Government / Intelligence Agency |
| 132 | Annual Threat Dynamics 2026 | Bottom Line Up Front (BLUF) PwC’s 2026 threat report indicates that attackers are increasingly using identity, SaaS integrations, supply chains, cloud services, and AI-enabled social engineering to gain access and scale impact. For SMBs and insurance teams, the key takeaway is that strong internal defenses are no longer enough if credentials, vendors, SaaS connectors, or trusted access paths are weak. Top 3-5 Most Notable Statistics •18% of executives reported identity and access management as a top-three priority for cyber budget allocation. •Roughly one-third of leaders ranked cloud and connected product attacks among the top three cyber threats their organisation is least prepared to handle. •Over 25% of executives reported their most damaging data breach in the past three years cost at least US$1 million. •The Shai-Hulud supply chain attack impacted more than 600 NPM packages and 40 developer accounts. Top 3-5 Exploitable Technology Risks •Identity abuse through SSO, OAuth, federated access, token theft, session hijacking, and valid account use, allowing attackers to “log in” rather than break in. •SaaS and supply chain compromise through over-scoped OAuth apps, unmanaged service principals, third-party connectors, developer accounts, and vendor trust relationships. •Social engineering using phishing, vishing, IT helpdesk impersonation, fake CAPTCHA prompts, remote management tools, and AI-generated personas. •Infostealer malware and browser/session theft that can capture credentials, cookies, active sessions, and cloud access. |
| PwC | 2026 | Consulting / Analyst Firm |
| 133 | Annual Threat Report 2024 | Bottom Line Up Front (BLUF) Expel’s 2024 report shows that identity compromise remains the central threat businesses must manage, with identity-based incidents making up the majority of SOC investigations and rising sharply year over year. For SMBs and insurance teams, this means the biggest practical risk is not only malware or ransomware, but attackers using stolen credentials, phishing, weak reset processes, and cloud misconfigurations to gain access before more damaging activity begins. Top 3-5 Most Notable Statistics •Identity threats accounted for 64% of all incidents Expel investigated and increased 144% from 2022. •Identity incidents affected 58% of Expel customers; among targeted organizations, 35% had more than one incident and averaged 8 identity-based incidents during the year. •Cloud infrastructure incidents increased 72%, with 96% of detected cloud incidents occurring in AWS. •High-risk malware, including pre-ransomware activity, accounted for 57% of malware incidents. •Hospitality saw the highest volume of targeted phishing attacks at 55%, followed by travel at 12% and technology at 9%. Top 3-5 Exploitable Technology Risks •Phishing-as-a-service platforms that create convincing credential harvesters, including pages that pre-fill victim email addresses and mimic company login branding. •QR code phishing, which moves users from managed endpoints to mobile devices that may lack the same security controls. •Weak helpdesk and self-service password reset processes, especially when combined with MFA push fatigue against Microsoft and Okta accounts. |
| Expel | 2024 | MSP / MSSP / SOC Provider |
| 134 | Annual Threat Report 2024 | Bottom Line Up Front (BLUF) Deepwatch’s 2024 Annual Threat Report shows that attackers are succeeding by using valid credentials, exposed remote access, user interaction, and known internet-facing vulnerabilities rather than relying only on traditional malware. For SMBs and insurance teams, the main takeaway is that account security, patching, exposed services, email controls, and supplier risk management should be treated as core loss-prevention priorities. Top 3-5 Most Notable Statistics •Deepwatch analyzed nearly 1.5 million security-related events detected across customer environments and response engagements. •The report recorded 1,351,145 total detections and 1,343,862 observed MITRE ATT&CK techniques in 2023. •Over 50% of incident response engagements involved suspicious activity or account compromise. •Ransomware represented 16% of threat response engagements, while malware infection represented 13%. •Finance and insurance accounted for 31% of engagements, manufacturing 22%, and health care and social assistance 18%. Top 3-5 Exploitable Technology Risks •Valid account abuse: attackers used compromised credentials, including administrative usernames and passwords, to bypass standard security measures and conduct unauthorized activity. •External remote services: remote access mechanisms such as RDP, VPNs, Citrix, and other access gateways remained important attacker entry and persistence paths. •Internet-facing known vulnerabilities: exploitation of exposed systems, including ColdFusion exploitation and other known vulnerabilities with public exploit code, was a recurring incident driver. |
| Deepwatch | 2024 | MSP / MSSP / SOC Provider |
| 135 | Annual Threat Report 2024 | Bottom Line Up Front (BLUF) Intel471’s 2024 report shows that ransomware, stolen credentials, exploitable vulnerabilities, and infostealer malware remained the most practical threats to businesses, even as law enforcement disrupted major criminal infrastructure. For SMBs and insurance teams, the key takeaway is that attackers continue to buy access, exploit known flaws, and use credential theft to create ransomware and data-extortion losses. Top 3-5 Most Notable Statistics •Intel471 reported 3,985 ransomware breach events in 2024. •Initial access brokers made 3,977 claims offering compromised credentials or alleged unauthorized access to networks or systems. •About 80% of initial access broker claims were categorized as wholesale access. •Intel471 reported 516 vulnerabilities in 2024; 30% were high risk, 46% medium risk, and 24% low risk. •Of reported vulnerabilities, 56% were weaponized, 19% had proof-of-concept code available, and 9% were productized. Top 3-5 Exploitable Technology Risks •Vulnerable remote access and perimeter systems, including Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, Palo Alto Networks PAN-OS, VMware ESXi, and Adobe products, were tied to malware or ransomware activity. •Corporate access resources were repeatedly targeted, including RDWeb, Windows RDP, Outlook Web App, Fortinet VPN, and SSH. •Brute-forcing corporate resources, use of malware logs, and SQL injection were the top observed techniques used to gain initial access. |
| Intel 471 | 2024 | Threat Intelligence Vendor |
| 136 | Annual Threat Report 2025 | Bottom Line Up Front (BLUF) Expel’s 2025 Annual Threat Report shows that identity compromise remains the dominant threat, with attackers repeatedly using stolen credentials, phishing, infostealing malware, and session theft to reach email, single sign-on, cloud, and business systems. For SMBs and insurance teams, the key takeaway is clear: account takeover, weak credential controls, and delayed patching are central drivers of cyber risk, including fraud, ransomware access, data theft, and operational disruption. Top 3-5 Most Notable Statistics •Identity-based incidents made up 68% of all incidents in 2024, up four percentage points from 2023. •Endpoint-based incidents accounted for 22% of threats. •Cloud infrastructure attacks accounted for approximately 2% of threats, with leaked or stolen cloud secrets causing the highest volume of cloud incidents. •In identity incidents, attackers were blocked after credential compromise 56.3% of the time, while business email compromise represented 36.4% and identity provider compromise represented 7.3%. •Credential harvesting made up about 41% of malicious phishing submissions, while other social engineering made up about 34%. Top 3-5 Exploitable Technology Risks •Stolen credentials and phishing-as-a-service platforms that can intercept session cookies and bypass multi-factor authentication. •Leaked or stolen cloud secrets, especially in cloud environments such as AWS, Azure, Google Cloud, and Kubernetes. •ClickFix-style attacks that trick users into running malicious code through Windows Run or PowerShell, often to deploy infostealers or remote access tools. |
| Expel | 2025 | MSP / MSSP / SOC Provider |
| 137 | Annual Threat Report 2026 | Bottom Line Up Front (BLUF) Expel’s 2026 report shows that most successful attacks are not highly sophisticated; they exploit preventable gaps in identity controls, endpoint hygiene, cloud configuration, and response speed. For SMBs and insurance teams, the key takeaway is clear: strong basics such as multifactor authentication, conditional access, patching, least privilege, and fast containment materially reduce business risk. Top 3-5 Most Notable Statistics •Identity-based attacks represented 68.6% of incidents across Expel’s customer base. •In identity incidents involving stolen legitimate credentials, 52.3% were blocked immediately, while 47.7% resulted in access being granted. •Small organizations with fewer than 1,000 employees averaged 6.3 incidents in 2025; medium-sized organizations averaged 23.8. •Malware accounted for 63.9% of endpoint incidents, and ClickFix-style attacks accounted for 35.4% of malware-driven incidents. •Cloud infrastructure incidents were only 2.5% of total incidents, but Expel characterized them as lower volume and higher risk. Top 3-5 Exploitable Technology Risks •Stolen credentials, stolen session tokens, and adversary-in-the-middle phishing tools that can bypass weaker forms of MFA. •Phishing-as-a-service platforms that increase phishing volume and make credential theft easier for criminals. •ClickFix attacks that trick users into copying and executing malicious commands on their own systems. |
| Expel | 2026 | MSP / MSSP / SOC Provider |
| 138 | Annual Vulnerability Report 2024 | Bottom Line Up Front (BLUF) Secpod reports a sharp rise in disclosed vulnerabilities in 2024, including many critical, high-severity, zero-day, widely exploited, and malware-exploiting vulnerabilities. For SMBs and insurance teams, the core takeaway is that vulnerability management and timely patching are no longer optional controls; they are central to reducing the chance of system compromise, data theft, business disruption, and ransomware-related impact. Top 3-5 Most Notable Statistics •40,704 total vulnerabilities were identified in 2024. •19,100 vulnerabilities were rated critical or high severity under CVSS v3 and v4. •31 zero-day vulnerabilities were reported in 2024. •129 vulnerabilities were described as widely exploited. •120 vulnerabilities were identified as malware-exploiting vulnerabilities capable of high-fidelity attacks. Top 3-5 Exploitable Technology Risks •Microsoft technologies, including Exchange Server, Outlook, and Windows, were tied to multiple critical vulnerabilities enabling privilege gain, remote code execution, data access, account creation, and system compromise. •Internet-facing and administrative platforms such as Fortra GoAnywhere MFT, ConnectWise ScreenConnect, Telerik Report Server, ServiceNow Now Platform, GitLab, GeoServer, VMware vCenter Server, and Jenkins were highlighted among the most critical vulnerabilities. •Network and security infrastructure, including Fortinet FortiOS and Palo Alto Networks PAN-OS, included critical vulnerabilities that could allow unauthorized code or command execution, including root-level code execution on a firewall. |
| Secpod | 2024 | Threat Intelligence Vendor |
| 139 | Annual Vulnerability Review 2022 | Bottom Line Up Front (BLUF) Flexera’s 2022 review shows that vulnerability volume reached a record high, while attackers can exploit some weaknesses within days or even 24 hours. For SMBs and insurance teams, the key takeaway is that patching everything by severity alone is not enough; organizations need visibility, threat intelligence, and faster prioritization of vulnerabilities that are actually likely to be exploited. Top 3-5 Most Notable Statistics •7,097 total Secunia Advisories were reported in 2022, up from 6,153 in 2021. •85 advisories reported a zero-day vulnerability, up from 81 in 2021. •Less than 11 percent of advisories had a high to critical threat score, meaning there was evidence of exploitation. •More than 50 percent of all advisories were for vulnerabilities in Unix/Linux operating systems. •Almost 79 percent of networking-related advisories were for Cisco, NetApp, and Juniper. Top 3-5 Exploitable Technology Risks •Log4Shell/Log4j remained a major risk because many organizations were still struggling to identify and patch affected systems. •Spring4Shell remained risky because the report states many systems were still unpatched despite the risk. •ProxyNotShell in Microsoft Exchange was highlighted as one of the top critical vulnerability issues of 2022. |
| Flexera | 2022 | Security Research Vendor |
| 140 | Annual Vulnerability Review 2023 | Bottom Line Up Front (BLUF) Flexera’s 2023 review shows vulnerability volume, zero-days, and exploit speed all increasing, making timely, risk-based patching a business-critical control. For SMBs and insurance teams, the main takeaway is that patching everything equally is not realistic; organizations need to prioritize based on exploit likelihood, asset sensitivity, criticality, and whether a patch is available. Top 3-5 Most Notable Statistics •9,402 Secunia advisories were issued in 2023, up from 7,097 in 2022, the highest total since Secunia began reporting. •NVD published 28,834 CVEs in 2023, a 15% increase from 25,050 in 2022. •130 advisories reported a zero-day vulnerability, up from 85 in 2022. •The average threat score rose to 15.68, compared with 13.66 in 2022. •57.6% of all zero-days were related to Microsoft products, while Microsoft represented 2.56% of all advisories. Top 3-5 Exploitable Technology Risks •Web browsers: Flexera highlights browsers as commonly exposed to remote attack vectors and stresses timely browser patching to reduce the likelihood of remote exploitation. •Microsoft products: Microsoft accounted for the largest share of zero-day advisories in the report, making rapid review and remediation important where Microsoft software is widely used. •Unix/Linux operating systems: More than 50% of all advisories were Unix/Linux operating system vulnerabilities, creating broad exposure for organizations using Linux-based servers or appliances. |
| Flexera | 2023 | Security Research Vendor |
| 141 | Annual Vulnerability Review 2024 | Bottom Line Up Front (BLUF) Flexera’s 2024 review shows that vulnerability volume reached a record high, while attackers can weaponize some exploits within days or even 24 hours. For SMBs and insurance teams, the key takeaway is that patching must be prioritized by real-world exploit likelihood, asset sensitivity, and business impact—not by CVSS score alone. Top 3-5 Most Notable Statistics •12,318 Secunia advisories were issued in 2024, the highest annual count since reporting began in 2002. •NVD published more than 40,000 CVEs in 2024, an increase of almost 39% from 28,817 in 2023. •83 advisories reported a zero-day vulnerability in 2024, down from 130 in 2023. •23.35% of 2024 advisories were rejection advisories, totaling 2,877 advisories not considered worth mitigation focus by Secunia Research. •Focusing only on advisories with CVSS scores of 7 or higher would address about 50% of exploits, while focusing only on the top 20 vendors would address only about 20%. Top 3-5 Exploitable Technology Risks •Unix/Linux operating system vulnerabilities represented more than 50% of all advisories, making them a major area for vulnerability management attention. •Browser vulnerabilities remain high-risk because browsers are commonly exposed to remote attack vectors; delayed browser patching increases exposure to remote exploits. •Networking-related vulnerabilities were concentrated among Cisco, F5, and Juniper, which accounted for a little over 58% of networking-related advisories. |
| Flexera | 2024 | Security Research Vendor |
| 142 | Aon Reinsurance Market Dynamics 2026 | Bottom Line Up Front (BLUF) Aon’s report shows a highly competitive reinsurance market with record capital, expanding third-party capacity, and favorable renewal conditions for many insurance buyers. For SMBs and insurance teams, the main takeaway is that stronger reinsurance capacity may create opportunities to improve coverage terms, manage volatility, and revisit protections that became limited or expensive in harder markets. Top 3-5 Most Notable Statistics •Global reinsurer capital reached a record $760 billion as of September 30, 2025. •Third-party capital reached an estimated record $124 billion, up $9 billion from the end of 2024. •The catastrophe bond market ended 2025 with more than $24 billion issued across 74 sponsors and $59 billion outstanding. •Aon estimates cumulative global insurance premiums associated with data centers will reach $134 billion between 2026 and 2030. •Large data center campuses can require insurance limits of $10 billion or more, exceeding what the traditional insurance market has historically supported. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs The report points to a buyer-favorable insurance and reinsurance environment, especially in property catastrophe renewals, where abundant capacity and competition led to significant pricing reductions and improved terms for many non-loss-impacted accounts. SMBs may benefit indirectly if insurers use reinsurance savings and added capacity to offer broader or more affordable protection. However, the report also highlights continuing volatility from natural catastrophes, liability trends, medical cost inflation, and emerging exposures linked to data, cloud services, AI, and data center expansion. For SMBs, this means insurance availability may improve in some areas, but businesses still need to understand where their operations, suppliers, locations, or digital infrastructure dependencies create concentration risk. |
| Aon | 2026 | Cyber Insurance Carrier |
| 143 | API Security Perspectives 2025 | Bottom Line Up Front (BLUF) API security is now a material business risk, especially as AI tools and large language models add new ways for attackers and internal users to create exposure. For SMBs and insurance teams, the key takeaway is that API incidents are common, can be costly to remediate, and may be underestimated even by organizations that feel confident in their defenses. Top 3-5 Most Notable Statistics •55% of surveyed organizations experienced an API security incident in the past 12 months. •47% of organizations that had an API incident reported remediation costs above $100,000. •20% reported API incident remediation costs exceeding $500,000. •74% are extremely or very concerned about AI-enhanced attacks. •77% say AI models such as LLMs may introduce significant security vulnerabilities when integrated into their API ecosystem. Top 3-5 Exploitable Technology Risks •AI-enhanced cyberattacks: AI can lower the barrier to entry for cyberattacks and create another attack vector against API security. •Unauthorized access or breaches: Respondents ranked this as one of the most significant API security threats after AI-enhanced attacks. •Shadow APIs: Undiscovered and unmanaged APIs can create blind spots, especially when organizations lack an up-to-date system of record for services and APIs. |
| Kong | 2025 | Network Security Vendor |
| 144 | API Threat Report - The API Battleground | Bottom Line Up Front (BLUF) APIs are now a primary attack surface because they directly control payments, identities, data access, promotions, and business workflows. For SMBs and insurance teams, the key takeaway is that many API attacks look like normal customer or partner activity, so traditional defenses may miss fraud, data theft, account takeover, and service disruption until business impact is already visible. Top 3-5 Most Notable Statistics •Imperva recorded more than 40,000 API incidents across 4,000+ monitored environments in the first half of 2025. •APIs accounted for roughly 14% of all attacks but attracted about 44% of advanced bot activity. •Imperva observed an application-layer DDoS spike reaching 15 million requests per second against a financial API. •The most-targeted API endpoint types were data-access endpoints at 37%, checkout/payment endpoints at 32%, and authentication endpoints at 16%. •Imperva detected 10–20% more API endpoints than organizations believed they had, indicating material exposure from unknown or underprotected APIs. Top 3-5 Exploitable Technology Risks •Business-logic abuse and Broken Object Level Authorization, where attackers use valid-looking requests to access data, abuse promotions, or manipulate workflows. •Parameter tampering in checkout, pricing, quantity, account, or authorization fields that can enable free orders, privilege escalation, or fraud. •Shadow, hidden, test, or unauthenticated APIs that bypass normal WAF, bot, authentication, or rate-limit controls. |
| Imperva | 2025 | Application / API Security Vendor |
| 145 | API Threat Stats Report 2025 | Bottom Line Up Front (BLUF) Wallarm’s Q1 2025 API threat data shows that APIs are a primary target for attackers, with risks driven by access control failures, misconfigurations, hardcoded secrets, and the rapid growth of agentic AI systems. For SMBs and insurance teams, the key takeaway is that API weaknesses can create direct paths to data exposure, credential compromise, and business interruption across many industries. Top 3-5 Most Notable Statistics •582 API-related vulnerabilities were disclosed in Q1 2025. •The average severity score for API-related vulnerabilities was 7.42. •Wallarm analyzed 2,869 security issues across agentic AI projects, and 1,858 of them were API-related. •API-related issues represented 65% of the agentic AI security issues analyzed. •The average time to close an agentic AI security issue was 42 days, while 716 issues remained open. Top 3-5 Exploitable Technology Risks •Broken access control and authorization failures, which were the leading API threat category and can allow unauthorized access to systems or data. •Authentication flaws, including weak or improper login and access mechanisms that attackers can exploit to reach protected API functions. •Misconfigured APIs, publicly accessible databases, and unauthenticated API access, which were recurring drivers of reported breaches. |
| Wallarm | 2025 | Application / API Security Vendor |
| 146 | API Threat Stats Report 2026 | Bottom Line Up Front (BLUF) APIs are one of the most important cyber risk areas for SMBs because attackers are repeatedly exploiting weak authentication, exposed interfaces, and automation-friendly endpoints rather than exotic flaws. For insurance and risk teams, the report’s main message is that API security is now directly tied to breach likelihood, AI adoption risk, and business interruption potential. Top 3-5 Most Notable Statistics •11,053 API-related vulnerabilities were identified out of 67,058 published security bulletins in 2025. •97% of API vulnerabilities could be exploited with a single request, and 98% were rated easy or trivial to exploit. •59% of API vulnerabilities required no authentication. •106 of 245 CISA Known Exploited Vulnerabilities added in 2025, or 43%, were API-related. •60 API-related breach incidents were analyzed, with 52% mapped to broken authentication. Top 3-5 Exploitable Technology Risks •Broken authentication and weak identity controls, including stolen credentials, weak authentication, and loose token scope or lifetime. •Exposed APIs, including admin endpoints, shadow APIs, forgotten integrations, and internet-reachable management interfaces. •Broken access control and object-level authorization failures that allow enumeration, scraping, or privilege escalation. |
| Wallarm | 2026 | Application / API Security Vendor |
| 147 | Application Security 2026: An Executive Forecast of Emerging Threats and Secure-by-Design Strategies | Bottom Line Up Front (BLUF) Application security risk in 2026 is shifting from isolated coding flaws to broader business exposure driven by generative AI, software supply chain compromise, cloud-native complexity, and API weaknesses. For SMBs and insurance teams, the key takeaway is that application security is becoming a measurable governance issue, not just an IT concern, with vendor trust, downtime, privacy liability, and executive accountability directly affected. Top 3-5 Most Notable Statistics •50% of C-level executives are predicted to have cybersecurity risk performance metrics directly tied to employment contracts by 2026. •60% of organizations are predicted to use demonstrable cybersecurity risk posture as a key factor in selecting third-party vendors by the end of 2025. •35% of smaller organizations reported insufficient cyber resilience. •A 2025 Red Hat GitLab breach reportedly involved 570GB of data from more than 28,000 repositories. •The F5 BIG-IP incident was reported to affect risk across more than 266,000 exposed BIG-IP instances and more than 600,000 internet-connected devices globally. Top 3-5 Exploitable Technology Risks •Generative AI and LLM applications: Prompt injection, sensitive information disclosure, data/model poisoning, supply chain vulnerabilities, and excessive agency can expose data or trigger unauthorized actions. •API authorization failures: Broken Object Level Authorization and Broken Function Level Authorization can let attackers access other users’ data or administrative functions. •Cloud-native misconfiguration: Public cloud storage, overly permissive IAM roles, insecure Infrastructure-as-Code templates, and containers running as root can create direct breach paths. |
| Robotti | 2026 | MSP / MSSP / SOC Provider |
| 148 | AppOmni State of SaaS Security Report 2025 | Bottom Line Up Front (BLUF) SaaS security is a major risk area because organizations are experiencing frequent incidents despite high confidence in their controls. For SMB owners and insurance teams, the key takeaway is that relying on vendor trust, periodic audits, or informal ownership is not enough; SaaS permissions, configurations, integrations, and AI access need continuous validation. Top 3-5 Most Notable Statistics •75% of respondents experienced a SaaS-related security incident or data breach in the past 12 months. •91% expressed confidence in their SaaS security posture, even though 75% experienced an incident. •89% of compromised organizations believed they had appropriate SaaS visibility at the time. •52% still rely on point-in-time SaaS compliance audits, including regular and ad hoc reviews. •41% identified SaaS user permission vulnerabilities, while 29% reported incidents tied to SaaS application misconfigurations. Top 3-5 Exploitable Technology Risks •SaaS user permission weaknesses can expose sensitive data or allow access beyond what users need. •SaaS application misconfigurations can create unintended exposure as settings, users, and features change over time. •Unsanctioned SaaS applications and weak enforcement of app policies can leave security teams without full control or visibility. |
| AppOmni | 2025 | Cloud Security Vendor |
| 149 | Arctic Wolf State of Cybersecurity Trends Report 2025 | Bottom Line Up Front (BLUF) Arctic Wolf’s 2025 survey shows that cyber attacks remain common and operationally disruptive, even as AI has become the top concern for security leaders. For SMBs and insurance teams, the key takeaway is that basic resilience measures—MFA, backups, visibility, security awareness, and current incident response planning—still matter most for reducing downtime, claims severity, and breach impact. Top 3-5 Most Notable Statistics •70% of surveyed security leaders said their organization experienced at least one significant cyber attack in 2024. •52% of organizations identified one or more breaches in the last 12 months, while another 23% were unsure whether a breach occurred. •35% reported significant malware infections and 35% reported business email compromise attacks. •23% experienced a significant ransomware attack, and 76% of those victims paid the ransom. •88% of organizations had an active incident response retainer, and 81% of those used it at least once in the past year. Top 3-5 Exploitable Technology Risks •Lack of multi-factor authentication: 56% of organizations that experienced a significant cyber attack had not implemented MFA, leaving accounts more vulnerable to compromise. •Business email compromise and social engineering: BEC was one of the most common significant attacks, and the report highlights phishing lures, MFA bombs, and other low-tech techniques as effective attacker methods. •Endpoint visibility gaps: Only 40% of organizations with endpoint solutions reported complete coverage across desktops, laptops, and servers, creating blind spots where threats can persist. |
| Arctic Wolf | 2025 | MSP / MSSP / SOC Provider |
| 150 | Arctic Wolf The State of Cybersecurity 2024 | Bottom Line Up Front (BLUF) Arctic Wolf’s 2024 survey shows that ransomware, business email compromise, data breaches, and insider-driven incidents remain common and costly, even among organizations that already use modern security tools. For SMB owners and insurance teams, the key takeaway is that resilience depends less on buying one product and more on closing visibility gaps, preparing for incidents, and maintaining practical controls that reduce downtime and claims severity. Top 3-5 Most Notable Statistics •48% of organizations identified evidence of a successful breach in the last 12 months. •70% of organizations were targeted by attempted business email compromise attacks in the last year. •45% of organizations reported being victims of ransomware in the last 12 months. •91% of reported ransomware events included a data exfiltration component. •95% of organizations either currently have cyber insurance or are in the process of obtaining it within the next 12 months. Top 3-5 Exploitable Technology Risks •Cloud-based email environments such as Office365 can make business email compromise harder to detect with traditional tools, allowing account takeover and fraud attempts to go unnoticed. •Endpoint agent deployment gaps create blind spots where attackers may operate with limited visibility from security teams. •Ransomware victims often lacked broader monitoring: among successful ransomware victims, 62% were not using SIEM or SIEM-alternative log analysis and 67% were not using network traffic analysis. |
| Arctic Wolf | 2024 | MSP / MSSP / SOC Provider |
| 151 | Arctic Wolf Threat Report 2025 | Bottom Line Up Front (BLUF) Arctic Wolf’s 2025 Threat Report shows that the most severe cyber incidents are still concentrated in ransomware/data extortion, business email compromise, and intrusions. For SMBs and insurance teams, the core message is practical: attackers are often succeeding through exposed remote access, stolen credentials, phishing, and unpatched known vulnerabilities—not exotic techniques. Top 3-5 Most Notable Statistics •95% of Arctic Wolf incident response cases involved ransomware/data extortion, business email compromise, or intrusions. •44% of incident response cases were ransomware/data extortion, making it the largest category. •96% of ransomware cases included data theft, showing that double extortion is now the norm. •Arctic Wolf negotiators reduced aggregate ransom demands by 64%, and 70% of clients using negotiation services did not pay. •In 76% of intrusion cases, attackers used at least one of 10 specific vulnerabilities, all of which had available patches. Top 3-5 Exploitable Technology Risks •Unsecured Remote Desktop Protocol (RDP): RDP was the root cause in 38% of ransomware cases, allowing attackers to abuse exposed remote access. •Compromised VPN credentials: Attackers used valid credentials to access environments through remote access tools that are meant to support distributed workforces. •Externally exposed services and edge devices: External exposure drove most ransomware and intrusion cases, including attacks against VPNs, firewalls, and other internet-facing infrastructure. |
| Arctic Wolf | 2025 | MSP / MSSP / SOC Provider |
| 152 | Arctic Wolf Threat Report 2026 | Bottom Line Up Front (BLUF) Arctic Wolf’s central finding is that attackers are winning by using familiar, low-complexity paths: remote access, phishing, weak identity controls, exposed edge devices, and trusted platforms. For SMBs and insurance teams, this means the biggest losses are often preventable with disciplined controls, faster detection, tested recovery, and professional incident response. Top 3-5 Most Notable Statistics •92% of Arctic Wolf incident response cases were ransomware, business email compromise, or data incidents. •Ransomware accounted for 44% of incident response cases, while business email compromise accounted for 26%. •Data incidents rose to 22% of cases, up from 2% in the prior report. •65% of non-BEC incidents were attributed to abuse of external remote access products and services such as RDP, VPNs, and RMM tools. •In 77% of ransomware incident response cases handled by Arctic Wolf, the impacted organization did not pay a ransom. Top 3-5 Exploitable Technology Risks •External remote access services, including RDP, VPN, and RMM tools, are being abused as leading entry points because attackers can often log in rather than exploit complex flaws. •Edge devices such as VPNs, firewalls, and other privileged infrastructure remain prime targets due to exposure, inconsistent patching, and weak credential hygiene. •Known vulnerabilities in products including SonicWall SonicOS, Citrix NetScaler ADC and Gateway, ConnectWise ScreenConnect, Cisco ASA VPN, FortiOS/FortiProxy, FortiClientEMS, Microsoft Exchange, and Cleo file transfer products were observed in incident response cases. |
| Arctic Wolf | 2026 | MSP / MSSP / SOC Provider |
| 153 | Automotive & Smart Mobility Global Cybersecurity Report 2025 | Bottom Line Up Front (BLUF) The automotive and smart mobility cyber risk landscape expanded sharply in 2024, with remote attacks, ransomware, data theft, and vehicle-system manipulation creating business interruption, privacy, safety, and financial exposure. SMBs that operate fleets, dealerships, EV charging, mobility services, or connected vehicle systems should treat this as an operational risk, not just an IT issue. Top 3-5 Most Notable Statistics •Upstream analyzed 409 automotive and smart mobility cybersecurity incidents in 2024, averaging 34 incidents per month. •Incidents with high-to-massive impact accounted for nearly 60% of all incidents. •65% of attacks were executed by black hat actors, and 92% of attacks were remote. •Telematics and application server attacks increased from 43% in 2023 to 66% in 2024. •A ransomware attack on a dealership management software provider disrupted 15,000 dealerships for nearly 3 weeks, with estimated direct dealer losses of $1.02 billion. Top 3-5 Exploitable Technology Risks •Telematics and application servers, which saw a major increase in attacks and can disrupt fleet, dealership, and mobility operations. •APIs connecting vehicles, backend systems, applications, and services, with API-related incidents rising to 17% of total attacks. •Electronic logging devices in commercial trucks using default firmware settings, exposed APIs for over-the-air updates, predictable identifiers, weak passwords, Bluetooth, Wi-Fi, and CAN bus communication. |
| Upstream | 2025 | Threat Intelligence Vendor |
| 154 | Automotive & Smart Mobility Global Cybersecurity Report 2026 | Bottom Line Up Front (BLUF) Automotive and smart mobility cyber risk escalated sharply in 2025, with ransomware, data breaches, business disruption, and vehicle-system manipulation becoming major operational and safety concerns. For SMBs in the automotive ecosystem, and for insurance teams assessing them, the key takeaway is that even smaller suppliers, dealerships, fleet operators, EV charging providers, and mobility service firms can be affected by attacks that spread through connected vehicles, cloud services, APIs, and third-party providers. Top 3-5 Most Notable Statistics •Upstream analyzed 494 automotive and smart mobility cybersecurity incidents in 2025, averaging 41 incidents per month. •Automotive and smart mobility incidents increased 21% over 2024. •Ransomware accounted for 44% of publicly reported incidents and increased from about 26% in 2024. •Black hat actors carried out over 71% of all attacks. •Data and privacy-related incidents accounted for 68% of 2025 incidents, up from 60% in 2024. Top 3-5 Exploitable Technology Risks •APIs and backend servers: The report identifies backend servers and APIs as dominant exposure points that connect vehicles, cloud services, and third-party ecosystems. •AI, LLMs, and AI agents: In-vehicle and cloud-based AI systems introduce risks from manipulated inputs, crafted prompts, corrupted data streams, and unpredictable behavior. •Model Context Protocol and AI orchestration layers: The report highlights critical remote code execution risk and attack paths that can bypass traditional API security boundaries. |
| Upstream | 2026 | Threat Intelligence Vendor |
| 155 | AWS Cloud Security Report 2021 | Bottom Line Up Front (BLUF) Public cloud security remains a major concern for organizations using AWS, with misconfiguration, sensitive data exposure, insecure APIs, and credential exposure standing out as the most important risks. For SMBs and insurance teams, the key takeaway is that cloud losses are likely to stem less from the cloud provider itself and more from how the customer configures, monitors, and remediates its own cloud environment. Top 3-5 Most Notable Statistics •95% of cybersecurity professionals are extremely to moderately concerned about public cloud security. •71% identify cloud platform misconfiguration or wrong setup as a top public cloud security threat. •67% cite data loss or leakage as a major cloud security concern, followed by data privacy and confidentiality at 61%. •90% of organizations use two or more cloud providers, increasing the complexity of cloud security management. •66% of organizations need three to six dashboards to configure cloud security policies across their cloud footprint. Top 3-5 Exploitable Technology Risks •Cloud platform misconfiguration or wrong setup, which can expose systems, data, or services if security settings are incorrect. •Exfiltration of sensitive data, identified as a major cloud threat and directly tied to privacy, confidentiality, and regulatory concerns. •Insecure interfaces and APIs, which matter because cloud services often depend on APIs for access, integration, and administration. |
| Fidelis | 2021 | Network Security Vendor |
| 156 | AWS Cloud Security Report 2022 | Bottom Line Up Front (BLUF) Cloud security risk in AWS and multi-cloud environments is driven less by one single tool gap and more by complexity: multiple cloud providers, multiple dashboards, misconfigurations, inconsistent policies, and staffing limits. For SMBs and insurance teams, the key takeaway is that cloud incidents are already common enough to warrant focused underwriting and loss-prevention attention, especially around configuration management, access control, visibility, and compliance monitoring. Top 3-5 Most Notable Statistics •87% of organizations using cloud use two or more cloud providers. •95% of security professionals are moderately to extremely concerned about public cloud security. •31% of organizations experienced a public cloud-related security incident in the prior 12 months. •28% of cloud incidents were caused by wrongly configured resources or accounts, the leading reported incident type. •67% of organizations use three to six different dashboards to configure cloud security policies. Top 3-5 Exploitable Technology Risks •Misconfigured cloud resources or accounts, which were the leading cause of reported cloud security incidents. •Inappropriately shared data or files, creating exposure when users share information incorrectly. •Account compromise, which can allow unauthorized access to cloud resources and data. |
| Fidelis | 2022 | Network Security Vendor |
| 157 | AXA XL Cyber Claims Analysis Report 2025 | Bottom Line Up Front (BLUF) AXA XL’s claims analysis shows that large cyber losses are increasingly driven by ransomware, with system vulnerabilities, weak credentials, and business interruption playing central roles. For SMBs and insurance teams, the key takeaway is that ransomware is not just a technology problem; it is a financial resilience, operations continuity, and claims severity problem. Top 3-5 Most Notable Statistics •88.1% of total incurred losses in AXA XL’s Global Cyber portfolio came from claims exceeding $1 million. •Ransomware impacted 54.3% of large claims in the sample from 2019 onward. •Ransomware represented 62.8% of expected ultimate incurred large losses in 2023, up from 15.9% in 2018. •Average initial ransom demand increased from $7.77 million in 2019 to $32.25 million in 2023. •Approximately 92% of ransomware cases involved some level of systems shutdown, and businesses typically required around two full months to restore operations. Top 3-5 Exploitable Technology Risks •System vulnerabilities: The most common ransomware access method in large claims, accounting for 49.2% of attack vectors. •Compromised or weak credentials: Accounted for 24.6% of ransomware attack vectors and can enable attackers to access systems without exploiting software flaws. •Phishing: Represented 16% of ransomware attack vectors and remains a practical entry point for threat actors. |
| AXA | 2025 | Cyber Insurance Carrier |
| 158 | Axur Threat Landscape 2025 | Bottom Line Up Front (BLUF) Axur’s 2025 threat landscape shows that attackers are increasingly exploiting what sits outside the traditional company perimeter: leaked credentials, cloud and SaaS access, suppliers, brand impersonation, and support workflows. For SMBs and insurance teams, the key takeaway is that losses may come not only from malware, but from stolen access, phishing, data exposure, and third-party compromise that can quickly lead to extortion, fraud, downtime, and reputational harm. Top 3-5 Most Notable Statistics •Axur detected 6 billion new and unique credentials in 2025. •52.2% of new credentials were tied to corporate systems. •Phishing cases totaled 71,399 detected pages. •Fraudulent brand use reached 454,000 incidents, and Axur reported removing over 343,000 fraudulent content cases through automated takedown flows. •The Financial/Insurance sector saw phishing grow by 65%, with 24,959 pages detected. Top 3-5 Exploitable Technology Risks •Leaked credentials for corporate systems, VPNs, SaaS platforms, and other remote access services, which attackers can combine with phishing or support manipulation to bypass or weaken MFA. •Edge devices such as VPNs and firewalls, where exploited vulnerabilities, stolen credentials, brute force attacks, and MFA bypasses were linked to ransomware and data breaches. •Social engineering against IT support, recruitment, software engineers, and technical staff, including voice phishing, fake job offers, malicious files, and credential reset scams. |
| Axur | 2025 | Threat Intelligence Vendor |
| 159 | Bad Bot Report 2025 | Bottom Line Up Front (BLUF) Bad bots are now a mainstream business risk, not just a technical nuisance: automated traffic exceeded human web traffic in 2024, and malicious bots made up more than a third of all internet traffic. For SMBs and insurance teams, this matters because bots directly drive fraud, account takeover, API abuse, distorted analytics, downtime, chargebacks, and customer trust loss. Top 3-5 Most Notable Statistics •Automated traffic accounted for 51% of all web traffic in 2024, surpassing human traffic for the first time in a decade. •Bad bots made up 37% of all internet traffic, up from 32% in 2023. •Imperva blocked 13 trillion bad bot requests across thousands of domains and industries in 2024. •31% of all attacks recorded and mitigated by Imperva were OWASP-defined automated threats. •Account takeover attacks increased 40% year over year and 54% since 2022. Top 3-5 Exploitable Technology Risks •API business logic abuse: bots target API workflows to scrape data, commit payment fraud, hijack accounts, and bypass front-end controls. •Authentication and login abuse: credential stuffing, brute-force attacks, token abuse, and session manipulation can lead to account takeover. •Checkout, payment, and gift card endpoints: bots exploit these areas for carding, payment fraud, coupon guessing, and gift card balance theft. |
| Imperva | 2025 | Application / API Security Vendor |
| 160 | Baird Disruptors 2026 | Bottom Line Up Front (BLUF) Baird Disruptors 2026 is not a traditional cyber threat report; it is an equity research list of influential privately held software companies, including a large security and infrastructure software section. For SMB owners and insurance teams, its value is as a map of control areas Baird highlights across identity, email security, cloud security, data protection, application security, endpoint management, and resilience—not as evidence of attack frequency or claims severity. Top 3-5 Most Notable Statistics •5 analyst coverage areas are included: Security & Infrastructure Software, Human Capital Technology & Solutions, Software & SaaS, Cloud Software, and Vertical Software. •Baird U.S. Equity Research covered 719 companies as of January 30, 2026. •Identity Digital is described as supporting around 25 million domains across nearly 300 top-level domains. •VensureHR is described as processing over $19bn in payroll and supporting over 508,000 worksite employees. •Remote is described as helping companies hire, pay, and manage employees in over 200 countries. Top 3-5 Exploitable Technology Risks •Identity and access management gaps: the report highlights password management, multi-factor authentication, biometric security, passwordless authentication, identity governance, and access management as major security areas. •Email-based threats and human-centric risk: the report identifies email security, data loss prevention, phishing prevention, and security awareness as key security capabilities. •Cloud and multi-cloud exposure: the report highlights hybrid and multi-cloud networking, cloud security, cloud deployments, configurations, applications, and cloud data access control. |
| Baird | 2026 | Financial Services / Bank |
| 161 | Balancing Act: Security and Productivity in the Age of AI | Bottom Line Up Front (BLUF) 1Password’s 2024 report shows that employees are adopting AI, unapproved apps, personal devices, and shortcut behaviors faster than security teams can control them. For SMBs and insurance teams, the key issue is not only external attacks, but everyday productivity choices that create exploitable gaps in identity, access, device, and data protection. Top 3-5 Most Notable Statistics •92% of security professionals have security concerns about generative AI. •79% of security professionals do not feel their security protections are adequate. •61% of employees have poor password practices, including password reuse, similar password patterns, or unchanged IT-selected defaults. •34% of employees use unapproved apps or tools, and those users average five shadow IT apps or tools. •54% of employees admit to being lax about company security policies. Top 3-5 Exploitable Technology Risks •Generative AI tools: security professionals worry about employees entering sensitive company data into AI tools, using AI systems trained with incorrect or malicious data, and falling for AI-enhanced phishing. •Shadow IT: unapproved apps and tools create unmanaged access points and potential new threat vectors that security teams may not control. •Weak password behavior: reused passwords, similar password patterns, unchanged defaults, and passwords sent between devices increase breach exposure. |
| 1Password | 2024 | Identity Security Vendor |
| 162 | Balancing AI Usage and Risk in 2025: The Global State of DevSecOps | Bottom Line Up Front (BLUF) Black Duck’s 2025 survey shows that organizations are moving software into production quickly while security testing remains manual, noisy, and incomplete. For SMBs and insurance teams, the key issue is not simply AI adoption; it is unmanaged software risk created by fast releases, tool sprawl, limited testing coverage, and ungoverned AI use. Top 3-5 Most Notable Statistics •59.74% of organizations deploy code to production daily or multiple times per day. •45.56% still rely on fully or primarily manual processes to get new code into application security testing. •61%+ of respondents said their companies test 60% or less of their application portfolio. •71.63% said 21% to 60% of security test results are noise, such as duplicates, false positives, or conflicting findings. •56.55% agreed that AI coding assistants have introduced new security risks or made issues harder to detect. Top 3-5 Exploitable Technology Risks •AI-generated code risk: AI coding assistants may introduce vulnerabilities at a scale and speed that application security teams struggle to manage. •Shadow AI: 10.69% reported unverified or unmonitored use of AI coding assistants without official permission, creating unmanaged security and compliance exposure. •Open source AI model use: Nearly 97% of organizations use open source AI models in software they build, requiring governance over model use, policies, and related risks. |
| Black Duck | 2025 | Application / API Security Vendor |
| 163 | BeyondTrust Microsoft Vulnerability Report 2023 | Bottom Line Up Front (BLUF) Microsoft vulnerabilities reached a record high in 2022, even as critical vulnerabilities declined, meaning SMBs cannot rely on severity labels alone to manage risk. The most practical takeaway for SMB owners and insurance teams is to prioritize vulnerability management, patching, and least privilege controls, because attackers continue to benefit from excessive privileges, exposed services, and delayed remediation. Top 3-5 Most Notable Statistics •Total Microsoft vulnerabilities rose to 1,292 in 2022, an all-time high for the report. •Elevation of Privilege accounted for 55% of total Microsoft vulnerabilities. •Critical vulnerabilities dropped to 89 in 2022, a five-year low. •Azure and Dynamics 365 vulnerabilities increased by 159%, from 44 in 2021 to 114 in 2022. •Windows Server had 552 vulnerabilities in 2022, including 53 critical vulnerabilities. Top 3-5 Exploitable Technology Risks •Elevation of Privilege vulnerabilities: These allow attackers to gain higher levels of access after initial compromise and remain the dominant Microsoft vulnerability category. •Remote Code Execution vulnerabilities: The report describes these as high-risk because exploitation can allow code execution, often with fewer prerequisites. •Microsoft Office and MSDT abuse: Follina and DogWalk showed how Office-related workflows and Microsoft support tooling could enable code execution, including cases where macros were disabled or files were previewed. |
| BeyondTrust | 2023 | Identity Security Vendor |
| 164 | BeyondTrust Microsoft Vulnerability Report 2024 | Bottom Line Up Front (BLUF) Microsoft vulnerabilities remain near historic highs, but the report’s central warning is that attackers are increasingly finding easier paths through identity, privileges, and misconfigurations rather than only exploiting software flaws. For SMBs and insurance teams, this means patching remains essential, but loss prevention also depends on strong identity controls, least privilege, and visibility into how accounts can be abused. Top 3-5 Most Notable Statistics •Microsoft reported 1,228 total vulnerabilities in 2023, a 5% decrease from 2022, but still within the 1,200 to 1,300 range seen for four years. •Critical Microsoft vulnerabilities fell to 84 in 2023, down 6% from 2022. •Elevation of Privilege remained the top category at 490 vulnerabilities, representing 40% of the total. •Remote Code Execution vulnerabilities rose 13%, from 314 to 356. •Denial of Service vulnerabilities increased 51% to 109, while Spoofing increased 190%, from 31 to 90. Top 3-5 Exploitable Technology Risks •Elevation of Privilege flaws remain a major risk because attackers need higher privileges to complete many attacks. •Remote Code Execution flaws, especially in Windows Server, matter because they can allow attacker-controlled code to run. •Microsoft Outlook CVE-2023-23397 required no user interaction and could expose NTLM credential hashes through a crafted calendar invite. |
| BeyondTrust | 2024 | Identity Security Vendor |
| 165 | BioCatch Digital Banking Fraud Trends in Latin America 2026 | Bottom Line Up Front (BLUF) Digital banking fraud in Latin America is rising sharply, driven by social engineering, account takeover, malware, stolen devices, mule accounts, and remote-access tool fraud. For SMBs and insurance teams, the key takeaway is that many losses may look like legitimate customer-authorized transactions, making prevention, verification, and real-time fraud controls especially important. Top 3-5 Most Notable Statistics •Social engineering scam attempts against Latin American consumers increased by 155% in 2025. •Account takeover attempts at Latin American financial institutions increased by 155%, with Mexico reporting a 311% increase and Colombia a 188% increase. •Malware attacks across the region increased by 225%, while stolen device cases surged by 344%. •Fraud attempted via remote-access tools increased by 409% across Latin America. •Banks deploying BioCatch solutions reported 42% more money mule accounts, while Argentina recorded a 27% decline in mule activity. Top 3-5 Exploitable Technology Risks •Remote-access tools on mobile devices, which allow fraudsters to guide or control a victim’s banking session and complete transactions faster than on desktop. •Account takeover attacks, especially where stolen credentials, phishing, malware, SIM swap, or compromised devices are used to bypass authentication controls. •Voice scams impersonating bank employees, where victims are pressured into authorizing transfers that appear legitimate to the bank. |
| BioCatch | 2026 | Identity Security Vendor |
| 166 | BioCatch Digital Banking Fraud Trends in Thailand 2026 | Bottom Line Up Front (BLUF) Thai banking leaders report rising fraud attempts, rising losses, and major exposure from social engineering, mule accounts, and real-time payments. For SMBs and insurance teams, the key takeaway is that digital banking fraud is becoming faster, more organized, and harder to recover from once funds move through instant payment channels. Top 3-5 Most Notable Statistics •63% of Thai banking leaders surveyed believe fraud attempts at their organization are increasing. •52% say fraud losses at their organization are increasing. •80% estimate their institution’s annual fraud losses exceed $5 million. •87% say identifying mule accounts reused across multiple institutions is moderately or very challenging. •92% recognize instant payments as a very high or moderate fraud risk. Top 3-5 Exploitable Technology Risks •Malicious remote-access applications: Criminals persuade victims to install remote-access apps, creating a direct path to manipulate accounts or transactions. •Real-time transfers via PromptPay and instant payments: Faster transfers shrink the window for banks to detect, block, or recover fraudulent payments. •Mule account networks: Fraud groups use accounts across multiple institutions to move and launder stolen funds, making detection and tracing more difficult. |
| BioCatch | 2026 | Identity Security Vendor |
| 167 | BioCatch Digital Banking Fraud Trends in the United States 2025 | Bottom Line Up Front (BLUF) BioCatch reports that U.S. digital banking fraud is shifting toward account takeover, social engineering, money mule activity, bot-driven account opening, and faster cash-out through stablecoins. For SMBs and insurance teams, the key concern is that fraud increasingly depends on convincing legitimate users to authorize payments or bypass controls, making prevention, customer education, and early detection critical. Top 3-5 Most Notable Statistics •13% increase in account takeover fraud reported to BioCatch in the first half of 2025 compared with the first half of 2024. •3x increase in bot usage for account opening fraud. •50% increase in remote access being used for account takeover fraud. •168% increase in reported money mules. •Americans lost more than $6.5 billion to investment scams in 2024. Top 3-5 Exploitable Technology Risks •Social engineering and phishing, including impersonation, purchase, and investment scams, are used to trick victims into sharing credentials, financial information, or authorizing payments. •One-time-password theft through social engineering, including OTP vishing, helps attackers bypass two-factor authentication. •Remote access Trojans and remote access tools are increasingly present in account takeover activity, allowing criminals to control or influence banking sessions. |
| BioCatch | 2025 | Identity Security Vendor |
| 168 | Black Duck Open Source Risk Analysis Report 2026 | Bottom Line Up Front (BLUF) Open source is effectively universal in commercial software, and Black Duck’s 2026 data shows that vulnerability volume, supply chain attacks, outdated components, and AI-driven development are expanding the risk surface quickly. For SMBs and insurance teams, the key takeaway is that software risk now depends heavily on third-party components that many organizations may not fully inventory, monitor, or maintain. Top 3-5 Most Notable Statistics •98% of audited codebases contained open source components. •Audited codebases contained an average of 581 vulnerabilities. •65% of surveyed organizations reported experiencing a software supply chain attack in the past year. •93% of audited codebases contained components with no development activity in over two years. •Only 7% of components were running the latest available version, while 41% were more than 10 versions behind. Top 3-5 Exploitable Technology Risks •Malicious open source packages created through typosquatting, dependency confusion, or social engineering, which accounted for 66% of malicious packages identified by Black Duck. •Hijacked legitimate packages, often compromised through maintainer account takeover or malicious commits, which are dangerous because trusted packages may already be installed across many applications. •Persistent older jQuery-related vulnerabilities, including CVE-2020-11022, CVE-2020-11023, CVE-2019-11358, and CVE-2015-9251, collectively affecting 25%–28% of codebases. |
| Black Duck | 2026 | Application / API Security Vendor |
| 169 | BSIMM11 2020 | Bottom Line Up Front (BLUF) BSIMM11 is a benchmark of real-world software security programs across 130 organizations, not a breach or attack report. The main takeaway for SMBs and insurance teams is that software security is increasingly being measured, automated, and integrated into engineering workflows, especially CI/CD, cloud, containers, and incident response feedback loops. Top 3-5 Most Notable Statistics •BSIMM11 is based on observed software security practices at 130 firms. •The model includes 121 software security activities across 12 practices and 4 domains. •“Ensure host and network security basics are in place” was observed in 121 firms, making it one of the most common deployment activities. •The median ratio of full-time software security group members to developers was 0.63%, or about 1 software security person for every 159 developers. •Insurance firms represented 14 of 130 organizations and, on average, lagged financial services in Strategy & Metrics, Compliance & Policy, and Attack Models. Top 3-5 Exploitable Technology Risks •Weak host and network security basics, including gaps in provisioning controls, hardening, patching, monitoring, and configuration standards. •Insecure deployment parameters and configurations, especially as infrastructure moves into cloud environments. •Insufficient code integrity protection, which can weaken confidence in what is built, packaged, and deployed. |
| Synopsys | 2020 | Threat Intelligence Vendor |
| 170 | BSIMM12 Digest: The CISO's Guide to Next-Gen AppSec | Bottom Line Up Front (BLUF) BSIMM12’s key message is that organizations are accelerating software delivery faster than many application security programs can adapt, which can result in vulnerable code reaching production. For SMBs and insurance teams, the practical takeaway is to focus on a balanced, risk-based AppSec program: know what software exists, address cloud and open source risk, automate where useful, and assign clear ownership. Top 3-5 Most Notable Statistics •61% increase over two years in organizations identifying open source components. •57% increase over two years in organizations creating SLA boilerplate. •30% increase over 24 months in organizations publishing software security data internally. •560% increase in use of orchestration for containers and virtualized environments. •555% increase in activity to ensure cloud security basics. Top 3-5 Exploitable Technology Risks •Open source components: the report links increased attention to open source with the prevalence of open source in modern software and attacks using popular open source projects as vectors. •Cloud environments: organizations are building capabilities to manage cloud security and evaluate shared responsibility models, showing that cloud basics remain a key risk area. •Containers and virtualized environments: the highest-growth activity was using orchestration for containers and virtualized environments, indicating rising AppSec focus around these environments. |
| Synopsys | 2021 | Threat Intelligence Vendor |
| 171 | BSIMM13 Foundations Report 2022 | Bottom Line Up Front (BLUF) Synopsys’ BSIMM13 shows that mature software security programs are moving from occasional, late-stage testing to continuous, data-driven security across development, operations, cloud, and software supply chains. For SMBs and insurance teams, the key takeaway is that unmanaged software assets, open source components, third-party code, and weak security governance can create preventable exposure that is increasingly visible to customers, partners, executives, and regulators. Top 3-5 Most Notable Statistics •BSIMM13 reflects software security practices across 130 organizations. •Those organizations collectively include 11,850 security professionals supporting about 410,000 developers and about 145,000 applications. •Observation of efforts to identify open source and control open source risk grew by nearly 35% from BSIMM12 to BSIMM13. •Efforts to look for and fix all occurrences of important defects found in operations grew by 175%. •Organizations with security champions scored about 35% higher on average than organizations without them. Top 3-5 Exploitable Technology Risks •Open source and third-party software risk: the report highlights growing concern around vulnerabilities in third-party libraries and the need to identify and control open source use. •Software supply chain visibility gaps: external software integrated into internal systems requires tracking and security oversight, including bills of materials. •Cloud, container, and orchestration security: software security is increasingly intertwined with cloud security, infrastructure security, container security, and orchestration security. |
| Synopsys | 2022 | Threat Intelligence Vendor |
| 172 | BSIMM14 Report 2023 | Bottom Line Up Front (BLUF) BSIMM14 shows that mature organizations are treating software security as an ongoing business program, not a one-time technical task. For SMBs and insurance teams, the main takeaway is that practical controls around software development, open source, cloud environments, vendor software, and vulnerability handling are becoming core indicators of software risk. Top 3-5 Most Notable Statistics •BSIMM14 is based on observed software security activities from 130 organizations. •The BSIMM project has grown from 9 participating companies in 2008 to 130 in 2023. •The data pool includes approximately 3,600 software security group members and 7,500 security champions. •The most observed activity was implementing security checkpoints and associated governance, seen in 90.8% of firms. •Firms with security champions scored on average 25% higher than firms without one. Top 3-5 Exploitable Technology Risks •Software supply chain exposure: The report highlights risk from third-party code, open source components, vendor software, and software artifacts moving through development pipelines. •Open source vulnerabilities: Firms are increasing efforts to identify open source and control open source risk because integrated components can introduce vulnerabilities into deployed software. •Development toolchain integrity: BSIMM14 added an activity to track how firms protect development toolchains, reflecting concern about software and artifacts as they pass through the pipeline. |
| Black Duck | 2023 | Application / API Security Vendor |
| 173 | BSIMM15 Report 2025 | Bottom Line Up Front (BLUF) Black Duck’s BSIMM15 shows that leading organizations are moving software security from occasional testing into structured governance, automation, supply chain oversight, and secure adoption of new technologies. For SMBs and insurance teams, the key takeaway is that risk is increasingly tied to whether a business can prove it has repeatable software security controls across code, vendors, deployment environments, and incident response. Top 3-5 Most Notable Statistics •BSIMM15 is based on observed software security activities from 121 organizations. •The BSIMM project now includes approximately 3,400 software security group members and 7,700 security champions. •The most commonly observed activity was creating or interfacing with incident response, seen in 91.7% of participants. •Use of automated code review tools was observed in 87.6% of participants. •The report observed a 67% increase in application composition analysis on code repositories and a 22% increase in creating bills of materials for deployed software. Top 3-5 Exploitable Technology Risks •Software supply chain exposure, including open source, vendor code, SBOM management, and application composition analysis gaps. •Weak source code, code integrity, development endpoint, and SDLC toolchain protections. •Insecure deployment parameters, cloud environments, containers, orchestration, and infrastructure-as-code artifacts. |
| Black Duck | 2025 | Application / API Security Vendor |
| 174 | BSIMM16 Report 2026 | Bottom Line Up Front (BLUF) BSIMM16 shows that mature software security programs are increasingly focused on AI, regulatory pressure, software supply chain risk, automation, and measurable governance. For SMBs and insurance teams, the key takeaway is that software risk is no longer limited to code defects; it also includes third-party components, development pipelines, cloud infrastructure, AI-assisted coding, and the ability to prove controls are working. Top 3-5 Most Notable Statistics •BSIMM16 is based on observations from 111 organizations across sectors including cloud, financial services, FinTech, healthcare, insurance, IoT, ISVs, and technology. •The BSIMM project now includes approximately 3,700 software security group members and 6,500 security champions. •The report’s participating organizations collectively support about 223,700 developers working on about 91,200 applications. •The most observed activity was creating or interfacing with incident response, seen in 87.6% of organizations. •Use of automated code review tools was observed in 78.5% of organizations. Top 3-5 Exploitable Technology Risks •AI/ML and LLM adoption: The report highlights emerging attacks against AI/ML safeguards and the need to gather attack intelligence because standard testing may not fully cover newer LLM-related risks. •AI-assisted code generation: Coding copilots can speed development, but the report states they are not infallible and the code they produce may not be perfect, making mandatory code review important. •Software supply chain exposure: Third-party code, open source, cloud-hosted AI/ML services, SBOM management, vendors, and vulnerability information are called out as complicated areas requiring stronger risk management. |
| Black Duck | 2026 | Application / API Security Vendor |
| 175 | Bundeslagebild Cybercrime 2023 | Bottom Line Up Front (BLUF) The BKA assesses that cyberattacks in 2023 increased again in both volume and severity, with ransomware, data extortion, supply-chain attacks, and easier access to criminal tools remaining central concerns. For SMBs and insurance teams, the key takeaway is that attackers are becoming more scalable, more professional, and more internationally distributed, which increases the likelihood of business interruption and high-cost claims. Top 3-5 Most Notable Statistics •Total losses to German companies from theft, industrial espionage, or sabotage were reported at 205.9 billion euros. •Nearly three quarters of those losses, 72%, or 148.2 billion euros, were attributed to cyberattacks. •Explicit losses from extortion involving stolen or encrypted data were 16.1 billion euros. •Losses from extortion with stolen or encrypted data increased by 50.5%. •The report states that total losses appear to be stabilizing at over 200 billion euros. Top 3-5 Exploitable Technology Risks •Initial access brokers: specialized criminal actors sell access to compromised environments, enabling other attackers to conduct follow-on attacks. •Zero-day vulnerabilities: newly exploited weaknesses were highlighted as entry vectors that caused serious damage in 2023. •Malware and ransomware variants: ransomware remains the primary malware threat, with existing code from variants such as Babuk Locker, Conti, LockBit, and HIVE reused to create new variants. |
| Bundeskriminalamt (BKA) | 2023 | Government / Intelligence Agency |
| 176 | Business Email Compromise 2024 | Bottom Line Up Front (BLUF) Business Email Compromise (BEC) is a financially damaging “sleeper threat” that can affect companies of any size or industry, even though it attracts less attention than ransomware or cloud outages. For SMBs and insurance teams, the key concern is that smaller-revenue companies may experience fewer BEC events, but when they do, the loss can represent a much larger share of revenue. Top 3-5 Most Notable Statistics •Between October 2013 and December 2022, reported U.S. BEC victim complaints totaled 137,601. •Total U.S. exposed dollar loss from those complaints was USD 17.3 billion. •In 2023, the IC3 received more than 21,000 BEC-related complaints. •The average loss per BEC incident now surpasses 6 figures. •Less than 25% of BEC events had any funds recovered; when recovery occurred, 90-100% of the initial loss was recovered in half of those cases. Top 3-5 Exploitable Technology Risks •Email spoofing, where attackers forge sender addresses to make messages appear to come from trusted internal sources. •Domain impersonation, where attackers use lookalike or compromised domains to make fraudulent emails appear legitimate. •Compromised email accounts, which allow attackers to monitor communications, harvest credentials, and send convincing fraudulent requests. |
| Guy Carpenter | 2024 | Threat Intelligence Vendor |
| 177 | Chainguard Engineering Reality Report 2026 | Bottom Line Up Front (BLUF) Chainguard’s report shows that engineering teams are losing substantial time to maintenance, fragmented tools, and repetitive work, leaving less capacity for building, patching, and improving software. For SMBs and insurance teams, the key takeaway is that developer productivity issues can become operational and security risk when vulnerability remediation, compliance tasks, and tool integration are inconsistent or delayed. Top 3-5 Most Notable Statistics •72% of engineers said demands on their time make it difficult to find space for building new features. •93% of engineers said writing code and building new features is rewarding, but they spend only 16% of their week on that work. •65% of respondents said most common engineering tasks are mostly or fully automated. •Among respondents highly leveraging automation, 94% said they spend most of their time on energizing work, compared with 67% of those not highly leveraging automation. •88% said switching between tools affects productivity, and 44% reported significant loss of focus. Top 3-5 Exploitable Technology Risks •Frequent code maintenance, upgrades, breaking changes, patching, and vulnerability resolution can distract teams from key priorities and create delays in addressing known weaknesses. •Reviewing CVE alerts and triaging security scanners is identified as disliked work, which may make vulnerability management harder to sustain consistently. •Security patching and vulnerability remediation are common automation targets, but AI use in this area raises concerns about security, privacy, accountability, and trust. |
| Chainguard | 2026 | Supply Chain Security Vendor |
| 178 | Check Point Cyber Security Report 2022 | Bottom Line Up Front (BLUF) Check Point’s 2022 report shows a sharp rise in cyberattacks, driven by supply chain compromise, ransomware, cloud weaknesses, mobile threats, and fast exploitation of major vulnerabilities such as Log4j. For SMBs and insurance teams, the key takeaway is that attackers are exploiting common business technology and trusted vendors, making prevention, patching, segmentation, and employee awareness essential loss-control priorities. Top 3-5 Most Notable Statistics •Cyberattacks increased by an average of 50% compared with the prior year. •The education and research sector averaged 1,605 attacks per week and saw a 75% increase compared with 2020. •Software supply chain attacks increased by 650% during the year. •Check Point detected approximately 830,000 Log4j attack attempts within 72 hours of disclosure. •Approximately 48.3% of organizations were affected by exploitation attempts against the Log4Shell vulnerability in 2021. Top 3-5 Exploitable Technology Risks •Log4Shell in Apache Log4j allowed remote code execution through a simple logged string, affecting millions of Java-based applications and enabling cryptomining, network access, and advanced threat activity. •Microsoft Exchange ProxyLogon could enable authentication bypass and remote code execution on unpatched Exchange servers, and was exploited by multiple threat groups. •Atlassian Confluence remote code execution could be exploited without authentication, with attackers scanning for vulnerable systems to install cryptominers and launch ransomware. |
| Check Point | 2022 | Network Security Vendor |
| 179 | Check Point Cyber Security Report 2023 | Bottom Line Up Front (BLUF) Check Point’s 2023 report shows a threat environment where attackers are using email, stolen credentials, cloud access, exposed servers, and legitimate administration tools to move from initial access to ransomware, data theft, or destructive disruption. For SMBs and insurance teams, the main takeaway is that common business systems and routine IT tools can become the path to high-impact losses if access, patching, email security, and monitoring are weak. Top 3-5 Most Notable Statistics •86% of all file-based attacks observed in the wild were delivered by email in 2022. •Global attacks increased by 28% in the third quarter of 2022 compared with the same period in 2021, with average weekly attacks per organization exceeding 1,130. •Cloud-based network attacks per organization increased by 48% in 2022 compared with 2021. •Infostealers affected 24% of organizations in 2022, up from 21% in 2021 and 18% in 2020. •Check Point’s incident response cases showed ransomware as the initial threat indication in 49% of investigations. Top 3-5 Exploitable Technology Risks •Email-delivered malware and phishing, including malicious Office documents, macro-based lures, thread hijacking, and alternative file types used to bypass user protections. •Exposed RDP services, vulnerable mail servers, remote code execution flaws, weak passwords, and poor patch management, which attackers use to gain footholds. •Cloud identity and access risks, including compromised credentials, excessive third-party permissions, stolen cookies, and multi-factor authentication fatigue attacks. |
| Check Point | 2023 | Network Security Vendor |
| 180 | Check Point Cyber Security Report 2024 | Bottom Line Up Front (BLUF) Check Point’s 2024 report shows that ransomware and extortion remained the dominant business risk in 2023, while attackers increasingly exploited edge devices, cloud identity tokens, software supply chains, and phishing lures. For SMBs and insurance teams, the key takeaway is that backups alone are no longer enough because many attacks now focus on data theft, operational disruption, and stolen access rather than only file encryption. Top 3-5 Most Notable Statistics •Ransomware accounted for 10% of all malware types detected by Check Point sensors. •Check Point Incident Response Team data found that nearly half of handled incidents involved ransomware. •Reported ransomware victims reached nearly 5,000 in 2023, up from 2,600 in 2022. •MGM estimated damage costs of $100 million after a ransomware-related cyberattack disrupted operations. •Qbot impacted more than 700,000 computers worldwide before law enforcement disruption efforts. Top 3-5 Exploitable Technology Risks •Edge devices such as routers, switches, VPN hardware, firewalls, and security appliances were exploited because they are often poorly monitored, inadequately patched, left with default passwords, or past end-of-life. •Vulnerable VPN and access products, including Citrix, Fortinet, Zyxel, Barracuda Email Security Gateway, Ivanti EPMM, and MOVEit Transfer, were used in major campaigns involving ransomware, espionage, or data theft. •Stolen cloud access tokens and session artifacts were used to bypass normal authentication, including attacks involving support systems, HAR files, Microsoft cloud environments, and Okta customer-support data. |
| Check Point | 2024 | Network Security Vendor |
| 181 | Check Point Cyber Security Report 2025 | Bottom Line Up Front (BLUF) Check Point’s 2025 report shows that attackers are increasingly focused on stealing access and data, not just encrypting systems. For SMBs and insurance teams, this means cyber risk is shifting toward credential theft, data extortion, exposed edge devices, cloud access abuse, and faster-moving ransomware operations. Top 3-5 Most Notable Statistics •Infostealer attacks increased by 58%, with a focus on corporate access. •Cyberint, a Check Point company, reported that over 70% of devices infected by infostealers are personal rather than corporate or managed. •More than 10 million infostealer logs were available for purchase on Russian Market. •The median ransom payment in 2024 remained approximately $200,000. •Check Point Incident Response found that 35% of incident response engagements were triggered by security alerts, while 11% of investigated ransomware attacks specifically targeted VMware ESXi servers. Top 3-5 Exploitable Technology Risks •Infostealers on personal and BYOD devices can steal credentials, browser cookies, financial details, and session tokens, creating a path into corporate networks. •Publicly exposed edge devices, including VPNs, routers, firewalls, NAS systems, and IP cameras, are being exploited through zero-day and known vulnerabilities. •Cloud and SSO environments face credential stuffing and low-volume password spray attacks, including campaigns using residential proxies and compromised SOHO devices. |
| Check Point | 2025 | Network Security Vendor |
| 182 | Check Point Cyber Security Report 2026 | Bottom Line Up Front (BLUF) Check Point’s report shows that attackers are combining social engineering, identity abuse, ransomware, exposed infrastructure, and AI to move faster from initial access to business impact. For SMBs and insurance teams, the key issue is not just whether an attack starts with malware or a vulnerability, but whether weak monitoring, identity controls, backups, and third-party access allow it to become a costly outage or data breach. Top 3-5 Most Notable Statistics •ClickFix activity increased by approximately 500% in 2025 and appeared in nearly half of documented malware campaigns. •Ransomware data-leak sites named more than 7,960 victims in 2025, a 53% year-over-year increase. •Q1 2025 recorded 2,289 published ransomware victims, while Q4 reached 2,473, the highest quarterly level in the dataset. •Approximately 89% of organizations were impacted by risky AI prompts in an average month, with 1 in 41 prompts classified as high risk. •EXE files accounted for 65% of web-delivered malware, while HTML and SVG each accounted for 34% of email-based malicious file activity. Top 3-5 Exploitable Technology Risks •ClickFix, FileFix, and ConsentFix attacks that trick users into manually executing malicious content or approving cloud account access. •Voice-based social engineering against help desks, IT support, and SaaS users, including attacks involving password resets, MFA codes, and malicious app authorization. •Ransomware targeting backup infrastructure, privileged accounts, file servers, and virtual infrastructure to slow recovery and increase pressure. |
| Check Point | 2026 | Network Security Vendor |
| 183 | Cisco 2022 Data Privacy Benchmark Study | Bottom Line Up Front (BLUF) Privacy is now a business-critical trust issue, not just a compliance task. For SMBs and insurance teams, the key takeaway is that customers, boards, and business partners increasingly expect organizations to protect personal data, demonstrate privacy maturity, and be transparent about data use. Top 3-5 Most Notable Statistics •90% of respondents said customers would not buy from them if they did not adequately protect data. •91% said external privacy certifications are a factor in their buying process. •94% of organizations report one or more privacy-related metrics to the Board of Directors. •Average privacy spending increased 13%, from $2.4 million to $2.7 million. •88% said data localization requirements are adding significant cost to operations. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs For small and medium-sized businesses, the report shows that privacy performance directly affects customer trust, sales, and operational cost. Smaller organizations reported increased privacy spending, with organizations of 50-249 employees rising from $1.1 million to $1.7 million, and those with 250-499 employees rising from $1.6 million to $2.1 million. The report also found that privacy investment can produce business benefits, including reduced sales delays, mitigation of losses from data breaches, improved operational efficiency, and stronger customer loyalty and trust. SMBs that cannot explain how they collect, use, and protect personal data may face customer hesitation, partner scrutiny, and added compliance pressure. |
| Cisco | 2022 | Network Security Vendor |
| 184 | Cisco 2023 Data Privacy Benchmark Study | Bottom Line Up Front (BLUF) Cisco’s study shows that privacy is now a core business trust issue, not just a compliance task. For SMBs and insurance teams, the key takeaway is that organizations report measurable business value from privacy investment, but customer trust can still be weakened by poor transparency, AI-related concerns, and unclear handling of personal data. Top 3-5 Most Notable Statistics •95% of respondents said privacy is a business imperative, and 94% said customers would not buy from them if their data was not properly protected. •Average privacy spending reached $2.7 million, up from $1.2 million three years earlier. •Organizations estimated privacy benefits at 1.8 times spending on average. •98% of organizations report one or more privacy-related metrics to the Board of Directors. •60% of consumers are concerned about how organizations use AI, and 65% have already lost trust in organizations over AI practices. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs For small and medium-sized businesses, the report reinforces that privacy affects sales, customer retention, operations, and trust. Cisco found that organizations recognize benefits from privacy investment across areas including reducing sales delays, mitigating losses from data breaches, improving operational efficiency, enabling innovation, and building customer loyalty and trust. Smaller organizations in the survey also increased privacy spending, with organizations of 50-249 employees reporting a rise from $1.7 million to $2.0 million. The practical message for SMBs is that customers increasingly expect their data to be protected and clearly explained, and weak privacy practices may directly affect buying decisions. |
| Cisco | 2023 | Network Security Vendor |
| 185 | Cisco 2024 Data Privacy Benchmark Study | Bottom Line Up Front (BLUF) Cisco’s 2024 study shows that privacy is now a business trust issue, not just a compliance task: customers may not buy from organizations that fail to protect data properly. For SMBs and insurance teams, the most important takeaway is that privacy controls, AI governance, and GenAI data-use limits are becoming practical indicators of business resilience and customer confidence. Top 3-5 Most Notable Statistics •94% of organizations said customers would not buy from them if their data was not properly protected. •98% said external privacy certifications are important when choosing a vendor. •95% said the benefits of privacy investment are greater than the costs, with an average reported return of 1.6x. •91% said they still need to do more to reassure customers that data used with AI is for intended and legitimate purposes. •79% said they are getting significant or very significant value from GenAI, while 62% have entered internal process information into GenAI applications. Top 3-5 Exploitable Technology Risks •GenAI applications may expose sensitive business information if employees enter internal processes, non-public company information, customer information, or employee information. •Lack of clear limits on what data can be entered into GenAI tools increases the chance of unauthorized sharing of confidential or personal information. •Weak restrictions on which GenAI tools employees may use can make it harder to manage data and privacy risk. |
| Cisco | 2024 | Network Security Vendor |
| 186 | CISO and CIO Investment Priorities for Cybersecurity in 2025 | Bottom Line Up Front (BLUF) Cybersecurity investment in 2025 is being driven by rising insurance costs, AI-enabled attacks, cloud incidents, and data exposure. For SMBs and insurance teams, the key takeaway is that strong cloud, identity, API, and data controls are increasingly tied to both loss prevention and the ability to obtain affordable cyber coverage. Top 3-5 Most Notable Statistics •72% of surveyed organizations experienced three or more types of cybersecurity incidents in 2024. •97% experienced one or more cybersecurity incident types in 2024. •83% rated the increasing cost of cybersecurity insurance premiums as very or extremely impactful, and 83% said the same about the growing use of AI in cyberattacks. •34% experienced a cyberattack against a cloud service, making it the most common incident type highlighted. •98.5% reported higher cybersecurity budgets for 2025 compared with 2024. Top 3-5 Exploitable Technology Risks •Cloud service attacks and misconfigured cloud access rights, which can enable unauthorized access to sensitive data. •API weaknesses, including broken authentication, excessive data exposure, security misconfiguration, and unmanaged “shadow APIs.” •Identity compromise, including phishing, MFA bypass, weak controls for non-human identities such as service accounts, and delayed revocation of departed employee credentials. |
| Osterman Research | 2025 | Threat Intelligence Vendor |
| 187 | CISO Report 2023 | Bottom Line Up Front (BLUF) Proofpoint’s 2023 CISO survey shows a sharp return to elevated cyber concern: more leaders expect a material attack, and many believe their organizations are not prepared. For SMBs and insurance teams, the key takeaway is that people-driven risk, data loss, ransomware pressure, and budget constraints are converging in ways that can drive claims, downtime, recovery costs, and reputational harm. Top 3-5 Most Notable Statistics •68% of CISOs say their organization is at risk of a material cyber attack in the next 12 months. •61% say their organization is unprepared to cope with a targeted cyber attack. •60% consider human error to be their organization’s biggest cyber vulnerability. •63% say their organization dealt with a material loss of sensitive information in the past 12 months. •61% say they would place a claim on cyber insurance policies to recover losses incurred. Top 3-5 Exploitable Technology Risks •Email fraud was the top cited threat, identified by 33% of CISOs, making it a major concern for business email compromise and related losses. •Insider threats were cited by 30%, including negligent, malicious, and compromised users who can expose sensitive data. •Cloud account compromise was cited by 29%, reflecting the risk of attackers abusing cloud identities and access. |
| Proofpoint | 2023 | Email Security Vendor |
| 188 | CISO Report 2024 | Bottom Line Up Front (BLUF) Proofpoint’s 2024 CISO Report shows that people remain the central cybersecurity risk: human error, employee negligence, insider threats, and data leaving with departing staff are repeatedly tied to attacks and data loss. For SMB owners and insurance teams, the key takeaway is that technical defenses alone are not enough; cyber risk management must focus on employee behavior, data protection, recovery planning, and insurance readiness. Top 3-5 Most Notable Statistics •70% of CISOs feel their organization is at risk of a material cyber attack in the next 12 months, and 31% rate the risk as very likely. •43% of CISOs say their organization is unprepared to cope with a targeted cyber attack in 2024. •74% of CISOs consider human error their organization’s biggest cyber vulnerability, up from 60% in 2023. •46% of CISOs reported a material loss of sensitive information in the past 12 months, down from 63% in 2023. •79% of CISOs say they would use cyber insurance to cover losses if hit by a cyber attack in the next 12 months. Top 3-5 Exploitable Technology Risks •Ransomware: Identified as the leading threat by 41% of CISOs, with attackers using double and triple extortion involving system disruption and data release threats. •Email fraud: A continuing top concern since 2021 and a major risk because attacks often depend on employee interaction. •Cloud account compromise: Listed among the top cybersecurity concerns, reflecting the risk created by growing reliance on cloud technology. |
| Proofpoint | 2024 | Email Security Vendor |
| 189 | CISO Report 2025 | Bottom Line Up Front (BLUF) Splunk’s 2025 CISO Report shows that cyber resilience depends as much on leadership alignment as on security tools. For SMB owners and insurance teams, the key takeaway is that security risk becomes harder to manage when leaders do not understand the business impact of downtime, compliance failures, incident response, and AI-enabled attacks. Top 3-5 Most Notable Statistics •94% of CISOs report being victims of a disruptive cyberattack. •67% say social engineering was the most common attack vector experienced in the past year. •21% of CISOs said they had been pressured not to report a compliance issue. •53% of CISOs believe AI will give attackers a slight or significant advantage. •64% of boards find positioning security as a business enabler the most convincing argument for increasing cybersecurity budgets. Top 3-5 Exploitable Technology Risks •AI-enhanced phishing emails and deepfakes, which can make social engineering more realistic and harder for employees to detect. •New malware strains that may evade cybersecurity controls. •Exploitation of generative AI tools used by the company. |
| Splunk | 2025 | SIEM / Security Analytics Vendor |
| 190 | CISO Survey 2025 | Bottom Line Up Front (BLUF) Team8’s 2025 CISO survey shows that AI has moved from a future concern to a current security and risk-management priority. For SMBs and insurance teams, the key takeaway is that AI is expanding both attacker capability and business exposure through convincing social engineering, unmanaged employee AI use, autonomous AI agents, and persistent gaps in vulnerability and data protection. Top 3-5 Most Notable Statistics •25% of CISOs reported experiencing an AI-generated attack within the past 12 months. •67% of enterprises are deploying AI agents in 2025, and another 23% plan to introduce them in 2026. •39% of CISOs ranked securing AI agents as a top pain point, followed by 36% for governing employee AI usage. •37% of CISOs said more than 40% of critical vulnerabilities remain unpatched beyond service-level expectations. •52% of CISOs reported a cybersecurity budget increase in 2025. Top 3-5 Exploitable Technology Risks •AI-generated social engineering, including deepfakes, voice cloning, and real-time impersonation, can exploit employee trust across business communication channels. •Malicious AI tools can help low-skill attackers create more sophisticated phishing campaigns and obfuscated malware. •AI agents can be abused through prompt injection or tool hijacking, potentially causing harmful actions, privilege escalation, lateral movement, or business disruption. |
| Team8 | 2025 | Threat Intelligence Vendor |
| 191 | Cloud and Threat Report: 2026 | Bottom Line Up Front (BLUF) Netskope’s 2026 report shows that rapid generative AI adoption is creating a major data exposure problem, especially through unmanaged “shadow AI,” personal accounts, and AI tools connected to business data. For SMBs and insurance teams, the key issue is not just new technology use, but sensitive data leaving approved environments through AI apps, personal cloud apps, phishing, and trusted cloud channels. Top 3-5 Most Notable Statistics •SaaS generative AI users tripled over the past year, while prompts sent to SaaS generative AI apps grew sixfold from 3,000 to 18,000 per month in the average organization. •The average organization saw 223 generative AI data policy violations per month, with 3% of generative AI users committing violations. •47% of generative AI users used personal AI apps. •60% of insider threat incidents involved personal cloud app instances. •87 out of every 10,000 users clicked on a phishing link each month. Top 3-5 Exploitable Technology Risks •Unmanaged generative AI tools and personal AI accounts, which can receive source code, regulated data, intellectual property, passwords, and keys outside approved controls. •Agentic AI systems, AI browsers, and Model Context Protocol-enabled tools, which can access resources, execute actions, and expand opportunities for data exposure or workflow compromise. •Personal cloud app instances, where users upload regulated data, intellectual property, source code, credentials, passwords, and API keys in violation of policies. |
| Netskope | 2026 | Cloud Security Vendor |
| 192 | Cloud Compliance Pulse 2025: The Half-Year Cloud Identity and Access Compliance Benchmark | Bottom Line Up Front (BLUF) Cloud identity and access weaknesses remain the most important compliance and breach risk highlighted in this benchmark. For SMBs and insurance teams, the key takeaway is practical: missing multifactor authentication, excessive privileges, stale keys, and unmanaged service-account credentials are common, measurable gaps that can lead to ransomware, data theft, audit findings, and higher risk exposure. Top 3-5 Most Notable Statistics •98% of firms in the sample had at least one high-severity cloud identity or access gap. •Organizations averaged 40 cloud control failures per tenant. •70% of high-severity findings came from four gap families: missing MFA, over-privileged roles, stale or duplicate credentials, and unmanaged service-account keys. •68% of tenants violated ISO 27002 control 5.17 due to privileged accounts without MFA. •AWS accounted for 63% of total findings in the study, followed by GCP at 27% and Azure at 10%. Top 3-5 Exploitable Technology Risks •Privileged admin accounts without MFA, which the report describes as enabling full-account compromise, including ransomware and data exfiltration. •Over-privileged roles, including Azure subscription-level Owner or Contributor roles and GCP project-wide Service Account User or TokenCreator roles. •Long-lived or unmanaged service-account keys, especially user-managed keys older than 90 days or keys stored outside provider-managed controls. |
| Unosecur | 2025 | Compliance / GRC Vendor |
| 193 | Cloud Data Security Snapshot: Current Exposure Trends | Bottom Line Up Front (BLUF) Wiz’s 2025 snapshot shows that many cloud environments expose sensitive data through misconfigurations, weak access controls, and vulnerable cloud-native assets. For SMBs and insurance teams, the key issue is not cloud use itself, but “toxic combinations” such as public exposure plus sensitive data, or excessive permissions plus paths to privilege escalation. Top 3-5 Most Notable Statistics •72% of cloud environments have publicly exposed PaaS databases lacking sufficient access controls. •54% of cloud environments have exposed virtual machines and serverless functions containing sensitive data. •22% of cloud environments have storage buckets that allow write access for all users. •12% of cloud environments have publicly exposed containers with high- or critical-severity vulnerabilities and known exploits. •4% of cloud environments have misconfigured HTTP/S application endpoints that expose sensitive data. Top 3-5 Exploitable Technology Risks •Publicly exposed PaaS databases without sufficient access controls, creating a direct path to sensitive data exposure. •Exposed VMs and serverless functions containing sensitive information such as credit card details and phone numbers. •Publicly exposed containers with high- or critical-severity vulnerabilities and known exploits, lowering the effort required for attackers. |
| Wiz | 2025 | Threat Intelligence Vendor |
| 194 | Cloud Report 2023 | Bottom Line Up Front (BLUF) Orca’s honeypot research shows that exposed cloud assets and leaked secrets can be found and used extremely quickly, sometimes within minutes. For SMBs and insurance teams, the key takeaway is that accidental public exposure in cloud environments is not a slow-moving risk; it can rapidly become a security incident involving reconnaissance, malware, cryptomining, persistence attempts, or access to sensitive data. Top 3-5 Most Notable Statistics •Attackers used leaked AWS keys exposed on GitHub in 2 minutes. •The HTTP honeypot was accessed in 3 minutes, and the SSH honeypot was accessed in 4 minutes. •Public S3 buckets were accessed in 1 hour, and exposed keys in those buckets were used within 8 hours. •Orca observed hundreds of attempts to install malware and cryptominers on the SSH honeypot. •The top targeted ports in scanning attempts included VNC port 5900 with 24M scans and Telnet port 23 with 6.5M scans. Top 3-5 Exploitable Technology Risks •Leaked cloud keys in GitHub repositories, including Git history, because attackers can quickly discover and test exposed secrets. •Public S3 buckets with List and Get permissions, because attackers can identify accessible buckets, inspect permissions, and use exposed keys. •Exposed SSH services with weak or common usernames and passwords, because attackers can attempt automated logins and deploy malware or cryptominers. |
| Orca | 2023 | Cloud Security Vendor |
| 195 | Cloud ROI of AI 2025 | Bottom Line Up Front (BLUF) Google’s 2025 report shows that generative AI has moved from experimentation to measurable business value, with AI agents emerging as the next major area of adoption. For SMBs and insurance teams, the key takeaway is that AI can improve productivity, customer experience, marketing, and security outcomes, but only when paired with strong governance, secure data access, executive sponsorship, and clear business goals. Top 3-5 Most Notable Statistics •74% of executives report ROI within the first year on at least one gen AI use case. •88% of executives from agentic AI early adopter organizations report ROI now on at least one gen AI use case. •52% of executives whose organizations use gen AI also have adopted AI agents in production. •49% of executives report gen AI has created meaningful impact to security posture. •37% rank data privacy and security as a top factor when considering LLM providers, ahead of integration with existing systems and cost. Top 3-5 Exploitable Technology Risks •AI agents need access to internal enterprise systems, which creates risk if access is not secure, governed, and controlled. •Data privacy and security are the top LLM provider consideration, reflecting concern over sensitive business data exposure. •The report highlights the risk of bad actors gaining access to company data through LLM-related systems. |
| 2025 | Cloud Provider / Hyperscaler | |
| 196 | Cloud Security Report 2021 | Bottom Line Up Front (BLUF) Cloud adoption is increasing, but organizations remain highly concerned about their ability to secure public cloud environments. For SMBs and insurance teams, the most important takeaway is that cloud risk is driven less by cloud adoption itself and more by misconfiguration, data exposure, weak access control, limited visibility, and a shortage of qualified security staff. Top 3-5 Most Notable Statistics •96% of surveyed cybersecurity professionals are at least moderately concerned about public cloud security. •67% identify cloud platform misconfiguration or wrong setup as the biggest public cloud security threat. •64% cite data loss or leakage as a major cloud security concern, and 62% cite data privacy or confidentiality. •73% rate their overall security readiness as average or below average. •81% say traditional security tools either do not work in cloud environments or have only limited functionality. Top 3-5 Exploitable Technology Risks •Cloud platform misconfiguration or wrong setup, which was the top identified public cloud threat. •Exfiltration of sensitive data, which can expose confidential or regulated information stored in cloud environments. •Unauthorized access, including incorrect user access privileges and access weaknesses. |
| ISC2 | 2021 | Education / Academic |
| 197 | Cloud Security Report 2021 | Bottom Line Up Front (BLUF) Cloud adoption is accelerating, but security maturity is not keeping pace with the complexity of hybrid and multi-cloud environments. For SMBs and insurance teams, the key takeaway is that misconfiguration, sensitive data exposure, unauthorized access, and insecure APIs are the most important cloud risks to evaluate because they are common, exploitable, and directly tied to loss scenarios. Top 3-5 Most Notable Statistics •96% of surveyed cybersecurity professionals are at least moderately concerned about public cloud security, and 32% are extremely concerned. •67% identify cloud security misconfiguration as the biggest public cloud security threat. •59% identify exfiltration of sensitive data as a major cloud threat. •71% of organizations use a hybrid or multi-cloud strategy, and 76% use two or more cloud providers. •56% expect to run more than half of their workloads in the cloud within the next 12–18 months, up from 33% today. Top 3-5 Exploitable Technology Risks •Cloud platform misconfiguration or wrong setup, which can expose systems or data when security settings are not properly applied. •Exfiltration of sensitive data, meaning unauthorized removal or exposure of business information from cloud environments. •Unauthorized access to cloud services or data, especially where identity, permissions, or access controls are not managed consistently. |
| Fortinet | 2021 | Network Security Vendor |
| 198 | Cloud Security Report 2023 | Bottom Line Up Front (BLUF) Cloud adoption continues to deliver business value, but security concerns remain widespread and are driven mainly by misconfiguration, data exposure, insecure APIs, unauthorized access, lack of skilled staff, and poor visibility across hybrid and multi-cloud environments. For SMBs and insurance teams, the key takeaway is that cloud risk is not just a technology issue; it is also an operational control, staffing, and governance issue. Top 3-5 Most Notable Statistics •95% of surveyed organizations are moderately to extremely concerned about security in public cloud environments. •59% identify cloud platform misconfiguration or wrong setup as the biggest public cloud security threat. •69% of organizations use two or more cloud providers, increasing complexity across environments. •60% expect cloud security budgets to increase, with an average increase of 33%. •90% consider a single cloud security platform and dashboard moderately to extremely helpful for consistent protection across cloud environments. Top 3-5 Exploitable Technology Risks •Cloud misconfiguration, which can expose systems or data when cloud platforms are set up incorrectly. •Exfiltration of sensitive data, identified as one of the top public cloud security threats. •Insecure interfaces and APIs, which matter because cloud services are commonly managed and connected through these access points. |
| Fortinet | 2023 | Network Security Vendor |
| 199 | Cloud Security Report 2024 | Bottom Line Up Front (BLUF) Cloud security is now a core business risk, with nearly all surveyed organizations concerned about public cloud security and many struggling with multi-cloud complexity, fragmented tools, and skills shortages. For SMBs and insurance teams, the main takeaway is that cloud risk is not just a technology issue; it affects data protection, compliance, operational resilience, and the ability to prevent or respond to incidents. Top 3-5 Most Notable Statistics •96% of organizations are moderately to extremely concerned about public cloud security. •78% of organizations use a multi-cloud or hybrid cloud environment. •69% of organizations depend on at least three separate security solutions to manage cloud security across the enterprise. •93% are moderately to extremely concerned about the shortage of qualified cybersecurity professionals. •55% identify data protection and privacy as a top challenge in securing multi-cloud environments. Top 3-5 Exploitable Technology Risks •Multi-cloud and hybrid environments create complexity that can weaken data protection, privacy controls, and consistent security management. •Fragmented security tools can increase operational complexity, create potential protection gaps, and make it harder for teams to keep up with alerts and requirements. •Weak or inconsistent identity and access management is a key concern because access control is central to protecting cloud systems and data. |
| ISC2 | 2024 | Education / Academic |
| 200 | Cloud Security Report 2024 | Bottom Line Up Front (BLUF) Cloud adoption is expanding the attack surface, especially as organizations move into hybrid and multi-cloud environments that are harder to secure consistently. For SMBs and insurance teams, the key takeaway is that cloud risk is less about whether businesses use the cloud and more about whether they can manage data protection, identity access, configurations, monitoring, and compliance across increasingly complex environments. Top 3-5 Most Notable Statistics •78% of organizations use a hybrid or multi-cloud deployment strategy. •71% use two or more cloud providers. •96% of organizations are moderately to extremely concerned about public cloud security. •93% are moderately to extremely concerned about the shortage of qualified cybersecurity professionals, and 74% report experiencing a cybersecurity talent shortage. •95% consider a single cloud security platform with one dashboard moderately to extremely helpful. Top 3-5 Exploitable Technology Risks •Cloud misconfigurations: Configuration management is a major operational challenge, and the report notes that a single misconfiguration can expose organizations to significant security risks. •Data security and privacy gaps: Protecting sensitive information and preventing data leaks is the top day-to-day cloud security challenge. •Weak access control and identity management: Poor control over user access and privileges can increase the risk of unauthorized access. |
| Fortinet | 2024 | Network Security Vendor |
| 201 | Cloud Security Report 2025 | Bottom Line Up Front (BLUF) Cloud security risk is being driven less by cloud adoption itself and more by complexity: hybrid and multi-cloud environments, inconsistent visibility, misconfigurations, weak access control, and staffing shortages. For SMBs and insurance teams, the key takeaway is that cloud environments need centralized oversight, faster detection, and stronger identity and configuration controls to reduce breach likelihood and business disruption. Top 3-5 Most Notable Statistics •82% of organizations are using a multi-cloud or hybrid environment. •78% use two or more cloud providers, up from 71% last year. •92% of respondents are concerned about public cloud security risks. •64% lack confidence in their organization’s ability to detect and respond to cloud threats in real time. •76% of organizations report a cybersecurity talent shortage. Top 3-5 Exploitable Technology Risks •Cloud misconfigurations, including publicly exposed storage buckets, which can lead to sensitive data exposure. •Excessive permissions and weak privilege management across cloud platforms, increasing the risk of unauthorized access or privilege misuse. •Loss of visibility and control in multi-cloud and hybrid environments, making it harder to detect suspicious activity quickly. |
| Check Point | 2025 | Network Security Vendor |
| 202 | Cloud Security Report 2025 | Bottom Line Up Front (BLUF) Cloud security is not keeping pace with how organizations are using cloud, SaaS, hybrid, multi-cloud, and edge environments. For SMBs and insurance teams, the key concern is that cloud incidents are common, detection is often late, and remediation frequently takes more than a day, increasing the chance of business disruption and larger losses. Top 3-5 Most Notable Statistics •65% of organizations experienced a cloud-related security incident in the past 12 months, up from 61% the year before. •Only 9% detected a cloud-related incident within the first hour, while 38% took more than 24 hours to detect one. •62% took more than 24 hours to remediate a cloud-related incident. •71% use more than 10 cloud security tools, and 16% use more than 50. •Only 17% have full visibility into lateral, or east-west, traffic inside cloud environments. Top 3-5 Exploitable Technology Risks •Fragmented hybrid, multi-cloud, cloud-edge, and SaaS environments can create inconsistent controls, visibility gaps, and policy enforcement weaknesses. •Misconfigured assets, identity governance gaps, and inconsistent enforcement across cloud deployments are specifically described as being exploited by attackers. •Limited visibility into east-west traffic allows attackers using legitimate credentials or lateral movement techniques to move quietly after initial access. |
| Check Point | 2025 | Network Security Vendor |
| 203 | Cloud Security Report 2026 | Bottom Line Up Front (BLUF) Fortinet’s 2026 Cloud Security Report shows that cloud security risk is being driven less by lack of spending and more by complexity: too many tools, limited visibility, stretched teams, and fast-moving attackers. For SMBs and insurance teams, the key takeaway is that cloud losses are most likely to emerge where identity, misconfiguration, and exposed data risks connect across hybrid, multi-cloud, and SaaS environments. Top 3-5 Most Notable Statistics •88% of organizations now operate across hybrid or multi-cloud environments, up from 82% in last year’s survey. •69% cite tool sprawl and visibility gaps as the top barrier limiting cloud security effectiveness. •66% lack strong confidence in their ability to detect and respond to cloud threats in real time. •74% report an active shortage of qualified cybersecurity professionals. •59% rate their cloud security posture at the initial or developing stages of maturity. Top 3-5 Exploitable Technology Risks •Identity and access weaknesses: 77% rank identity and access security as a top cloud-native concern, reflecting risk from excessive permissions, stolen credentials, and hidden access paths. •Misconfigured cloud services: 70% cite configuration and posture security as a major concern, with misconfigurations able to expose resources or sensitive data. •Data exposure and privacy risk: 66% identify data exposure and privacy security as a key concern, especially as sensitive data moves across services and regions. |
| Fortinet | 2026 | Network Security Vendor |
| 204 | Cloud Threat Horizons Report 2025 | Bottom Line Up Front (BLUF) Google’s 2025 Cloud Threat Horizons Report shows that cloud compromises still most often begin with basic control failures: weak credentials, misconfigurations, exposed credentials, and excessive permissions. For SMBs and insurance teams, the key takeaway is that cloud risk is not limited to large enterprises; attackers are exploiting everyday identity, backup, software supply chain, and user-trust weaknesses that can drive downtime, data loss, theft, and difficult recovery. Top 3-5 Most Notable Statistics •47.1% of observed initial access incidents in the first half of 2025 involved weak or absent credentials. •29.4% of observed initial access incidents involved misconfigurations. •11.8% of observed initial access incidents involved API or user interface compromise. •2.9% of observed initial access incidents involved leaked credentials, and 2.9% involved remote code execution. •Google observed a 4.9% decrease in misconfiguration-based access and a 5.3% decrease in API/UI compromises compared with H2 2024. Top 3-5 Exploitable Technology Risks •Weak, absent, or leaked credentials that allow attackers to access cloud environments, APIs, and administrative tools. •Cloud misconfigurations and excessive permissions, especially where human users or service accounts have more access than needed. •Backup infrastructure connected to production environments, which ransomware and extortion actors may delete, disrupt, or use to slow recovery. |
| 2025 | Cloud Provider / Hyperscaler | |
| 205 | Cloud Threat Horizons Report H1 2024 | Bottom Line Up Front (BLUF) Google’s report shows that weak cloud security basics—especially poor credentials, exposed remote access, misconfigured storage, and insufficient logging—remain major drivers of cloud compromise. For SMBs and insurance teams, the main takeaway is that many costly cloud incidents are preventable with stronger access controls, asset management, backups, and logging. Top 3-5 Most Notable Statistics •Weak or no passwords accounted for 51.1% of observed 2023 cloud compromise initial access. •Cryptomining accounted for 65.4% of observed cloud compromise impact. •Threat actors using illicit cloud access to attempt to infect third parties represented over 25% of observed incidents. •Mandiant identified more than 100 tools that target or can leverage cloud-related technologies for command-and-control, payload hosting, or data exfiltration. •In the Storm-0558 campaign, forged tokens were used to access email systems of about 25 entities. Top 3-5 Exploitable Technology Risks •Weak or nonexistent passwords on SSH and RDP, allowing attackers to gain unauthorized access to cloud instances. •Misconfigured cloud networks and excessive privileges, which can support ransomware, data theft, and lateral movement. •Weak cloud storage defenses, including predictable bucket naming conventions that attackers may exploit to capture and exfiltrate data. |
| 2024 | Cloud Provider / Hyperscaler | |
| 206 | Cloudflare Threat Report 2026 | Bottom Line Up Front (BLUF) Cloudflare’s 2026 report says attackers are industrializing cybercrime by abusing trusted identity, cloud, SaaS, email, and AI systems rather than relying only on traditional malware. For SMBs and insurance teams, the most important takeaway is that routine business tools can become the attack path, making identity controls, email authentication, SaaS governance, and rapid response to credential theft central to loss prevention. Top 3-5 Most Notable Statistics •Cloudflare’s network is described as defending against more than 230 billion threats every day. •Cloudflare says its telemetry covers approximately 20% of the web and over 20% of global Internet traffic. •A reported hyper-volumetric DDoS baseline reached 31.4 Tbps, a level Cloudflare says can exhaust most organizations’ network capacity. •In Cloudflare’s screening of 450 million emails, link-based detections accounted for 25%, identity deception 19%, and brand impersonation 16%. •Email authentication gaps were widespread: nearly 43% of emails failed SPF, over 44% lacked valid DKIM signatures, and 46% failed DMARC. Top 3-5 Exploitable Technology Risks •Over-privileged SaaS-to-SaaS integrations can let one trusted connection expose data across multiple tenants or connected systems. •Stolen session tokens and active cookies from infostealers can bypass standard MFA by letting attackers log in as already-authenticated users. •Cloud and XaaS abuse, including overly permissive IAM roles, unsecured cloud storage, and legitimate cloud hosting, lets attackers blend into normal business traffic. |
| Cloudflare | 2026 | Network Security Vendor |
| 207 | Cofense: The New Era of Phishing | Bottom Line Up Front (BLUF) Cofense reports that phishing has shifted into an AI-enabled model where attacks are faster, more personalized, and harder to detect with traditional email perimeter controls alone. For SMBs and insurance teams, the key issue is that malicious emails increasingly look like normal business communications or abuse legitimate tools, raising the risk of inbox-delivered compromise, credential theft, and business email compromise. Top 3-5 Most Notable Statistics •Cofense observed, on average, 1 malicious email every 19 seconds throughout 2025. •76% of initial infection URLs were unique and not seen across other customers, while 94% reused the same infrastructure. •Conversational attacks accounted for 18% of malicious emails, making them the second-highest threat vector. •Legitimate remote access tool abuse increased almost 900% by volume from 2024 to 2025. •Cofense reported a 106% increase in the total number of remote access trojans reported in 2025 compared with 2024. Top 3-5 Exploitable Technology Risks •Adaptive phishing pages that change payloads based on the victim’s browser or operating system, including Windows, macOS, and Android delivery. •Polymorphic phishing campaigns that generate unique URLs, file hashes, wording, logos, and sender details, reducing the value of exact-match detection. •Business Email Compromise using plain-text conversations with no malicious link or attachment, making detection difficult for tools focused on URLs and files. |
| Cofense | 2026 | Email Security Vendor |
| 208 | Commercial Cyber Security Trends 2023 | Bottom Line Up Front (BLUF) Ransomware remains the dominant cyber threat and the largest driver of cyber insurance claims, but the risk is shifting from simple encryption to data theft, supply chain compromise, and mass attacks. For SMBs and insurance teams, the key lesson is that prevention alone is no longer enough: early detection, response readiness, and data management are critical to limiting downtime, liability, and claim severity. Top 3-5 Most Notable Statistics •Ransomware victims increased by 143% globally during the first quarter of 2023. •Ransomware is projected to cost victims approximately US$265bn annually by 2031. •Allianz analysis found data exfiltration in large cyber losses rose from 40% of cases in 2019 to around 77% in 2022. •Business interruption accounts for 50% of all cyber-related losses by value. •Data breaches at small businesses globally jumped 152% during 2021, compared with 75% at larger organizations. Top 3-5 Exploitable Technology Risks •Ransomware-as-a-Service kits, which allow less skilled criminals to launch ransomware attacks quickly and cheaply. •Data exfiltration combined with encryption or DDoS, increasing extortion pressure and adding notification, legal, regulatory, and reputational costs. •Software supply chain vulnerabilities, including zero-day flaws in file transfer and remote management tools. |
| Allianz | 2023 | Cyber Insurance Carrier |
| 209 | Commercial Cyber Security Trends 2024 | Bottom Line Up Front (BLUF) Allianz reports that cyber claims are rising again, with data breach and privacy issues now central to large cyber losses. For SMBs and insurance teams, the key takeaway is that ransomware is no longer only an encryption and downtime problem: stolen data, privacy litigation, vendor exposure, and weak basic controls can turn an incident into a much larger claim. Top 3-5 Most Notable Statistics •Large cyber claims over €1mn increased in frequency by 14% and severity by 17% in the first six months of 2024. •Data and privacy breach-related elements were present in two thirds of large cyber losses. •Ransomware accounted for 58% of the value of large cyber claims in the first half of 2024. •The share of “non-attack” privacy data breaches tripled in value from 7% in 2022 to 21% in the first half of 2024. •US data breach class actions rose to 1,320 in 2023, more than double the 604 filed in 2022. Top 3-5 Exploitable Technology Risks •Stolen or compromised credentials: attackers used compromised credentials in major breaches, including access to cloud or portal environments, and these remain a leading attack vector. •Phishing and business email compromise: these attacks trick users into revealing passwords, downloading malware, or transferring funds, and often precede ransomware or data breach events. •Missing or weak multifactor authentication: Allianz highlights cases where compromised accounts did not have multifactor authentication enabled. |
| Allianz | 2024 | Cyber Insurance Carrier |
| 210 | Commercial Cyber Security Trends 2025 | Bottom Line Up Front (BLUF) Allianz reports that insured organizations are becoming more resilient, but attackers are shifting toward mid-sized and smaller firms that are less protected. For SMBs and insurance teams, the key takeaway is that ransomware, data theft, social engineering, supplier outages, and technical failures can all create costly business interruption and claims. Top 3-5 Most Notable Statistics •Ransomware accounted for around 60% of the value of large cyber claims above €1mn during the first half of 2025. •Claims involving data exfiltration represented around 40% of large cyber claim value in the first half of 2025, up from 25% in 2024. •Non-attack incidents, including technical failure and data privacy liability, accounted for a record 28% of large claims by value in 2024. •Around 60% of breaches in 2024 involved a human element, and third-party involvement doubled to 30%. •Overall claims severity declined by more than 50% in the first half of 2025, while large loss claim frequency fell by around 30%. Top 3-5 Exploitable Technology Risks •Compromised credentials and help-desk impersonation: attackers use stolen usernames, passwords, phishing, and social engineering to gain access, reset passwords or MFA, and move quickly toward ransomware deployment. •Data exfiltration: attackers increasingly steal data instead of, or before, encrypting systems because it is faster and increases pressure to pay. •Third-party IT and cloud dependencies: supplier attacks, cloud intrusions, software provider outages, and outsourced service failures can trigger contingent business interruption even when the insured’s own controls are strong. |
| Allianz | 2025 | Cyber Insurance Carrier |
| 211 | CompTIA State of the Tech Workforce 2026 | Bottom Line Up Front (BLUF) CompTIA’s report shows that technology talent remains a major business constraint and competitive factor, with U.S. net tech employment projected to rebound in 2026 after a slight decline in 2025. For SMBs and insurance teams, the key takeaway is that hiring, retaining, and budgeting for qualified technology workers—especially in cybersecurity, data, AI, software, and infrastructure roles—will directly affect operational resilience and risk management capacity. Top 3-5 Most Notable Statistics •U.S. net tech employment reached an estimated 9,597,888 workers in 2025 and is forecast to grow 1.9% to 9.8 million in 2026. •The tech industry accounts for an estimated 8.7% of direct U.S. economic value, translating to over $2 trillion. •There were 3,080,057 active employer job postings for tech occupations from January 2025 to January 2026. •Employer job postings requiring AI skills totaled 1,229,505 across all jobs from January 2025 to January 2026. •The tech workforce is projected to grow about twice as fast as the overall U.S. workforce over the next ten years. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs For SMBs, the report points to a practical workforce challenge: technology roles are growing, replacement needs are significant, and demand is spread across every sector of the economy—not just technology companies. CompTIA notes that 60% of technology professionals work outside technology companies, meaning SMBs in finance, healthcare, manufacturing, retail, professional services, and other sectors compete for the same workers. This can raise hiring costs, extend vacancies, and make it harder to maintain reliable IT support, cybersecurity operations, cloud infrastructure, software systems, and data capabilities. The report also highlights strong demand for AI-related skills, which may further increase competition for workers who can support emerging digital tools. |
| CompTIA | 2026 | Research Organization |
| 212 | ConductorOne Identity Security Outlook Report 2024 | Bottom Line Up Front (BLUF) Identity and access risk is now a major security exposure, with improper access and overprivileged users tied to a high share of reported attacks and breaches. For SMBs and insurance teams, the key takeaway is that access controls, account cleanup, third-party access, and privilege management should be treated as core loss-prevention controls, not just IT administration. Top 3-5 Most Notable Statistics •77% of surveyed security leaders said their organization had cyberattacks or data breaches in the past 12 months due to improper access or overprivileged users. •85% of respondents at companies with 250-500 employees reported a breach or attack in the last 12 months. •97% said their company involves external entities such as contractors, partners, or suppliers with access to systems, applications, or resources. •81% expressed concern about non-human identities, such as service accounts, API tokens, and OAuth tokens. •47% said their company’s identity security strategy and access policies hinder team productivity. Top 3-5 Exploitable Technology Risks •Overprivileged users and improper access, which can let attackers “log in” rather than break in and reach sensitive systems or data. •Orphaned and unused accounts, which the report describes as easy targets when not deactivated or removed. •Third-party access by contractors, partners, and suppliers, especially where external entities have broad access to internal systems. |
| ConductorOne | 2024 | Identity Security Vendor |
| 213 | ConnectEU State of Digital Communications 2026 | Bottom Line Up Front (BLUF) Europe’s digital communications sector is improving coverage and investing in cloud, AI, edge, and cybersecurity, but the report warns that security and resilience must keep pace with growing cyber, physical, AI-enabled, and future quantum threats. For SMBs and insurance teams, the key takeaway is that connectivity, cloud, and telecom dependencies are becoming more business-critical, while disruption and compliance expectations are rising. Top 3-5 Most Notable Statistics •The European digital communications ecosystem was worth EUR1.09 trillion in 2024, representing 5% of Europe’s GDP. •5G coverage in Europe reached 94.9% of the population by the end of 2025, while 5G adoption was only 43% of mobile connections. •FTTH reached 77.2% of European households by the end of 2025, and gigabit-capable networks reached 86.2%. •Around EUR88 billion in additional investment is required to reach the fixed gigabit target. •European telecom operators’ cybersecurity revenues reached EUR5.3 billion in 2025, up from EUR3.2 billion in 2020. Top 3-5 Exploitable Technology Risks •Cyber and physical threats to communications infrastructure, including domestic infrastructure, submarine cables, and international links, can disrupt critical connectivity. •AI-enabled attack mechanisms are identified as an emerging threat that telecom operators and EU-funded security projects are working to address. •Quantum computing-enabled key decryption is highlighted as a future risk, driving the planned transition to post-quantum cryptography for critical infrastructure. |
| ConnectEU | 2026 | ISAC / Industry Consortium |
| 214 | Consolidated Annual Activity Report 2024 | Bottom Line Up Front (BLUF) Europol’s 2024 activity report shows sustained law-enforcement pressure against cybercrime, online fraud, ransomware, and technology-enabled criminal networks. For SMBs and insurance teams, the key takeaway is that ransomware, online/payment fraud, phishing, malware distribution, cryptocurrency-enabled crime, and misuse of AI remain important operational concerns that can drive financial loss, disruption, and investigation complexity. Top 3-5 Most Notable Statistics •Europol supported 3,324 operations in 2024 and coordinated 432 Action Days, leading to 4,124 arrests and more than €1.4B in assets seized. •Europol’s European Cybercrime Centre supported 535 operations, produced 3,846 operational reports, and supported 31 Action Days leading to 199 arrests. •Europol accepted 114,459 operational contributions via SIENA, above its annual target of 101,000. •More than 2 million SIENA messages were exchanged in 2024, with more than 169,000 SIENA cases initiated. •A major ransomware disruption involved 10 countries, 34 servers taken down, and more than 200 cryptocurrency accounts frozen. Top 3-5 Exploitable Technology Risks •Ransomware operations: Europol reported disruption of a highly harmful ransomware group causing billions of euros in damage, showing the continued operational importance of ransomware to criminal groups. •Online and payment fraud schemes: Europol’s cybercrime assessment highlighted online and payment fraud, and EC3 training covered digital skimming, card-present fraud, phishing, and cryptocurrency tracing. •Malware distribution through internet domains: Europol reported an international operation seizing domains used by cybercriminals to sell malware. |
| Europol | 2024 | Government / Intelligence Agency |
| 215 | Cost of a Data Breach Report 2021 | Bottom Line Up Front (BLUF) IBM’s 2021 report shows that data breaches became materially more expensive, slower to contain, and more affected by remote work, cloud change, and weak access controls. For SMBs and insurance teams, the key takeaway is that breach cost is driven not only by the attack itself, but by how quickly the business can detect, contain, respond, and keep operating. Top 3-5 Most Notable Statistics •Average total breach cost rose to $4.24 million, a 9.8% increase from 2020 and the highest in the report’s history. •Lost business represented 38% of total breach costs, averaging $1.59 million. •Compromised credentials caused 20% of breaches, making them the most common initial attack vector. •Breaches took an average of 287 days to identify and contain. •Organizations with fully deployed security AI and automation had average breach costs of $2.90 million, compared with $6.71 million for organizations without it. Top 3-5 Exploitable Technology Risks •Compromised credentials: the most common initial attack vector and associated with the longest breach lifecycle, creating extended exposure before containment. •Phishing and business email compromise: phishing was a frequent and costly attack vector, while business email compromise had the highest average total cost among initial attack vectors. •Cloud misconfiguration: identified as one of the most frequent initial attack vectors and a major concern as organizations move data and systems into cloud environments. |
| IBM | 2021 | Consulting / Analyst Firm |
| 216 | Cost of a Data Breach Report 2022 | Bottom Line Up Front (BLUF) IBM’s 2022 report shows that data breaches are becoming more expensive, slower to resolve, and frequently tied to preventable weaknesses such as stolen credentials, phishing, cloud misconfiguration, third-party software vulnerabilities, and immature response planning. For SMBs and insurance teams, the most important takeaway is that breach cost is strongly influenced by preparedness: tested incident response, security automation, zero trust, cloud security, and risk quantification were all associated with lower costs. Top 3-5 Most Notable Statistics •The global average total cost of a data breach reached USD 4.35 million, the highest level in the history of the report. •83% of studied organizations had experienced more than one data breach. •Stolen or compromised credentials caused 19% of breaches, making them the most common initial attack vector. •Breaches took an average of 277 days to identify and contain. •Organizations with a tested incident response plan and IR team saw USD 2.66 million lower average breach costs than those without both. Top 3-5 Exploitable Technology Risks •Stolen or compromised credentials: the most common initial attack vector and the slowest to identify and contain, increasing exposure time. •Phishing and business email compromise: phishing was the costliest initial attack vector, while business email compromise was also among the most expensive and slow to resolve. •Cloud misconfiguration and immature cloud security: cloud misconfiguration was one of the top initial attack vectors, and nearly half of organizations experienced a breach in the cloud. |
| IBM | 2022 | Consulting / Analyst Firm |
| 217 | Cost of a Data Breach Report 2023 | Bottom Line Up Front (BLUF) IBM’s 2023 report shows that data breaches are becoming more expensive, slower to contain, and heavily tied to cloud data, stolen credentials, phishing, ransomware, and weak response readiness. For SMBs and insurance teams, the main takeaway is that breach cost is not only driven by the attack itself, but by how quickly an organization detects, contains, and manages the incident. Top 3-5 Most Notable Statistics •The global average cost of a data breach reached USD 4.45 million, an all-time high. •82% of breaches involved data stored in cloud environments, including public, private, or multiple environments. •Only 1 in 3 breaches were discovered by the organization’s own security teams or tools. •Organizations with extensive security AI and automation had USD 1.76 million lower breach costs and contained breaches 108 days faster than organizations with no use. •Ransomware attacks cost an average of USD 5.13 million, up 13% from the prior year. Top 3-5 Exploitable Technology Risks •Phishing: The most common initial attack vector, responsible for 16% of breaches, and associated with higher-than-average breach costs. •Stolen or compromised credentials: Responsible for 15% of breaches and the longest average time to identify and contain at 328 days. •Cloud misconfiguration: Identified as the initial attack vector in 11% of breaches, with cloud-stored data involved in most incidents. |
| IBM | 2023 | Consulting / Analyst Firm |
| 218 | Cost of a Data Breach Report 2024 | Bottom Line Up Front (BLUF) IBM’s 2024 report shows that data breaches are becoming more expensive primarily because of business disruption, lost customers, post-breach response, and regulatory costs. For SMBs and insurance teams, the key takeaway is that faster detection, stronger response planning, employee training, data visibility, and security AI/automation are associated with materially lower breach costs. Top 3-5 Most Notable Statistics •The global average cost of a data breach reached USD 4.88 million, a 10% increase from 2023. •Organizations using security AI and automation extensively had average breach costs of USD 3.84 million, compared with USD 5.72 million for those not using them. •Breaches involving stolen or compromised credentials took 292 days on average to identify and contain, the longest among attack vectors studied. •Customer personal identifiable information was involved in 46% of breaches, making it the most common compromised data type. •35% of breaches involved shadow data, and those breaches were associated with a 16% higher breach cost. Top 3-5 Exploitable Technology Risks •Compromised credentials: Attackers used stolen or compromised credentials in 16% of breaches, and these incidents were difficult to detect because malicious activity can appear like normal user behavior. •Phishing and social engineering: Phishing was the second most common attack vector, and employee-focused attacks took long periods to identify and contain. •Shadow data: Unmanaged data sources made it harder for organizations to know what was breached and increased breach lifecycle time. |
| IBM | 2024 | Consulting / Analyst Firm |
| 219 | Cost of a Data Breach Report 2025 | Bottom Line Up Front (BLUF) IBM’s 2025 report shows breach costs fell globally, but the main risk is shifting toward poorly governed AI, shadow AI, identity exposure, phishing, and supply chain compromise. For SMBs and insurance teams, the key takeaway is that faster detection and response can materially reduce losses, while unmanaged AI and weak access controls can raise both breach cost and business disruption. Top 3-5 Most Notable Statistics •The global average cost of a data breach was USD 4.44 million, down 9% from 2024. •The United States average breach cost reached USD 10.22 million, an all-time high for any region in the report. •97% of organizations with an AI-related breach lacked proper AI access controls. •86% of organizations experienced operational disruption due to a data breach. •Extensive use of security AI and automation reduced average breach costs by USD 1.9 million compared with organizations that did not use these tools. Top 3-5 Exploitable Technology Risks •Shadow AI: Unauthorized or unmanaged AI use created a blind spot, added breach cost, and was linked to data compromise and operational disruption. •Weak AI access controls: Nearly all AI-related breaches involved organizations without proper AI access controls, making AI systems and data easier to abuse. •AI supply chain exposure: The most common AI security incident involved compromised apps, APIs, or plug-ins, showing risk from third-party AI components. |
| IBM | 2025 | Consulting / Analyst Firm |
| 220 | Cost of Insider Threats Global Report 2022 | Bottom Line Up Front (BLUF) Insider threats are increasing in both frequency and cost, with negligent employees, malicious insiders, and stolen credentials all creating material business risk. For SMBs and insurance teams, the most important takeaway is that insider incidents are expensive to contain, take a long time to resolve, and often involve everyday business tools such as email, cloud applications, devices, and credentials. Top 3-5 Most Notable Statistics •56% of insider incidents were caused by employee or contractor negligence. •Credential theft incidents represented 18% of incidents and cost an average of $804,997 per incident to remediate, the highest of the three insider profiles. •Organizations spent an average of 85 days to contain an insider incident, and only 12% were contained in less than 30 days. •Smaller organizations with headcount below 500 spent an average of $8.13 million over the past year to resolve insider-related incidents. •Business disruption accounted for 23% of total cost, while technology accounted for 21%. Top 3-5 Exploitable Technology Risks •Stolen employee credentials, especially through social engineering and phishing, can give outsiders access to critical data and systems. •Unmanaged IoT devices were identified as the data-loss channel of greatest concern, cited by 63% of respondents. •Cloud environments are a major concern, including employees sending confidential data to unsecured cloud locations. |
| Proofpoint | 2022 | Email Security Vendor |
| 221 | Cost to Business 2022 | Bottom Line Up Front (BLUF) Ransomware remains a high-impact business risk, and the report’s clearest finding is that paying a ransom often does not solve the problem. For SMBs and insurance teams, the key issue is not just ransom cost, but operational shutdowns, data loss, repeat attacks, staffing strain, reputational damage, and potential coverage gaps. Top 3-5 Most Notable Statistics •73% of surveyed organizations were targeted by at least one ransomware attack in the prior 24 months. •64% of organizations that suffered a successful ransomware attack said the primary infection vector was a third-party supply chain compromise. •54% of organizations that paid still reported system issues or corrupted data after decryption. •80% of organizations that paid were victims of a second ransomware attack. •33% were forced to temporarily suspend business operations after an attack. Top 3-5 Exploitable Technology Risks •Third-party supply chain compromise, including managed service provider exposure, which can allow attackers to compromise one provider and reach many customers. •Unsecured Microsoft Remote Desktop Protocol connections, which attackers can scan for, brute-force, and use as an entry point. •Phishing emails, including emails that redirect users to exploit kits. |
| Cybereason | 2022 | Endpoint / MDR / XDR Vendor |
| 222 | Cost to Business 2024 | Bottom Line Up Front (BLUF) Cybereason’s 2024 ransomware study shows that paying a ransom is often ineffective and may leave organizations exposed to repeat attacks, higher demands, and unresolved business disruption. For SMB owners and insurance teams, the key takeaway is that ransomware resilience depends on planning, people, tested response processes, and coverage clarity—not simply ransom payment or insurance. Top 3-5 Most Notable Statistics •1,008 cybersecurity professionals were surveyed, all from organizations breached at least once in the previous 24 months. •56% said their organization did not detect a breach for 3-12 months. •84% paid the ransom, but only 47% got their data and services back uncorrupted. •78% of organizations that paid were breached again, and 63% of those were asked to pay more the second time. •46% estimated business losses of $1-10 million, while 16% estimated losses of more than $10 million. Top 3-5 Exploitable Technology Risks •Supply chain access: 41% of attackers got in through a supply chain partner, showing how third-party relationships can become an entry point. •Insider-enabled access: 22% got in with the help of an insider, highlighting the risk of trusted access being misused or compromised. •Generative AI-enabled social engineering: attackers are using tools such as ChatGPT to collect personal information, create professional-looking messages, translate them, and make scams harder to spot. |
| Cybereason | 2024 | Endpoint / MDR / XDR Vendor |
| 223 | CrowdStrike Global Threat Report 2022 | Bottom Line Up Front (BLUF) CrowdStrike’s 2022 Global Threat Report shows that attackers are moving faster, using fewer traditional malware tools, and increasingly targeting cloud environments, identities, and internet-facing systems. For SMBs and insurance teams, the main takeaway is that ransomware, credential misuse, and exploitable vulnerabilities can lead quickly to data theft, extortion, business interruption, and difficult claims scenarios. Top 3-5 Most Notable Statistics •Average eCrime breakout time was 1 hour 38 minutes, leaving defenders a very short response window. •CrowdStrike observed an 82% increase in ransomware-related data leaks in 2021 compared with 2020. •Interactive intrusion campaigns increased by nearly 45% compared with 2020. •62% of detections indexed by the CrowdStrike Security Cloud in Q4 2021 were malware-free. •eCrime accounted for 49% of observed interactive intrusion activity in 2021. Top 3-5 Exploitable Technology Risks •Internet-facing vulnerabilities, including Microsoft Exchange ProxyLogon and ProxyShell, Zoho ManageEngine, Atlassian Confluence, GitLab, VPNs, and routers, were used for initial access. •Log4Shell, a vulnerability in Apache Log4j2, allowed remote attackers to inject Java code into affected services and potentially gain access, deliver malware, or acquire sensitive data. •Cloud credential theft affected services such as Microsoft Office 365, Okta, webmail, AWS, Microsoft 365, and GSuite. |
| CrowdStrike | 2022 | Endpoint / MDR / XDR Vendor |
| 224 | CrowdStrike Global Threat Report 2023 | Bottom Line Up Front (BLUF) CrowdStrike’s 2023 report shows attackers are moving faster, relying more on stolen credentials and social engineering, and expanding into cloud environments. For SMBs and insurance teams, the key takeaway is that ransomware is no longer the only major loss scenario: data theft, extortion, identity abuse, and cloud compromise can create serious business interruption and privacy exposure even without malware. Top 3-5 Most Notable Statistics •71% of detections in 2022 were malware-free, up from 62% in 2021. •Average eCrime breakout time declined from 98 minutes in 2021 to 84 minutes in 2022. •More than 2,500 access broker advertisements were identified, a 112% increase compared to 2021. •Cloud exploitation cases grew by 95%, and cases involving cloud-conscious actors nearly tripled from 2021. •CrowdStrike observed a 50% increase in interactive intrusion campaigns compared to 2021. Top 3-5 Exploitable Technology Risks •Abuse of valid credentials, including credentials acquired through information stealers or underground log shops, enabling initial access and persistence. •Social engineering against multifactor authentication, including phishing pages, one-time password capture, and MFA notification fatigue. •Cloud compromise through valid cloud accounts, public-facing applications, password resets, webshells, reverse shells, and credentials found in files or instance metadata services. |
| CrowdStrike | 2023 | Endpoint / MDR / XDR Vendor |
| 225 | CrowdStrike Global Threat Report 2024 | Bottom Line Up Front (BLUF) CrowdStrike’s 2024 report shows attackers are moving faster, using fewer obvious malware tools, and increasingly abusing identities, cloud services, and trusted third parties. For SMBs and insurance teams, the most important takeaway is that losses may begin with ordinary-looking logins, vendor access, exposed credentials, or unmanaged edge devices rather than a traditional malware alert. Top 3-5 Most Notable Statistics •Cloud environment intrusions increased by 75% year over year. •Cloud-conscious cases increased by 110%, meaning attackers more often understood and abused cloud-specific features. •Victims named on eCrime dedicated leak sites increased by 76%, showing continued growth in extortion and data-theft pressure. •Interactive intrusion campaigns increased by 60% year over year, while average eCrime breakout time fell from 84 minutes to 62 minutes. •Malware-free activity represented 75% of detections in 2023, up from 71% in 2022. Top 3-5 Exploitable Technology Risks •Stolen or abused credentials, including those obtained through phishing, social engineering, brute force, credential stealers, access brokers, insecure password reset services, and accidental leakage. •Cloud identity and access weaknesses in environments such as Microsoft 365, Entra ID, Okta, SharePoint, Azure Key Vault, cloud secrets managers, and cloud storage. •Unmanaged edge gateway devices, including firewall and VPN platforms affected by vulnerabilities in Cisco, Citrix, and F5 products. |
| CrowdStrike | 2024 | Endpoint / MDR / XDR Vendor |
| 226 | Crypto Crime Report 2026 | Bottom Line Up Front (BLUF) TRM Labs reports that illicit crypto flows reached a record level in 2025, driven mainly by sanctions-linked activity, improved attribution, large-scale hacks, and state-aligned use of crypto infrastructure. For SMBs and insurance teams, the key takeaway is that any business touching crypto, stablecoins, exchanges, wallets, or crypto payments faces higher exposure to sanctions, stolen funds, and illicit counterparties. Top 3-5 Most Notable Statistics •Illicit cryptocurrency flows reached USD 158 billion in 2025, the highest level TRM observed in the past five years. •Illicit crypto volume increased by nearly 145% from 2024, rising from USD 64.5 billion. •Illicit activity fell as a share of total attributed on-chain volume, from 1.3% in 2024 to 1.2% in 2025. •Sanctions-related activity grew by more than 400% year over year. •Chinese-language escrow services and underground banking networks grew from approximately USD 123 million in 2020 to over USD 103 billion in 2025. Top 3-5 Exploitable Technology Risks •Stablecoins: TRM states that stablecoins were central to illicit flows and were the predominant form of inflows to sanctioned entities. •Sanctioned tokens and wallet clusters: The A7A5 ruble-pegged stablecoin and A7 wallet cluster show how sanctions exposure can attach to an asset ecosystem, not just a single transaction. •High-risk and less regulated services: TRM notes that illicit actors are adapting by moving to riskier, less regulated channels as enforcement and freezing risk increase. |
| TRM | 2026 | Crypto / Blockchain Security Vendor |
| 227 | CTI Spotlight Trends Report 2024 | Bottom Line Up Front (BLUF) Kroll’s 2024 CTI Spotlight shows that email compromise, phishing links, social engineering, insider use of valid accounts, and ransomware remain the most important practical risks for organizations. For SMBs and insurance teams, the key takeaway is that common access paths—not only advanced attacks—are driving incidents, while ransomware operators are also exploiting specific software vulnerabilities. Top 3-5 Most Notable Statistics •Email compromise was the top incident type, representing 47% of May 2024 incidents. •Ransomware accounted for 16% of incidents, while insider threat and unauthorized access each represented 10%. •The top initial access methods were phishing links at 27%, valid insider accounts at 24%, and social engineering at 19%. •Professional services was the most impacted sector at 21%, followed by healthcare at 14%, and retail/restaurant and manufacturing at 12% each. •FOG was the top ransomware variant observed in May 2024 at 20%. Top 3-5 Exploitable Technology Risks •Phishing links: attackers use email links that can lead to credential loss or malware download, making ordinary email use a major entry point. •Valid insider accounts: legitimate or unrevoked access can be used by insiders, creating risk when account access is not tightly managed. •CVE and zero-day exploitation: ransomware operators most commonly used vulnerability exploitation for initial access in May 2024, with CVE-2024-3400 and CVE-2024-24919 highlighted as top exploited vulnerabilities. |
| Kroll | 2024 | Consulting / Analyst Firm |
| 228 | Cyber Annual Threat Report 2024 | Bottom Line Up Front (BLUF) Blackpoint’s 2024 report shows that SMBs are increasingly targeted at the earliest stage of attack: initial access. For SMB owners and insurance teams, the key issue is speed—attackers can move from entry to lateral movement quickly, turning phishing, stolen credentials, VPN abuse, RMM tools, or unpatched public-facing systems into ransomware, data theft, BEC, and operational disruption. Top 3-5 Most Notable Statistics •83 minutes was the average time between initial access and lateral movement observed in 2023. •95% of endpoint device incidents involved initial access attempts, up from 86% in 2022. •Ransomware attacks using double extortion increased by approximately 64% from 2022 to 2023. •BEC attempts rose by an average of 210%, reaching 42,688 incidents. •VPN usage appeared in over 99% of cloud incidents, indicating heavy abuse in cloud-related attacks. Top 3-5 Exploitable Technology Risks •Remote Monitoring and Management tools were frequently exploited for initial access and movement through organizations, especially where trial versions lacked human verification. •VPN abuse was present across most cloud-related incidents and can obscure malicious locations and infrastructure. •Public-facing applications, including web servers, content management systems, and remote management interfaces, were targeted through vulnerabilities and misconfigurations. |
| Blackpoint | 2024 | MSP / MSSP / SOC Provider |
| 229 | Cyber Claims Report 2024 | Bottom Line Up Front (BLUF) Coalition’s 2024 Cyber Claims Report shows that cyber claims increased in both frequency and severity in 2023, with ransomware, funds transfer fraud, business email compromise, and exposed internet-facing technologies driving losses. For SMBs and insurance teams, the core takeaway is that cyber risk is persistent and financially material, but strong controls, fast response, and active risk management can reduce claim impact. Top 3-5 Most Notable Statistics •Overall claims frequency increased 13% year over year, while overall claims severity increased 10% to an average loss amount of $100,000. •52% of all reported matters were handled without any out-of-pocket payments by the policyholder. •Funds transfer fraud frequency increased 15%, and initial severity increased 24% to an average loss of more than $278,000. •Ransomware frequency increased 15%, while ransomware severity increased 28% to an average loss of more than $263,000. •Businesses with internet-exposed Cisco ASA devices were nearly 5x more likely to experience a claim in 2023. Top 3-5 Exploitable Technology Risks •Internet-exposed Cisco ASA devices: Policyholders using exposed Cisco ASA devices had sharply higher relative claims frequency, and threat actors exploited known vulnerabilities affecting these devices. •Internet-exposed Fortinet devices: Businesses with exposed Fortinet devices were 2x as likely to experience a claim, with critical vulnerabilities continuing into 2024. •Internet-exposed Remote Desktop Protocol: Exposed RDP was associated with 2.5x higher claims likelihood, and scanning for RDP increased in 2023. |
| Coalition | 2024 | Cyber Insurance Carrier |
| 230 | Cyber Claims Report 2025 | Bottom Line Up Front (BLUF) Cyber claims stabilized in 2024, but SMBs still face meaningful financial risk, especially from email-based fraud, ransomware, and third-party vendor incidents. The report’s central message is that proactive risk management, fast response, and continuous security improvement reduce claim likelihood and financial impact. Top 3-5 Most Notable Statistics •Global claims frequency decreased 7% year over year to 1.48%. •Global claims severity remained stable, with an average loss amount of $115,000. •Business email compromise and funds transfer fraud accounted for 60% of all cyber insurance claims. •Businesses with less than $25 million in revenue represented 64% of total claims and had an average loss of $79,000. •Ransomware claims averaged $292,000, while Coalition reported a 60% average reduction in ransom payments through negotiation when payment was deemed reasonable and necessary. Top 3-5 Exploitable Technology Risks •Business email compromise, where attackers gain access to email accounts to find credentials, financial information, or private data. •Funds transfer fraud driven by social engineering, spoofed emails, or attackers posing as executives, vendors, or financial institutions. •Ransomware that encrypts data or systems, causing business interruption, forensic costs, and recovery expenses. |
| Coalition | 2025 | Cyber Insurance Carrier |
| 231 | Cyber Claims Report 2026 | Bottom Line Up Front (BLUF) Coalition’s 2026 Cyber Claims Report shows that SMBs are being targeted more often, but better preparation is helping reduce average losses. The biggest practical takeaway for SMB owners and insurance teams is to focus on the incidents that drive most claims: business email compromise, funds transfer fraud, and ransomware. Top 3-5 Most Notable Statistics •58% of claims were business email compromise or funds transfer fraud. •Global claims frequency rose 3% year over year to 1.54%, while global claims severity decreased 19% to an average loss of $116,000. •Business email compromise represented 31% of claims, with average severity of $27,000. •Funds transfer fraud represented 27% of claims, with average severity of $141,000. •Ransomware demands increased 47% to an average of more than $1 million, but 86% of ransomware victims refused to pay. Top 3-5 Exploitable Technology Risks •Virtual private networks, especially SSL VPNs, were the primary targeted technology in ransomware cases where a technology was confirmed, accounting for 59% of incidents. •Remote desktop applications accounted for 14% of exploited technologies in ransomware events and can allow broad lateral movement when exposed or compromised. •Software exploits were the most common ransomware attack vector, appearing in 38% of confirmed cases, showing the importance of patching internet-facing systems. |
| Coalition | 2026 | Cyber Insurance Carrier |
| 232 | Cyber Espionage Report 2020 | Bottom Line Up Front (BLUF) Cyber-espionage is a stealthy, targeted breach pattern focused on stealing secrets, internal information, credentials, and intellectual property rather than causing obvious disruption. For SMBs and insurance teams, the key issue is that these attacks can remain hidden for months or years, making strong logging, access control, phishing defense, and incident response readiness critical. Top 3-5 Most Notable Statistics •Cyber-Espionage represented 10% of known breaches in the 2014-2020 DBIR timeframe. •In Cyber-Espionage breaches, Time to Compromise was seconds to days in 91% of cases, while Time to Exfiltration was minutes to weeks in 88%. •Time to Discovery was months to years in 69% of Cyber-Espionage breaches. •Phishing appeared in 81% of 2020 Cyber-Espionage breaches, and some form of malware appeared in 92%. •Top actor varieties in Cyber-Espionage breaches were State-affiliated actors at 85% and Nation-state actors at 8%. Top 3-5 Exploitable Technology Risks •Phishing and targeted phishing emails, which are commonly used to gain the initial foothold or collect credentials. •Backdoors and command-and-control activity, which allow attackers to establish, maintain, and manage unauthorized access. •Compromised or over-privileged administrative credentials, especially in flat or poorly segmented networks where attackers can move laterally. |
| Verizon | 2020 | Telco / Network Operator |
| 233 | Cyber Exposure Report 2021 | Bottom Line Up Front (BLUF) Rapid7’s 2021 Cyber Exposure Report shows that even highly resourced organizations had visible gaps in basic internet-facing security controls, especially email authentication, web hardening, exposed legacy services, software version management, and vulnerability disclosure. For SMBs and insurance teams, the key takeaway is that preventable exposure remains a practical claims and loss-prevention issue: attackers can exploit weak configurations, old services, and unmanaged public-facing systems before more advanced controls matter. Top 3-5 Most Notable Statistics •Only 13% of Nikkei 225 organizations had DMARC configured for their primary domains; 87% had no valid policy. •Of the organizations with DMARC, 25 of 29 used a monitoring-only p=none policy, while only 4 used active quarantine or reject protection. •100% of surveyed companies supported HTTPS on primary websites, but only about 18% supported HSTS. •Telnet was exposed by about 27% of the Nikkei 225, with 243 hosts across 62 companies observed. •Only 16 companies, or about 7%, had a discoverable vulnerability disclosure program. Top 3-5 Exploitable Technology Risks •Weak or absent DMARC leaves organizations more exposed to spoofing and phishing that can mislead employees, customers, suppliers, or partners. •Missing HSTS allows users to remain vulnerable to man-in-the-middle attacks during insecure web connections, even where HTTPS is available. •Internet-exposed SMB, RDP, and Telnet create direct attack paths for brute force, credential compromise, data leakage, malware infection, and command interception. |
| Rapid7 | 2021 | Threat Intelligence Vendor |
| 234 | Cyber Insecurity Healthcare 2025 | Bottom Line Up Front (BLUF) Healthcare organizations remain highly exposed to people-centered cyber risks, especially cloud account compromise, ransomware, business email compromise, supply chain attacks, and data loss. For healthcare SMBs and insurance teams, the key takeaway is that cyber incidents are not only costly; they can disrupt operations, delay care, expose sensitive data, and create serious patient safety consequences. Top 3-5 Most Notable Statistics •93% of surveyed healthcare organizations experienced at least one cyberattack in the past 12 months, with an average of 43 attacks among those affected. •The average cost of the most expensive cyberattack was $3.9 million. •Among organizations experiencing the four attack types studied, an average of 72% reported disruption to patient care. •72% experienced cloud/account compromises, averaging 21 such compromises over the past two years. •96% had at least two data loss or exfiltration incidents involving sensitive and confidential healthcare data over the past two years. Top 3-5 Exploitable Technology Risks •Cloud/account compromise: Attackers obtain valid credentials and use them for account takeover, fraud, or transfer of sensitive data. •Ransomware: Malware blocks access to files or systems, creating downtime, delays, and financial pressure to pay. •BEC/spoofing/impersonation: Email fraud, including invoice scams and executive or attorney impersonation, remains a frequent attack path. |
| Proofpoint | 2025 | Email Security Vendor |
| 235 | Cyber Insurance 2025 | Bottom Line Up Front (BLUF) FERMA’s report shows a cyber insurance market that is becoming more buyer-friendly, with lower rates, broader coverage, and more capacity, but SME adoption remains low despite severe business consequences from cyber incidents. For SMBs and insurance teams, the key message is that cyber insurance can improve resilience, but only when paired with strong cybersecurity, incident preparation, and careful review of coverage gaps. Top 3-5 Most Notable Statistics •Europe represented about $3.9 billion in cyber insurance premiums in 2024, equal to 23.62% of the global cyber insurance market. •Cyber insurance rates in Europe decreased by an average of 10% to 15% in the first half of 2025, with some reductions exceeding 30%. •Cyber claims notifications in Europe rose by 61% in 2024, with about 10% of cyber policyholders reporting an event. •Malicious events accounted for 72% of cyber claims notifications, while non-malicious events increased to 28%. •Marsh estimates cyber insurance penetration at around 15% for SMEs, while large organisations account for about 50% of European cyber insurance premiums despite representing only 0.2% of EU companies. Top 3-5 Exploitable Technology Risks •Ransomware-as-a-Service, which drove a sharp increase in claims ratios and remains a major attack model. •Data exfiltration-based extortion, where attackers steal data rather than only encrypting systems. •Supply-chain incidents involving third or fourth parties, including outsourced technology dependencies. |
| FERMA | 2025 | Cyber Insurance Carrier |
| 236 | Cyber Insurance: Rebooting Growth 2025 | Bottom Line Up Front (BLUF) Cyber insurance buyers are in a favorable market: rates are falling, terms are improving, and insurers are actively seeking new customers, especially SMEs and international businesses. For SMBs and insurance teams, the key message is that cyber risk remains severe, but basic controls and cyber insurance can materially reduce attack costs, speed recovery, and improve resilience. Top 3-5 Most Notable Statistics •€307 billion: Estimated economic cost of cyber attacks from 2020 to 2025 across Germany, France, Italy, and Spain. •50%: Share of surveyed businesses in those four countries that suffered a cyber attack between 2020 and 2025. •87%: Lower average attack cost for companies using basic cyber security measures such as software patching, strong passwords, and email filtering. •19%: Estimated return on investment from cyber insurance for a business generating €500 million in annual revenue. •44%: Share of ransomware victims able to stop an attack before data encryption in 2025, up from 27% in 2024. Top 3-5 Exploitable Technology Risks •Ransomware remains a leading cyber threat, with global incidents increasing every year since 2022. •Business email compromise, data theft, and ransomware were the most common attack types reported by surveyed companies. •Third-party supplier breaches are a notable development, including attacks using social engineering to deceive help desks and gain access. |
| Howden | 2025 | Threat Intelligence Vendor |
| 237 | Cyber Readiness Report 2023 | Bottom Line Up Front (BLUF) US small businesses are improving their cyber awareness, but attacks remain common and repeated incidents are increasing. For SMB owners and insurance teams, the key takeaway is that basic controls, employee vigilance, backups, and access to expert incident support matter because ransomware, phishing, and cyber extortion continue to create real financial and operational disruption. Top 3-5 Most Notable Statistics •41% of US small businesses surveyed experienced a cyber-attack in the past year. •The median annual cost of cyber-attacks for one business was $8,300, down from nearly $10,000 the prior year. •The median number of attacks rose from 3 in 2022 to 4 in 2023. •In ransomware attacks, the most common entry points were phishing at 53%, unpatched servers/VPN at 38%, and credential theft at 29%. •53% of US small businesses have either standalone cyber insurance or cyber coverage through another policy. Top 3-5 Exploitable Technology Risks •Phishing emails and messages, which attackers use to trick employees into revealing information or clicking suspicious links. •Unpatched servers and VPNs, identified as a major ransomware entry point. •Credential theft, which can give attackers access to business systems or data. |
| Hiscox | 2023 | Cyber Insurance Carrier |
| 238 | Cyber Readiness Report 2025 | Bottom Line Up Front (BLUF) SMEs are being attacked frequently, and the impact is no longer limited to IT disruption: cyber incidents are creating financial, regulatory, operational, and employee stress consequences. The report’s core message for SMBs and insurance teams is that cyber resilience now requires ongoing investment, employee awareness, supplier risk management, tested recovery, and appropriate insurance protection. Top 3-5 Most Notable Statistics •59% of SMEs experienced at least one cyber attack in the last 12 months. •27% experienced a ransomware attack in the last 12 months. •33% of affected firms incurred fines significant enough to damage their financial health. •94% expect to increase cyber security and data protection investment in the next 12 months. •71% of surveyed firms have cyber insurance coverage, either as a standalone policy or as part of another policy. Top 3-5 Exploitable Technology Risks •Internet of Things devices: Company-owned IoT devices were the most common point of entry for cyber attacks, reported by 33% of businesses. •Supply chain vulnerabilities: Vendor websites and other partner-related weaknesses were a point of entry for 28%, making third-party exposure a major concern. •Cloud-based corporate servers: These were reported as an entry point by 27%, showing the need for secure cloud configuration and monitoring. |
| Hiscox | 2025 | Cyber Insurance Carrier |
| 239 | Cyber Recovery Readiness Report 2024 | Bottom Line Up Front (BLUF) Commvault’s 2024 report finds that breaches are common and recovery speed depends heavily on preparation, not just backup. For SMBs and insurance teams, the key takeaway is that cyber recovery must be treated as a tested, business-critical capability separate from traditional disaster recovery. Top 3-5 Most Notable Statistics •83% of surveyed organizations reported a material security breach, with over 50% of those occurring within the past year. •Organizations with higher cyber maturity recovered 41% faster than those with only zero or one maturity marker. •Only 4% of organizations had deployed all five cyber recovery readiness markers, and only 13% practiced at least four. •44% of respondents cited complexity of critical applications and data as the top cyber recovery challenge. •20% of organizations that had not been breached said they do not test their cyber recovery plan at all, compared with 2% of breached organizations. Top 3-5 Exploitable Technology Risks •Broader attack surface from cloud and SaaS environments, which increases the number of systems and services that must be protected and recovered. •Increasingly sophisticated hackers and attack types, which make basic recovery planning less reliable. •Use of artificial intelligence by cybercriminals, identified as a major cybersecurity challenge by respondents. |
| Commvault | 2024 | Backup & Recovery Vendor |
| 240 | Cyber Report 2019 | Bottom Line Up Front (BLUF) Cyber incidents are a routine business risk for everyday organisations, and SMEs are heavily represented among victims. The report’s main message for SMBs and insurance teams is that email-led attacks, weak detection, and delayed incident response can turn even modest fraud or data exposure into costly regulatory, legal, and operational events. Top 3-5 Most Notable Statistics •34% of data security incidents were linked to phishing emails, making email the most common known source. •32% of incidents had an unknown source, often because too much time had passed before investigation began. •50% of incidents were detected within the first three days, but some incidents lasted far longer, including malware infections lasting over a year. •61% of incidents were notified to the ICO as personal data breaches, while 39% were not. •IT forensics providers were appointed in 80% of matters, while PR firms were appointed in only 13%. Top 3-5 Exploitable Technology Risks •Phishing emails used to gain unauthorised access to corporate systems and support fraud or wider compromise. •Lack of multi-factor authentication for off-site, cloud-based email access, including partial rollouts limited only to “high risk” staff. •Compromised mailboxes used for invoice fraud, including intercepting and amending customer or supplier payment details. |
| Pinsent Masons | 2019 | Consulting / Analyst Firm |
| 241 | Cyber Report 2020 | Bottom Line Up Front (BLUF) Cyber risk is now a business continuity issue, not just an IT issue. Pinsent Masons’ 2020 report shows that phishing, compromised credentials, business email compromise, ransomware, and Covid-19-driven remote working pressures are creating incidents that can lead to downtime, regulatory scrutiny, ransom demands, and follow-on claims from affected individuals. Top 3-5 Most Notable Statistics •46% of UK businesses reported having a cyber attack in the last 12 months. •32% of businesses experienced attacks more than once a week. •16% of incidents involved a ransom demand, including ransom extortion or ransomware. •75% of incidents were detected within 20 days of intrusion, compared with 66% in the prior year. •20% of matters where data subjects were notified involved actual or threatened claims from data subjects. Top 3-5 Exploitable Technology Risks •Phishing emails remained a major entry point, with phishing identified as the source of incident in a third of all data security incidents affecting clients. •Business email compromise and attempted payment diversion fraud were prominent financially motivated attacks, often involving compromised credentials. •Ransomware and ransom extortion created both operational and legal risk, especially where attackers encrypted systems and exfiltrated data. |
| Pinsent Masons | 2020 | Consulting / Analyst Firm |
| 242 | Cyber Report 2021 | Bottom Line Up Front (BLUF) Pinsent Masons identifies ransomware as the dominant cyber threat facing organisations of all sizes and sectors, with attacks increasingly combining system encryption with data theft and threats of publication. For SMBs and insurance teams, the main takeaway is that preparation, tested response plans, backups, and clear decision-making processes are critical because an unprepared organisation can face severe operational, financial, legal, and reputational consequences. Top 3-5 Most Notable Statistics •Ransomware was involved in 31% of Pinsent Masons’ cyber cases in 2021, up from 16% in 2020 and 14% in 2019. •The UK ICO reported ransomware cases increasing from 13 per month to 42 per month in 2021. •Typical ransom demands ranged from $30,000 to $250,000, with some demands reaching $9.5 million. •In ransomware cases with payment engagement, expert negotiation reduced demands by an average of 39%. •81% of ransomware cases involved a ransom demand, while 19% did not. Top 3-5 Exploitable Technology Risks •Vulnerabilities in VPNs and remote desktop protocols, particularly where remote working was introduced quickly or without strong security controls. •Phishing emails, including more convincing campaigns sent from genuine accounts within a victim’s supply chain. •Malware leading to ransomware, including attacks where data is exfiltrated before systems are encrypted. |
| Pinsent Masons | 2021 | Consulting / Analyst Firm |
| 243 | Cyber Report 2022 | Bottom Line Up Front (BLUF) Pinsent Masons’ 2022 cyber report identifies ransomware as the continuing top threat, even though overall incident volumes temporarily reduced in early 2022. For SMBs and insurance teams, the key takeaway is that cyber readiness, response planning, and basic security controls are now central to reducing business interruption, regulatory exposure, and insurability challenges. Top 3-5 Most Notable Statistics •Ransomware accounted for one third of the matters Pinsent Masons handled in 2022. •Pinsent Masons saw a 2% increase in ransomware cases in 2022 compared with 2021. •ICO data showed ransomware reports increased by 339% from Q2 2019 to Q1 2022. •A ransom was demanded in 45% of Pinsent Masons’ ransomware cyber/data incidents in 2022. •ICO notification occurred in 64% of Pinsent Masons matters in 2022, down from 72% in 2021. Top 3-5 Exploitable Technology Risks •Ransomware attacks that encrypt systems, interrupt operations, and may involve data theft or threats to publish data. •Phishing emails, which remain a common initial attack vector and were identified as the root cause in the Interserve incident discussed in the report. •Delayed software patching, including failure to apply critical updates promptly. |
| Pinsent Masons | 2022 | Consulting / Analyst Firm |
| 244 | Cyber Report 2024 | Bottom Line Up Front (BLUF) Cyber risk remains elevated, but the insurance market is currently more favorable for buyers. For SMBs and insurance teams, the key takeaway is that ransomware, AI-enabled scams, and supply-chain concentration continue to drive loss potential, while stronger controls and available cyber insurance can materially improve resilience. Top 3-5 Most Notable Statistics •Global ransomware attacks increased by 85% in 2023 compared with 2022. •Ransomware attacks on U.S. critical infrastructure increased at a 35% compound annual growth rate from 2021 to 2023. •Cyber insurance pricing is down 15% from its mid-2022 peak. •The U.S. standalone cyber market recorded a 44% loss ratio in 2023, in line with 2022 and better than 2021 and 2020. •The MOVEit breach affected approximately 2,800 organisations and 96 million people. Top 3-5 Exploitable Technology Risks •Ransomware-as-a-service and malware-as-a-service lower the barrier for criminals, allowing less skilled attackers to launch financially motivated attacks. •External remote services, especially VPNs not protected by multi-factor authentication, remain a major entry point for ransomware. •Weak endpoint detection and response, limited monitoring, and poor identity and access management can allow intruders to move through networks undetected. |
| Howden | 2024 | Threat Intelligence Vendor |
| 245 | Cyber Risk Report 2025 | Bottom Line Up Front (BLUF) Resilience’s 2025 report shows fewer cyber claims in the first half of 2025, but the losses that do occur are more severe, especially from ransomware and vendor-related business interruption. For SMBs and insurance teams, the key takeaway is that resilience, vendor visibility, and ransomware readiness matter more than simply reducing incident frequency. Top 3-5 Most Notable Statistics •Cyber claims notifications dropped 53% in H1 2025 compared with H1 2024. •Ransomware accounted for 76% of incurred losses in H1 2025, rising to 91% when ransomware affecting vendors is included. •The severity of ransomware attacks increased 17% year over year. •Vendor-related incidents represented 37% of claims notices and 22% of incurred losses in 2024, then 26% of claims notifications and 15% of incurred losses in H1 2025. •Phishing was responsible for 19% of incurred claims and 49% of incurred losses in H1 2025. Top 3-5 Exploitable Technology Risks •Ransomware attacks, including double extortion where attackers demand payment for both decryption and suppression of stolen data. •Phishing and social engineering, including browser-based phishing, credential harvesting, voice impersonation, and helpdesk impersonation. •Vendor outages and vendor ransomware, which can create business interruption even when the insured organization is not directly compromised. |
| Resilience | 2025 | Threat Intelligence Vendor |
| 246 | Cyber Roundup Report 2024 | Bottom Line Up Front (BLUF) Cowbell’s report shows that cyber risk for SMEs is rising through supply chain exposure, ransomware, and weaknesses in core business technologies. For SMB owners and insurance teams, the most important takeaway is that risk varies sharply by industry, company size, and technology stack, so controls, underwriting, and loss prevention should be tailored rather than generic. Top 3-5 Most Notable Statistics •Supply chain attacks increased by 431% between 2021 and 2023. •Manufacturing cyber risk scores were 11.7% below the global average, making it the most vulnerable sector identified. •Manufacturing claims were 1.6x more frequent and 1.2x more severe than the average across sectors. •Educational institutions saw a 70% increase in attacks over the past year. •Businesses with annual revenue above $50 million experienced cyber incidents 2.5x more frequently than other enterprises. Top 3-5 Exploitable Technology Risks •Operating systems: Vulnerabilities can lead to broad or complete system compromise because operating systems sit at the foundation of business computing. •Content management and collaboration tools: Attackers may exploit these platforms to tamper with content, leak data, or gain unauthorized access. •Virtualization technologies: Poorly managed virtualization can create single points of failure affecting multiple systems. |
| Cowbell | 2026 | Cyber Insurance Carrier |
| 247 | Cyber Roundup: Claims Report 2025 | Bottom Line Up Front (BLUF) Cyber claims continue to be driven by familiar, preventable weaknesses: phishing, social engineering, data exposure, ransomware, and funds transfer fraud. For SMBs and insurance teams, the key takeaway is that fast incident response, layered defenses, patching, access controls, and employee vigilance can materially reduce disruption, ransom leverage, and claim severity. Top 3-5 Most Notable Statistics •33,561 cyber insurance claims were reported in the U.S. market in 2024, the highest annual total noted in the report. •Ransomware accounted for 17–19% of Cowbell claims between 2022 and 2024. •Average ransom payments declined by approximately 20.5% from 2022 to 2024. •Cowbell claims data identifies data breach (34%), cybercrime (30%), and extortion events (19%) as the leading incident types. •Nearly 48% of severe ransomware cases with identified threat actors involved five groups: Akira, Play, LockBit, Fog, and RansomHub. Top 3-5 Exploitable Technology Risks •Phishing emails, malicious links, and fake login pages that trick employees into giving attackers access to systems or credentials. •Misconfigured email accounts that can enable business email compromise, spoofing, and funds transfer fraud. •Outdated software and unpatched network boundaries, including unpatched VPN and email systems exploited by ransomware groups. |
| Cowbell | 2026 | Cyber Insurance Carrier |
| 248 | Cyber Safety Insights Report 2021 | Bottom Line Up Front (BLUF) Norton’s 2021 report shows widespread consumer exposure to cybercrime, account compromise, scams, identity theft, and privacy risk across 10 countries. For SMBs and insurance teams, the key takeaway is that everyday users remain a major risk point: many people are worried, many have already been affected, and many still do not know how to protect themselves. Top 3-5 Most Notable Statistics •328.5 million adults in the 10 surveyed countries experienced cybercrime in the past 12 months. •53% of adults have experienced cybercrime at some point, and 35% experienced it in the past year. •Past-year cybercrime victims spent an average of 6.7 hours resolving issues, totaling an estimated 2.7 billion hours lost. •47% of past-year cybercrime victims lost money as a result. •55.3 million consumers were victims of identity theft in the past 12 months. Top 3-5 Exploitable Technology Risks •Malicious software on computers, Wi-Fi networks, smartphones, tablets, smart home devices, or other connected devices was the most commonly reported cybercrime experience. •Unauthorized access to email accounts was one of the top cybercrimes reported, creating risk where email is used for password resets, financial communications, or business correspondence. •Unauthorized access to social media accounts was also common, which can enable impersonation, fraud, and reputational harm. |
| Norton | 2021 | Endpoint / MDR / XDR Vendor |
| 249 | Cyber Safety Insights Report 2022 | Bottom Line Up Front (BLUF) Norton’s 2022 report shows that cybercrime, identity theft, scams, and account compromise are common consumer experiences with real financial and time impacts. For SMB owners and insurance teams, the key takeaway is that everyday users remain a major risk point: compromised accounts, malicious software, phishing scams, and identity theft can quickly create cost, disruption, and support needs. Top 3-5 Most Notable Statistics •415.6 million adults across 10 countries said they experienced cybercrime in the past 12 months. •Past-year cybercrime victims spent an estimated 4.4 billion hours resolving issues, averaging 7.8 hours per victim. •51% of past-year cybercrime victims reported losing money as a result. •81.5 million adults across 10 countries were victims of identity theft in the past year. •68% of adults said they do not know how to check whether their identity has been stolen, and 59% said they would not know what to do if it was. Top 3-5 Exploitable Technology Risks •Malicious software on computers, Wi-Fi networks, smartphones, tablets, smart home devices, and other connected devices was the top cybercrime ever experienced, reported by 24% of adults. •Unauthorized access to social media accounts and email accounts were among the top cybercrimes ever experienced, each reported by 14% of adults. •Phishing scams were reported by 25% of adults, with fraudulent package notification links the most common scam experienced in the past year. |
| Norton | 2022 | Endpoint / MDR / XDR Vendor |
| 250 | Cyber Safety Insights Report 2023 | Bottom Line Up Front (BLUF) Norton’s 2023 Cyber Safety Insights Report shows that cybercrime, scams, identity theft, and privacy risks are widespread across surveyed adults in eight countries, with victims losing both money and time. For SMB owners and insurance teams, the most important takeaway is that common, human-centered attack paths such as malicious links, mobile/SMS scams, phishing, account compromise, and identity theft can create real financial loss and operational disruption. Top 3-5 Most Notable Statistics •463.2 million adults across the eight surveyed countries said they were victims of cybercrime in 2022. •Cybercrime victims spent an estimated 3.5 billion hours resolving issues in 2022, averaging 6.6 hours per victim. •54% of 2022 cybercrime victims globally reported financial loss. •About 47.5 million adults experienced identity theft in 2022, and 76% of those victims lost money. •40% of adults surveyed fell victim to a scam in 2022, most commonly by clicking a link in an email or text message. Top 3-5 Exploitable Technology Risks •Email and SMS scam links: The report identifies email links and SMS links as common ways people fell victim to scams, making employee click behavior a practical exposure point. •Mobile/SMS scam attempts: These were the most common cyberthreat attempts globally, affecting 36% of surveyed adults. •Phishing attempts: Phishing scam attempts affected 33% of surveyed adults and were among the top threats in nearly all countries. |
| Norton | 2023 | Endpoint / MDR / XDR Vendor |
| 251 | Cyber Safety Insights Report 2024 | Bottom Line Up Front (BLUF) Norton’s 2024 Cyber Safety Insights Report shows that online dating scams are common, emotionally persuasive, and increasingly intersect with AI-assisted behavior. For SMB owners and insurance teams, the key takeaway is that scam risk is not limited to email: malicious links, fake profiles, bots, catfishing, and webcam blackmail can expose people to malware, credit card theft, and extortion. Top 3-5 Most Notable Statistics •13,107 adults across 13 countries were surveyed online. •45% of respondents globally have used an online dating app or service. •26% of consumers globally reported they have been targeted by a dating scam. •32% of respondents who have used an online dating app or service said they have been catfished. •77% of consumers who use dating apps said they use them while traveling. Top 3-5 Exploitable Technology Risks •Malicious links sent through dating messages can lead to sites that download malware onto a computer. •Bots can operate fake dating profiles and use canned responses to push users toward links associated with porn, malware, or credit card scams. •Webcam chats can be recorded and used for blackmail if the interaction becomes compromising. |
| Norton | 2024 | Endpoint / MDR / XDR Vendor |
| 252 | Cyber Safety Insights Report 2025 | Bottom Line Up Front (BLUF) Norton’s 2025 report is not a traditional SMB cyber threat report; it focuses on children’s online safety, especially cyberbullying, AI companionship, screen time, and parental controls. The key takeaway for SMBs and insurance teams is that youth-facing digital risk is expanding beyond social media into gaming, messaging, AI tools, and everyday online interactions, which matters most for organizations that serve families, students, or minors. Top 3-5 Most Notable Statistics •36% of parents globally have noticed their child using AI for companionship, conversation, or emotional support. •13% of parents globally say their child has been a victim of cyberbullying; in the U.S., the figure is 24%. •Among reported cyberbullying cases, top perpetrators included strangers online (43%), classmates or peers (39%), and people met through online gaming (30%). •Cyberbullying was reported across platforms including Facebook (43%), Instagram (39%), TikTok (31%), YouTube (27%), online gaming (25%), and text (23%). •82% of parents actively manage children’s screen time, but 29% said their child found a way around limits or parental controls and told them, while 23% said their child got around controls and thought they got away with it. Top 3-5 Exploitable Technology Risks •AI tools used by children, including ChatGPT, Google Gemini, Microsoft Copilot, Snapchat My AI, and Character.AI, creating exposure to AI-related risks such as deepfakes and misinformation. •Online gaming environments, where children may encounter cyberbullying or interactions with strangers and people they met through games. •Social media and video platforms, including Facebook, Instagram, TikTok, and YouTube, which remain major channels for cyberbullying. |
| Norton | 2025 | Endpoint / MDR / XDR Vendor |
| 253 | Cyber Security in Critical National Infrastructure 2026 Research Report | Bottom Line Up Front (BLUF) Bridewell’s 2026 report shows cyber risk becoming direct business risk, with attacks now near-universal across critical national infrastructure and causing outages, operational disruption, revenue loss, data loss, and higher insurance costs. For SMBs and insurance teams, the key takeaway is that familiar weaknesses—phishing, malware, cloud exposure, outdated systems, poor visibility, and weak response execution—remain the most likely paths to loss. Top 3-5 Most Notable Statistics •93% of surveyed CNI organisations experienced a cyber attack in the past 12 months. •50% reported IT disruption or outage as a consequence of cyber incidents. •31% experienced revenue loss and 31% suffered data loss after attacks. •20% saw cyber insurance premium increases following cyber incidents. •39% ranked managing AI cyber risk among their top cyber security challenges. Top 3-5 Exploitable Technology Risks •Phishing and business email compromise remain the most prevalent attack type, averaging 11 attacks in the past 12 months. •Malware remains a major threat, averaging 8 attacks across sectors. •Outdated software or unavailable patches on legacy equipment averaged 7 attacks, highlighting patching and asset visibility gaps. |
| Bridewell | 2026 | Cybersecurity Services / Consultancy |
| 254 | Cyber Security Risk Report 2020 | Bottom Line Up Front (BLUF) Aon’s 2020 report frames cyber risk as an enterprise business risk, not just an IT problem. For SMBs and insurance teams, the key takeaway is that cyber events can affect intellectual property, transactions, retirement plans, executives, fraud losses, regulatory exposure, litigation, and business continuity. Top 3-5 Most Notable Statistics •IP theft is estimated to be a $1 trillion per year problem. •Less than 10% of M&A deals globally include specialist cyber security due diligence. •C-level executives are 12x more likely to be pursued and 9x more likely to be victimized. •Internet-enabled theft, fraud, and exploitation caused $2.7 billion in financial losses in 2018. •Global ransomware damage costs were predicted to reach $20 billion in 2021, up from $11.5 billion in 2019. Top 3-5 Exploitable Technology Risks •Web-based email account compromise using stolen credentials, which the report links to rising attacks against executives and business email compromise. •Ransomware that encrypts networks and may also involve attackers releasing sensitive company data if payment is refused. •Weak or unverified fund transfer processes, including email-based wire instructions and vendor banking-detail changes. |
| Aon | 2020 | Cyber Insurance Carrier |
| 255 | Cyber Survey 2021 | Bottom Line Up Front (BLUF) Deloitte’s 2021 survey shows that cyber risk is being amplified by complexity: hybrid IT, cloud adoption, remote work, connected operational technology, and data-rich customer experiences are expanding the attack surface. For SMBs and insurance teams, the key takeaway is that visibility, governance, incident readiness, and risk-based access controls matter as much as security tools. Top 3-5 Most Notable Statistics •69% of respondents reported an increase or significant increase in threats to their business between early 2020 and May 2021. •41% of CIOs and CISOs said transformation and gaining visibility across complex hybrid ecosystems was their greatest challenge. •32% of global C-suite respondents said operational disruption was the greatest impact of cyber incidents, followed by intellectual property theft at 22%. •72% of respondents said their organizations experienced between one and 10 cyber incidents and breaches in the last year. •44% ranked data management across complex perimeters as the top barrier to managing cybersecurity. Top 3-5 Exploitable Technology Risks •Hybrid IT and cloud environments: complex ecosystems make it harder to see and manage risk across on-premises, cloud, and third-party providers. •Remote work and mobile access: the shift to work-from-anywhere increased attack surfaces and weakened reliance on traditional network perimeters. •Connected operational technology and industrial control systems: formerly isolated environments are increasingly connected and exposed to ransomware and production disruption. |
| Deloitte | 2021 | Consulting / Analyst Firm |
| 256 | Cyber Survey 2021 | Bottom Line Up Front (BLUF) Critical Infrastructure SMBs in this survey experienced frequent, costly, and disruptive cyber breaches, with many reporting lost productivity, lost customers, and long recovery times. For SMB owners and insurance teams, the key takeaway is that proactive preparation—risk assessments, training, policies, configuration updates, cyber insurance, and outside support—matters because breaches can materially affect operations and customer trust. Top 3-5 Most Notable Statistics •75% of Critical Infrastructure SMBs experienced a breach at least once in company history. •45% experienced a breach within the past year. •59% reported that a breach stopped daily productivity. •Companies spent $170,000 on average to resolve a cyber breach. •On average, it took companies 7.5 months to fully recover from a breach. Top 3-5 Exploitable Technology Risks •Social engineering and phishing: 53% of respondents reported an increase in phishing since the start of the coronavirus pandemic, and the report highlights social engineering as a key vulnerability. •VPNs and remote work exposure: the report identifies VPNs as a heightened vulnerability vector and notes that remote workers may operate beyond the company network perimeter. •Electronically held customer information: the report identifies customer information as a vulnerability vector, and stolen data can damage customer trust. |
| USTelecom | 2021 | Network Security Vendor |
| 257 | Cyber Survey 2023 | Bottom Line Up Front (BLUF) Deloitte’s 2023 survey shows that cyber is no longer just an IT control function; it is becoming a core business capability tied to trust, operational stability, revenue, and resilience. For SMB owners and insurance teams, the key takeaway is that organizations with stronger planning, board-level engagement, incident-response preparation, and supplier oversight appear better positioned to reduce disruption and create business value from cyber investments. Top 3-5 Most Notable Statistics •91% of surveyed organizations reported at least one cyber incident or breach, up from 88% in the 2021 survey. •70% of respondents said cyber was on their board’s agenda regularly, either monthly or quarterly. •86% reported that cyber initiatives made a significant, positive contribution to at least one key business priority. •58% planned to increase cyber investment in the next year. •56% reported suffering loss of revenue or loss of customer trust from cyber incidents to a moderate or large extent. Top 3-5 Exploitable Technology Risks •Cloud environments: Cloud was the top digital transformation priority, and the report notes complex cyber considerations from hosting data and applications off premises and across varied environments. •Phishing, malware, and ransomware: High-maturity organizations showed particular concern about these attack types, which can directly disrupt operations and data access. •Denial-of-service attacks: Low- and medium-maturity organizations expressed greater concern about denial-of-service attacks, which can interrupt availability of digital services. |
| Deloitte | 2023 | Consulting / Analyst Firm |
| 258 | Cyber Survey 2024 | Bottom Line Up Front (BLUF) Deloitte’s Cyber Survey 2024 shows that cybersecurity is now tightly linked to business resilience, technology investment, and leadership confidence. For SMBs and insurance teams, the main takeaway is that cyber risk should be managed as an operational and financial resilience issue, not only as an IT problem. Top 3-5 Most Notable Statistics •57% of respondents expect to increase cybersecurity budgets over the next 12 to 24 months. •52% of all respondents are very confident in their C-suite and board’s ability to navigate cybersecurity; this rises to 82% among high-cyber-maturity organizations. •40% of respondents reported six to ten cybersecurity breaches in the past year. •34% identified phishing, malware, and ransomware as the top combined threat vector. •Negative consequences from cyber incidents rose from an average of 56% in the prior edition to 64% in this edition. Top 3-5 Exploitable Technology Risks •Phishing, malware, and ransomware remain the leading attack techniques, giving attackers practical ways to steal credentials, disrupt systems, or extort payment. •Data loss threats increased significantly, highlighting risk around where data is stored, processed, transmitted, and protected. •Generative AI is increasing risk by enabling artificially generated content that can impersonate trusted sources and target organizations more efficiently. |
| Deloitte | 2024 | Consulting / Analyst Firm |
| 259 | Cyber Threat Assessment Report 2024 | Bottom Line Up Front (BLUF) Cybercrime across Africa escalated in 2023, with ransomware, online scams, and business email compromise identified as the fastest-growing threats. For SMBs and insurance teams, the key takeaway is that attackers are exploiting everyday business tools, human trust, email, mobile banking, social media, and remote access weaknesses to create financial loss, downtime, fraud, and extortion risk. Top 3-5 Most Notable Statistics •Africa saw an estimated 23 per cent year-on-year increase in the average number of weekly cyberattacks per organization in 2023, the highest regional average cited in the report. •On average, 1 out of every 15 organizations in Africa experienced a ransomware attempt every week during the first quarter of 2023. •Nearly half of surveyed African countries reported ransomware attacks against critical infrastructure between January and December 2023. •Phishing emails were identified as the most common attack vector for business email compromise in nearly 80 per cent of African member countries in 2023. •19 member countries reported a cumulative total of 10,490 cybercrime-related arrests from January to December 2023. Top 3-5 Exploitable Technology Risks •Phishing emails remain a major entry point for ransomware, online scams, and business email compromise because they trick users into clicking links, opening files, or sharing credentials. •Unsecured Remote Desktop Protocol connections and unpatched system vulnerabilities are repeatedly highlighted as ransomware access paths. •Social media and messaging platforms, including Meta, Messenger, WhatsApp, Telegram, Signal, and SMS, are being abused for phishing, scams, reconnaissance, and victim contact. |
| Interpol | 2024 | Threat Intelligence Vendor |
| 260 | Cyber Threat Intelligence Report 2021 | Bottom Line Up Front (BLUF) Accenture’s 2021 report shows ransomware, stolen credentials, commodity malware, abused security tools, and exposed edge devices increasing risk across both IT and operational technology environments. For SMBs and insurance teams, the key takeaway is that attackers are pressuring victims through downtime, data exposure, customer contact, and business disruption, while ransom payment may not restore data or prevent leaks. Top 3-5 Most Notable Statistics •Colonial Pipeline reported a ransom payment of US$4.4M. •Median ransom payments fell from US$110,532 in September 2020 to US$78,398 in March 2021. •Cobalt Strike-enabled attacks reportedly increased by 163% between 2019 and 2020. •Accenture identified four early 2021 trends affecting IT and OT: ransomware extortion, Cobalt Strike abuse, commodity malware movement from IT to OT, and Dark Web activity. •Slightly over 50% of surveyed OT/ICS respondents reported continuous monitoring to detect vulnerabilities, and only 1/3 of surveyed OT/ICS security monitoring technologies were in use across respondents. Top 3-5 Exploitable Technology Risks •Ransomware operators are using faster deployment, data theft, leak sites, DDoS threats, and direct contact with customers or partners to increase pressure on victims. •Pirated Cobalt Strike and its Beacon backdoor are being used to evade detection, support ransomware campaigns, and customize command-and-control behavior. •Commodity malware such as QakBot, IcedID, DoppelDridex, and Hancitor can arrive through spam, malicious Office documents, macros, and links, then enable follow-on malware. |
| Accenture | 2021 | Consulting / Analyst Firm |
| 261 | Cyber Threat Intelligence Report 2024 | Bottom Line Up Front (BLUF) NCC Group’s 2024 report shows a threat landscape where ransomware, mass vulnerability exploitation, cloud exposure, and nation-state activity continue to create serious operational and data-loss risk. For SMBs and insurance teams, the key takeaway is that basic security hygiene, fast patching, resilient backups, and staff readiness remain critical because attackers are exploiting common weaknesses faster and at scale. Top 3-5 Most Notable Statistics •40,287 vulnerabilities were disclosed in 2024, up from 29,066 in 2023. •North America saw 2,689 ransomware attacks, while the European Union saw 1,272. •Ransomware attacks increased by 23% in Asia, 29% in South America, and 22% in Oceania compared with 2023. •The average time to exploitation for vulnerabilities fell sharply in recent years, with a reported median of one day for CVEs considered between 2020 and February 2024. •AT&T reported a breach affecting call and SMS logs of approximately 109 million customers. Top 3-5 Exploitable Technology Risks •Cloud misconfigurations and poorly secured APIs, which the report says can expose networks and provide attackers entry points. •Vulnerable edge and perimeter technologies, including VPNs and remote support platforms, which attackers used for initial access and zero-day exploitation. •Legacy systems and the convergence of operational technology and IT in industrial environments, which expand the attack surface and can cause operational disruption. |
| NCC Group | 2024 | Threat Intelligence Vendor |
| 262 | Cyber Threat Intelligence Report 2025 | Bottom Line Up Front (BLUF) Ransomware activity rose sharply in October 2025, with Industrials again the most targeted sector and Qilin the most active named ransomware actor. For SMBs and insurance teams, the key concern is that ransomware groups are becoming more varied, harder to attribute, and increasingly focused on data theft as well as disruption. Top 3-5 Most Notable Statistics •Global ransomware attacks increased by 41% in October 2025. •Industrials accounted for 28% of ransomware attacks in October 2025. •Qilin was responsible for 29% of ransomware attacks in October 2025. •The Gentlemen ransomware group made 21 public attack claims by the end of October after emerging in September 2025. •More than 200 ransomware variants were observed during 2025. Top 3-5 Exploitable Technology Risks •Ransomware with double extortion tactics, where attackers encrypt systems and also exfiltrate data to increase pressure on victims. •LockBit 5.0, which includes modular architecture, stronger anti-analysis features, DLL reflection capabilities, and Windows, Linux, and ESXi versions. •Fileless malware that runs in memory and uses legitimate tools and trusted processes to evade traditional detection. |
| NCC Group | 2025 | Threat Intelligence Vendor |
| 263 | Cyber Threat Intelligence Report 2025 | Bottom Line Up Front (BLUF) Bridewell’s 2025 report shows that credential theft, malicious infrastructure, and ransomware-linked tooling remain central to real-world cyber risk. For SMBs and insurance teams, the key takeaway is that attackers are using stolen credentials, social engineering, exposed edge devices, and post-exploitation tools to gain access and turn intrusions into ransomware, data theft, or business disruption. Top 3-5 Most Notable Statistics •Bridewell tracked over 28,000 servers used by financially motivated threat actors and nation-state groups in 2024. •40% of tracked malicious infrastructure was hosted in the United States or China, down 8% from 2023. •Global information stealer compromises peaked at over 620,000 incidents in January 2024, then resurged to 480,453 in August and 260,670 in December. •Ransomware incidents linked to information stealers most affected technology at 20.08%, business services at 17.67%, and healthcare at 11.65%. •Ransomware operators claimed approximately 6,130 victims in 2024. Top 3-5 Exploitable Technology Risks •Information stealers such as Lumma Stealer, Redline Stealer, StealC, Meduza Stealer, Raccoon Stealer, and Vidar are used to harvest credentials, session tokens, and sensitive data that can support unauthorised access and ransomware. •ClickFix-style social engineering tricks users into running malicious PowerShell commands through fake errors, fake CAPTCHA pages, compromised websites, and other deceptive prompts. •Offensive security tools and command-and-control frameworks, including Cobalt Strike, Sliver, Brute Ratel, Metasploit, and Burp Suite, are being used by criminals for remote control, lateral movement, and persistence. |
| Bridewell | 2025 | Cybersecurity Services / Consultancy |
| 264 | Cyber Threat Intelligence Report Vol2 2022 | Bottom Line Up Front (BLUF) Accenture’s report shows that financially motivated cybercrime remained highly active, with ransomware, stolen credentials, cloud abuse, supply chain compromise, and vulnerability exploitation all creating practical paths into business networks. For SMBs and insurance teams, the key takeaway is that attackers are monetizing access quickly through extortion, ransomware, data theft, and resale of compromised credentials. Top 3-5 Most Notable Statistics •Ransomware and extortion operations made up almost 35% of Accenture incident response intrusion volume in 2021, a 107% year-over-year increase from 2020. •The United States represented approximately 45% of ransomware and extortion intrusion volume in 2021. •In observed malware categories, ransomware accounted for 33%, backdoors 30%, and infostealers/credential stealers 10%. •Underground “bots” for sale increased from approximately 76,000 between December 2017 and December 2019 to more than 11 million between December 2019 and November 2021. •Accenture telemetry observed 119,514 unique Log4j exploitation attempts from December 9-31, 2021. Top 3-5 Exploitable Technology Risks •Cloud environments and hosted backups: ransomware and extortion operators targeted cloud infrastructure, including attempts to use compromised credentials and identity federation to access AWS through Azure Active Directory. •Software supply chain components: malicious and backdoored NPM packages can provide attacker footholds into networks or cloud tenants. •Infostealers and endpoint marketplaces: stolen usernames, passwords, keys, tokens, and cookie sessions can give attackers a direct or easier route into corporate systems. |
| Accenture | 2022 | Consulting / Analyst Firm |
| 265 | Cyber Threat Landscape Report 2024 | Bottom Line Up Front (BLUF) Ensign’s 2024 report shows that ransomware, supply chain compromise, exposed network infrastructure, and identity-based attacks remain the most important cyber risks for organisations across its Asia-Pacific operating territories. For SMBs and insurance teams, the key takeaway is that attackers are exploiting practical weaknesses: unpatched systems, third-party access, weak identity controls, and poor recovery readiness. Top 3-5 Most Notable Statistics •21 threat groups were observed actively targeting Ensign’s operating territories in 2023. •16 of those groups were state-sponsored, compared with 5 organised crime groups. •Maximum observed dwell time decreased from 1,095 days to 49 days, suggesting improved detection in some organisations. •Reported vulnerabilities increased by more than 20% between 2022 and 2023. •In exchange disclosures reviewed, 6 of 7 SGX-listed companies and 5 of 5 ASX-listed companies reported unauthorised access to IT networks or servers as the vector of entry. Top 3-5 Exploitable Technology Risks •Commonly used commercial software with notable exploitation: MOVEit Managed File Transfer, Citrix NetScaler ADC and Gateway, Confluence Server and Data Center, Zoho ManageEngine, 3CX Desktop Application, GoAnywhere MFT, Ivanti Connect Secure VPN, PaperCut Application Server, and Veeam Backup & Replication. •Network equipment and edge devices, including long-unpatched or end-of-life routers and cameras, were compromised and used in botnets such as KV Botnet. •Identity and access weaknesses, including stolen credentials, valid account abuse, privileged accounts, and external remote services, were repeatedly highlighted as attack paths. |
| Ensign | 2024 | Threat Intelligence Vendor |
| 266 | Cyber Threat Landscape Report 2025 | Bottom Line Up Front (BLUF) Ensign’s 2025 report shows a more persistent and harder-to-defend threat environment across Asia Pacific, with ransomware, data breaches, denial-of-service attacks, and cyber supply chain compromise standing out as major business risks. For SMBs and insurance teams, the key takeaway is that smaller firms, especially business and professional services providers, are increasingly attractive because they hold valuable data but may not have deep cyber defenses. Top 3-5 Most Notable Statistics •Incident-response maximum dwell time increased from 49 days to 201 days. •Minimum observed dwell time increased from 3 days to 7 days. •Average dwell time in retail increased from 5 days to 28 days. •Average dwell time in “Others” increased from 33 days to 70 days. •Organised crime groups actively targeting the territories doubled from 5 to 10. Top 3-5 Exploitable Technology Risks •Ransomware increasingly uses EDR/XDR stealth and process-killing capabilities to impair endpoint defenses. •Initial Access Brokers use a “breach once, sell to many” model, meaning one compromise can lead to repeated attacks by different threat actors. •Networking equipment and remote access solutions, including VPN and VDI technologies, are being targeted as cyber supply chain entry points. |
| Ensign | 2025 | Threat Intelligence Vendor |
| 267 | Cyber Threat Landscape Report 2026 | Bottom Line Up Front (BLUF) Dataminr’s 2026 report shows a faster, more identity-driven threat landscape where attackers increasingly use valid credentials, phishing, third-party exposure, and data theft rather than only breaking in through technical exploits. For SMBs and insurance teams, the key issue is that fewer incidents can still create much larger losses when credential theft, data exfiltration, operational disruption, and regulatory exposure combine into one event. Top 3-5 Most Notable Statistics •225% increase in monthly threat actor alerts from 2024 to 2025. •18,000+ alerts on ransomware activity in 2025. •2,000,000+ domain impersonation alerts and 425,000+ instances of brand fraud. •30% of cyber intrusions now involve valid credentials. •60% of cases still involve phishing as the dominant intrusion vector, while AI-supported phishing represented over 80% of observed social engineering activity worldwide by early 2025. Top 3-5 Exploitable Technology Risks •Valid credential abuse: attackers are increasingly “logging in” rather than “breaking in,” making stolen credentials and infostealer malware a major path to compromise. •Phishing and AI-enhanced social engineering: threat actors use phishing, voice phishing, and help-desk manipulation to bypass technical controls. •Third-party and supply chain exposure: one in four modern breaches exploits a third-party vulnerability, and vendor compromise can expose customer or employee credentials before the affected organization is aware. |
| Dataminr | 2026 | Threat Intelligence Vendor |
| 268 | Cyber Threat Landscape Report Q1 2026 | Bottom Line Up Front (BLUF) PDI Technologies’ Q1 2026 threat landscape points to faster exploitation, heavier targeting of firewalls and VPNs, and continued ransomware and extortion pressure. For SMBs and insurance teams, the key concern is reduced response time: attackers are using stolen credentials, exposed software, remote access paths, and edge devices to gain access before detection. Top 3-5 Most Notable Statistics •PDI analyzed more than 4 trillion security events to assess evolving cyberattack activity. •Exploit activity surged 247%. •Ransomware increased 35% year over year. •Ransomware surged 61% in Q4 due to expanding access paths. •Firewall exploit attempts increased 210%. Top 3-5 Exploitable Technology Risks •Firewalls and VPNs are heavily targeted, creating a direct risk to perimeter and remote access security. •Stolen credentials enable “quiet” access, increasing the chance that attackers can operate without immediate detection. •Infostealers remain a concern because new infostealers quickly filled the gap after enforcement activity reduced market activity. |
| PDI Technologies | 2026 | MSP / MSSP / SOC Provider |
| 269 | Cyber Threat Monitor Report 2024 | Bottom Line Up Front (BLUF) K7Security’s report shows that SMBs face a broad threat landscape across Windows, Android, macOS, enterprise networks, and internet-connected devices. The most important takeaway is that attackers are exploiting weak cyber hygiene, unpatched systems, poor password practices, exposed servers, malicious apps, and known vulnerabilities to steal data, disrupt operations, and monetize access through ransomware, cryptomining, and credential theft. Top 3-5 Most Notable Statistics •India’s overall infection rate was 35% in Q3_2023-24, down from 38% in the previous quarter, though the report cautions this does not necessarily mean a safer digital experience. •Visakhapatnam recorded an infection rate of 37%, Imphal 36%, Port Blair 35%, and several major cities ranged from 28% to 33%. •In Windows exploit detections, “Lateral Network” accounted for 56% in Q3_2023-24, followed by “WORM_DOC001.EXE” at 20%. •Android detections were dominated by Trojans at 73%, with adware at 27% in Q3_2023-24. •macOS detections shifted toward Trojans at 47%, adware at 40%, and potentially unwanted programs at 13% in Q3_2023-24. Top 3-5 Exploitable Technology Risks •Poorly protected internet-facing SQL servers, which the report describes as enabling cryptomining malware to spread laterally across an enterprise network. •Weak passwords and insufficient access controls, including brute forcing, Mimikatz use, disabling Windows Defender, and creation of elevated-privilege users. •Known vulnerabilities in Microsoft products, including Skype for Business, WordPad, SmartScreen, Excel, and Windows Server versions. |
| K7Security | 2024 | Threat Intelligence Vendor |
| 270 | Cyber Threat Monitor Report 2025 | Bottom Line Up Front (BLUF) K7Security’s report shows that the biggest cyber risk for SMBs is “vulnerability debt”: old and new software weaknesses left unpatched, combined with credential theft and socially engineered attacks. For insurance and risk teams, this matters because these conditions can lead directly to ransomware, data theft, business interruption, supply chain disruption, and reputational damage. Top 3-5 Most Notable Statistics •The global Infection Rate for Q2 2025-26 was 19%, based on active K7 users who encountered at least one blocked cyber threat event. •IT/ITES and Manufacturing were the most impacted industry groups by vulnerability impact, at 28% and 21% respectively. •Government and Hospitality showed high infection rates at 23% and 20%, indicating sustained targeting of public data and high-volume transaction environments. •MS17-010-related SMB exploit detections accounted for a combined 75% of highlighted Windows vulnerability detections. •Trojans made up 86% of Android detected threats and 88% of macOS detected threats. Top 3-5 Exploitable Technology Risks •Unpatched Windows SMBv1 exposure, especially MS17-010 and EternalBlue-style exploitation, remains a major route for lateral movement, mass infection, and ransomware risk. •Exposed SMB shares can be abused to install malware, as shown in the Purplefox case involving brute force access, remote service creation, RDPWrap installation, firewall disablement, and port reassignment. •Public-facing systems with critical vulnerabilities are a major concern, including Cisco ISE, Wing FTP Server, Microsoft SharePoint, Fortinet FortiWeb, Trend Micro Apex One, CrushFTP, and Citrix NetScaler VPN/ADC. |
| K7Security | 2025 | Threat Intelligence Vendor |
| 271 | Cyber Threat Report 2024 | Bottom Line Up Front (BLUF) NCSC’s 2024 report shows that cyber incidents affect all parts of New Zealand’s economy, with individuals and small-to-medium businesses making up most reported incidents. For SMB owners and insurance teams, the key takeaway is that common, preventable attack methods—especially phishing, credential theft, public-facing application exploitation, and ransomware—continue to create real financial, operational, and reputational harm. Top 3-5 Most Notable Statistics •7,122 total incident reports were recorded by the NCSC in 2023/2024. •6,779 incidents were handled through the general triage process, often affecting individuals and small-to-medium businesses. •3,455 general-triage incidents involved phishing and credential harvesting, making it the most common reported category overall. •46 ransomware incidents were recorded, approximately half the number reported in 2022/2023. •10.3 million malicious cyber events were disrupted through Malware Free Networks, compared with 250,000 in 2022/2023. Top 3-5 Exploitable Technology Risks •Exploitation of public-facing applications, including websites, databases, webservers, FTP, and SSH services, was the top technique in incidents of potential national significance. •Phishing and credential harvesting remain major risks because stolen credentials can enable unauthorised access, money transfer fraud, ransomware, and account compromise. •Adversary-in-the-middle phishing can bypass some multi-factor authentication by capturing credentials and session cookies. |
| NCSC | 2024 | Government / Intelligence Agency |
| 272 | Cyber Threat Report 2024 | Bottom Line Up Front (BLUF) ASD’s 2024 report shows that Australian businesses face persistent cyber risk from cybercriminals and state-sponsored actors, with compromised credentials, malware, business email compromise, ransomware, and supply chain exposure recurring across incidents. For SMBs and insurance teams, the key takeaway is that basic control failures—weak authentication, reused passwords, unpatched systems, limited logging, and poor recovery readiness—continue to create preventable losses. Top 3-5 Most Notable Statistics •ASD received over 36,700 calls to the Australian Cyber Security Hotline in FY2023–24, a 12% increase from the previous financial year. •ASD responded to over 1,100 cyber security incidents, with 14% categorised as Category 3 or above. •Critical infrastructure organisations self-reported 128 incidents to ASD, representing over 11% of incidents ASD responded to. •Business email compromise losses reported through ReportCyber were almost $84 million, with over 1,400 financially damaging reports and an average loss of over $55,000 per confirmed incident. •ASD responded to 121 ransomware incidents, accounting for around 11% of all reported incidents. Top 3-5 Exploitable Technology Risks •Compromised accounts and credentials: the top reported incident type for critical infrastructure and government, and a major enabler of fraud, unauthorised access, and lateral movement. •Legacy and unpatched systems: ASD noted a serious incident involving exploitation of a known vulnerability on a legacy, unpatched test server. •Cloud access attacks: malicious actors used brute-force attacks and password spraying to access highly privileged cloud service accounts. |
| ASD | 2024 | Government / Intelligence Agency |
| 273 | Cyber Threat Report 2024 | Bottom Line Up Front (BLUF) Intel471’s report shows ransomware, stolen access, exploitable vulnerabilities, and information-stealing malware remained the core cybercrime risks from 2023 into 2024. For SMBs and insurance teams, the key takeaway is that attackers do not need highly advanced methods when compromised credentials, unpatched public-facing systems, and social engineering can provide a fast path to extortion, data theft, and operational disruption. Top 3-5 Most Notable Statistics •Ransomware attacks rose to 4,429 in 2023, almost double the 2,344 observed in 2022. •Intel471 observed 5,347 instances of access vendors offering compromised credentials or alleged unauthorized access to networks or systems in 2023. •The National Vulnerability Database documented 28,831 vulnerabilities in 2023, up from 25,081 in 2022. •Intel471 identified 88 zero-day vulnerabilities exploited by threat actors in 2023, a 43% increase from 2022. •Information stealers accounted for 21% of malware-related offerings, followed by remote access trojans at 13.4% and drainers at 11.2%. Top 3-5 Exploitable Technology Risks •Compromised credentials and unauthorized access offers, which remain a major enabler of broader cybercrime and ransomware activity. •Public-facing applications with recent vulnerabilities, which threat actors prioritized for initial access before organizations patched exposed instances. •Managed file transfer software, including the MOVEit example, highlighted as an overlooked attack surface used for data exfiltration and extortion. |
| Intel 471 | 2024 | Threat Intelligence Vendor |
| 274 | Cyber Threat Report 2025 | Bottom Line Up Front (BLUF) Honeywell’s 2025 report shows that operational technology environments are being hit by both familiar threats and newer attack patterns, with ransomware, USB-borne malware, Trojans, weak access controls, and critical vulnerabilities all creating real disruption risk. For SMBs and insurance teams, the key takeaway is that even baseline controls such as backups, vulnerability assessments, removable media scanning, MFA, least privilege, and network segmentation can materially reduce the chance that an incident becomes an operational shutdown. Top 3-5 Most Notable Statistics •Honeywell analyzed 253.2 billion logs, scanned 79.2 million files, and triaged 4,600 events during the reporting period. •Honeywell documented a 46% increase in ransomware extortion incidents compared with the previous reporting period. •55% of self-reported cybersecurity incidents by companies on SEC Form 8-Ks in 2024 were reported as direct attacks on operational technology. •Honeywell SMX scanned 31.4 million files and detected 1,826 distinct threats, including 124 unique threats not seen in previous reporting periods. •W32.Worm.Ramnit represented 37% of files blocked by Honeywell SMX and showed a 3,000% increase since it was last observed in Q2 2024. Top 3-5 Exploitable Technology Risks •USB and removable media threats: USB plug-and-play was the top AMIR incident type, and removable media can carry worms, Trojans, ransomware, and other malware into industrial environments. •Privileged account changes: Adding accounts to local or domain security groups can grant elevated access and increase the risk of unauthorized changes or sensitive data access. •Application control weakened from high to low enforcement: Moving from an allowlist approach to a less restrictive model can permit more files to run unless already known to be malicious. |
| Honeywell | 2025 | Threat Intelligence Vendor |
| 275 | Cyber Threat Report 2025 | Bottom Line Up Front (BLUF) The NCSC’s core message is that New Zealand organisations of all sizes, including smaller businesses, can be targeted because of what they hold, who they work with, or simply because they are easy to compromise. For SMBs and insurance teams, the biggest practical concern is that ransomware, credential theft, unpatched systems, supplier compromise, and denial-of-service activity are creating real financial, operational, data, and reputational losses. Top 3-5 Most Notable Statistics •The NCSC received 5,995 cyber incident reports in 2024/25. •331 incidents were triaged as incidents of potential national significance. •137 nationally significant incidents were linked to criminal or financially motivated actors, more than double the prior year’s 65. •Direct financial loss reported to the NCSC totalled $26.9M, up from $21.6M in 2023/24. •53% of New Zealand SMEs experienced a cyber threat between January and June 2025, up from 36% reported in 2024. Top 3-5 Exploitable Technology Risks •Ransomware and ransomware-as-a-service, which lower the skill needed to launch attacks and can cause data loss, business disruption, extortion, and recovery costs. •Phishing, spear-phishing, credential harvesting, and helpdesk social engineering, which attackers use to gain valid access to systems and accounts. •Known weaknesses and unpatched vulnerabilities, including publicly disclosed CVEs that remain exploitable long after fixes are available. |
| NCSC | 2025 | Government / Intelligence Agency |
| 276 | Cyber Threat Trends and Outlook Report 2026 | Bottom Line Up Front (BLUF) Intel 471’s main message is that extortion, supply chain compromise, credential-based access, and fast weaponization of vulnerabilities will define cyber risk in 2026. For SMBs and insurance teams, the practical concern is not only preventing attacks, but limiting how quickly one compromised vendor, account, package, or remote access point can turn into business interruption, data theft, and extortion. Top 3-5 Most Notable Statistics •Intel 471 reported over 6,800 extortion breach events in 2025, an increase of about 63% compared with 2024. •Intel 471 observed over 3,200 initial access broker claims offering unauthorized access to corporate networks or systems, down about 27% from 2024. •Intel 471’s Vulnerability Intelligence team reported over 500 vulnerabilities; 238 were observed in active exploitation campaigns, and more than 80% of those were weaponized or productized. •Qilin accounted for about 18% of all extortion victims in 2025, and more than 80% of its victims were entities with low or undisclosed revenues. •From April 1 to Dec. 1, 2025, Intel 471 identified over 8,400 new mobile malware observations across more than 60 mobile malware families. Top 3-5 Exploitable Technology Risks •Supply chain compromise affecting platforms and providers, including CRM, managed file transfer, Oracle EBS, and managed service provider environments, because one upstream breach can impact many downstream organizations. •Credential-based intrusions, remote access portals, and RDP technologies, especially where weak credentials, misconfigurations, or inconsistent multifactor authentication are present. •ClickFix social-engineering attacks, which trick users into pasting and executing malicious commands on Windows or macOS systems. |
| Intel 471 | 2026 | Threat Intelligence Vendor |
| 277 | Cyber Threat Trends Report 2024 | Bottom Line Up Front (BLUF) Cisco’s 2024 report shows that the most active DNS-observed threats are designed to steal credentials, gain unauthorized access, and deploy ransomware. For SMBs and insurance teams, the key takeaway is that many serious incidents can begin with ordinary internet activity—email links, malicious domains, compromised websites, weak credentials, or infected endpoints—making DNS-layer visibility, endpoint protection, backups, and incident response planning central to loss prevention. Top 3-5 Most Notable Statistics •Information stealers averaged 246 million monthly blocks, making them the most-seen threat category in the report. •Trojans averaged 175 million monthly blocks, the second-highest threat category. •Ransomware averaged 154 million monthly blocks and remained high after a January jump. •Botnet activity spiked in March to 174% above the observed average. •The report cites DNS security as capable of mitigating one-third of cyber incidents and preventing up to $10 billion in losses. Top 3-5 Exploitable Technology Risks •Information stealers that capture passwords, cookies, credit card data, cryptocurrency wallets, VPN credentials, and other sensitive information from infected systems. •Trojans delivered through malicious links or email attachments disguised as legitimate files, enabling data theft, backdoor access, and installation of additional malware. •Ransomware seeded through droppers, with the report noting similar activity trends between ransomware and droppers. |
| Cisco | 2024 | Network Security Vendor |
| 278 | Cyber Threat Trends Report: From Trojan Takeovers to Ransomware Roulette | Bottom Line Up Front (BLUF) Cisco’s report shows that common malware categories—not just advanced nation-state activity—are generating very large volumes of blocked DNS activity, with information stealers, Trojans, and ransomware leading the list. For SMBs and insurance teams, the key takeaway is that attacks often begin with everyday user activity such as malicious links, email attachments, compromised websites, or software vulnerabilities, then progress toward credential theft, backdoor access, ransomware, or data loss. Top 3-5 Most Notable Statistics •Information stealers averaged 246 million monthly DNS blocks, the highest category in the report. •Trojans averaged 175 million monthly DNS blocks, making them the second-highest category. •Ransomware averaged 154 million monthly DNS blocks and jumped in January, staying high for the rest of the observed period. •Botnet activity averaged 31 million monthly DNS blocks, with a March spike 174% above the observed-period average. •Advanced Persistent Threat activity averaged 40 million monthly DNS blocks and showed one of the most stable month-to-month activity levels. Top 3-5 Exploitable Technology Risks •Malicious DNS activity: Many attacks rely on DNS connections, including callbacks to command-and-control servers, phishing sites, malicious domains, and data exfiltration paths. •Information stealers: These can capture passwords, cookies, session data, credit card information, cryptocurrency wallets, VPN credentials, and other sensitive data from infected systems. •Trojans and droppers: Trojans can disguise themselves as legitimate software or invoices, while droppers install additional malware and may be used to seed ransomware payloads. |
| Cisco | 2025 | Network Security Vendor |
| 279 | Cyber Threat Trends Report: From Trojan Takeovers to Ransomware Roulette | Bottom Line Up Front (BLUF) Cisco’s report shows that privacy, data governance, and AI governance are now core business trust issues, not just compliance tasks. For SMBs and insurance teams, the key takeaway is that organizations see measurable business value from privacy investment, but GenAI use is creating new exposure around sensitive data, employee information, customer information, and non-public company data. Top 3-5 Most Notable Statistics •90% of respondents believe data is inherently safer when stored within their own country or region. •88% said data localization adds significant operating cost. •86% reported that privacy laws have had a positive impact on their organization, up from 80% in the prior Cisco study. •96% said the benefits from privacy investment outweigh the costs. •64% were concerned that information entered into GenAI tools could be shared with the public or competitors, while 46% reported entering employee names or information and 42% reported entering non-public company information into GenAI applications. Top 3-5 Exploitable Technology Risks •GenAI applications receiving sensitive inputs: respondents reported entering employee information, customer information, internal process information, and non-public company information into GenAI tools. •Information leakage through GenAI: the report highlights concern that information entered into GenAI tools could be shared with the public or competitors. •AI deployment without governance and controls: Cisco recommends deploying AI with governance and controls to respect privacy and manage unintended consequences. |
| Cisco | 2025 | Network Security Vendor |
| 280 | Cyber Threat Trends Report: From Trojan Takeovers to Ransomware Roulette | Bottom Line Up Front (BLUF) AI adoption is expanding faster than many organizations’ ability to secure it, creating new exposure across AI applications, models, data, infrastructure, and employee use of third-party AI tools. For SMBs and insurance teams, the key issue is not only attackers using AI for phishing, but also businesses introducing AI systems that can leak sensitive data, be manipulated, or depend on compromised third-party components. Top 3-5 Most Notable Statistics •72 percent of surveyed organizations said they had adopted AI capabilities in business functions as of early 2024. •Only 13 percent of surveyed senior business leaders said they were ready to leverage AI and AI-powered technologies to their full potential. •Around 60 percent of surveyed IT decision makers use open-source ecosystems as an AI tool source. •80 percent of surveyed IT decision makers said at least a quarter of their company’s AI solutions or platforms are based on open source. •In 2024, U.S. state lawmakers introduced over 700 AI-related bills, with 113 enacted into law across 45 states. Top 3-5 Exploitable Technology Risks •AI supply chain compromise through third-party models, datasets, and open-source libraries, including backdoored models and malicious components. •Prompt injection and jailbreaking, where attackers manipulate large language models to bypass guardrails, reveal system prompts, or produce harmful outputs. •Training data extraction and model inversion, which can expose sensitive, proprietary, or private information used to train models. |
| Cisco | 2025 | Network Security Vendor |
| 281 | CyberArk Identity Security Threat Landscape 2024 | Bottom Line Up Front (BLUF) CyberArk’s 2024 report shows that identity-related risk is expanding quickly because organizations are adding more human, machine, cloud, SaaS, and third-party identities while attackers use phishing, vishing, ransomware, and AI-enabled methods to exploit them. For SMBs and insurance teams, the core takeaway is clear: unmanaged identities, weak vendor oversight, and basic social-engineering attacks can create direct business losses even when newer technologies like GenAI receive most of the attention. Top 3-5 Most Notable Statistics •99% of surveyed organizations are using GenAI in identity-related cybersecurity initiatives. •9 out of 10 organizations experienced a successful identity-related breach due to phishing or vishing. •47% expect total identities to grow by three times or more in the next 12 months, with machine identities the top driver. •90% were targeted by ransomware, and 75% paid the ransom but did not recover data. •94% use more than 10 vendors for identity-related cybersecurity initiatives. Top 3-5 Exploitable Technology Risks •Phishing and vishing attacks that compromise identities and can lead to ransomware, data loss, and business disruption. •Machine identities, including applications, cloud workloads, service accounts, DevOps environments, CI/CD pipelines, and automation tools, that may have access to sensitive data but are not always treated as privileged users. •Third- and fourth-party access paths, including cloud, SaaS, service providers, integrators, and supply chain relationships that can cascade risk into the organization. |
| CyberArk | 2024 | Identity Security Vendor |
| 282 | CyberArk Identity Security Threat Landscape 2025 | Bottom Line Up Front (BLUF) CyberArk’s 2025 report shows that identity is the central cyber risk as AI adoption, machine identities, cloud access, and fragmented tools expand the attack surface. For SMBs and insurance teams, the key takeaway is that attackers are exploiting credentials, privileges, AI tools, and unmanaged identities faster than many organizations can see or control them. Top 3-5 Most Notable Statistics •9 out of 10 organizations reported a successful identity-centric breach. •87% of respondents experienced at least two successful identity-centric breaches in the past 12 months. •Machine identities now outnumber human identities by more than 80 to 1. •68% of respondents lack identity security controls for AI and large language models. •88% of respondents say cyber insurers are demanding stricter privilege controls, and 89% say insurers require stricter adherence to least privilege. Top 3-5 Exploitable Technology Risks •AI-generated phishing and vishing: Attackers use AI to create highly personalized, realistic messages and voice scams that help steal credentials and escalate access. •Shadow AI: Employees or departments may use AI tools not approved or managed by IT, creating risks of data leaks, exposed API keys, and unmanaged processing of company information. •Machine identity sprawl: Bots, service accounts, scripts, workloads, and AI agents often have sensitive or privileged access but may not be treated as privileged users. |
| CyberArk | 2025 | Identity Security Vendor |
| 283 | CyberArk State of Machine Identity Security Report 2025 | Bottom Line Up Front (BLUF) Machine identities such as API keys, certificates, secrets, tokens, and service accounts are growing quickly and are increasingly tied to breaches and outages. For SMBs and insurance teams, the key takeaway is that unmanaged or undiscovered machine credentials can become entry points for attackers, disrupt customer-facing systems, and create compliance or audit problems. Top 3-5 Most Notable Statistics •50% of organizations reported security incidents or breaches related to compromised machine identities in the last year. •77% of security leaders said every undiscovered machine identity is a potential point of compromise. •72% of organizations experienced at least one certificate-related outage in the past year. •79% expect machine identities to increase over the next 12 months, with some projecting growth up to 150%. •42% lack a cohesive machine identity security strategy across environments, business units, and identity types. Top 3-5 Exploitable Technology Risks •API keys and SSL/TLS certificates are among the most common machine identities involved in security incidents and are also viewed as difficult to secure. •Expired certificates can cause service disruptions and outages, including access problems for business-critical systems. •Stolen machine identities can be misused for privilege escalation, malicious updates, and man-in-the-middle attacks. |
| CyberArk | 2025 | Identity Security Vendor |
| 284 | Cybercrime: COVID-19 Impact (August 2020) | Bottom Line Up Front (BLUF) COVID-19 sharply changed the cybercrime landscape by giving criminals new themes, targets, and opportunities, especially through phishing, fraud, ransomware, malicious domains, and remote-work weaknesses. For SMBs and insurance teams, the main takeaway is that workplace disruption and urgent pandemic-related decision-making increased exposure to credential theft, payment diversion, operational downtime, and data loss. Top 3-5 Most Notable Statistics •907,000 COVID-19-related spam messages, 737 malware incidents, and 48,000 malicious URLs were detected between January and 24 April 2020 by an INTERPOL private sector partner. •Around two-thirds of responding member countries reported significant use of COVID-19 themes for phishing and online fraud. •COVID-19-related phishing/scam/fraud represented 59% of key reported cyberthreats, followed by malware/ransomware at 36%, malicious domains at 22%, and fake news at 14%. •By the end of March 2020, 116,357 COVID-19 newly registered domains were detected, including 2,022 malicious domains and 40,261 high-risk domains. •From February to March 2020, one INTERPOL partner detected 569% growth in malicious registrations and 788% growth in high-risk registrations. Top 3-5 Exploitable Technology Risks •COVID-19-themed phishing emails impersonating government and healthcare authorities to steal credentials, passwords, financial information, and tax data. •Business Email Compromise using spoofed supplier or client email addresses to divert procurement funds, especially for essential supplies and healthcare products. •Ransomware and DDoS attacks that make data inaccessible, disrupt systems, lock critical services, and create pressure to pay. |
| INTERPOL | 2020 | Threat Intelligence Vendor |
| 285 | CyberEdge Cyberthreat Defense Report 2025 | Bottom Line Up Front (BLUF) CyberEdge’s 2025 report shows that successful cyberattacks remain common, even though some attack and ransomware indicators have improved. For SMB owners and insurance teams, the key takeaway is that risk is still high and increasingly tied to identity abuse, web and mobile applications, hybrid cloud complexity, and gaps in attack surface management. Top 3-5 Most Notable Statistics •81.6% of surveyed organizations experienced at least one successful cyberattack in the previous 12 months. •53.0% experienced one to five successful attacks, while 20.8% experienced six to 10 and 7.9% experienced more than 10. •Organizations victimized by ransomware that paid the ransom fell 22% over three years. •92.1% of organizations reported at least one attack surface management challenge. •IT security budgets are expected to increase by an average of 4.3% in 2025. Top 3-5 Exploitable Technology Risks •Identity and credential abuse: the report highlights account takeover, credential abuse, stolen identities, and Active Directory compromise as major concerns because they can enable impersonation, privilege escalation, and lateral movement. •Web and mobile application attacks: respondents cited risks such as personally identifiable information harvesting, credential stuffing, payment fraud, and digital skimming. •Hybrid multi-cloud complexity: organizations struggle with unsanctioned cloud applications, inconsistent security policies, identity and access control, administrative account protection, and monitoring across environments. |
| CyberEdge | 2025 | MSP / MSSP / SOC Provider |
| 286 | Cybersecurity Almanac 2025 | Bottom Line Up Front (BLUF) Momentum Cyber’s Cybersecurity Almanac 2025 shows a cybersecurity market being reshaped by record M&A, strong financing, and rapid AI security investment. For SMBs and insurance teams, the key takeaway is that security priorities are moving quickly toward AI governance, cloud security, identity, data protection, and operational resilience as attackers and defenders both become more automated. Top 3-5 Most Notable Statistics •$96B in total disclosed cybersecurity M&A deal value across 400 transactions in 2025, both record highs. •M&A deal value grew 270% year over year, while deal volume grew 22%. •Cybersecurity financing reached $20.7B across 820 financing rounds. •AI Security was the most active financing sector, with 144 raises in 2025. •Strategic buyers accounted for 92% of disclosed M&A value and 59% of deal count. Top 3-5 Exploitable Technology Risks •AI systems and AI-enabled operations: the report highlights prompt injection, model poisoning, and autonomous, agent-driven attacks operating at machine speed. •Immature AI governance: enterprises are embedding AI into mission-critical systems before governance, security, and regulatory frameworks have fully matured. •Cloud-native and SaaS environments: cloud-native/SaaS deals represented a large share of M&A activity, reflecting the importance and consolidation of cloud-first security architectures. |
| Momentum Cyber | 2025 | Threat Intelligence Vendor |
| 287 | Cybersecurity Considerations 2026 | Bottom Line Up Front (BLUF) KPMG’s core message is that cybersecurity in 2026 is becoming a business resilience issue, not just an IT control issue. For SMBs and insurance teams, the most important takeaway is that AI, third-party dependency, cloud concentration, non-human identities, and connected IT/OT environments are expanding the attack surface while regulators are demanding stronger proof of control. Top 3-5 Most Notable Statistics •79% of CEOs identified cybercrime and cyber insecurity as a major threat to future prosperity. •69% identified regulatory demands as a major threat to future prosperity. •57% identified geopolitical conflicts as a major threat to future prosperity. •45% of organizations said regulatory and compliance risk has grown in importance for third-party risk management. •36% of organizations said they plan to strengthen data sovereignty audits across partner networks. Top 3-5 Exploitable Technology Risks •Non-human identities, including machine credentials, service accounts, and AI agents, can be targeted and exploited, especially through third parties such as hyperscalers and SaaS providers. •IT/OT hyperconnectivity, including IoT sensors, robotics, embedded devices, and legacy operational technology, creates opportunities for data theft, ransomware, device compromise, and DDoS attacks. •Supply chain ecosystems involving cloud platforms, SaaS providers, and third, fourth, and fifth parties create blind spots when monitoring is limited to periodic questionnaires. |
| KPMG | 2026 | Consulting / Analyst Firm |
| 288 | Cybersecurity Forecast 2026 | Bottom Line Up Front (BLUF) Google expects 2026 to bring faster, more scalable cyberattacks as criminals and nation-state actors expand their use of artificial intelligence, ransomware, data theft extortion, and attacks on high-impact infrastructure layers. For SMBs and insurance teams, the most important takeaway is that human-targeted attacks, third-party exposure, and overlooked infrastructure risks may drive more disruptive losses and faster-moving incidents. Top 3-5 Most Notable Statistics •2,302 victims were listed on data leak sites in Q1 2025, the highest single-quarter count Google observed since it began tracking these sites in 2020. •Incidents in 2025 affecting retail and food wholesale supply chains caused hundreds of millions of dollars in total damages. •North Korean threat actors conducted the largest recorded cryptocurrency heist, valued at approximately $1.5 billion. •Hypervisor-focused attacks can render hundreds of systems inoperable in hours, compared with traditional endpoint ransomware campaigns that often spread over days or weeks. Top 3-5 Exploitable Technology Risks •Prompt injection against enterprise AI systems, where attackers manipulate AI tools to bypass safeguards and follow hidden instructions. •AI-enabled social engineering, including vishing and AI-driven voice cloning of executives or IT staff to deceive employees. •Managed file transfer software, which attackers can use to exfiltrate data from many targets at once. •Enterprise virtualization and hypervisors, especially where outdated software, insecure defaults, and limited EDR visibility leave core infrastructure exposed. |
| 2026 | Cloud Provider / Hyperscaler | |
| 289 | Cybersecurity Report 2025 | Bottom Line Up Front (BLUF) Hornetsecurity’s 2025 report shows that email and Microsoft 365 remain major attack paths for businesses of all sizes, with phishing, malicious URLs, brand impersonation, and credential theft still central to attacker activity. For SMBs and insurance teams, the key takeaway is that basic controls are no longer enough unless they are consistently implemented, tested, and adapted to attacks that can bypass traditional multi-factor authentication. Top 3-5 Most Notable Statistics •Hornetsecurity analyzed more than 55.6 billion emails during the reporting period. •36.9% of all scanned emails were categorized as unwanted. •2.3% of unwanted emails were flagged as malicious, down from 3.7% the prior year and 5.5% the year before. •Phishing accounted for 33.3% of email attack types, followed by malicious URLs at 22.7%. •Only 35.4% of analyzed active mail-sending domains had implemented DMARC, and only 16.6% used RUA reporting capabilities. Top 3-5 Exploitable Technology Risks •Phishing and malicious URLs, especially links used in reverse-proxy credential harvesting attacks. •Adversary-in-the-middle attacks that steal authentication tokens and can work even when standard MFA is in place. •Malicious attachments, especially HTML files, PDFs, and archive files, which remain common delivery formats. |
| Hornetsecurity | 2025 | Email Security Vendor |
| 290 | Cybersecurity Report 2026 | Bottom Line Up Front (BLUF) Hornetsecurity’s 2026 report shows that email, identity, Microsoft 365, and SaaS environments remain the main battlegrounds for cyber risk, with ransomware and AI-enabled social engineering accelerating again. For SMBs and insurance teams, the key takeaway is that resilience matters as much as prevention: attackers are diversifying entry points, while organizations with immutable backups, disaster recovery plans, and stronger identity controls are better positioned to recover. Top 3-5 Most Notable Statistics •Hornetsecurity analyzed more than 72 billion emails from 2025. •Malware-laden emails increased by 130.92% year over year. •Scams increased by 34.70%, and phishing increased by 20.97%. •24% of organizations reported being victims of ransomware in 2025, up from 18.6% in 2024. •Only 13% of ransomware victims paid the ransom in 2025, while 62% of organizations use immutable backups and 82% have a disaster recovery plan. Top 3-5 Exploitable Technology Risks •Email evasion techniques, including fake sender headers, manipulated spam headers, legitimate hosting platforms, shortened URLs, non-ASCII characters, and ZeroFont techniques, are being used to bypass filters and trick users. •Malicious attachments are shifting toward overlooked file types, especially TXT files, legacy DOC files, ZIP archives, ICS calendar files, and SHTML files. •Ransomware entry points are diversifying beyond email to include compromised credentials, endpoint compromise, and exploited vulnerabilities. |
| Hornetsecurity | 2026 | Email Security Vendor |
| 291 | Cybersecurity Risk Report 2025 | Bottom Line Up Front (BLUF) Trend Micro’s 2025 report shows that many organizations remain in a “medium risk” state because common, preventable exposures persist across identity, cloud, email, endpoints, and patching. For SMBs and insurance teams, the key takeaway is that risk is not limited to large enterprises: smaller organizations can have high exposure and should prioritize measurable controls that reduce attack surface risk. Top 3-5 Most Notable Statistics •The overall average Cyber Risk Index for 2024 was 38.4, which remains in the medium-risk range. •Overall risk improved by 6.2 points from February to December 2024, ending at 36.3. •Trend Micro detected and blocked 57 million high-risk email threats in 2024, a 27% increase from 45 million in 2023. •Organizations with 1-100 users had an average risk index of 44.2, higher than larger size categories shown in the report. •Weak authentication events were very large in volume, including 1,011,628,400 detections for Microsoft Entra ID accounts with MFA disabled. Top 3-5 Exploitable Technology Risks •Risky cloud app access was the top risky event, showing that cloud use and user behavior remain major exposure points. •Stale Microsoft Entra ID and on-premises Active Directory accounts, disabled MFA, disabled password expiration, weak passwords, and accounts with passwords not required create paths for unauthorized access. •Cloud misconfigurations across AWS, Azure, GCP, and Amazon S3 include issues such as overly permissive access, weak IAM policies, public read/write settings, lack of encryption, and insufficient network security configurations. |
| Trend Micro | 2025 | Threat Intelligence Vendor |
| 292 | Cybersecurity Sector Report 2026 | Bottom Line Up Front (BLUF) The report’s central message is that cyber risk is escalating through AI-driven attacks, ransomware, deepfake fraud, and supply-chain compromises, while regulation and enforcement are also increasing. For SMBs and insurance teams, this means cyber incidents should be treated as business disruption events with potential financial, operational, legal, and compliance consequences. Top 3-5 Most Notable Statistics •In 2025, the cybersecurity sector recorded 400 M&A deals, including 165 companies acquired by private equity. •Total disclosed cybersecurity M&A deal value in 2025 exceeded US$84 billion, with a 270% year-over-year value surge. •Only 18% of organizations had fully adopted and integrated AI cybersecurity tools, while 65% of security teams reported challenges integrating AI security solutions with legacy systems. •Israeli cybersecurity exit value reached US$72.6 billion in 2025, an increase of more than 1,500% compared with 2024. •The HACK cybersecurity ETF underperformed the S&P 500 by approximately 10% over the past year. Top 3-5 Exploitable Technology Risks •AI-driven attacks: Attackers are increasingly using AI, while defenders are still struggling to integrate AI security tools into legacy environments. •Ransomware: The report identifies ransomware as one of the most disruptive cyber threats, requiring stronger prevention, detection, response, and recovery capabilities. •Deepfake fraud: Deepfake-enabled fraud is highlighted as part of the rapidly escalating threat environment. |
| Clairfield International | 2026 | Consulting / Analyst Firm |
| 293 | Cybersecurity Skills Gap Report 2025 | Bottom Line Up Front (BLUF) Fortinet’s 2025 report shows that breaches remain common, costly, and strongly tied to people, skills, and training gaps. For SMBs and insurance teams, the key takeaway is that cyber risk management cannot rely on technology alone: employee awareness, board-level understanding, skilled staff, certifications, and appropriate security tools all affect breach likelihood, recovery, and loss severity. Top 3-5 Most Notable Statistics •86% of surveyed organizations experienced one or more breaches in 2024, and 28% reported five or more. •52% said breaches cost them more than $1 million. •56% attributed breaches to lack of employee security awareness, followed by lack of cybersecurity skills or trained staff at 54%. •78% of attacks involved malware, phishing, and web attacks. •97% are using or plan to use cybersecurity solutions that leverage AI, while 48% cite lack of staff with sufficient AI expertise as the biggest AI implementation challenge. Top 3-5 Exploitable Technology Risks •Malware attacks: the most reported attack type, affecting 40% of respondents, and a direct operational risk for business disruption and recovery costs. •Phishing attacks: reported by 32%, showing continued exploitation of employees through deceptive emails or messages. •Web attacks: reported by 30%, creating risk where internet-facing applications or user browsing activity can be abused. |
| Fortinet | 2025 | Network Security Vendor |
| 294 | Cybersecurity Statistics 2025: Breach Costs, Ransomware & AI Threats | Bottom Line Up Front (BLUF) Cyber risk in 2025 is a direct financial and operational threat for SMBs, not just an IT problem. The report highlights ransomware, phishing, third-party compromise, and rising breach costs as the core issues most likely to drive downtime, recovery expense, insurance claims, and business disruption. Top 3-5 Most Notable Statistics •Cybercrime is projected to cost the world $10.5 trillion annually by 2025. •The global average cost of a data breach in 2025 is $4.44 million, while the U.S. average reached $10.22 million. •Ransomware was involved in 44% of breaches, up from about 32% in 2024. •Phishing accounted for 16% of breaches, making it the leading initial attack vector identified in the report. •Third-party or supply chain compromise reached roughly 30% of breaches, about double the prior year’s level. Top 3-5 Exploitable Technology Risks •Phishing and social engineering: Attackers use deceptive messages, including AI-crafted phishing, to trick employees into giving up access or taking harmful actions. •Third-party and supply chain access: Vendors, SaaS integrations, outsourced support, and cloud platforms can become entry points that expose many connected businesses at once. •Ransomware: Attackers encrypt systems, steal data, and use downtime or data leaks to pressure victims, even when ransom payments are refused. |
| Deepstrike | 2025 | Industrial / Manufacturing Vendor |
| 295 | Cybersecurity Statistics 2026 | Bottom Line Up Front (BLUF) Cyber risk in 2026 is best understood as a high-loss environment driven by phishing, identity abuse, ransomware, cloud misconfiguration, and third-party exposure. For SMBs and insurance teams, the most important takeaway is that even when ransom payments decline, breach response, downtime, legal costs, customer impact, and vendor fallout can still create material losses. Top 3-5 Most Notable Statistics •FBI IC3 recorded 859,532 cybercrime complaints in 2024, with $16.6 billion in reported losses. •Global ransomware attacks reached roughly 7,419 in 2025, up 32% year over year. •IBM’s latest cited breach-cost study placed the global average breach cost at about $4.44 million, while the U.S. average reached about $10.22 million. •Microsoft reported roughly 600 million identity attack attempts per day, with more than 99% of identity attacks described as password-based. •About 63% of ransomware victims refused to pay, while average ransomware recovery costs were around $1.53 million, excluding ransom payments. Top 3-5 Exploitable Technology Risks •Phishing, smishing, voice scams, QR-code phishing, and business email compromise remain major initial access paths because they can steal credentials or trigger fraudulent payments. •Stolen credentials and password-based identity attacks are heavily exploited for account takeover, access, and lateral movement. •Ransomware frequently begins through exploitable vulnerabilities, exposed services, or compromised access, creating downtime and recovery costs. |
| Deepstrike | 2026 | Industrial / Manufacturing Vendor |
| 296 | Cybersecurity Statistics Report 2026 | Bottom Line Up Front (BLUF) Astra’s report highlights that cyber risk is frequent, financially material, and increasingly focused on small and medium-sized businesses. For SMB owners and insurance teams, the clearest takeaway is that common attack paths such as phishing, ransomware, exposed web applications, APIs, cloud misconfigurations, and weak authentication remain practical routes to business interruption, data loss, and costly claims. Top 3-5 Most Notable Statistics •A cyberattack happens every 39 seconds on average. •61% of SMBs were hit by cyberattacks in 2023. •The average corporate data breach cost $4.45 million in 2023. •More than 72% of businesses worldwide were affected by ransomware attacks as of 2023. •92% of malware was delivered via email. Top 3-5 Exploitable Technology Risks •Email-delivered malware and phishing: The report identifies email as the dominant malware delivery channel and phishing as a major cybercrime method, including business email compromise. •Ransomware: Attackers encrypt files and demand payment, with the report noting long detection and containment times. •Web applications and WordPress plugins: Web application attacks contribute to breaches, and the report highlights plugin exploitation as a major source of WordPress security breaches. |
| Astra | 2026 | Application / API Security Vendor |
| 297 | Cybersecurity Statistics Report 2026 | Bottom Line Up Front (BLUF) Cybersecurity losses are rising sharply, and the report’s central message is that slow detection, stolen credentials, ransomware, and exposed connected devices are driving major breach costs. For SMBs and insurance teams, the practical takeaway is clear: basic controls, faster response, protected backups, and better visibility can materially reduce loss severity. Top 3-5 Most Notable Statistics •Global cybercrime costs are projected to reach $10.5 trillion in 2026. •The average global cost of a data breach is $4.88 million. •Organizations take an average of 277 days to identify and contain security incidents. •Stolen credentials account for 31% of breaches, making them the leading listed attack vector. •Ransomware affects 76% of organizations annually, and 96% of attacks target backup repositories. Top 3-5 Exploitable Technology Risks •Stolen credentials: Attackers use compromised usernames and passwords to gain access, contributing to nearly one-third of breaches. •Phishing, including AI-generated content: The report states that approximately 80% of phishing attacks now use AI-generated content, increasing the risk of convincing employee-targeted attacks. •Ransomware targeting backups: Ransomware groups increasingly target backup repositories to prevent recovery and increase pressure to pay. |
| Ordr | 2026 | OT/ICS Security Vendor |
| 298 | CyberSecurityScorecard The Cyber Risk Landscape of the U.S. Healthcare Industry 2024 | Bottom Line Up Front (BLUF) SecurityScorecard finds that U.S. healthcare organizations in its sample generally scored better than expected, but risk is concentrated in specific areas: third-party dependency, application security weaknesses, endpoint issues such as outdated browsers, and ransomware exposure. For SMBs and insurance teams, the key takeaway is that healthcare cyber risk is not limited to hospitals; vendors, suppliers, billing partners, labs, and technology providers can create material loss and disruption. Top 3-5 Most Notable Statistics •500 large, publicly traded U.S. healthcare companies were analyzed. •90% of organizations had “A” or “B” security ratings, while 10% had “C” or lower ratings. •9% of organizations had either a publicly reported breach in the past year or evidence of a compromised machine in the past 30 days. •5% had a publicly reported breach in the past year, and 6% had evidence of a compromised machine in the past 30 days. •Devices & Supplies represented 22% of the overall sample but 34% of the bottom 10% by score and 38% of organizations with reported breaches or compromised machines. Top 3-5 Exploitable Technology Risks •Application Security weaknesses, especially public-facing website issues, were the most common score-lowering area. •Redirect chains containing HTTP were the most common specific issue with negative score impact. •Weak SSL/TLS protocols were a major Network Security issue, especially among lower-scoring organizations. |
| SecurityScorecard | 2024 | Security Research Vendor |
| 299 | Cyberthreat Defense Report 2024 | Bottom Line Up Front (BLUF) CyberEdge’s 2024 report shows improving confidence and fewer reported successful attacks, but the risk level remains high: most organizations still experienced compromise, ransomware, skills shortages, and concern around credential abuse, web attacks, and weak security processes. For SMBs and insurance teams, the practical takeaway is that basic, insurable controls still matter most: faster detection, patching, identity protection, user education, third-party risk management, and ransomware readiness. Top 3-5 Most Notable Statistics •81.5% of organizations were compromised by at least one successful cyberattack in the prior 12 months, down from 84.7% the previous year. •27.8% experienced six or more successful attacks, down sharply from 39.2%. •64.1% of organizations were victimized by ransomware, down from 72.7%. •85.8% reported a shortage of skilled IT security personnel in at least one role. •88.7% expect their IT security budget to increase in 2024, while only 3.0% expect a decrease. Top 3-5 Exploitable Technology Risks •Credential abuse and account takeover: phishing, credential stuffing, and reused stolen passwords remain major paths into networks and applications. •Ransomware: attackers continue to exploit weak monitoring, containment, and recovery capabilities, including unpatched third-party devices and software. •Web and mobile application attacks: account takeover, credential stuffing, and personally identifiable information harvesting are leading concerns. |
| CyberEdge | 2024 | MSP / MSSP / SOC Provider |
| 300 | Cyfirma Tracking Ransomware 2026 | Bottom Line Up Front (BLUF) Ransomware entering 2026 is a persistent business risk, not just a malware event. Cyfirma highlights a shift toward browser-based user manipulation, brokered access, silent data theft, delayed extortion, and pressure on executives and regulatory exposure, which matters to SMBs and insurers because losses may involve downtime, recovery costs, data exposure, reputational harm, and complex claims even when encryption is not the main issue. Top 3-5 Most Notable Statistics •January 2026 recorded 683 ransomware incidents, up from 511 in January 2025 and 284 in January 2024. •December 2025 reached 801 incidents, the highest monthly total in the four-year dataset referenced by the report. •The United States was the top targeted country in January 2026 with 317 victims, followed by the United Kingdom with 42 and Canada with 37. •Professional Goods & Services was the most affected sector with 142 victims, followed by Manufacturing with 109 and Information Technology with 78. •The report cites public reporting that 60% of small businesses shut down within six months after an attack, and 75% of SMEs may face closure if extorted for ransom. Top 3-5 Exploitable Technology Risks •Browser-centric access abuse, where attackers manipulate trusted browser workflows, prompts, extensions, CAPTCHA validation, update flows, and enterprise single sign-on interactions to induce user execution. •Malformed or ambiguous delivery artifacts, including archives, installers, scripts, and container formats designed to fail in scanners and sandboxes but execute on real endpoints. •Long-lived loaders that maintain access, evaluate the environment, evade defenses, and delay ransomware, data theft, or resale until conditions are favorable. |
| Cyfirma | 2026 | Threat Intelligence Vendor |
| 301 | Darktrace Annual Threat Report 2024 | Bottom Line Up Front (BLUF) Darktrace’s 2024 report shows attackers are succeeding by exploiting internet-facing systems, stolen credentials, trusted cloud and email services, and legitimate remote-access tools. For SMBs and insurance teams, the key takeaway is that common business technologies—VPNs, firewalls, SaaS accounts, email platforms, file transfer tools, and remote management software—remain practical entry points for ransomware, data theft, and fraud. Top 3-5 Most Notable Statistics •Darktrace / EMAIL detected 30.4 million phishing emails across monitored customer environments. •96% of phishing emails detected used existing domains rather than newly registered domains. •At least 2.7 million multistage payload emails and over 940,000 malicious QR codes were identified. •In the first half of 2024, 40% of identified campaign activity involved exploitation of internet-facing devices. •Remote Access Trojans represented 46% of campaigns in the second half of 2024, up from 12% in the first half. Top 3-5 Exploitable Technology Risks •Internet-facing edge and perimeter devices, including Palo Alto Networks PAN-OS, Fortinet FortiManager, Ivanti appliances, Cleo file transfer software, ScreenConnect, and TeamCity servers. •Stolen credentials used against VPN, VDI, Remote Desktop Services, SaaS, and cloud accounts. •Adversary-in-the-Middle phishing kits such as Mamba 2FA and Tycoon 2FA, which were used to bypass MFA protections on SaaS accounts. |
| Darktrace | 2024 | Network Security Vendor |
| 302 | Darktrace Annual Threat Report 2026 | Bottom Line Up Front (BLUF) Darktrace’s central finding is that attackers are increasingly succeeding by abusing identity, cloud/SaaS platforms, and email rather than relying only on traditional technical exploits. For SMBs and insurance teams, this means the most important risk is no longer just whether systems are patched, but whether attackers can log in, impersonate trusted users, move through cloud tools, steal data, and trigger extortion or ransomware before defenders respond. Top 3-5 Most Notable Statistics •Darktrace detected over 32,000,000 high-confidence phishing emails across its global fleet in 2025. •Over 8.2 million phishing emails targeted VIP users, representing more than 25% of all phishing emails detected. •In the Americas, SaaS/Microsoft 365 account compromise and phishing or email-based social engineering accounted for nearly 70% of recorded incidents. •In Europe, cloud account and email compromises accounted for 58% of incidents, exceeding network-based compromises at 42%. •In Africa, 76% of compromises among Darktrace customers were network-based, and ransomware grew around 60% year over year. Top 3-5 Exploitable Technology Risks •SaaS and Microsoft 365 account compromise, including malicious inbox rules, session hijacking, OAuth abuse, and thread hijacking. •Phishing and social engineering, including QR code phishing, AI-generated content, brand impersonation, and abuse of trusted platforms. •Exposed VPNs, firewalls, edge systems, and internet-facing services used for initial access and lateral movement. |
| Darktrace | 2026 | Network Security Vendor |
| 303 | Darktrace Insider Threat Report 2020 | Bottom Line Up Front (BLUF) The report’s core message is that insider threats are hard to detect because the activity often comes from trusted users, known devices, contractors, vendors, or valid accounts. For SMBs and insurance teams, the key risk is that normal-looking access can quickly become data theft, file deletion, lateral movement, credential harvesting, or unauthorized use of company infrastructure. Top 3-5 Most Notable Statistics •47% increase in the number of insider threat attacks between 2018 and 2020. •$11.45 million cited as the total cost of insider threat attacks in 2020. •33% of breaches are the result of internal incidents. •72% of organizations reported an increase in insider attacks last year. •Only 13% of organizations stated they can detect insider attacks that start with personal mobile devices. Top 3-5 Exploitable Technology Risks •Privileged and legitimate user accounts: insiders can misuse valid access, and only 61% of organizations have visibility over privileged accounts. •SaaS and cloud access: the report describes large sensitive file downloads and attempted exfiltration from SaaS accounts by a former administrator. •VPN access after termination: a terminated employee retained unsanctioned VPN access, read more than 9,000 files, and deleted at least 160 files. |
| Darktrace | 2020 | Network Security Vendor |
| 304 | Data Breach Investigations Report 2020 | Bottom Line Up Front (BLUF) Verizon’s 2020 DBIR shows that most breaches are financially motivated and commonly involve web applications, stolen credentials, phishing, errors, and malware. For SMBs and insurance teams, the key takeaway is that attackers often use practical, repeatable methods rather than exotic techniques, making basic control failures a major driver of breach and claims risk. Top 3-5 Most Notable Statistics •3,950 confirmed data breaches were analyzed from a record 157,525 incidents. •28% of breaches involved small business victims. •86% of breaches were financially motivated. •45% of breaches featured hacking, and 37% of breaches stole or used credentials. •Web applications were involved in 43% of breaches. Top 3-5 Exploitable Technology Risks •Web application attacks, including use of stolen credentials and vulnerability exploitation, were a major breach path. •Stolen credentials were repeatedly highlighted across breach patterns and cloud-related breaches. •Phishing and other social attacks were common, including business email compromise and pretexting scenarios. |
| Verizon | 2020 | Telco / Network Operator |
| 305 | Data Breach Investigations Report 2021 | Bottom Line Up Front (BLUF) Verizon’s 2021 DBIR shows that SMB-relevant cyber risk is concentrated around a few repeatable attack paths: phishing, stolen credentials, ransomware, basic web application attacks, and human error. For SMB owners and insurance teams, the practical takeaway is that common controls around email security, account access, secure configuration, and response planning remain central to reducing both breach likelihood and loss severity. Top 3-5 Most Notable Statistics •Verizon analyzed 79,635 incidents, including 29,207 that met quality standards and 5,258 confirmed data breaches across 88 countries. •Phishing was present in 36% of breaches, up from 25% the prior year. •Use of stolen credentials remained at approximately 25% of breaches. •Ransomware appeared in 10% of breaches, more than doubling from the prior year. •Reported median losses were $30,000 for Business Email Compromise, $30,000 for Computer Data Breach, and $11,150 for ransomware where losses occurred. Top 3-5 Exploitable Technology Risks •Phishing and cloud-based email compromise: Social Engineering breaches were heavily driven by phishing, with cloud-based mail servers identified as a target of choice. •Stolen credentials and brute force attacks: Attackers used stolen credentials and brute force through web application vectors to compromise web applications and mail servers. •Ransomware deployment paths: Ransomware commonly involved stolen credentials, brute force, direct install, desktop sharing applications, email, network propagation, or download by other malware. |
| Verizon | 2021 | Telco / Network Operator |
| 306 | Data Breach Investigations Report 2022 | Bottom Line Up Front (BLUF) Verizon’s 2022 DBIR shows that SMBs face the same core attack paths as larger organizations: stolen credentials, phishing, exploited vulnerabilities, and botnets. For business owners and insurance teams, the most important takeaway is that ransomware, credential theft, web application attacks, and human error are recurring drivers of both operational disruption and data breach claims. Top 3-5 Most Notable Statistics •Verizon analyzed 23,896 security incidents and 5,212 confirmed data breaches. •Ransomware increased by almost 13%, reaching 25% of breaches. •The human element was involved in 82% of breaches. •External actors caused 80% of breaches. •Error was responsible for 13% of breaches, heavily influenced by misconfigured cloud storage. Top 3-5 Exploitable Technology Risks •Stolen credentials: The report identifies credential use as one of the four key paths into an organization and a top concern across multiple attack patterns and industries. •Phishing: Phishing remains a major entry point, enabling credential theft, malware delivery, business email compromise, and ransomware. •Exploited vulnerabilities: Exploit vulnerability rose to 7% of breaches, with attackers scanning for IPs, open ports, services, known CVEs, and remote code execution opportunities. |
| Verizon | 2022 | Telco / Network Operator |
| 307 | Data Breach Investigations Report 2023 | Bottom Line Up Front (BLUF) The 2023 Verizon DBIR shows that most breaches still come from familiar, preventable paths: people being tricked, credentials being stolen or reused, vulnerabilities being exploited, and ransomware disrupting operations. For SMBs and insurance teams, the key takeaway is that basic cyber hygiene, strong authentication, tested backups, and better controls around email and data handling directly address the most common loss drivers. Top 3-5 Most Notable Statistics •Verizon analyzed 16,312 incidents and 5,199 confirmed data breaches for the 2023 report. •74% of all breaches included the human element, including error, privilege misuse, stolen credentials, or social engineering. •83% of breaches involved external actors, and 95% of breaches were financially motivated. •Business Email Compromise-style pretexting attacks almost doubled across the incident dataset and now represent more than 50% of Social Engineering incidents. •The median amount stolen from Social Engineering attacks increased to $50,000. Top 3-5 Exploitable Technology Risks •Stolen credentials: Attackers commonly use valid usernames and passwords to access web applications, email, remote services, and other business systems. •Phishing and pretexting: Email remains a common way to manipulate employees into taking unsafe actions or exposing credentials. •Exploitation of vulnerabilities: Public-facing applications and remote services are highlighted as common ways attackers gain access. |
| Verizon | 2023 | Telco / Network Operator |
| 308 | Data Breach Investigations Report 2024 | Bottom Line Up Front (BLUF) Verizon’s 2024 DBIR shows that breaches are being driven by a familiar but dangerous mix: ransomware and extortion, exploited vulnerabilities, stolen credentials, phishing, and human error. For SMBs and insurance teams, the key takeaway is that loss prevention must focus on internet-facing systems, vendor/software exposure, and fast-moving human-driven attacks that can create claims within minutes. Top 3-5 Most Notable Statistics •Verizon analyzed 30,458 real-world security incidents, including 10,626 confirmed data breaches across 94 countries. •Exploitation of vulnerabilities as the critical path to initiate a breach increased by 180% from the prior year. •Ransomware or other extortion techniques were involved in 32% of breaches; ransomware alone was present in 23% of breaches. •The human element was involved in 68% of breaches, excluding malicious privilege misuse. •Third-party involvement, including partner infrastructure and software supply chain issues, appeared in 15% of breaches, a 68% increase from the prior year. Top 3-5 Exploitable Technology Risks •Internet-facing web applications: The report identifies web applications as the main vector for vulnerability exploitation used to initiate breaches. •Zero-day and near-zero-day vulnerabilities: MOVEit and similar vulnerabilities were highlighted as major drivers of breach growth, particularly for ransomware and extortion actors. •VPN and remote access software: The report notes current attention on zero-day or near-zero-day vulnerabilities in VPN software and also identifies desktop sharing software as an entry path. |
| Verizon | 2024 | Telco / Network Operator |
| 309 | Data Breach Investigations Report 2025 | Bottom Line Up Front (BLUF) Verizon’s 2025 DBIR shows that SMB cyber risk is increasingly tied to third-party dependence, ransomware-driven system intrusion, and exploited internet-facing vulnerabilities. For SMB owners and insurance teams, the key takeaway is that a company can suffer data loss, downtime, or business interruption not only from its own security gaps, but also from the vendors and platforms it relies on. Top 3-5 Most Notable Statistics •Verizon analyzed 22,052 security incidents and 12,195 confirmed data breaches. •Third-party involvement appeared in 30% of breaches, up from roughly 15% last year. •Exploitation of vulnerabilities was present in 20% of all breaches, a 34% increase from last year. •Use of stolen credentials was at 22%, while phishing was around 15%. •System Intrusion accounted for 9,124 incidents and 7,302 confirmed breaches; ransomware accounted for 75% of breaches in that pattern. Top 3-5 Exploitable Technology Risks •Internet-facing VPN and edge devices: exploitation through VPN and edge devices rose sharply and was linked to the broader growth in vulnerability exploitation. •Unpatched enterprise systems and software vulnerabilities: the report highlights ongoing pressure from critical flaws in products such as VMware ESXi, Cisco Secure Client, Fortinet FortiClient EMS, Progress Kemp LoadMaster, Ivanti VPN products, JetBrains TeamCity, and others. •Stolen credentials and infostealer logs: attacker-accessible logs may contain credentials for VPNs, GitHub repositories, cloud environments, developer tools, and remote access systems. |
| Verizon | 2025 | Telco / Network Operator |
| 310 | Data Security and Compliance Risk 2025 Annual Survey Report: The Visibility Challenge: How AI and Third-Party Blind Spots Multiply Enterprise Risk | Bottom Line Up Front (BLUF) Kiteworks’ 2025 survey shows that poor visibility is the core risk multiplier: organizations that cannot track third parties, AI data use, breach frequency, detection time, or compliance effort experience worse security and cost outcomes. For SMBs and insurance teams, the practical takeaway is clear: unknowns are not neutral—they signal higher breach, litigation, and compliance risk. Top 3-5 Most Notable Statistics •46% of organizations that do not know their third-party count also do not know their breach frequency. •Only 17% of organizations have implemented AI technical governance frameworks. •Organizations with 1,001–5,000 third-party relationships report the highest supply chain cyber risk increase at 46%. •31% of organizations with more than 5,000 third parties take more than 90 days to detect breaches. •46% of surveyed organizations fall into the High to Critical risk range under the report’s scoring model. Top 3-5 Exploitable Technology Risks •Third-party data exchange blind spots: organizations with large or poorly tracked partner ecosystems show higher breach frequency and slower detection. •Ungoverned AI data use: many organizations cannot estimate how much data enters AI systems, and those without measurement are less likely to have technical controls. •Weak or missing privacy-enhancing technologies: organizations that do not know their third-party ecosystem size are more likely to use no PETs. |
| Kiteworks | 2025 | Compliance / GRC Vendor |
| 311 | Data Security and Compliance Risk Forecast Report 2026 | Bottom Line Up Front (BLUF) Kiteworks’ 2026 forecast says AI adoption is moving faster than AI governance, especially around sensitive data, third parties, and autonomous agents. For SMBs and insurance teams, the main concern is not simply whether AI is being used, but whether the business can see, control, stop, and prove what AI systems and vendors are doing with private data. Top 3-5 Most Notable Statistics •100% of surveyed organizations have agentic AI on their roadmap. •63% cannot enforce purpose limitations on AI agents, and 60% cannot quickly terminate a misbehaving agent. •61% have fragmented logs across systems, limiting evidence-quality audit trails. •89% have never practiced incident response with third-party vendors. •84% have not implemented post-quantum cryptography. Top 3-5 Exploitable Technology Risks •AI agents without containment controls: Many organizations lack purpose binding, kill switches, and network isolation, meaning an AI agent may be hard to constrain, terminate, or isolate if it behaves unexpectedly. •Sensitive data in AI prompts: Personal data entered into AI assistants is identified as the top privacy exposure, while technical controls to prevent this are described as rare. •Fragmented data exchange and logging: Separate systems for email, file sharing, managed file transfer, cloud storage, and AI tools can make it difficult to reconstruct incidents or prove compliance. |
| Kiteworks | 2026 | Compliance / GRC Vendor |
| 312 | Data Threat Report 2024 | Bottom Line Up Front (BLUF) Thales’ 2024 Data Threat Report shows that organizations face rising attack volume while still struggling with basic data security controls, identity protection, cloud security, ransomware planning, and data classification. For SMBs and insurance teams, the key takeaway is that preventable control gaps—especially weak identity controls, poor ransomware preparation, unmanaged secrets, and limited visibility into sensitive data—remain central drivers of cyber risk. Top 3-5 Most Notable Statistics •93% of respondents reported an increase in attacks. •49% of organizations reported being breached at some point, while recent breach history decreased to 15% in 2024. •28% experienced a ransomware attack, up from 22% the prior year, but only 21% said they would follow a formal ransomware plan. •Human error was the leading cause of cloud data breaches at 31%, and failure to apply MFA to privileged accounts accounted for another 17%. •Almost 70% of enterprises can classify only 50% or less of their sensitive data. Top 3-5 Exploitable Technology Risks •Weak or incomplete multi-factor authentication, especially for privileged accounts and cloud applications, creates opportunities for account takeover and cloud compromise. •Poor secrets management in DevOps environments exposes bearer tokens, signing keys, and other credentials that attackers can use without impersonating a user. •Ransomware preparedness gaps increase the likelihood of disorganized response, operational disruption, and ransom payment decisions under pressure. |
| Thales | 2024 | Threat Intelligence Vendor |
| 313 | Data Threat Report 2026 | Bottom Line Up Front (BLUF) Thales’ 2026 Data Threat Report shows that AI, cloud services, and security complexity are increasing the risk of sensitive data exposure. For SMBs and insurance teams, the key takeaway is that attackers are focusing on cloud assets, credentials, secrets, and AI-connected data paths while many organizations still lack full visibility into where data resides and how it is protected. Top 3-5 Most Notable Statistics •70% of respondents ranked rapid change in the AI ecosystem among the top three AI security risks. •35% cited cloud-based storage, 34% cited cloud-delivered applications, and 32% cited cloud management infrastructure among the top three cyberattack targets. •Only 34% of organizations reported complete knowledge of where their data is stored. •The average proportion of sensitive cloud data protected by encryption was 47%. •67% of respondents reporting increased cloud management infrastructure attacks said credential theft or compromise, including misappropriated secrets, is increasing. Top 3-5 Exploitable Technology Risks •Cloud storage, SaaS applications, and cloud management infrastructure are leading attack targets because they hold critical applications and data. •Credential theft and misappropriated secrets are increasing against cloud management infrastructure, allowing attackers to bypass or abuse access controls. •Human error and misconfiguration remain major breach causes, especially in complex environments with many tools and cloud services. |
| Thales | 2026 | Threat Intelligence Vendor |
| 314 | Datadog State of Cloud Security 2025 | Bottom Line Up Front (BLUF) Datadog’s 2025 cloud security findings show that many organizations are improving secure defaults, but still leave major cloud attack paths open through stale credentials, public exposure, overprivileged roles, and misconfigured managed services. For SMBs and insurance teams, the most important takeaway is that cloud compromise often comes from preventable configuration and identity weaknesses, not only from sophisticated attacks. Top 3-5 Most Notable Statistics •59% of AWS IAM users have an active access key older than one year, and over half of those users have credentials unused for more than 90 days. •49% of EC2 instances have IMDSv2 enforced, though 82% exclusively used IMDSv2 in the prior two weeks and likely could have enforced it without functional impact. •1% of S3 buckets are effectively public, down from 1.5% in 2024 and 2023; 83% are covered by S3 Block Public Access. •12.2% of third-party AWS integration roles are dangerously overprivileged, allowing broad data access or potential AWS account takeover. •39% of EKS clusters, 34% of AKS clusters, and 54% of GKE clusters expose their managed API server to the internet. Top 3-5 Exploitable Technology Risks •Long-lived cloud credentials in AWS, Google Cloud, and Microsoft Entra ID, especially old or unused keys that can be stolen and reused. •EC2 instances without IMDSv2 enforcement, which can increase the impact of server-side request forgery and credential theft. •Public or insufficiently protected cloud storage, including S3 buckets and Azure Blob Storage containers. |
| Datadog | 2025 | Cloud Security Vendor |
| 315 | Datadog State of DevSecOps 2025 | Bottom Line Up Front (BLUF) Datadog’s 2025 DevSecOps report shows that many real-world application risks are not exotic: known exploitable vulnerabilities, malicious open source packages, long-lived cloud credentials, outdated libraries, oversized container images, and manual cloud changes remain common. For SMBs and insurance teams, the key takeaway is that loss prevention should focus on the internet-facing, production, highly privileged, and known-exploitable issues most likely to lead to compromise. Top 3-5 Most Notable Statistics •15 percent of services are vulnerable to known-exploited vulnerabilities, affecting 30 percent of organizations. •44 percent of Java services contain a known-exploited vulnerability, compared with 5 percent for Go and 2 percent across non-Java services. •88 percent of organizations received untargeted malicious HTTP requests scanning for exposed files or API routes. •The median dependency is 215 days behind its latest major version, and one in two services use libraries that are not actively maintained. •Container images under 100 MB averaged 3 severe vulnerabilities, while images over 500 MB averaged 20. Top 3-5 Exploitable Technology Risks •Known-exploited vulnerabilities in web applications, especially Java services, including high-impact remote code execution paths. •Malicious open source packages in ecosystems such as npm and PyPI, including typosquatting and takeovers of legitimate dependencies. •Long-lived credentials in CI/CD pipelines, particularly AWS IAM user access keys used with GitHub Actions instead of short-lived OIDC credentials. |
| Datadog | 2025 | Cloud Security Vendor |
| 316 | DataGrail Privacy Trends 2024 | Bottom Line Up Front (BLUF) DataGrail’s 2024 report shows that privacy operations are becoming a measurable business risk: consumer privacy requests are rising quickly, manual handling is expensive, and many websites are not honoring automated “Do Not Sell” signals. For SMBs and insurance teams, the key issue is readiness: businesses that collect personal data need practical processes to respond to requests, control costs, and avoid falling behind changing privacy requirements. Top 3-5 Most Notable Statistics •Data Subject Requests increased 246% from 2021 to 2023. •Businesses received an average of 859 DSRs per one million identities in 2023. •Manual processing of access and deletion requests can cost about $811K per year per one million identities. •DSR management costs increased 38% year over year from 2022. •75% of audited websites did not honor Global Privacy Control “Do Not Sell” requests. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs SMBs that collect customer, prospect, or user data should expect more people to ask for access to, deletion of, or limits on the sale or sharing of their personal information. The report shows deletion requests are the most common, representing more than 40% of requests, while access requests increased by around 50% from the prior year. Businesses with direct online customer relationships, ecommerce models, marketing technology, or heavy online communications may see higher request volumes. |
| DataGrail | 2024 | Compliance / GRC Vendor |
| 317 | DDoS Threat Intelligence Report Issue 16 (2H 2025) | Bottom Line Up Front (BLUF) DDoS risk in the second half of 2025 was not just about more attacks; it was about easier access to more powerful attacks. NETSCOUT reports that IoT botnets, DDoS-for-hire services, and AI-assisted attack coordination are lowering the skill required to disrupt websites, applications, networks, and service providers that SMBs depend on. Top 3-5 Most Notable Statistics •NETSCOUT recorded more than 8 million DDoS attacks globally across 203 countries and territories. •Demonstrated attack capacity reached up to 30Tbps and 4Gpps, primarily from IoT botnets such as Aisuru and related TurboMirai variants. •EMEA experienced 3.3 million attacks, followed by APAC with 1.9 million, North America with 1.27 million, and Latin America with 1.01 million. •More than 45,000 DDoS alerts included NTP traffic components, showing continued abuse of time-synchronization services. •More than 50% of attacks were multivector, with 42.06% using 2 to 5 vectors. Top 3-5 Exploitable Technology Risks •Compromised IoT and customer-premises devices, including routers, cameras, and broadband equipment, were used in high-capacity botnets capable of direct-path packet floods. •Long-standing device vulnerabilities and weak access controls remained exploitable, including CVE-2015-2051 in D-Link routers, CVE-2017-17215 in Huawei HG532 routers, and brute-force attacks against Telnet and other remote-access services. •Reflection and amplification vectors remained active, including DNS, NTP, SSDP, SNMP, mDNS, memcached, CLDAP, and NetBIOS. |
| NETSCOUT | 2025 | Threat Intelligence Vendor |
| 318 | Deepstrike Vulnerabilities Statistics Report 2025 | Bottom Line Up Front (BLUF) Deepstrike reports that 2025 is seeing a record surge in disclosed vulnerabilities, with attackers exploiting some flaws within hours or days. For SMBs and insurance teams, the key issue is speed: slow patching, weak asset visibility, and exposed systems can quickly turn known vulnerabilities into ransomware, data theft, downtime, and claim events. Top 3-5 Most Notable Statistics •More than 21,500 CVEs were disclosed in the first half of 2025, an 18% increase over the same period in 2024. •Security teams are facing roughly 133 new vulnerabilities per day. •About 38% of reported 2025 CVEs were rated High or Critical. •Roughly 28% of observed exploits were launched within 1 day of vulnerability disclosure. •By mid-year, 161 distinct vulnerabilities had been observed exploited in the wild, and 69% of exploited vulnerabilities required no authentication. Top 3-5 Exploitable Technology Risks •Internet-facing systems with known vulnerabilities, including VPNs, file transfer servers, firewalls, and other edge devices, because attackers use them for initial access. •Web application flaws such as cross-site scripting, SQL injection, cross-site request forgery, injection flaws, and missing authorization checks. •Operating system vulnerabilities across Linux, Windows, macOS, iOS, and Android, including flaws that may enable remote code execution or privilege escalation. |
| Deepstrike | 2025 | Industrial / Manufacturing Vendor |
| 319 | Department of Defense OSINT Strategy 2024-2028 | Bottom Line Up Front (BLUF) The Department of Defense’s OSINT strategy highlights a rapidly changing open-source information environment where massive data growth, artificial intelligence, commercial data markets, and connected devices are reshaping intelligence collection and validation. For SMBs and insurance teams, the main takeaway is that business decisions based on public or commercial data increasingly require stronger validation, governance, and awareness of false or manipulated information. Top 3-5 Most Notable Statistics •The Internet has grown to well over one billion sites. •4.5 billion users access 200 million active websites every day. •The global digital data environment doubles in size every 2 years. •In 2012, a smartphone could store 64GB of data; the report states it would take 234 of those devices to store the data produced by a single person each day in 2023. •Since 2018, the total value of data bought and sold in the global economy surpassed that of crude oil. Top 3-5 Exploitable Technology Risks •Generative AI can rapidly create false digital media, calling into question the validity of data collected from open sources. •Spam accounts, offensive content, and false information may degrade the reliability and accessibility of social media and web platforms. •Internet of Things devices can track health, fitness, entertainment, temperature control, lighting, and home security information, increasing the volume of sensitive personal data available in the broader information environment. |
| U.S. Department of Defense | 2024 | Threat Intelligence Vendor |
| 320 | Digital Aftershocks: Collateral Damage from DDoS Attacks | Bottom Line Up Front (BLUF) DDoS attacks remain a major availability risk, with NETSCOUT recording more than 8 million attacks in the first half of 2025 and showing that geopolitical events, botnets, and DDoS-for-hire services can rapidly drive large attack waves. For SMBs and insurance teams, the key issue is business interruption: even short attacks can disrupt websites, customer access, service delivery, and dependent networks. Top 3-5 Most Notable Statistics •8,062,971 DDoS attacks were recorded globally in the first half of 2025. •EMEA experienced 3,268,863 attacks, the highest regional volume reported. •Peak attack intensity reached 3.12 Tbps and 1.50 Gpps. •March 2025 saw more than 27,000 botnet-driven DDoS attacks, averaging about 880 confirmed events per day. •The Iran-Israel cyber conflict generated more than 15,000 attacks against Iran compared with 279 against Israel since June 13, 2025. Top 3-5 Exploitable Technology Risks •Known vulnerabilities in IoT devices, web servers, routers, and servers are being exploited to build botnets used in DDoS campaigns. •DDoS-for-hire infrastructure lowers the barrier to entry, allowing new and established threat actors to launch attacks without building their own capability. •Multi-vector attacks combine techniques such as TCP SYN floods, TCP ACK floods, DNS amplification, CLDAP amplification, NTP amplification, and HTTP/2 POST requests to overwhelm defenses. |
| NETSCOUT | 2025 | Threat Intelligence Vendor |
| 321 | Digital Defense Report 2021 | Bottom Line Up Front (BLUF) Microsoft’s 2021 report shows that cybercrime has become a mature, low-cost service economy, making serious attacks easier for less-skilled criminals to launch. For SMBs and insurance teams, the most important takeaway is that ransomware, phishing, exposed remote access, weak identity controls, and supplier/IoT risk can create business interruption, data exposure, recovery costs, and ransom pressure. Top 3-5 Most Notable Statistics •Microsoft’s findings are informed by over 24 trillion security signals per day. •Thousands of Microsoft security experts across 77 countries contribute to the report’s insights. •Compromised credentials are offered in some marketplaces for $1.00 USD to $50.00 USD, depending on perceived target value. •Distributed denial of service attacks are described as cheap for unprotected sites, at about $300 USD/month. •Microsoft surveyed 28 organizations on AI security, and 25 out of 28 said they did not have the right tools to secure their AI systems. Top 3-5 Exploitable Technology Risks •Phishing and credential theft: attackers can buy or harvest credentials and “log in” instead of breaking in, especially where multifactor authentication is not in place. •Exposed access services and tools: RDP, SSH, VPN, VPS, web shells, cPanels, proxies, and similar services are used to enable access, anonymity, and scale. •Ransomware-as-a-service: affiliate models provide ransomware, recovery services, and payment services, lowering the barrier to entry for criminals. |
| Microsoft | 2021 | Cloud Provider / Hyperscaler |
| 322 | Digital Defense Report 2022 | Bottom Line Up Front (BLUF) Microsoft’s 2022 Digital Defense Report shows that cyberattacks are becoming faster, more industrialized, and more dependent on weak identity, poor patching, exposed devices, and phishing. For SMBs and insurance teams, the most important takeaway is that many serious incidents remain preventable when basic security controls are consistently implemented and tested. Top 3-5 Most Notable Statistics •Password attacks rose to an estimated 921 attacks every second, a 74% increase in one year. •93% of Microsoft ransomware recovery investigations found insufficient controls over privileged access and lateral movement. •Microsoft blocked 710 million phishing emails per week. •After a successful phishing email, the median time for an attacker to access private data was 1 hour 12 minutes, and the median time to begin lateral movement was 1 hour 42 minutes. •Attacks against remote management devices exceeded 100 million in May 2022, a five-fold increase over the prior year. Top 3-5 Exploitable Technology Risks •Weak identity controls, including no multifactor authentication and insecure identity provider configuration, give attackers easier access to business systems. •Insufficient privileged access and lateral movement controls allow attackers to move across a network after the first compromise. •Ineffective vulnerability and patch management leaves known weaknesses open for exploitation, especially where manual patching or legacy systems are common. |
| Microsoft | 2022 | Cloud Provider / Hyperscaler |
| 323 | Digital Defense Report 2023 | Bottom Line Up Front (BLUF) Microsoft’s 2023 report shows that most organizations can materially reduce cyber risk by implementing basic security hygiene, yet ransomware, identity attacks, phishing, business email compromise, and abuse of legitimate tools continue to scale. For SMBs and insurance teams, the key takeaway is that smaller organizations are actively affected, and preventable control gaps such as unmanaged devices, weak identity protections, poor patching, and limited detection can drive costly incidents. Top 3-5 Most Notable Statistics •70% of organizations encountering human-operated ransomware had fewer than 500 employees. •80-90% of successful ransomware compromises originated through unmanaged devices. •Human-operated ransomware attacks increased by more than 200% since September 2022. •On average, 60% of human-operated ransomware attacks used remote encryption over the past year. •Microsoft states that implementing a few fundamental security hygiene practices can protect against over 99% of attacks. Top 3-5 Exploitable Technology Risks •Unmanaged or bring-your-own devices, which are a major entry point for ransomware compromise and can allow infected home or personal devices to expose corporate credentials. •Identity attacks, including password spraying, adversary-in-the-middle phishing, MFA fatigue, and token replay, where attackers reuse legitimate authentication tokens. •Abuse of legitimate remote monitoring and management tools, which can provide persistent access, system-level commands, file transfer, and data exfiltration while blending into normal IT activity. |
| Microsoft | 2023 | Cloud Provider / Hyperscaler |
| 324 | Digital Defense Report 2024 | Bottom Line Up Front (BLUF) Microsoft’s 2024 report shows that cyber risk is now constant, broad, and increasingly identity-driven, with attackers using ransomware, phishing, fraud, impersonation, and cloud compromise at large scale. For SMBs and insurance teams, the most important takeaway is that basic control failures—weak identity security, unmanaged devices, exposed systems, and disabled security tools—remain highly exploitable and directly connected to loss events. Top 3-5 Most Notable Statistics •Microsoft customers face more than 600 million cybercriminal and nation-state attacks every day. •Microsoft processes more than 78 trillion security signals per day. •Microsoft tracks more than 1,500 unique threat groups, including more than 600 nation-state groups and 300 cybercrime groups. •In May 2024, Microsoft Defender XDR detected over 176,000 incidents involving tampering with security settings, affecting more than 5,600 organizations. •Microsoft observed remote encryption in 70% of successful ransomware attacks, with 92% originating from unmanaged devices in the network. Top 3-5 Exploitable Technology Risks •Identity attacks and social engineering, including adversary-in-the-middle techniques, SIM swapping, impersonation, and attempts to bypass or circumvent access controls. •Unmanaged devices inside networks, which Microsoft links to remote encryption in successful ransomware attacks. •Security tool tampering, including disabling antivirus or endpoint protections through privileged access, registry changes, malicious tools, PowerShell or batch scripts, and driver tampering. |
| Microsoft | 2024 | Cloud Provider / Hyperscaler |
| 325 | Digital Defense Report 2024 | Bottom Line Up Front (BLUF) Microsoft reports a cyber threat environment that is more dangerous, higher-volume, and harder to defend, with attackers using identity attacks, phishing, ransomware, fraud, and security-tool tampering at massive scale. For SMBs and insurance teams, the key takeaway is that attackers do not need highly customized methods when weak identity controls, unmanaged devices, exposed systems, and trusted cloud services can be exploited efficiently. Top 3-5 Most Notable Statistics •Microsoft customers face more than 600 million cybercriminal and nation-state attacks every day. •Microsoft processes more than 78 trillion security signals per day. •Microsoft observed 600 million identity attacks per day. •In May 2024, Microsoft Defender XDR detected over 176,000 incidents involving tampering with security settings, affecting more than 5,600 organizations. •Microsoft observed remote encryption in 70% of successful ransomware attacks, with 92% originating from unmanaged devices in the network. Top 3-5 Exploitable Technology Risks •Weak or insufficient identity protection, as attackers continue to focus on identity attacks, phishing, social engineering, adversary-in-the-middle techniques, and SIM swapping. •Unmanaged devices inside networks, which were strongly associated with remote encryption in successful ransomware attacks. •Security product tampering, including attempts to disable antivirus or endpoint detection settings using registry changes, malicious tools, scripts, commands, and driver tampering. |
| Microsoft | 2024 | Cloud Provider / Hyperscaler |
| 326 | Digital Defense Report 2025 | Bottom Line Up Front (BLUF) Microsoft’s 2025 report shows that attackers are increasingly “logging in” rather than breaking in, using stolen credentials, social engineering, infostealers, and exposed cloud or remote-access systems to gain access. For SMBs and insurance teams, the most important takeaway is that identity protection, patching, cloud visibility, and incident response speed are now central to reducing ransomware, data theft, and business email compromise losses. Top 3-5 Most Notable Statistics •Microsoft processes more than 100 trillion security signals daily and screens 5 billion emails per day on average for malware and phishing. •Modern multifactor authentication reduces the risk of identity compromise by more than 99%. •More than 97% of identity attacks are password spray or brute force attacks. •ClickFix accounted for 47% of initial access methods observed in Microsoft Defender Experts notifications, followed by phishing at 35%. •Cloud attacks escalated in 2025, including an 87% increase in disruptive campaigns and a 58% increase in attempts to extract sensitive data from storage accounts and databases. Top 3-5 Exploitable Technology Risks •Stolen credentials and valid accounts, including password spray, brute force, token theft, and infostealer-driven access. •Exposed perimeter systems, including web-facing applications, external remote services, and unpatched known vulnerabilities. •Cloud identity abuse, including malicious OAuth apps, legacy authentication, device code phishing, adversary-in-the-middle attacks, and over-permissioned access. |
| Microsoft | 2025 | Cloud Provider / Hyperscaler |
| 327 | Digital Threat Report 2024 | Bottom Line Up Front (BLUF) SISA’s Digital Threat Report 2024 shows that financial-sector cyber risk is being driven by social engineering, credential theft, cloud and API weaknesses, ransomware, and third-party compromise. For SMBs and insurance teams, the key takeaway is that attackers are exploiting common control gaps—weak access controls, poor configuration, insufficient monitoring, and vendor dependencies—to create fraud, downtime, data exposure, and recovery costs. Top 3-5 Most Notable Statistics •The average cost of a data breach reached $4.88 million globally, a 10% increase from 2023. •The average cost of a data breach in India reached $2.18 million. •The Indian financial sector saw a 175% surge in phishing attacks in the first half of 2024 compared with the same period last year. •Digital payments are projected to generate $3.1 trillion by 2028, representing 35% of total banking revenue. •IoT devices worldwide are forecast to reach 32.1 billion by 2030, and nearly 99% of IoT exploitation attempts use previously known vulnerabilities. Top 3-5 Exploitable Technology Risks •Cloud misconfigurations, including publicly accessible storage, default credentials, weak IAM settings, missing MFA, and incomplete logging. •API weaknesses, including hardcoded API keys, credential reuse, predictable patterns, and Broken Object Level Authorization allowing unauthorized access or actions. •Credential theft and session hijacking that can bypass traditional defenses and even neutralize multi-factor authentication. |
| SISA | 2024 | Threat Intelligence Vendor |
| 328 | DigitalAI Application Security Threat Report 2023 | Bottom Line Up Front (BLUF) Digital.ai’s 2023 report shows that applications operating “in the wild” face a high likelihood of attack, even when they are not highly popular or in traditionally high-risk sectors. For SMBs and insurance teams, the key takeaway is that customer-facing apps should be treated as exposed assets requiring built-in protection, monitoring, and response capabilities. Top 3-5 Most Notable Statistics •57% of monitored apps experienced at least one attack. •Gaming apps had a 63% likelihood of being attacked, and financial services apps had a 62% likelihood. •Apps outside gaming and financial services still had a 54% chance of being attacked. •Android apps were more likely than iPhone apps to be placed in unsafe environments: 76% versus 55%. •The probability that at least one instance of a mobile app is placed into a virtualized environment was 29%. Top 3-5 Exploitable Technology Risks •Unsafe mobile environments, including rooted Android phones and jailbroken iPhones, where apps may be easier to manipulate or monitor. •Modified application code, resources, or signatures, which can indicate tampering or unauthorized changes. •Reverse-engineering and dynamic instrumentation tools, including Ghidra and Frida, which the report identifies as increasingly sophisticated and popular. |
| Digital.ai | 2023 | Application / API Security Vendor |
| 329 | DigitalAI Application Security Threat Report 2024 | Bottom Line Up Front (BLUF) Digital.ai reports that attacks against applications running “in the wild” increased in 2024, with customer-facing apps exposed outside the corporate firewall facing meaningful risk from tampering, unsafe device environments, reverse engineering, and instrumentation. For SMBs and insurance teams, the key takeaway is that application risk is not limited to large or highly popular apps; protection should be based on the value of the data and functions the app exposes. Top 3-5 Most Notable Statistics •65% of apps were attacked during a four-week period in 2024, up from 57% in 2023. •Gaming app attack likelihood rose to 76% in 2024, up from 63% in 2023. •Financial services app attack likelihood rose to 67% in 2024, up from 62% in 2023. •Android app attack likelihood rose from 34% in 2023 to 84% in 2024. •Apps outside gaming and financial services still had a 66% chance of being attacked. Top 3-5 Exploitable Technology Risks •Unsafe mobile environments, including rooted or jailbroken devices, emulators, virtualizers, and devices with malicious applications installed. •Application integrity attacks, including modified application code, changed signatures, altered resources, and code lifting. •Reverse engineering and malware creation aided by increasingly accessible tools such as Ghidra and Frida. |
| Digital.ai | 2024 | Application / API Security Vendor |
| 330 | DigitalAI Application Security Threat Report 2025 | Bottom Line Up Front (BLUF) Digital.ai reports that attacks against client-side applications are now widespread, with monitored apps increasingly probed, run in unsafe environments, instrumented, or tampered with. For SMBs and insurance teams, the key takeaway is that any business offering mobile, web, or desktop apps should treat application security as a direct business risk, not just a software development issue. Top 3-5 Most Notable Statistics •82.7% of monitored client-side apps experienced attacks in January 2025, up from 65% in 2024, a 27% increase. •Mobile app attack rates were high on both major platforms: 90.4% for Android and 88.1% for iOS. •Industry attack rates were significant across sectors: Telecom 91%, Financial Services 87.5%, Automotive 86%, and Healthcare 78.5%. •Instrumentation attacks occurred on 81.5% of Android apps and 44% of iOS apps. •1.2% of monitored devices were infected with malware; 6.94% of that malware was classified as high threat, including banking trojans, spyware, trojans, viruses, and worms. Top 3-5 Exploitable Technology Risks •Unsafe environments, including rooted or jailbroken phones, debuggers, and emulators, which can weaken platform protections and expose apps to further probing. •Instrumentation attacks using dynamic code modification or hooking frameworks such as Frida, allowing attackers to observe or manipulate app behavior at runtime. •Integrity attacks, where app code is modified or repackaged, especially on Android where third-party app distribution can make modified apps easier to spread. |
| Digital.ai | 2025 | Application / API Security Vendor |
| 331 | Directors and Officers (D&O) Insurance Insights 2026 | Bottom Line Up Front (BLUF) Allianz’s 2026 D&O outlook warns that cyber incidents, AI-related disclosures, geopolitical volatility, tariffs, and insolvencies are increasing personal liability exposure for directors and officers. For SMBs and insurance teams, the key takeaway is that cyber and operational resilience are now board-level governance issues, not just IT issues, and weak oversight can lead to lawsuits, regulatory action, defense costs, and coverage scrutiny. Top 3-5 Most Notable Statistics •60% of the value of large cyber insurance claims seen by Allianz Commercial in the first half of 2025 came from ransomware attacks. •40% of the value of large cyber insurance claims in the first half of 2025 included data theft, up from 25% in 2024. •Contingent business interruption and IT supply chain events accounted for 15% of large cyber insurance claims by value in the first half of 2025, compared with 6% in 2024. •Global business insolvencies are expected to rise by 6% in 2025 and 5% in 2026, reaching 24% above the pre-pandemic average. •There were 12 AI-related securities class action lawsuits filed in the first half of 2025, bringing the total to 53 since March 2020. Top 3-5 Exploitable Technology Risks •Ransomware attacks that disrupt operations and can trigger cyber, D&O, and business interruption claims. •Data exfiltration during cyberattacks, which increases loss severity and can lead to privacy, regulatory, and shareholder scrutiny. •Weak management of IT suppliers and technology partners, where breaches or failures at vendors can cause contingent business interruption. |
| Allianz | 2026 | Cyber Insurance Carrier |
| 332 | Email Threat Trends Report: An Expert Look at Email-Based Threats | Bottom Line Up Front (BLUF) VIPRE’s Q2 2025 email threat data shows that attackers are increasingly using human-centered, personalized email attacks that bypass traditional signature-based defenses. For SMBs and insurance teams, the main concern is not only malware, but business email compromise, credential theft, invoice-themed phishing, and callback scams that exploit urgency and trust. Top 3-5 Most Notable Statistics •Manufacturing received the most email attacks in Q2 2025 at 26%, followed by Retail at 20% and Healthcare at 19%. •More than half of phishing sites analyzed, 58%, did not use identifiable phishing kits, suggesting more custom or obfuscated deployments. •Callback phishing accounted for 16% of phishing attacks in Q1 2025 and remained the third most prevalent phishing type in Q2. •BEC accounted for 42% of scam emails, and 78% of BEC emails were impersonation attempts. •VIPRE reports spear phishing click-through rates of over 53%, compared with regular phishing at around 18%. Top 3-5 Exploitable Technology Risks •Customized phishing deployments that avoid known phishing kit signatures and are harder to track or block. •Callback phishing that avoids malicious links or attachments by persuading victims to call attackers directly. •BEC impersonation of CEOs and executives, especially using urgent subjects tied to payroll, invoices, account changes, or quick responses. |
| VIPRE | 2025 | Threat Intelligence Vendor |
| 333 | Energy Sector Exposure Assessment 2025 | Bottom Line Up Front (BLUF) SixMap’s assessment of major U.S. energy providers shows that Internet-facing exposure, especially on non-standard ports and IPv6, can leave serious vulnerabilities outside normal security visibility. For SMBs and insurance teams, the key lesson is that attackers do not need a large enterprise environment to exploit the same kinds of exposed services, known CVEs, and unmanaged assets. Top 3-5 Most Notable Statistics •21 leading U.S. energy providers were assessed across IPv4 and IPv6. •39,986 hosts and 58,862 Internet-exposed services were identified. •3,910 exposed services, about 7%, were running on non-standard ports. •5,756 vulnerable services with CVEs were found, including 377 CVEs known to be exploited in the wild. •43 unique CVEs were present in at least 45% of the organizations assessed, suggesting potential systemic risk. Top 3-5 Exploitable Technology Risks •HTTP services: About 76% of detected vulnerabilities were tied to HTTP implementations, making exposed web services a major attack surface. •SSH services: The report highlights SSH as particularly risky because successful exploitation can lead directly to command execution and system compromise. •Non-standard ports: Vulnerable services running outside commonly scanned ports may be invisible to traditional vulnerability management tools. |
| SixMap Research | 2025 | Industrial / Manufacturing Vendor |
| 334 | Enhanced 5G and Zero Trust Cloud and Operational Security Aspects | Bottom Line Up Front (BLUF) ATIS’ central message is that 5G cloud environments require Zero Trust because cloud-native and third-party-operated infrastructure expands the attack surface and reduces traditional visibility. For SMBs and insurance teams, the practical takeaway is to assess reliance on telecom and cloud providers through the lens of identity, monitoring, segmentation, encryption, and incident detection controls. Top 3-5 Most Notable Statistics •ATIS identifies 12 fundamental Zero Trust security control groups for 5G networks. •The report describes four dominant 5G cloud deployment models: multi-vendor stack, telco vendor full stack, hyperscale public cloud offering, and hyperscale private cloud. •NIST defines seven foundational Zero Trust tenets used as a reference point throughout the report. •CISA’s Zero Trust Maturity Model uses four maturity stages to help organizations assess implementation progress. •ATIS notes two developing 5G-focused threat frameworks: MITRE FiGHT and GSMA MOTIF. Top 3-5 Exploitable Technology Risks •Third-party cloud and vendor infrastructure can create paths for internal or external threat actors to gain access to 5G virtual or cloud-native functions. •Cloud models may obscure visibility into lower infrastructure layers, making it harder to monitor for vulnerabilities and attacks. •Single-factor authentication is vulnerable to credential theft, forgery, and reuse, especially where public cloud user accounts are globally accessible. |
| ATIS | 2025 | ISAC / Industry Consortium |
| 335 | ENISA Threat Landscape 2023 | Bottom Line Up Front (BLUF) ENISA’s 2023 threat landscape shows a materially more aggressive cyber environment, with ransomware, DDoS, social engineering, data theft, and supply chain attacks all creating practical loss scenarios for SMBs and insurers. The most important takeaway is that SMBs are not only direct targets; they are also exposed through managed service providers, identity providers, software suppliers, and extortion campaigns that combine downtime with data theft. Top 3-5 Most Notable Statistics •ENISA identified 8 prime threat groups: ransomware, malware, social engineering, threats against data, denial of service, internet threats, information manipulation and interference, and supply chain attacks. •Cl0p reportedly compromised 104 organisations during its GoAnywhere campaign by exploiting a critical zero-day vulnerability in managed file transfer software. •Ransomware accounted for 24% of data breaches according to Verizon and 35% according to Tenable Research. •Since 2004, breached accounts reached 16 billion, including 5.7 billion with a unique email address. •IBM reported the mean time to identify and contain a data breach was 277 days in 2022. Top 3-5 Exploitable Technology Risks •Ransomware and extortion campaigns, including double extortion and extortion-only techniques that rely heavily on data theft. •Zero-day exploitation in managed file transfer products, highlighted by attacks involving GoAnywhere MFT and MOVEit Transfer. •Social engineering, especially phishing, smishing, business email compromise, pretexting, and campaigns designed to capture credentials and MFA codes. |
| ENISA | 2023 | Government / Intelligence Agency |
| 336 | ENISA Threat Landscape 2024 | Bottom Line Up Front (BLUF) ENISA reports a clear escalation in cybersecurity attacks from July 2023 to June 2024, with denial-of-service attacks, ransomware, and threats against data among the most prominent risks. For SMBs and insurance teams, the key takeaway is that attackers continue to exploit exposed systems, weak identity controls, cloud services, and human error to create downtime, data loss, extortion pressure, and costly claims. Top 3-5 Most Notable Statistics •19,754 vulnerabilities were identified; 9.3% were critical and 21.8% were high severity. •Reported data compromises increased by 78% compared with 2022. •The average total cost of a data breach rose to USD 4.45 million in 2023, up 2.3% from 2022 and 15.3% since 2020. •82% of data breaches involved data stored in the cloud, and 39% spanned multiple environments. •The mean time to identify and contain breaches remained high at 277 days. Top 3-5 Exploitable Technology Risks •Internet-facing services such as web management systems, firewalls, VPNs, routers, and edge devices remain frequent targets for vulnerability exploitation. •Misconfigured services, including exposed Redis services and exploitable Remote Desktop Protocol, continue to create significant risk. •Identity and credential attacks remain central, including use of breached credentials, password spraying, brute force, dormant account reactivation, phishing, and cloud-specific credential misuse. |
| ENISA | 2024 | Government / Intelligence Agency |
| 337 | ENISA Threat Landscape 2025 | Bottom Line Up Front (BLUF) ENISA’s 2025 threat landscape shows a more continuous and diversified cyber threat environment, where phishing, vulnerability exploitation, ransomware, and third-party dependencies remain the main practical risks for organisations. For SMBs and insurance teams, the key takeaway is that common weaknesses are still being exploited at scale, while ransomware and data theft continue to drive the most direct business impact. Top 3-5 Most Notable Statistics •ENISA analysed 4,875 selected and curated incidents from July 2024 to June 2025. •Phishing and related social engineering accounted for about 60% of observed initial entry cases, while vulnerability exploitation accounted for 21.3%. •DDoS attacks made up about 76.7% of recorded cases, largely driven by hacktivist activity. •Cybercrime accounted for 13.4% of all incidents, with ransomware representing 81.1% of cybercrime activity targeting EU organisations. •ENISA reported 82 ransomware variants deployed against EU Member State organisations, with Akira the most frequent at 11.6%. Top 3-5 Exploitable Technology Risks •Phishing, including vishing, malspam, malvertising, QR-code phishing, and fake CAPTCHA “ClickFix” scams that trick users into running malicious commands. •Exploitation of public-facing vulnerabilities, which ENISA says is often weaponised within days of disclosure and frequently leads to malware deployment. •Ransomware-as-a-Service, leaked ransomware builders, access brokers, and infostealers that lower attacker skill requirements and support follow-on intrusions. |
| ENISA | 2025 | Government / Intelligence Agency |
| 338 | Estimating Return on Investment for the Orca Cloud Security Platform | Bottom Line Up Front (BLUF) Orca’s report argues that consolidating cloud security tools into a unified platform can reduce operating costs and improve cloud risk visibility, especially for organizations currently using multiple point solutions. For SMBs and insurance teams, the key takeaway is that cloud risk is not just a technical issue; fragmented tools, manual triage, and slow remediation can drive incident response costs, contractor spend, and business disruption. Top 3-5 Most Notable Statistics •TAG reports a representative mid-sized enterprise can achieve an annual cloud-security ROI of 198.33% compared with typical existing approaches. •The modeled pre-Orca annual CISO budget totals $4,230,000, including cloud security tools, staffing, and incident response budget. •The modeled post-Orca annual CISO budget totals $2,440,000. •The report assumes an Orca platform purchase cost of $600,000 in the representative model. •The model assumes roughly one major cloud breach per year at an estimated $1.3 million in costs for items such as legal, response, forensic, and reporting expenses. Top 3-5 Exploitable Technology Risks •Cloud misconfigurations that create policy, compliance, or exposure gaps across multi-cloud environments. •Exposed or overly permissive identities and entitlements that can be combined with reachable assets. •Reachable workloads that attackers can use in multi-step attack paths, including internet-accessible or laterally reachable systems. |
| Orca | 2026 | Cloud Security Vendor |
| 339 | Expanding Attack Surface 2022 | Bottom Line Up Front (BLUF) Trend Micro’s 2022 report shows that organizations are struggling to defend a growing digital attack surface while ransomware, cloud attacks, and exploitable vulnerabilities continue to expand. For SMBs and insurance teams, the most important takeaway is that smaller organizations are explicitly identified as common ransomware targets because they often have fewer resources and staff to manage attacks. Top 3-5 Most Notable Statistics •73% of surveyed IT security decision-makers were concerned about the size of their digital attack surface. •62% of respondents admitted to having blind spots that weaken their security posture. •Trend Micro observed 57 active ransomware-as-a-service and extortion groups and 1,205 ransomware victim organizations in the first half of 2022. •Emotet detections rose from 13,811 in the first half of 2021 to 148,701 in the first half of 2022. •Trend Micro identified over 240,000 exposed Kubernetes cluster nodes via port 10250, with approximately 600 returning “200 – OK” responses. Top 3-5 Exploitable Technology Risks •Ransomware-as-a-service operations such as LockBit, Conti, and BlackCat, which use affiliates, stolen access, phishing, exposed applications, and post-exploitation tools to scale attacks. •Exposed or vulnerable remote access and server infrastructure, including brute-forced VPN servers, compromised IIS servers, Microsoft Exchange Server vulnerability CVE-2021-31207, and vulnerable WSO2 products. •Unpatched high-impact vulnerabilities, including Spring4Shell, Log4Shell, Follina, Dirty Pipe, and older flaws that still generated large volumes of exploit detections. |
| Trend Micro | 2022 | Threat Intelligence Vendor |
| 340 | Fall 2025 Threat Report: Beyond Detection - The $280K Reality of Deepfake Attacks | Bottom Line Up Front (BLUF) Deepfake-related attacks are now a current, costly business risk, not a future concern. Ironscales reports widespread incidents, frequent financial losses, and a gap between confidence and actual preparedness, which matters for SMBs and insurance teams because these attacks can drive six-figure losses through email, voice, image, and video impersonation. Top 3-5 Most Notable Statistics •85% of surveyed IT and cybersecurity professionals said their organizations experienced one or more deepfake-related incidents in the past 12 months. •55% reported financial losses from deepfake or AI-voice fraud in the past 12 months. •Mean losses from deepfake-related incidents were reported at more than $280,000. •61% of organizations that lost money reported losses above $100,000, and 19% reported losses of $500,000 or more. •Only 37% of respondents said their organizations are already investing in deepfake defense, despite 99% saying it will be important to cybersecurity strategy over the next 12-18 months. Top 3-5 Exploitable Technology Risks •Email-based deepfake attacks: reported by 59% of respondents, making email one of the leading channels for deepfake-related incidents. •Static image manipulation: also reported by 59%, including doctored photos, altered documents, and fake profile pictures. •Recorded audio and voice manipulation: rose from 25% to 52%, showing rapid growth in pre-created voice messages, voicemails, or audio files. |
| Ironscales | 2025 | Email Security Vendor |
| 341 | FBI Internet Crime Report 2014 | Bottom Line Up Front (BLUF) The FBI’s 2014 Internet Crime Report shows that Internet-enabled fraud created substantial reported losses, with business e-mail compromise, social media abuse, and virtual currency schemes emerging as notable risks. For SMBs and insurance teams, the most important takeaway is that routine business activities—e-mail, wire transfers, online payments, social media, and vendor relationships—were actively exploited for financial loss. Top 3-5 Most Notable Statistics •IC3 received 269,422 complaints in 2014, with adjusted reported losses of $800,492,073. •123,684 complaints reported a loss; the average loss for complaints reporting loss was $6,472, and the median was $530. •Social media appeared in 12% of 2014 complaints, and complaints involving social media quadrupled over the prior five years. •For June 1 through December 31, 2014, business e-mail compromise accounted for 1,495 victims and $60,294,162 in victim losses. •During the same six-month period, confidence fraud accounted for 5,791 victims and $82,315,378 in losses. Top 3-5 Exploitable Technology Risks •Business e-mail compromise using spoofed or hacked executive, employee, or personal e-mail accounts to redirect invoice or wire payments. •Social media exploitation through compromised accounts, social engineering, click-jacking, doxing, and pharming. •Phishing, spoofing, spam, vishing, smishing, and pharming used to obtain personal, banking, or account information. |
| Federal Bureau of Investigation | 2014 | Threat Intelligence Vendor |
| 342 | FBI Internet Crime Report 2014 | Bottom Line Up Front (BLUF) The most important takeaway is that Internet-enabled fraud is a high-volume, financially damaging problem, with Business Email Compromise standing out as a major loss driver for organizations that send wire payments. For SMBs and insurance teams, the report shows that ordinary business processes—email, invoices, vendor payments, and account recovery—can become the path to large financial losses. Top 3-5 Most Notable Statistics •IC3 received 7,838 Business Email Compromise complaints in 2015, with losses of over $263 million. •Business Email Compromise and Email Account Compromise generated over 8,000 complaints and nearly $275 million in combined reported losses. •Since its inception, IC3 has received 3,463,620 complaints. •Over the last five years, IC3 received an average of nearly 300,000 complaints per year. •IC3 receives, on average, 800 complaints per day. Top 3-5 Exploitable Technology Risks •Compromised legitimate business email accounts used to conduct unauthorized wire transfers. •Spoofed or hacked executive email accounts, including accounts of Chief Executive Officers and Chief Financial Officers, used to request fraudulent payments. •Compromised personal email accounts used to identify vendors from contact lists and send fraudulent payment requests. |
| Federal Bureau of Investigation | 2015 | Threat Intelligence Vendor |
| 343 | FBI Internet Crime Report 2015 | Bottom Line Up Front (BLUF) The FBI’s IC3 data shows Internet-enabled fraud produced substantial reported losses in 2016, with Business Email Compromise, romance/confidence fraud, and non-payment/non-delivery scams leading loss totals. For SMBs and insurance teams, the most important takeaway is that routine business processes—email, wire transfers, remote access, and employee handling of sensitive data—are common paths to costly claims. Top 3-5 Most Notable Statistics •IC3 received 298,728 complaints in 2016, with reported losses over $1.3 billion. •Business Email Compromise/Email Account Compromise caused $360,513,961 in reported losses, the highest loss category. •IC3 received 2,673 ransomware complaints with losses over $2.4 million. •IC3 received 17,146 extortion-related complaints with adjusted losses over $15 million. •Since inception, IC3 has received 3,762,348 complaints; over the last five years, it averaged more than 280,000 complaints per year. Top 3-5 Exploitable Technology Risks •Compromised or spoofed business email accounts used to request unauthorized wire transfers, checks, employee W-2 forms, or other personally identifiable information. •Ransomware delivered through phishing and Remote Desktop Protocol, leading to encrypted files and denial of access to critical data or systems. •Tech support fraud using cold calls, pop-ups, locked screens, search engine manipulation, or typosquatting to persuade victims to grant remote access. |
| Federal Bureau of Investigation | 2016 | Threat Intelligence Vendor |
| 344 | FBI Internet Crime Report 2016 | Bottom Line Up Front (BLUF) The FBI’s IC3 data shows that internet-enabled fraud produced major financial losses in 2017, with Business Email Compromise/Email Account Compromise causing the highest reported losses. For SMBs and insurance teams, the key takeaway is that everyday business processes—email, wire transfers, remote access, and employee handling of sensitive data—are central targets for criminals. Top 3-5 Most Notable Statistics •IC3 received 301,580 complaints in 2017, with reported losses exceeding $1.4 billion. •Business Email Compromise/Email Account Compromise caused $676,151,185 in reported losses, the highest loss category. •Non-Payment/Non-Delivery was the most reported crime type, with 84,079 victims. •IC3 received 1,783 ransomware complaints with adjusted losses of over $2.3 million. •Extortion generated 14,938 complaints and more than $15 million in adjusted losses. Top 3-5 Exploitable Technology Risks •Compromised business email accounts used for unauthorized fund transfers, often through social engineering or computer intrusion. •Ransomware delivered through phishing and Remote Desktop Protocol, making critical data or systems inaccessible. •Phishing, vishing, smishing, and pharming used to obtain personal, financial, and login credentials. |
| Federal Bureau of Investigation | 2017 | Threat Intelligence Vendor |
| 345 | FBI Internet Crime Report 2017 | Bottom Line Up Front (BLUF) The FBI’s IC3 data shows that internet-enabled fraud created substantial financial losses in 2018, with business email compromise as the largest reported loss category. For SMBs and insurance teams, the key takeaway is that many high-impact losses come from manipulated payments, compromised accounts, spoofed communications, and fast-moving fraud schemes where early reporting and bank coordination can affect recovery. Top 3-5 Most Notable Statistics •IC3 received 351,937 complaints in 2018, with reported losses exceeding $2.7 billion. •Business Email Compromise/Email Account Compromise generated 20,373 complaints and over $1.2 billion in adjusted losses. •The IC3 Recovery Asset Team handled 1,061 recovery matters totaling $257,096,992, with a 75% recovery rate. •Extortion-related complaints reached 51,146, with over $83 million in adjusted losses and a 242% increase in complaints from 2017. •Tech support fraud produced 14,408 complaints and nearly $39 million in losses, a 161% increase in losses from 2017. Top 3-5 Exploitable Technology Risks •Business email and email account compromise, where attackers use social engineering or computer intrusion to take over or spoof email accounts and redirect wire transfers. •Payroll diversion, where phishing emails capture employee login credentials, allowing criminals to access payroll accounts and change direct deposit information. •Spoofed emails, phone calls, and text messages, including requests from a supposed authority figure to purchase gift cards or change payment instructions. |
| Federal Bureau of Investigation | 2018 | Threat Intelligence Vendor |
| 346 | FBI Internet Crime Report 2018 | Bottom Line Up Front (BLUF) The FBI’s IC3 data shows that internet-enabled fraud is a major and growing source of financial loss, with Business Email Compromise standing out as the largest reported loss driver. For SMBs and insurance teams, the key takeaway is that email-based payment fraud, ransomware, spoofing, phishing, and tech support scams can create fast-moving losses that require immediate reporting, banking action, and strong verification controls. Top 3-5 Most Notable Statistics •IC3 received 467,361 complaints in 2019, with reported losses exceeding $3.5 billion. •Business Email Compromise/Email Account Compromise generated 23,775 complaints and over $1.7 billion in adjusted losses. •The IC3 Recovery Asset Team handled 1,307 incidents involving $384,237,651 in losses and recovered $304,930,696, a 79% recovery rate. •Phishing/Vishing/Smishing/Pharming was the most reported crime type, with 114,702 victims. •Ransomware accounted for 2,047 complaints and over $8.9 million in adjusted losses, excluding estimates for lost business, time, wages, files, equipment, and third-party remediation. Top 3-5 Exploitable Technology Risks •Compromised business email accounts used to initiate unauthorized fund transfers, often through social engineering or computer intrusion. •Payroll diversion schemes where attackers impersonate employees and request changes to direct deposit information. •Phishing, vishing, smishing, and pharming used to obtain personal, financial, or login credentials. |
| Federal Bureau of Investigation | 2019 | Threat Intelligence Vendor |
| 347 | FBI Internet Crime Report 2019 | Bottom Line Up Front (BLUF) The FBI’s IC3 data shows that internet-enabled fraud created record complaint volume and multibillion-dollar reported losses in 2020, with Business Email Compromise remaining the costliest category. For SMBs and insurance teams, the most important takeaway is that routine business activities—email, wire transfers, remote access, and online communications—are being exploited for direct financial loss, identity theft, and operational disruption. Top 3-5 Most Notable Statistics •IC3 received 791,790 complaints in 2020, a 69% increase from 2019. •Reported victim losses exceeded $4.1 billion in 2020. •Business Email Compromise/Email Account Compromise generated 19,369 complaints and more than $1.8 billion in adjusted losses. •Phishing, vishing, smishing, and pharming produced 241,342 complaints and more than $54 million in adjusted losses. •Ransomware accounted for 2,474 complaints and more than $29.1 million in adjusted losses, not including estimates for lost business, time, wages, files, equipment, or third-party remediation. Top 3-5 Exploitable Technology Risks •Business email compromise through compromised or spoofed email accounts, social engineering, or computer intrusion, enabling unauthorized fund transfers. •Phishing, vishing, smishing, and pharming that seek personal, financial, or login credentials through email, text messages, phone calls, or fraudulent online activity. •Ransomware delivered through malicious email files or links, including more targeted and sophisticated campaigns. |
| Federal Bureau of Investigation | 2020 | Threat Intelligence Vendor |
| 348 | FBI Internet Crime Report 2021 | Bottom Line Up Front (BLUF) The FBI’s 2021 Internet Crime Report shows that cyber-enabled fraud and ransomware created record reported losses, with business email compromise, cryptocurrency-enabled scams, and phishing-related activity standing out as major concerns. For SMBs and insurance teams, the key takeaway is that common business processes—email, wire transfers, remote access, virtual meetings, and cryptocurrency payments—remain frequent paths to high-dollar loss. Top 3-5 Most Notable Statistics •IC3 received 847,376 complaints in 2021, a 7% increase from 2020. •Reported potential losses exceeded $6.9 billion in 2021. •Business Email Compromise/Email Account Compromise generated 19,954 complaints and nearly $2.4 billion in adjusted losses. •Cryptocurrency-related complaints involved 34,202 victims and more than $1.6 billion in reported losses. •Ransomware accounted for 3,729 complaints and more than $49.2 million in adjusted losses, excluding items such as lost business, time, wages, files, equipment, and third-party remediation services. Top 3-5 Exploitable Technology Risks •Compromised business email accounts used to redirect wire transfers through social engineering or computer intrusion. •Virtual meeting platform abuse, including spoofed executive credentials, still images, and “deep fake” audio used to authorize fraudulent transfers. •Ransomware infection through phishing emails, Remote Desktop Protocol exploitation, and software vulnerability exploitation. |
| Federal Bureau of Investigation | 2022 | Threat Intelligence Vendor |
| 349 | FBI Internet Crime Report 2022 | Bottom Line Up Front (BLUF) The FBI’s 2022 Internet Crime Report shows that reported complaint volume decreased slightly, but reported losses rose sharply to more than $10 billion. For SMBs and insurance teams, the key takeaway is that fraud-driven cyber events, especially investment fraud, business email compromise, tech support scams, and ransomware, remain financially severe and require fast reporting, payment verification, and basic cyber hygiene. Top 3-5 Most Notable Statistics •IC3 received 800,944 complaints in 2022, a 5% decrease from 2021, while reported losses increased from $6.9 billion to more than $10.2 billion. •Over the last five years, IC3 received 3.26 million complaints with $27.6 billion in reported losses. •Investment fraud was the costliest reported scheme in 2022, rising to $3.31 billion in losses, including $2.57 billion tied to cryptocurrency investment fraud. •Business Email Compromise generated 21,832 complaints and more than $2.7 billion in adjusted losses. •IC3’s Recovery Asset Team handled 2,838 incidents involving $590.62 million in losses and froze $433.30 million, a 73% success rate. Top 3-5 Exploitable Technology Risks •Phishing emails, which remained a top initial infection vector for ransomware and were the most reported crime type with 300,497 victims. •Compromised business email accounts, social engineering, and computer intrusion used to redirect wire transfers and other payments. •Remote Desktop Protocol exploitation, identified as a top initial ransomware infection vector. |
| Federal Bureau of Investigation | 2023 | Threat Intelligence Vendor |
| 350 | FBI Internet Crime Report 2023 | Bottom Line Up Front (BLUF) The FBI’s 2023 IC3 data shows cyber-enabled fraud and extortion at record levels, with reported losses exceeding $12.5 billion. For SMBs and insurance teams, the most important takeaway is that routine business processes—email, wire transfers, customer support interactions, cryptocurrency payments, and data access—remain major loss pathways. Top 3-5 Most Notable Statistics •IC3 received 880,418 complaints in 2023, with losses exceeding $12.5 billion. •Reported losses increased 22% compared with 2022, while complaint volume increased nearly 10%. •Investment fraud was the costliest category, with $4.57 billion in losses, up 38% from 2022. •Business Email Compromise generated 21,489 complaints and more than $2.9 billion in adjusted losses. •IC3’s Recovery Asset Team initiated action on 3,008 incidents and froze $538.39 million, a 71% success rate. Top 3-5 Exploitable Technology Risks •Business Email Compromise: attackers compromise or spoof legitimate business communications to redirect wire transfers, vendor payments, real estate funds, or purchase activity. •Phishing and spoofing: the most reported crime type, with 298,878 complaints, using unsolicited emails, texts, calls, and fake identities to obtain money or information. •Ransomware: malware encrypts data and often includes data theft, causing service disruption, financial loss, and possible permanent data loss. |
| Federal Bureau of Investigation | 2024 | Threat Intelligence Vendor |
| 351 | FBI Internet Crime Report 2024 | Bottom Line Up Front (BLUF) The FBI’s 2024 IC3 data shows record reported cybercrime losses, with fraud driving most financial harm and ransomware remaining a major operational threat. For SMBs and insurance teams, the key takeaway is that payment fraud, credential theft, data exposure, cryptocurrency-related scams, and ransomware should be treated as core business loss scenarios, not rare events. Top 3-5 Most Notable Statistics •IC3 received 859,532 complaints in 2024, with reported losses of $16.6 billion, a 33% increase from 2023. •Cyber-enabled fraud accounted for 333,981 complaints and $13.7 billion in losses, representing 83% of 2024 reported losses. •Business Email Compromise generated 21,442 complaints and $2.77 billion in losses. •Cryptocurrency was associated with 149,686 complaints and $9.32 billion in losses. •IC3 received more than 4,800 complaints from critical infrastructure organizations affected by cyber threats; ransomware and data breaches were the most reported cyber threats among them. Top 3-5 Exploitable Technology Risks •Phishing and spoofing: unsolicited emails, texts, and calls impersonating legitimate organizations to obtain personal, financial, or login credentials. •Business Email Compromise: compromised email accounts, phone numbers, or virtual meeting applications used with social engineering or intrusion techniques to cause unauthorized fund transfers. •Ransomware: malicious software designed to block access to computer systems until money is paid; the FBI identified Akira, LockBit, RansomHub, FOG, and PLAY as the most reported ransomware variants. |
| Federal Bureau of Investigation | 2025 | Threat Intelligence Vendor |
| 352 | FBI Internet Crime Report 2025 | Bottom Line Up Front (BLUF) Cyber-enabled fraud and cybercrime losses reported to IC3 reached a record level in 2025, with fraud driving the overwhelming majority of financial impact. For SMBs and insurance teams, the most important takeaway is that common business exposures—phishing, business email compromise, tech support scams, account takeover, and ransomware—remain costly, reportable, and in some cases recoverable if acted on quickly. Top 3-5 Most Notable Statistics •IC3 received 1,008,597 complaints in 2025, with $20.877 billion in reported losses. •Reported losses increased 26% from 2024, with an average reported loss of $20,699. •Cyber-enabled fraud accounted for 452,868 complaints and $17.697 billion in losses, representing 85% of all reported 2025 losses. •Investment fraud caused $8.648 billion in losses, followed by business email compromise at $3.047 billion and tech/customer support scams at $2.135 billion. •Cryptocurrency-related complaints were associated with $11.367 billion in losses, including $7.278 billion tied to cryptocurrency investment fraud. Top 3-5 Exploitable Technology Risks •Phishing and spoofing remained the largest complaint category, with 191,561 complaints, showing continued abuse of email, text, calls, and fake identities to steal credentials or money. •Business email compromise caused $3.047 billion in losses and is especially relevant to companies that rely on email-based payment approvals or wire/ACH instructions. •Ransomware remains a material operational threat, especially where organizations lack offline backups, multi-factor authentication, network segmentation, timely patching, or visibility into lateral movement. |
| Federal Bureau of Investigation | 2026 | Threat Intelligence Vendor |
| 353 | FireEye Cyber Trendscape Report 2020 | Bottom Line Up Front (BLUF) FireEye’s 2020 Cyber Trendscape report shows that executives broadly expected cyber risk to stay high or worsen, while many organizations lacked tested response plans, mature programs, or strong readiness. For SMBs and insurance teams, the key takeaway is that losses are not only driven by attack frequency, but by gaps in preparation, employee training, vulnerability management, and clarity around cyber insurance coverage. Top 3-5 Most Notable Statistics •Over 90% of organizations believed cyber threats would stay the same or worsen in 2020. •93% of organizations reported some form of successful cyber attack in the prior 12 months. •51% of organizations did not believe they were ready or would respond well to a cyber attack or breach event. •29% of organizations with cyber attack and breach response plans had not tested or updated them in 12 or more months. •50% of organizations had cyber insurance, while 41% planned to add it within 18 months. Top 3-5 Exploitable Technology Risks •Servers and server operating systems, web servers, medical devices, and endpoints were identified as the components most likely to be targeted and most likely to be vulnerable. •Malware, targeted phishing, and exploited vulnerabilities were viewed as the attack types most likely to cause a breach. •Endpoint exposure remains important: organizations identified endpoint security capabilities such as application privilege control, anti-malware or antivirus prevention, encryption, endpoint firewall, and vulnerability management and remediation. |
| FireEye | 2020 | Threat Intelligence Vendor |
| 354 | Flashpoint Cyber Threat Intelligence Index: 2024 Midyear Edition | Bottom Line Up Front (BLUF) Flashpoint’s midyear 2024 data shows that SMBs face pressure from multiple directions: rising vulnerabilities, widespread credential theft, aggressive ransomware activity, and insider-related threat activity. The most important takeaway for SMBs and insurance teams is that stolen credentials, exploitable vulnerabilities, and ransomware targeting remain closely connected and should be treated as core loss drivers. Top 3-5 Most Notable Statistics •Flashpoint aggregated and enriched 17,518 newly disclosed vulnerabilities in the first half of 2024, including 936 missed by CVE and NVD. •More than 45% of vulnerabilities disclosed in H1 2024 were rated high to critical in CVSSv3. •Information-stealing malware infected more than 13 million devices and compromised over 53 million credentials. •LockBit claimed 428 victims in the first half of 2024, making it the most prolific ransomware group identified in the report. •Flashpoint observed 8,497 unique instances of insider recruiting, advertising, or discussion involving insider-related threat activity. Top 3-5 Exploitable Technology Risks •Remotely exploitable vulnerabilities with public exploits and available solutions, which Flashpoint highlights as a practical prioritization point for vulnerability management teams. •Publicly known exploits, whose availability increased by 6%, raising the risk that attackers can turn disclosed weaknesses into real-world compromises. •Information-stealing malware such as Redline, Risepro, Stealc, Meta stealer, and Lumma stealer, which can compromise devices and harvest credentials. |
| Flashpoint | 2024 | Threat Intelligence Vendor |
| 355 | FluidAttacks State of Attacks 2025 | Bottom Line Up Front (BLUF) Fluid Attacks’ 2025 report shows that vulnerability count alone is a poor measure of security risk: high- and critical-severity issues made up a small share of findings but drove nearly all measured risk exposure. For SMBs and insurance teams, the key takeaway is to focus on exploitable, high-impact weaknesses and how quickly they are remediated, not just how many findings appear in a scan. Top 3-5 Most Notable Statistics •872,612 vulnerabilities were reported across assessed systems in 2024. •91.6% of total risk exposure came from high- and critical-severity vulnerabilities. •Total identified risk exposure decreased by 3.8% from 2023, even though reported vulnerabilities increased by 59.3%. •Organizations reduced mean time to remediate vulnerabilities by 18.5%, and mean time to remediate critical issues by 65%. •Systems that broke the build had a 62.4% remediation rate, compared with 31.5% for systems that did not. Top 3-5 Exploitable Technology Risks •Improper authorization control for web services, which the report says could allow attackers to obtain confidential information and accounted for over 27% of total risk exposure. •Authentication mechanism absence or evasion, a leading source of risk exposure in both source code and running applications. •Insecure deserialization, which appeared among the highest-risk source-code weaknesses. |
| Fluid Attacks | 2025 | Application / API Security Vendor |
| 356 | Forecast for Managing Private Content Exposure Risk 2025 | Bottom Line Up Front (BLUF) Kiteworks’ 2025 forecast warns that sensitive content exposure risk is rising because businesses are sharing more data across vendors, cloud tools, APIs, AI systems, and fragmented communication channels while privacy rules become stricter. For SMBs and insurance teams, the key takeaway is that data governance, third-party oversight, secure collaboration, and compliance evidence are becoming central to reducing breach likelihood and regulatory fallout. Top 3-5 Most Notable Statistics •75% of the world’s population is projected to have personal data protected under modern privacy laws in 2025. •GDPR fines in 2024 were approaching $5.3 billion as of November 2024. •Software supply chain attacks are predicted to cost $60 billion globally in 2025 and grow to $138 billion by 2031. •Software supply chain issues accounted for 15% of data breaches over the prior year, a 68% year-over-year increase. •Only 10% of organizations have tagged and classified all unstructured data, while 52% have classified less than half. Top 3-5 Exploitable Technology Risks •Software supply chain and third-party vendor compromise, where one weak supplier can expose data across many connected organizations. •AI-enabled attacks, including automated vulnerability scanning, phishing content generation, evolving malware, model hijacking, and training data corruption. •Fragmented sensitive-content communication tools, including email, file sharing, SFTP, managed file transfer, and web forms, which can create inconsistent controls and audit gaps. |
| Kiteworks | 2025 | Compliance / GRC Vendor |
| 357 | Fraud and Abuse Report 2025 | Bottom Line Up Front (BLUF) AI-enabled bots are rapidly increasing fraud and abuse risk by automating scraping, impersonation, phishing, credential attacks, and payment-related fraud at scale. For SMBs and insurance teams, the key issue is not simply “bot traffic,” but whether a business can distinguish useful automation from activity that increases costs, degrades websites, pollutes metrics, or enables fraud. Top 3-5 Most Notable Statistics •AI bot traffic rose by 300% in the past year. •AI bot activity now accounts for 0.27% of all traffic and 0.9% of known bot traffic across the Akamai platform. •Commerce had the most AI bot activity of any industry, reaching more than 25 billion bot requests during a two-month observation period. •The publishing segment accounted for 63% of AI bot triggers in the other digital media landscape. •More than 90% of AI bot triggers in healthcare were attributed to scraping activities. Top 3-5 Exploitable Technology Risks •AI-powered bots and scrapers that imitate legitimate traffic, collect large volumes of website data, and evade detection. •Credential stuffing and carding bots that automate login attempts with stolen credentials or test payment card numbers. •Magecart-style digital skimming, where malicious JavaScript is injected into ecommerce checkout pages to steal payment card data. |
| Akamai | 2025 | Network Security Vendor |
| 358 | Frost Radar: Email Security, 2024 | Bottom Line Up Front (BLUF) Email remains a prime attack vector, and Frost & Sullivan highlights that phishing, AI-enabled attacks, remote work, personal device use, and cloud migration are increasing pressure on organizations. For SMBs and insurance teams, the key takeaway is that email security is no longer just a technical control; it is a core loss-prevention measure tied to breach risk, data loss, and the human attack surface. Top 3-5 Most Notable Statistics •The global email security market was worth approximately $5,451.9 million in 2023. •The market achieved 22.9% year-over-year growth as of 2023. •Frost & Sullivan expects the market to reach $9,577.8 million by 2027. •The projected compound annual growth rate from 2023 to 2027 is 15.1%. •In 2023, the top five vendors held a combined market share of 65.0%, while Proofpoint held 24% market share. Top 3-5 Exploitable Technology Risks •Phishing emails, including targeted phishing, remain a major exploitable route because attackers rely on users clicking malicious links. •AI-enabled phishing and account compromise are increasing attacker speed and sophistication. •Remote work has introduced new vulnerabilities as users operate outside traditional network security environments. |
| Frost & Sullivan | 2024 | Consulting / Analyst Firm |
| 359 | Frost Radar: Zero Trust Browser Security, 2025 | Bottom Line Up Front (BLUF) The report’s core message is that the browser is becoming the main workplace access point and therefore a major security control point. For SMBs and insurance teams, this matters because web, SaaS, GenAI, and unmanaged-device activity increasingly happen in the browser, while adoption of zero trust browser security remains constrained by cost, awareness, and user resistance. Top 3-5 Most Notable Statistics •The zero trust browser security market generated $622.0 million in aggregated revenue in 2025. •Frost & Sullivan anticipates an 18.9% compound annual growth rate from 2025 to 2030. •North America accounted for 73.2% of ZTBS revenue in 2025. •Island led the market with 25.7% share, followed by Menlo Security with 18.7%. •Seraphic Security held an estimated 2.5% market share and has raised $37 million in funding. Top 3-5 Exploitable Technology Risks •Browser-based work: The report describes the browser as the new enterprise endpoint, making browsing sessions, SaaS access, and web activity central areas for threat risk. •GenAI and agentic AI browsers: The report highlights risks around AI usage visibility, prompt filtering, AI response inspection, model compliance, and data loss prevention in AI-driven workflows. •BYOD and unmanaged devices: As managed and unmanaged devices proliferate, organizations need identity-aware policy enforcement and browser-native protection that works without heavy endpoint infrastructure. |
| Seraphic | 2025 | Industrial / Manufacturing Vendor |
| 360 | Gallagher Cyber Insurance Market Outlook 2026 | Bottom Line Up Front (BLUF) Gallagher expects cyber insurance to remain mostly buyer-friendly into 2026, but with sharper underwriting attention on systemic risks, healthcare, supply chain exposure, AI, ransomware, and privacy-related claims. SMBs and insurance teams should use the current competitive market to improve coverage terms while tightening controls that underwriters are increasingly focused on. Top 3-5 Most Notable Statistics •The global cyber insurance market is forecast at $16 billion to $20 billion in 2025 and could grow to $30 billion to $50 billion by 2030. •North America is expected to continue dominating the cyber insurance market with 60%-70% market share. •The average cost of a data breach in the US was $10 million in 2025. •Only 28% to 32% of ransomware victims paid ransoms in 2025, down from 37% in 2024. •Phishing/spoofing led FBI IC3 complaints with 193,407 complaints in 2024, while total wire fraud losses exceeded $109 million. Top 3-5 Exploitable Technology Risks •Supply chain attacks against SaaS providers, cloud providers, managed service providers, and code repositories, especially through compromised software updates, API integrations, and authentication tokens. •Ransomware and data theft extortion, with threat actors shifting from encrypting data to exfiltrating it. •Website pixel tracking and other data collection technologies that can trigger non-breach privacy litigation. |
| Gallagher | 2026 | Cyber Insurance Carrier |
| 361 | Gen Threat Report Q2/2025 | Bottom Line Up Front (BLUF) Gen Digital’s Q2/2025 report shows cybercrime becoming faster, more convincing, and more consumer-focused, with fake pharmacies, Facebook scams, malicious push notifications, and AI-assisted ransomware all rising. For SMBs and insurance teams, the key takeaway is that everyday users, employees, and customers are increasingly being targeted through trusted-looking websites, social platforms, and payment flows that can lead to fraud, identity theft, ransomware losses, and recovery costs. Top 3-5 Most Notable Statistics •5,000+ fake online pharmacy sites were linked to the MediPhantom cybercrime network. •1 million fake pharmacy attacks were blocked. •Facebook saw a +340% spike in financial fraud, while tech support scams made up 14% of Facebook threats. •317% rise in malicious push notifications was reported. •100+ ransomware victims were hit by AI-assisted malware in just 3 months. Top 3-5 Exploitable Technology Risks •Fake online pharmacies using slick websites, unsecured checkouts, crypto-only payments, and prescription drugs offered without proof of prescription. •Malicious code placed in real medical websites, increasing the risk that users trust a site that has been compromised. •AI-generated fake health blogs and reviews, combined with search engine manipulation, to make fraudulent pharmacies appear legitimate. |
| Gen Digital | 2025 | Endpoint / MDR / XDR Vendor |
| 362 | Genetec State of Physical Security 2026 | Bottom Line Up Front (BLUF) Physical security is becoming a connected, IT-dependent business function, not just cameras, doors, and guards. For SMBs and insurance teams, the key issue is that modernization improves visibility and efficiency, but it also expands cyber exposure through cloud systems, IoT and edge devices, credentials, and integrated platforms. Top 3-5 Most Notable Statistics •7,368 fully completed surveys were analyzed across six regions. •More than 70% of respondents run unified or integrated video surveillance and access control systems. •60% of respondents cited integrating legacy systems with new technology as a primary reason for replacement. •Reported 2025 cybersecurity incident increases included phishing/smishing at 50%, malware at 41%, device hacking for network access at 40%, and compromised credentials at 36%. •End users’ 2026 project priorities include access control at 58%, cybersecurity tools at 44%, video surveillance at 43%, AI and/or LLM at 36%, and data analysis/visualization at 33%. Top 3-5 Exploitable Technology Risks •Connected IoT and edge devices in physical security systems can be targeted for network access, especially as physical and digital systems converge. •Phishing, smishing, and social engineering remain major routes to compromise because they target employees and credentials. •Malware, ransomware, DDoS, and man-in-the-middle attacks are identified incident types affecting connected security environments. |
| Genetec | 2026 | OT/ICS Security Vendor |
| 363 | GitGuardian State of Secrets Sprawl 2021 | Bottom Line Up Front (BLUF) GitGuardian’s report shows that leaked software secrets on public GitHub are a widespread and growing risk, including for companies that do not intentionally publish code publicly. For SMBs and insurance teams, the core issue is that developers’ personal repositories can expose corporate credentials, creating direct paths to data loss, infrastructure access, and business disruption. Top 3-5 Most Notable Statistics •2 million secrets were detected on public GitHub in 2020. •52,000 secrets were detected per day. •85% of leaks occurred in developers’ personal repositories, while 15% occurred in public repositories owned by organizations. •GitGuardian scanned 2.5 million public commits per day and almost 1 billion public commits per year. •The top 10 file extensions accounted for 81% of detected secrets, with the top 3 accounting for over 56%. Top 3-5 Exploitable Technology Risks •Hardcoded secrets in source code, including API keys, usernames and passwords, database connection strings, private keys, and certificates. •Public GitHub repositories, especially developers’ personal repositories that may contain corporate secrets. •Git history exposure, where deleted secrets remain accessible in prior commits even after being removed from the current code. |
| GitGuardian | 2021 | Application / API Security Vendor |
| 364 | GitGuardian State of Secrets Sprawl 2022 | Bottom Line Up Front (BLUF) GitGuardian’s report shows that leaked software secrets—API keys, passwords, certificates, and similar credentials—are widespread in both public and private code repositories, and the problem is growing quickly. For SMBs and insurance teams, the key takeaway is that source code and development workflows can expose direct access paths into systems, cloud services, data, and third-party platforms, even when repositories are private. Top 3-5 Most Notable Statistics •GitGuardian detected over 6 million secrets on public GitHub in 2021. •Public GitHub secrets increased by 125% year over year compared with the revised 2020 estimate. •On average, 3 commits out of 1,000 exposed at least one secret, a 50% increase compared to 2020. •A typical company with 400 developers and 4 AppSec engineers would discover 1,050 unique leaked secrets when scanning repositories and commits. •Private repositories were 3.8 times more likely than public repositories to expose at least one secret. Top 3-5 Exploitable Technology Risks •Hardcoded secrets in source code, including API keys, usernames and passwords, and security certificates, can grant access to services, systems, and data. •Git history creates persistent exposure because a secret that enters version control should be considered compromised and may require remediation even after the original code changes. •Private repositories can create a false sense of secrecy; the report found they are more likely than public repositories to contain secret incidents. |
| GitGuardian | 2022 | Application / API Security Vendor |
| 365 | GitGuardian State of Secrets Sprawl 2023 | Bottom Line Up Front (BLUF) GitGuardian’s 2023 report shows that hard-coded secrets—API keys, passwords, tokens, and certificates left in code—are spreading quickly and create direct paths into systems, data, and software supply chains. For SMBs and insurance teams, the core issue is simple: exposed credentials should be treated as compromised because attackers actively monitor public code and can reuse or resell secrets. Top 3-5 Most Notable Statistics •10 million new secrets were detected in public GitHub commits in 2022. •Hard-coded secrets increased by 67% compared with 2021, while scanned commits increased by 20%. •1 in 10 authors exposed a secret in 2022. •3.7% of active repositories in 2022 leaked a secret, representing 2.27 million repositories. •21.52% of Terraform repositories in GitGuardian’s dataset had one or more security policy vulnerabilities. Top 3-5 Exploitable Technology Risks •Hard-coded credentials in source code, including API keys, passwords, private keys, database credentials, and cloud provider keys, can grant privileged access to systems and data. •Public GitHub exposure creates immediate risk because malicious bots also monitor GitHub for sensitive information. •Infrastructure-as-code files, including Terraform, can expose both secrets and misconfigurations that weaken deployed infrastructure. |
| GitGuardian | 2023 | Application / API Security Vendor |
| 366 | GitGuardian State of Secrets Sprawl 2024 | Bottom Line Up Front (BLUF) Hard-coded secrets—API keys, passwords, private keys, and other credentials left in code—remain a major and growing exposure for organizations of all sizes. For SMBs and insurance teams, the key concern is not just that secrets leak, but that most remain active long enough for attackers to use them to access systems, data, cloud services, and software supply chains. Top 3-5 Most Notable Statistics •GitGuardian detected 12.8 million publicly exposed secret occurrences on GitHub in 2023, a 28% increase from 2022. •4.6% of active GitHub repositories leaked a secret in 2023. •11.7% of distinct commit authors leaked a secret. •91.6% of valid leaked secrets remained valid five days after notification. •OpenAI API key leaks increased by 1212x year over year, with an average of 46,441 OpenAI API key occurrences leaked per month in 2023. Top 3-5 Exploitable Technology Risks •Hard-coded credentials in source code: exposed API keys, passwords, and private keys can give attackers direct access to services, systems, and data. •Cloud and platform credentials: the report highlights large volumes of valid Google API secrets, Google Cloud secrets, and AWS IAM keys, which can enable access to cloud resources. •Generative AI service keys: OpenAI and other AI service tokens are increasingly leaked, creating risk of misuse of paid or sensitive AI services. |
| GitGuardian | 2024 | Application / API Security Vendor |
| 367 | Global Automotive Cybersecurity Report 2024 | Bottom Line Up Front (BLUF) Automotive and smart mobility cyber risk has shifted from isolated experimentation to large-scale incidents with operational, financial, privacy, and safety consequences. SMBs connected to this ecosystem—such as fleets, logistics firms, dealerships, suppliers, mobility service providers, and EV charging operators—should treat automotive cyber risk as a business continuity and insurance exposure, not only an IT issue. Top 3-5 Most Notable Statistics •295 automotive and smart mobility cybersecurity incidents were analyzed in 2023, averaging 25 incidents per month. •95% of attacks in 2023 were remote. •64% of attacks were executed by black hat actors. •Incidents disclosed in clear web media increased by more than 50% between 2019 and 2023. •Service and business disruption accounted for 42% of incidents, while fraud-related incidents rose to 20% in 2023 from 4% in 2022. Top 3-5 Exploitable Technology Risks •APIs: The report highlights API exploitation as a major risk, including data exfiltration, remote command invocation, and GenAI-assisted discovery of exposed or leaked API documentation. •Fleet management and telematics systems: Vulnerabilities can allow manipulation of telemetry data, disruption of electronic logging, inventory tracking failures, or potential fleet-wide impact. •EV charging infrastructure: Chargers and charging management systems are vulnerable to physical and remote manipulation, API flaws, provisioning bypass, OCPP connection hijacking, fraud, and service disruption. |
| Upstream | 2024 | Threat Intelligence Vendor |
| 368 | Global Crypto Policy Review & Outlook 2025/2026 | Bottom Line Up Front (BLUF) TRM Labs’ central takeaway is that crypto regulation became clearer and more active in 2025, especially around stablecoins, which is accelerating institutional adoption. For SMBs and insurance teams, the practical issue is not whether crypto is growing, but whether crypto exposure is handled through regulated providers with strong controls, because illicit actors continue to exploit lightly supervised infrastructure. Top 3-5 Most Notable Statistics •TRM Labs reviewed crypto policy developments in 30 jurisdictions representing over 70% of global crypto exposure. •Over 70% of reviewed jurisdictions advanced stablecoin regulatory frameworks in 2025. •Financial institutions in about 80% of reviewed jurisdictions announced new digital asset initiatives. •The Bybit hack attributed to North Korea resulted in losses of over USD 1.5 billion in Ethereum tokens. •Beacon Network received support from VASPs representing over 75% of total crypto volume and more than 60 law enforcement agencies across 15 countries. Top 3-5 Exploitable Technology Risks •Unlicensed over-the-counter brokers, which were used to launder proceeds from the Bybit hack and may sit outside stronger regulatory oversight. •Cross-chain bridges, which can help attackers move assets across blockchains and obscure the trail of funds. •Decentralized exchanges, which may operate outside existing regulatory perimeters and can be used to move illicit funds. |
| TRM | 2025 | Crypto / Blockchain Security Vendor |
| 369 | Global Cyber Resilience Report: Risk-Ready vs. Risk-Exposed: The Cyber Resilience Divide (November 2025) | Bottom Line Up Front (BLUF) Cohesity’s report shows that cyber resilience is increasingly defined by whether an organization can recover cleanly and quickly after a material cyberattack, not just whether it can detect or prevent one. For SMB owners and insurance teams, the key takeaway is that weak backup practices, incomplete recovery validation, and pressure to restore too quickly can turn an incident into prolonged downtime, revenue loss, legal exposure, and reinfection. Top 3-5 Most Notable Statistics •76% of surveyed organizations experienced at least one material cyberattack. •54% experienced a material cyberattack within the past 12 months. •26% endured multiple material attacks during that same period. •47% expressed complete confidence in their cyber-resilience strategy, despite widespread reported impacts. •Only 6% demonstrated the most mature, integrated cyber resilience capabilities. Top 3-5 Exploitable Technology Risks •Fragmented backup environments across hybrid and multicloud systems, which can reduce visibility and complicate response and recovery. •Incomplete recoverability controls: fewer than half follow the 3-2-1 backup rule or use immutability, increasing exposure to backup tampering or loss. •Limited use of isolated recovery environments, leaving restored systems more vulnerable to reinfection. |
| Cohesity | 2025 | Backup & Recovery Vendor |
| 370 | Global Cyber Threat Intelligence (CTI) Annual Cyberthreat Trends Report - 2024 | Bottom Line Up Front (BLUF) Deloitte’s 2024 threat report shows ransomware remains the most important cyber threat for SMBs and insurance teams, with attacks increasing and becoming easier for less-skilled criminals to launch through ransomware-as-a-service. The biggest practical risks are stolen credentials, exploitable vulnerabilities, social engineering, phishing, and third-party compromise. Top 3-5 Most Notable Statistics •Ransomware attack claims increased by 17 percent in 2024. •Fourth-quarter ransomware claims were 57 percent higher than the fourth quarter of 2023. •More than 30 new ransomware groups emerged in 2024. •The average cost of a ransomware data breach reached US$4.91 million. •Some large-impact exploits used in 2024 targeted vulnerabilities that were more than five years old. Top 3-5 Exploitable Technology Risks •Vulnerability exploitation, including zero-day vulnerabilities and older unpatched vulnerabilities, remained a major initial access method. •Corporate VPN access using stolen username and password combinations replaced brute force as a notable access trend. •Social engineering, including vishing combined with business email compromise, was used to trick service providers and steal credentials. |
| Deloitte | 2025 | Consulting / Analyst Firm |
| 371 | Global Cybersecurity Index 2024 | Bottom Line Up Front (BLUF) The Global Cybersecurity Index 2024 shows that national cybersecurity commitments are improving, but technical capabilities and capacity development remain weaker areas globally. For SMBs and insurance teams, the practical takeaway is that ransomware, data breaches, insecure infrastructure, and outage risk remain material business and claims concerns, especially where incident response, training, and standards adoption are immature. Top 3-5 Most Notable Statistics •The GCI measured 194 countries across 2023-2024 and found 27% average overall score growth since 2020, with a global average score of 65.7/100. •139 countries have active national CIRTs, while 55 do not have a CIRT or national CIRT in progress. •In 2023, 8 billion records were breached across more than 2,800 reported breaches; the global average cost of a data breach was estimated at USD 4.45 million. •For small businesses in North America, the average breach was estimated to cost USD 3.3 million. •In 2023, 25.7% of cyberattacks targeted manufacturing and 18.2% targeted finance and insurance; ransomware accounted for 17% of manufacturing attacks and 25% of finance and insurance attacks. Top 3-5 Exploitable Technology Risks •Ransomware affecting government services, critical sectors, manufacturing, finance, and insurance. •Data breaches involving personal data, privacy obligations, and unclear breach notification requirements. •Insecure or weak SSL/TLS use in mail services, with some regions showing 14% to 35% of mail services not using secure protocols or using weak ones. |
| International Telecommunication Union | 2024 | ISAC / Industry Consortium |
| 372 | Global Cybersecurity Outlook 2024 | Bottom Line Up Front (BLUF) The most important takeaway is that cyber resilience is becoming increasingly unequal: larger and better-funded organizations are improving, while many smaller organizations are falling behind. For SMBs and insurance teams, this matters because weaker cyber capability, limited skills, lower insurance adoption, and poor supply-chain visibility can translate into higher disruption, financial loss, and third-party-driven claims. Top 3-5 Most Notable Statistics •Organizations maintaining minimum viable cyber resilience are down 30%. •29% of organizations reported being materially affected by a cyber incident in the past 12 months. •41% of organizations that suffered a material incident said it was caused by a third party. •54% of organizations have insufficient understanding of cyber vulnerabilities in their supply chain. •Only 25% of small organizations carry cyber insurance, compared with 75% of the largest organizations by revenue. Top 3-5 Exploitable Technology Risks •Generative AI-enabled phishing, malware development, and deepfakes, which can make social engineering more convincing and easier to execute. •Third-party and supply-chain weaknesses, especially where organizations lack visibility into supplier vulnerabilities or do not request proof of cybersecurity posture. •Legacy technology and processes, which the report identifies as a major barrier to cyber resilience, especially in larger and operational technology environments. |
| WEF | 2024 | Research Organization |
| 373 | Global Cybersecurity Outlook 2025 | Bottom Line Up Front (BLUF) Cybersecurity risk in 2025 is becoming harder to manage because threats, technology adoption, supply chains, regulations and skills shortages are all growing more complex at the same time. This matters most for SMBs and insurance teams because smaller organizations are increasingly less able to absorb or prevent cyber disruption, while insurers must account for weaker controls, supply chain exposure and uncertainty around recoverability. Top 3-5 Most Notable Statistics •35% of small organizations say their cyber resilience is insufficient, up sevenfold since 2022. •71% of cyber leaders believe small organizations have reached a critical tipping point where they can no longer adequately secure themselves against growing cyber risk complexity. •72% of survey respondents reported a rise in cyber risks over the past year. •45% of respondents ranked ransomware as their top organizational cyber risk for 2025. •71% of large organizations expressed confidence that cyber insurance would adequately cover potential cyber losses, compared with only 35% of small organizations. Top 3-5 Exploitable Technology Risks •Ransomware and Ransomware-as-a-Service, which continue to commoditize attacks and keep ransomware as the leading organizational concern. •Generative AI-enabled phishing, vishing, smishing and deepfake impersonation, which make social engineering more personalized, convincing and scalable. •Third-party software vulnerabilities and supply chain weaknesses, including malware distribution through vendors and ecosystem dependencies. |
| WEF | 2025 | Research Organization |
| 374 | Global Cybersecurity Outlook 2026 | Bottom Line Up Front (BLUF) The most important takeaway is that cybersecurity risk is accelerating because AI, cyber-enabled fraud, ransomware, and supply chain dependence are converging. For SMBs and insurance teams, this means losses may come not only from direct attacks, but also from exposed data, fraudulent payments, unavailable systems, or a weak third-party provider. Top 3-5 Most Notable Statistics •94% of respondents expect AI and machine learning technologies to significantly affect cybersecurity in the next 12 months. •87% identified AI-related vulnerabilities as the fastest-growing cyber risk over 2025. •77% reported an increase in cyber-enabled fraud and phishing. •73% said they or someone in their network had been affected by cyber-enabled fraud in the past 12 months. •64% of organizations now have processes to assess AI tool security before deployment, up from 37% in 2025. Top 3-5 Exploitable Technology Risks •AI-related vulnerabilities, including poorly implemented AI, misconfiguration, over-reliance on automation, biased decision-making, and adversarial manipulation. •Generative AI data leaks, especially exposure of personal or proprietary data through AI tools. •Cyber-enabled fraud and phishing, including phishing, vishing, smishing, invoice or payment fraud, impersonation scams, and identity theft. |
| WEF | 2026 | Research Organization |
| 375 | Global Cyberthreat Report 2026 | Bottom Line Up Front (BLUF) Mile2’s 2026 report frames cyber risk as an executive and financial resilience issue, not just an IT problem. For SMBs and insurance teams, the main takeaway is that the most damaging incidents escalate because of weak governance, identity failures, untested recovery plans, and third-party dependencies—not because attackers always use highly novel techniques. Top 3-5 Most Notable Statistics •The report identifies 10 economically material cyber threats entering 2026. •Threat selection is based on 3 criteria: likelihood, impact, and systemic reach. •The report highlights 4 recurring governance failures: unclear ownership, untested recovery plans, poor identity governance, and misaligned incentives. •Widely cited projections referenced in the report place annual cybercrime costs at $10.5 trillion per year by the mid-2020s. •The report’s sector overview identifies 5 major affected sector groups: financial services, healthcare and life sciences, energy/utilities/transportation, manufacturing/industrial operations, and public sector/government services. Top 3-5 Exploitable Technology Risks •Cloud and identity compromise: attackers exploit stolen credentials, abused tokens, credential reuse, and excessive privileges to gain broad access across cloud and SaaS environments. •Ransomware and data extortion: attackers use phishing, credential reuse, third-party access, data theft, encryption, service disruption, and potential data destruction to increase pressure. •Data exposure through misconfiguration and excessive access: exposed storage, databases, weak change control, and poor access review can turn one account compromise into large-scale data loss. |
| Mile2 | 2026 | Education / Academic |
| 376 | Global Digital Trust Insights Report 2024 | Bottom Line Up Front (BLUF) PwC’s report shows that cyber risk management is not keeping pace with business technology use, especially cloud, connected devices, third parties, and generative AI. For SMBs and insurance teams, the key takeaway is that costly breaches are rising while many organizations still lack consistent controls, updated cloud risk plans, and cyber resilience practices. Top 3-5 Most Notable Statistics •36% of respondents reported that their most damaging breach in the past three years cost $1 million or more, up from 27% the prior year. •47% ranked cloud-related threats among their top cyber concerns for the next 12 months. •97% of cloud users had gaps in their cloud risk management plans; only 3% maintained up-to-date plans across all nine cloud security areas. •79% said they will increase cyber spending in 2024, up from 64% the prior year. •Only 5% of security and IT respondents were very satisfied with their cyber technology capabilities across all key areas. Top 3-5 Exploitable Technology Risks •Cloud-related threats: The report identifies cloud as the top cyber concern and notes that attackers may enter through identity and access, applications, portals, operating systems, connected devices, and customer interaction points. •Connected devices: Attacks on connected devices ranked second among top cyber threats, creating risk where operational and business technologies are linked. •Third-party and cloud provider risk: Many organizations have not fully addressed shared responsibility, third-party cloud risk, concentration risk, and fragmented regulations. |
| PwC | 2024 | Consulting / Analyst Firm |
| 377 | Global Digital Trust Insights Report 2026 | Bottom Line Up Front (BLUF) PwC’s 2026 report shows that cyber risk is becoming a core business resilience issue, driven by geopolitical volatility, cloud exposure, connected products, third-party risk, AI adoption, and emerging quantum risk. For SMBs and insurance teams, the main takeaway is that organizations are still spending too evenly between prevention and response, which can increase the likelihood of costly incidents, recovery delays, and coverage or underwriting pressure. Top 3-5 Most Notable Statistics •60% of business and technology leaders rank increased cyber risk investment among their top three strategic priorities in response to geopolitical uncertainty. •Only 6% say their organization is “very capable” of withstanding cyber attacks across all surveyed vulnerabilities. •33% rank cloud-related threats among the top three cyber threats their organization is least prepared to address. •Only 24% are spending significantly more on proactive cybersecurity measures than reactive measures. •More than a quarter of executives say their most damaging data breach in the past three years cost at least $1 million. Top 3-5 Exploitable Technology Risks •Cloud-related threats: Cloud is the top threat organizations feel least prepared to address, and cloud security is also a leading investment priority. •Connected products and devices: Attacks on connected products rank as a top preparedness gap, while budget priority for connected products is comparatively lower. •Third-party and supply chain vulnerabilities: Third-party breach and software supply-chain compromise are highlighted preparedness concerns, and supply chain vulnerabilities are among the weakest resilience areas. |
| PwC | 2026 | Consulting / Analyst Firm |
| 378 | Global Incident Response Report 2025 | Bottom Line Up Front (BLUF) Unit 42’s 2025 incident response findings show attackers are moving faster and causing more direct business disruption, not just stealing or encrypting data. For SMBs and insurance teams, the key takeaway is that cyber risk is increasingly an operational resilience issue: short detection windows, cloud exposure, identity weaknesses, and social engineering can quickly turn into downtime, data loss, extortion, and recovery costs. Top 3-5 Most Notable Statistics •86% of incidents Unit 42 responded to in 2024 involved business disruption, reputational damage, or other impact-related loss. •19% of cases involving data exfiltration saw data stolen within the first hour of compromise. •29% of 2024 cases were cloud-related, and 21% involved adverse impact to cloud environments or assets. •44% of investigated security incidents involved a web browser, including phishing, malicious redirects, or malware downloads. •The median initial extortion demand rose nearly 80%, from $695,000 in 2023 to $1.25 million in 2024. Top 3-5 Exploitable Technology Risks •Weak identity and access management, including overly permissive accounts, long-lived credentials, leaked API/access keys, and lack of least privilege. •Cloud and SaaS misconfigurations, including exposed environment variables, inadequate logging, poor visibility, and unsecured cloud storage. •Remote access weaknesses, including VPN accounts without multi-factor authentication and brute-forced VPN access. |
| Palo Alto Networks Unit 42 | 2025 | Network Security Vendor |
| 379 | Global Incident Response Report 2026 | Bottom Line Up Front (BLUF) Palo Alto Networks Unit 42’s 2026 incident response findings show that most serious intrusions are enabled by preventable gaps, especially weak identity controls, fragmented visibility, and inconsistent security coverage. For SMBs and insurance teams, the key takeaway is that attackers do not need highly sophisticated methods when they can log in with stolen credentials, exploit known vulnerabilities, abuse SaaS integrations, or move faster than detection and response teams can react. Top 3-5 Most Notable Statistics •87% of intrusions involved activity across multiple attack surfaces. •In more than 90% of breaches, preventable gaps such as limited visibility, inconsistent controls, or excessive identity trust materially enabled the intrusion. •Identity weaknesses played a material role in nearly 90% of Unit 42 investigations, and 65% of initial access was driven by identity-based techniques. •Phishing and software/API vulnerability exploitation each accounted for 22% of initial access in 2025. •Median initial ransom demands rose from $1.25 million in 2024 to $1.5 million in 2025, while median ransom payments rose from $267,500 to $500,000. Top 3-5 Exploitable Technology Risks •Weak identity and access management, including stolen credentials, session hijacking, overly permissive accounts, and IAM misconfigurations. •Phishing, social engineering, SEO poisoning, and browser-based attacks that exploit routine user workflows. •Software and API vulnerabilities, especially where patching and exposure management lag behind attacker automation. |
| Palo Alto Networks Unit 42 | 2026 | Network Security Vendor |
| 380 | Global Mobile Threat Report 2022 | Bottom Line Up Front (BLUF) Mobile devices are now a core business access point, but many organizations still treat them as secondary to laptops and desktops. For SMBs and insurance teams, the key takeaway is that unmanaged or under-protected mobile devices can expose corporate data through malware, phishing, rogue networks, weak applications, and compromised devices. Top 3-5 Most Notable Statistics •42% of surveyed respondents reported that mobile devices and web applications led to a security incident. •42% reported unauthorized apps and resources accessing enterprise data. •23% of mobile endpoints globally encountered mobile malware in 2021. •61% of respondents said they saw a spike in phishing attacks during the COVID-19 pandemic. •Zimperium identified 2,034,217 new mobile malware samples in 2021, averaging nearly 36,000 new variants per week. Top 3-5 Exploitable Technology Risks •Mobile malware delivered through app stores or sideloading can compromise devices and expose cloud-connected business data. •Mobile phishing and malicious websites can steal credentials, especially because smaller screens can hide warning signs and attacks can arrive through email, SMS, chat, and in-app messaging. •Man-in-the-middle attacks, rogue access points, malicious networks, traffic manipulation, and scans can intercept communications or support reconnaissance against business systems. |
| Zimperium | 2022 | Threat Intelligence Vendor |
| 381 | Global Mobile Threat Report 2023 | Bottom Line Up Front (BLUF) Mobile devices are now core business endpoints, customer channels, and authentication tools, but Zimperium reports that attackers are increasingly exploiting that same dependence. For SMBs and insurance teams, the key takeaway is that mobile risk should be treated as enterprise risk, especially where employees use personal devices, SMS-based authentication, mobile banking, cloud apps, and business apps. Top 3-5 Most Notable Statistics •60% of endpoints accessing enterprise assets were mobile devices, according to the prior year’s report referenced by Zimperium. •45% of companies surveyed suffered a compromise in the past 12 months, up 22% over the prior year. •80% of phishing sites now either specifically target mobile devices or are designed to work on both mobile and desktop. •The average user is 6-10 times more likely to fall for an SMS phishing attack than an email-based attack. •Mobile malware samples detected increased by 51% between 2021 and 2022. Top 3-5 Exploitable Technology Risks •SMS phishing, or “smishing,” which can trick users into clicking malicious links and may undermine SMS-based multi-factor authentication. •Unmanaged and BYOD mobile devices, where users control apps, permissions, updates, and network connections, often outside corporate visibility. •Mobile malware and trojans disguised as legitimate apps, including banking trojans that target financial, payment, investment, and cryptocurrency apps. |
| Zimperium | 2023 | Threat Intelligence Vendor |
| 382 | Global Mobile Threat Report 2024 | Bottom Line Up Front (BLUF) Zimperium’s 2024 report argues that attackers are increasingly using a “mobile-first” strategy because employee phones and tablets now access business apps, data, and networks but are often less controlled than traditional endpoints. For SMBs and insurance teams, the key takeaway is that mobile risk is no longer limited to lost devices; it includes phishing, malware, sideloaded apps, unsafe networks, vulnerable operating systems, and weak app security. Top 3-5 Most Notable Statistics •82% of organizations allow bring-your-own-device use, increasing exposure from personally owned devices used for work. •82% of phishing sites examined by Zimperium specifically targeted mobile devices, and 76% used HTTPS, which can make fake sites appear more trustworthy. •1 in 4 protected devices worldwide encountered malware, and Zimperium detected more than 87,000 malware samples per month. •Devices connecting to unsecured networks increased by 45%, and devices connecting to rogue access points increased by 100%. •14% of Android devices and 1% of iOS devices monitored in enterprises could not be upgraded, leaving them open to exploitation. Top 3-5 Exploitable Technology Risks •Mobile-targeted phishing, including email phishing, smishing, vishing, and QR-code phishing, can harvest credentials and lead to account takeover. •Mobile malware, including spyware, trojans, and riskware, can compromise devices that access business systems and sensitive data. •Sideloaded apps bypass official app stores and are associated with higher malware exposure; users who sideload are reported as 200% more likely to have malware running on their devices. |
| Zimperium | 2024 | Threat Intelligence Vendor |
| 383 | Global Mobile Threat Report 2025 | Bottom Line Up Front (BLUF) Zimperium’s 2025 report makes clear that mobile devices and apps are now a primary attack surface, with attackers using mobile-first tactics such as smishing, malicious apps, insecure networks, and outdated operating systems. For SMBs and insurance teams, the key takeaway is that phones used for work can expose sensitive business data, credentials, and financial workflows even when traditional desktop security is in place. Top 3-5 Most Notable Statistics •Smishing accounts for 69.3% of observed mishing attack vectors. •Vishing incidents increased 28%, and smishing incidents increased 22%. •25.3% of devices are not upgradeable due to device age. •Sideloaded apps were present on 23.5% of mobile devices. •23% of work apps analyzed communicated with embargoed or high-risk countries. Top 3-5 Exploitable Technology Risks •Mobile-targeted phishing, especially SMS phishing, can trick users into sharing credentials or visiting data-stealing sites. •Outdated or non-upgradeable mobile operating systems leave devices exposed to known vulnerabilities. •Sideloaded apps can include repackaged legitimate apps with malicious code, increasing the chance of device compromise. |
| Zimperium | 2025 | Threat Intelligence Vendor |
| 384 | Global OT and IoT Threat Landscape Report 2025 | Bottom Line Up Front (BLUF) Shieldworkz’s 2025 report shows that OT and IoT environments are facing more frequent, automated, and business-like attacks, with exposed industrial systems and weak IT-OT boundaries creating practical entry points for attackers. For SMBs and insurance teams, the key issue is not only technical compromise, but the potential for downtime, ransom pressure, data theft, disrupted operations, and physical process impact. Top 3-5 Most Notable Statistics •Shieldworkz’s honeypot network analyzes an average of 39 million attacks each day across more than 95 cities. •The energy sector saw a 79% surge in cyberattacks in 2024, making it the most targeted industry cited in the report. •Shieldworkz identified more than 95,000 internet-accessible industrial ports globally, with a 17% increase in exposed OT footprint compared with its 2023 study. •40% of system attacks specifically target the IT-OT convergence zone, where corporate networks connect with operational environments. •13% of serious OT vulnerabilities are described as “Forever Day” threats with no available patch. Top 3-5 Exploitable Technology Risks •Internet-accessible ICS ports and devices, which attackers can use for reconnaissance, unauthorized access, exploitation, malware deployment, or manipulation of industrial processes. •Weak IT-OT segmentation, allowing attackers to move laterally from business networks into operational systems. •Unpatched or unpatchable OT vulnerabilities, including “Forever Day” weaknesses and cases where patches are not deployed due to stability or operational concerns. |
| Shieldworkz | 2025 | MSP / MSSP / SOC Provider |
| 385 | Global Ransomware Report 2023 | Bottom Line Up Front (BLUF) Ransomware remains a high-probability, high-impact risk even for organizations that believe they are prepared. Fortinet’s survey found that many organizations detected attacks quickly and carried cyber insurance, yet still paid ransoms, failed to fully recover data, or received less insurance coverage than expected. Top 3-5 Most Notable Statistics •50% of surveyed organizations fell victim to ransomware in the last year, despite 78% saying they were “very” or “extremely” prepared. •71% of organizations that experienced ransomware paid at least part of the ransom demand. •Only 35% of affected organizations recovered all their data after a ransomware incident. •41% of organizations with cyber insurance did not receive as much coverage as expected, and some received none due to insurer exceptions. •FortiGuard Labs observed 10,666 new ransomware variants in the first half of 2022, double the number seen in the prior six months. Top 3-5 Exploitable Technology Risks •Phishing email remained the most common method of entry, making email security and employee awareness critical. •Social engineering continues to fool employees, creating an exploitable path into business networks. •Weak or unclear ransomware response processes, including no clear chain of command, can slow containment and recovery. |
| Fortinet | 2023 | Network Security Vendor |
| 386 | Global Regulatory Landscape Guide 2026 | Bottom Line Up Front (BLUF) Bridewell’s guide shows that privacy, cyber security, AI, breach notification, and third-party risk rules are expanding across the UK, Europe, the USA, and global markets through 2026 and beyond. For SMBs and insurance teams, the main takeaway is that compliance obligations increasingly apply based on where customers, users, data, or AI outputs are located, not just where the business is based. Top 3-5 Most Notable Statistics •The European Commission’s UK data adequacy decision is valid until 27 December 2031, allowing personal data to continue flowing from the EEA to the UK under recognised safeguards. •California’s breach notification bill requires disclosure to affected consumers within 30 calendar days of discovery or notification of a breach. •New EU rules for cross-border GDPR complaints set binding investigation timelines of 15 months for complex cases and 12 months for simpler cooperation proceedings. •The proposed American Privacy Rights Act defines exempt small businesses as those with $40M or less in annual revenue and covered data for 200,000 or fewer individuals, provided they do not earn revenue from transferring covered data. •Brazil Bill No. 36/2025 would allow LGPD sanctions for sensitive biometric data violations, including fines of up to 2% of revenue in Brazil, capped at BRL 50 million per violation. Top 3-5 Exploitable Technology Risks •Third-party service providers with access to information systems or nonpublic information are a clear focus, especially under New York guidance requiring tailored, risk-based due diligence and oversight. •Critical cyber systems and supply-chain dependencies are highlighted in Canadian cyber security proposals, which require designated operators to manage third-party and supply-chain risks. •Products with digital elements classified as “important” or “critical” under the EU Cyber Resilience Act will face stricter conformity assessment requirements. |
| Bridewell | 2026 | Cybersecurity Services / Consultancy |
| 387 | Global Risk Manager Survey Report 2024 | Bottom Line Up Front (BLUF) FERMA’s 2024 survey shows that cyber-attacks and data breaches remain immediate business threats, while AI, digitalisation, and fast technology change are increasing pressure on risk and insurance teams. For SMBs, the key lesson is to treat cyber, IT, data, and new technology risks as business risks that need active mapping, prevention, and insurance review. Top 3-5 Most Notable Statistics •1,041 respondents across 77 countries contributed to the survey, though responses were largely European. •Cyber-attacks and data breach are both in the Top 5 risks for the next 12 months. •89% of Risk Managers work on AI-related risk management, mainly through regulatory monitoring or internal AI usage policies. •79% of Risk Managers are involved in risk management for technological and digital projects. •53% of Insurance Managers think some risks, activities, or locations will become uninsurable in the near future; among them, 55% cite cyber-attacks. Top 3-5 Exploitable Technology Risks •Cyber-attacks: the report identifies cyber-attacks as a top short-term threat, driven by increasing digitalisation and reliance on digital connections. •Data breach: data breach is also a top short-term risk, reflecting heightened awareness and frequency of cyber incidents. •Hybrid working vulnerabilities: the report notes that hybrid working environments can expand potential vulnerabilities for both remote and on-site employees. |
| FERMA | 2024 | Cyber Insurance Carrier |
| 388 | Global Risks Report 2025 | Bottom Line Up Front (BLUF) The WEF’s 2025 outlook points to a more fragmented, unstable risk environment where misinformation, cyber espionage, geopolitical conflict, trade disruption, and extreme weather are converging. For SMBs and insurance teams, the key takeaway is that technology risk cannot be viewed separately from geopolitical and economic risk because false information, cyber activity, supply chain disruption, and financial uncertainty can compound quickly. Top 3-5 Most Notable Statistics •52% of surveyed experts anticipate an unsettled global outlook over the next two years, while 31% expect turbulence and 5% expect a stormy outlook. •62% of respondents expect turbulent or stormy conditions over the next 10 years. •State-based armed conflict is ranked the #1 current global risk for 2025 by 23% of respondents. •Misinformation and disinformation is ranked the #1 risk over the two-year outlook for the second year in a row. •71% of Chief Risk Officers cited concern about cyber risk and criminal activity severely impacting their organizations. Top 3-5 Exploitable Technology Risks •Generative AI-enabled misinformation and disinformation, which lowers barriers to producing and distributing misleading text, images, and voice content at scale. •Cyber espionage and warfare, ranked among the top two-year risks and linked to rising threat actor activity and more sophisticated technological disruption. •Attacks against algorithms and machine learning models, including manipulated inputs that can produce incorrect outcomes or compromise training data. |
| WEF | 2025 | Research Organization |
| 389 | Global Risks Report 2026 | Bottom Line Up Front (BLUF) The WEF’s Global Risks Report 2026 warns that businesses are entering a more volatile operating environment shaped by geoeconomic confrontation, misinformation, cyber insecurity, AI risk, fragile infrastructure, and future quantum threats. For SMBs and insurance teams, the key takeaway is that technology risk is increasingly tied to broader business disruption, supply chain stress, reputational exposure, and resilience planning. Top 3-5 Most Notable Statistics •50% of surveyed leaders and experts anticipate a turbulent or stormy global outlook over the next two years. •57% anticipate a turbulent or stormy outlook over the next 10 years. •Over 1,300 experts contributed to the Global Risks Perception Survey. •Over 11,000 business leaders across 116 economies contributed national risk perspectives through the Executive Opinion Survey. •Only 5% of organizations are estimated to have quantum-safe encryption in place, and the average quantum-safe readiness score is 25 out of 100. Top 3-5 Exploitable Technology Risks •Cyber insecurity is ranked among the top short- and long-term global risks, indicating continued concern over digital attacks and technology-dependent disruption. •Misinformation and disinformation is ranked the #2 short-term global risk, creating exposure to fraud, reputational harm, social instability, and loss of trust. •Adverse outcomes of AI technologies rise sharply over the long term, with risks linked to information integrity, overdependency, labour disruption, and broader societal impacts. |
| WEF | 2026 | Research Organization |
| 390 | Global Scams Report 2025 | Bottom Line Up Front (BLUF) Scams are accelerating globally, with BioCatch reporting a sharp increase in authorized push payment fraud, where victims are manipulated into sending money themselves. For SMBs and insurance teams, the key issue is that these losses can bypass traditional fraud defenses because the account holder appears to approve the transaction. Top 3-5 Most Notable Statistics •65% increase in the total number of scams reported by BioCatch customers between 2024 and 2025. •100% spike in voice phishing, or vishing, making it the second-most-reported scam type. •10x surge in smishing, which uses SMS text messages instead of email. •Reported scams in the U.S. and Canada have more than quadrupled since 2023. •Scam volumes in Latin America increased by a factor of six over the past year. Top 3-5 Exploitable Technology Risks •Real-time payment systems: Faster payments reduce the time available to reverse fraudulent transfers once a victim has been tricked. •Generative AI: The report states that GenAI has lowered the barrier to entry and helped scammers scale and improve attacks. •Vishing: Phone-based social engineering pressures victims into sharing sensitive information or taking financial action. |
| BioCatch | 2025 | Identity Security Vendor |
| 391 | Global Secure Coding Education Survey 2021 | Bottom Line Up Front (BLUF) Checkmarx’s 2021 survey shows that developers broadly believe secure coding education is necessary, but many are not receiving enough of it and are not fully confident their code is secure. For SMBs and insurance teams, the practical takeaway is that software security depends not only on tools, but also on whether developers are trained, supported, and treated as part of a shared security responsibility. Top 3-5 Most Notable Statistics •813 global developers responded to the secure coding education survey. •71% said secure coding education is “absolutely necessary.” •25% said the secure coding education they currently receive is adequate, while others said it could be better or is not adequate. •29% said they are completely confident that the code they develop and deliver is secure. •81% of global developers said secure code is a shared responsibility. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs The report’s main business message is that secure coding education can improve both security and efficiency. Developers surveyed believe better training would help them code more securely, save time for themselves and their organizations, save money and resources, and meet deadlines better. For an SMB that builds or maintains software, inadequate secure coding education can leave the organization dependent on developers who may not feel fully prepared to produce secure code. The report also emphasizes that as software becomes more central to business operations, it expands the attack surface, making software security a business-critical issue. |
| Checkmarx | 2021 | Application / API Security Vendor |
| 392 | Global Security Attitude Survey 2021 | Bottom Line Up Front (BLUF) CrowdStrike’s 2021 survey shows organizations are struggling with three linked risks: ransomware, software supply chain attacks, and slow detection and response. For SMBs and insurance teams, the main takeaway is that attacks are not only frequent but increasingly costly, and many organizations lack tested response strategies before incidents occur. Top 3-5 Most Notable Statistics •66% of respondents said their organization suffered at least one ransomware attack in the past 12 months. •The average ransom payment rose 63% in 2021 to $1.79 million, compared with $1.10 million in 2020. •96% of organizations that paid the initial ransom also paid additional extortion fees, averaging $792,493. •45% of respondents said their organization experienced at least one software supply chain attack in the last 12 months. •Respondents estimated it would take an average of 146 hours to detect a cybersecurity incident, up from 117 hours in 2020. Top 3-5 Exploitable Technology Risks •Software supply chain compromise, where attackers breach one supplier and potentially affect many downstream organizations. •Ransomware, including attacks that encrypt critical data and demand payment, often followed by additional extortion demands. •Remote and hybrid work environments, which increased the attack surface and were directly linked to cybersecurity incidents. |
| CrowdStrike | 2021 | Endpoint / MDR / XDR Vendor |
| 393 | Global State of API Security 2025 | Bottom Line Up Front (BLUF) APIs are a major and persistent breach pathway, and many organizations do not have enough visibility, testing, or confidence in their current defenses. For SMB owners and insurance teams, the key takeaway is that API risk is not only a technical issue; it can lead to financial loss, operational disruption, loss of customers, and compliance problems. Top 3-5 Most Notable Statistics •57% of organizations experienced at least one API-related data breach in the past two years. •Of organizations that had an API-related breach, 73% had at least three API-related breaches. •Organizations continually test only 38% of APIs for vulnerabilities on average and estimate they can prevent only 24% of API-related attacks. •61% of organizations expect API risk to increase or significantly increase over the next 12 to 24 months. •53% of organizations reported at least one bot-related incident targeting their APIs, while only 21% described their ability to mitigate bot traffic as high. Top 3-5 Exploitable Technology Risks •API sprawl: 54% cited preventing API sprawl as a top challenge, making it harder to know what APIs exist, where they are, and what they do. •DDoS attacks against APIs: DDoS was the leading reported root cause of API-related breaches, cited by 38% of respondents. •Fraud, abuse, and misuse: These attacks were cited as a major breach cause and are difficult for traditional tools to distinguish from legitimate API activity. |
| Traceable | 2025 | Threat Intelligence Vendor |
| 394 | Global State of Authentication Survey 2025 | Bottom Line Up Front (BLUF) Yubico’s 2025 survey shows a major gap between how secure employees believe authentication is and how exposed many organizations remain to phishing, social engineering, and AI-enabled attacks. For SMBs and insurance teams, the key takeaway is that passwords, SMS verification, inconsistent MFA use, and weak employee training create practical account-takeover risks that can lead to broader business compromise. Top 3-5 Most Notable Statistics •18,000+ employed adults were surveyed across Australia, India, Japan, France, Germany, Singapore, Sweden, the United Kingdom, and the United States. •40% of employees have never received cybersecurity training in any form. •62% of organizations still rely primarily on username and password credentials. •44% of companies use SMS-based one-time passwords, which the report says are susceptible to SIM swapping and social engineering. •76% of respondents are concerned that AI is affecting the security of their personal or professional accounts, up from 58% in a similar 2024 survey. Top 3-5 Exploitable Technology Risks •Password-based authentication remains widely used and is described as highly susceptible to phishing attacks. •SMS-based authentication can be exploited through SIM swapping and social engineering, especially as AI makes scams more convincing. •Basic MFA and one-time password methods can be bypassed or undermined by phishing, mobile device theft, and social engineering. |
| Yubico | 2025 | Threat Intelligence Vendor |
| 395 | Global State of DevSecOps 2023 | Bottom Line Up Front (BLUF) Synopsys’ 2023 survey shows that DevSecOps is now widely adopted, but many organizations still struggle to find, prioritize, and fix critical software vulnerabilities quickly enough. For SMBs and insurance teams, the key issue is operational risk: late vulnerability discovery and slow remediation can disrupt delivery schedules, increase costs, and leave exploitable weaknesses in deployed applications. Top 3-5 Most Notable Statistics •91% of respondents reported using some DevSecOps activities in their software development pipelines. •81.1% said addressing a critical security or vulnerability issue impacted software delivery schedules during 2022-2023. •28.26% reported taking over two weeks and up to three weeks to patch critical vulnerabilities in deployed applications; another 19.92% took over three weeks and up to one month. •52.6% use a combination of manual and automated assessments to test business-critical applications. •76.6% were concerned about potential bias or errors in AI-based security solutions. Top 3-5 Exploitable Technology Risks •Critical vulnerabilities in deployed applications, especially when patching takes weeks rather than days. •Open source and third-party dependencies introduced during development, which require software composition analysis to identify vulnerable components. •AI-generated or AI-recommended code packages, including nonexistent package names that attackers can copy and fill with malicious code. |
| Synopsys | 2023 | Threat Intelligence Vendor |
| 396 | Global State of DevSecOps 2024 | Bottom Line Up Front (BLUF) AI-assisted software development is now widespread, but security controls for AI-generated code have not kept pace. For SMBs and insurance teams, the key concern is that faster software delivery can introduce vulnerable or poorly governed code unless security testing is automated, centralized, and tied directly to remediation workflows. Top 3-5 Most Notable Statistics •Over 90% of surveyed organizations use AI tools in some capacity for software development. •Only 24% of respondents are very confident they have policies, management, and automated testing in place for AI-generated code. •82% of organizations use between 6 and 20 application security testing tools. •60% of respondents report that 21% to 60% of security test results are noise, such as false positives, duplicates, or conflicting results. •86% of respondents say application security testing slows development at least slightly, including 18% who say it severely slows development. Top 3-5 Exploitable Technology Risks •AI-generated code may introduce software vulnerabilities if it is trusted without security review and testing. •Sensitive data exposure remains a major application security issue; the report notes that organizations prioritize testing based on the sensitivity of information handled by applications. •Coverage gaps in testing queues can leave projects, branches, or repositories untested and potentially vulnerable. |
| Black Duck | 2024 | Application / API Security Vendor |
| 397 | Global Threat Intelligence Report 2025: Threats in Focus, Industry Snapshots, Recommendations | Bottom Line Up Front (BLUF) Mimecast’s 2025 report shows attackers increasingly bypassing traditional technical defenses by exploiting people, trusted business services, collaboration platforms, and unmanaged systems. For SMBs and insurance teams, the main risk is not just malware, but convincing social engineering that can lead to fraudulent payments, credential theft, remote access, data loss, and operational disruption. Top 3-5 Most Notable Statistics •Mimecast processed more than 24 trillion data points and flagged more than 9.13 billion threats in the first nine months of 2025. •Phishing accounts for 77% of all attacks, up from 60% in 2024. •ClickFix attacks increased by more than 500% in the first six months of 2025 and accounted for nearly 8% of reported attacks. •Mimecast detected more than 2 million malicious SVG file instances between mid-February and mid-March. •In 2024, nearly 40,000 vulnerabilities were reported to the National Vulnerability Database, while 2025 is on track to exceed 900 vulnerabilities per week. Top 3-5 Exploitable Technology Risks •Abuse of trusted services such as DocuSign, Intuit, PayPal, Adobe Sign, Salesforce, SharePoint, Google Drive, SendGrid, and Mailgun to deliver phishing, malicious files, and callback scams. •ClickFix attacks that trick users into copying and running malicious commands, leading to infostealers, remote access trojans, ransomware, and credential stealers. •Legitimate remote monitoring and management tools, including ScreenConnect, TeamViewer, AnyDesk, and LogMeIn, used for initial access and persistent remote control. |
| Mimecast | 2025 | Email Security Vendor |
| 398 | Global Threat Intelligence Report 2026 | Bottom Line Up Front (BLUF) CyberProof’s 2026 report shows that attackers are moving faster by combining vulnerability exploitation, identity abuse, social engineering, SaaS integrations, and supply-chain leverage into repeatable intrusion playbooks. For SMBs and insurance teams, the key takeaway is that cyber risk is increasingly a business interruption and data-extortion problem, not just an IT security issue. Top 3-5 Most Notable Statistics •Vulnerability exploitation increased by 17% compared with 2024 and remained a dominant entry vector. •Vulnerability exploitation accounted for an estimated 25–35% of successful ransomware incidents. •Global retail ransomware activity increased by 58% in Q2 2025 compared with Q1, and 80% of retailers faced a cyberattack in 2025. •Manufacturing attacks surged 61% year over year and represented 26% of all attacks in 2025. •ClickFix activity increased by over 500%, represented close to 8% of blocked attack attempts, and became the second most common intrusion vector after phishing. Top 3-5 Exploitable Technology Risks •ERP platforms such as SAP NetWeaver and Oracle E-Business Suite, where remote code execution flaws gave attackers access to finance, HR, procurement, and supply-chain workflows. •Collaboration servers such as Microsoft SharePoint, where exploitation enabled web shells, machine-key theft, valid authentication token creation, and lateral movement. •SaaS integrations and OAuth-connected apps, where attackers abused trusted access into Salesforce ecosystems without exploiting Salesforce’s core platform. |
| CyberProof | 2026 | Threat Intelligence Vendor |
| 399 | Global Threat Intelligence Report H1 2024 | Bottom Line Up Front (BLUF) Mimecast reports that email and messaging remain the primary launch point for cyberattacks, with attackers shifting away from malware attachments toward malicious links, credential theft, impersonation, and abuse of legitimate cloud and file-sharing services. For SMBs and insurance teams, the key takeaway is that ordinary business tools, weak authentication, and employee interaction are central to current loss exposure. Top 3-5 Most Notable Statistics •Mimecast threat intelligence is based on analysis of more than 1.7 billion messages per day across more than 42,000 customers. •Overall threats per user declined from 19 in Q4 2023 to 14 in Q2 2024, but small businesses still remained the most targeted business size. •Small businesses saw attacks rise to 40 threats per user in Q1 2024 before subsiding in Q2. •Malicious links increased by 133% in Q1 2024 and 53% in Q2 2024 compared with the same quarters a year earlier. •Mimecast detected more than 1.6 million email scam messages in May using fake invoices and phone numbers connected to AI-supported call centers. Top 3-5 Exploitable Technology Risks •Malicious links delivered through email, often using multiple redirects, CAPTCHAs, and fake Microsoft Outlook sign-in pages to steal credentials. •Abuse of legitimate cloud and file-sharing services such as SharePoint, Google Drive, Evernote, LinkedIn, Atlassian, Archbee, Nuclino, and Replit to host intermediate or malicious content. •Weak, stolen, or reused credentials, especially where multifactor authentication is absent or can be bypassed with username and password access. |
| Mimecast | 2024 | Email Security Vendor |
| 400 | Global Threat Intelligence Report H2 2023 | Bottom Line Up Front (BLUF) Mimecast’s Q4 2023 threat intelligence shows that SMB users faced more than twice as many threats per user as large-company users, with attackers shifting from malicious attachments to malicious links, QR codes, and credential phishing. For SMBs and insurance teams, the key risk is business disruption and data loss from phishing-led compromise, ransomware, business email compromise, and abuse of trusted brands and cloud services. Top 3-5 Most Notable Statistics •Mimecast analyzes more than 1.7 billion emails per day across more than 42,000 customers. •Average users at small and medium-sized businesses encountered 31 and 32 threats per user, respectively, compared with about 15 threats per user at large companies. •Spam accounted for 86% of all blocked messages, while phishing accounted for 9%. •ALPHV BlackCat compromised more than 1,000 victims and collected more than $300 million in ransom payments by the end of the quarter. •Four ransomware groups—LockBit, Cl0p, ALPHV/BlackCat, and Play—accounted for 88% of ransomware activity during the quarter. Top 3-5 Exploitable Technology Risks •Malicious links overtook malicious attachments for the first time, increasing exposure to phishing sites, credential theft pages, and malware downloads. •QR-code phishing became mainstream, with attackers using QR codes to hide destinations and bypass controls focused on clickable links. •Credential harvesting remained a major phishing attribute, especially against businesses using cloud services and infrastructure. |
| Mimecast | 2023 | Email Security Vendor |
| 401 | Global Threat Intelligence Report H2 2024 | Bottom Line Up Front (BLUF) Mimecast’s H2 2024 report shows attackers increasingly hiding inside legitimate email, cloud, collaboration, and supplier services to bypass traditional trust-based defenses. For SMBs and insurance teams, the key takeaway is that email security, user behavior, third-party exposure, and misconfigured internet-facing systems remain central drivers of business interruption, fraud, credential theft, and ransomware risk. Top 3-5 Most Notable Statistics •Mimecast processed more than 90 billion data points and flagged more than 5 billion threats in H2 2024. •About 12% of emails analyzed by Mimecast showed signs of being written by large language models. •More than 68% of breaches in the referenced 2024 DBIR involved a non-malicious human element. •Mimecast reported that cloud-related attacks more than doubled in 2024. •Mimecast noted continuing increases in attacks against RDP ports, which it states account for 80% of effective ransomware compromises. Top 3-5 Exploitable Technology Risks •Abuse of trusted cloud and collaboration services, including Microsoft, Google, Evernote, Adobe, DocuSign, TeamViewer, Gmail, Outlook, Dropbox, GitHub, and AWS, to host payloads, landing pages, phishing links, or malicious files. •Compromised consumer routers used as proxies to relay spoofed phishing emails through ISP mail services with weak or absent outbound authentication. •Business email compromise using trusted signing platforms such as DocuSign and Adobe Sign, combined with deepfake audio to pressure employees into fraudulent payments. |
| Mimecast | 2024 | Email Security Vendor |
| 402 | Global Threat Landscape H1 2025 | Bottom Line Up Front (BLUF) Cyble reports a sharp escalation in ransomware, software supply chain attacks, zero-day exploitation, and more capable hacktivist activity in the first half of 2025. For SMBs and insurance teams, the key takeaway is that smaller organizations, professional services, construction, healthcare, and technology-dependent businesses face meaningful risk from both direct ransomware attacks and attacks that arrive through vendors or exposed systems. Top 3-5 Most Notable Statistics •Ransomware attacks increased by 54% compared with the first half of 2024. •Cyble recorded 3,201 ransomware incidents in H1 2025. •North America accounted for 65% of all ransomware attacks, with the United States representing 57% of the global total. •CL0P, Akira, and Qilin were responsible for 34% of all ransomware attacks. •Software supply chain attacks increased by more than 30%, with Q2 2025 averaging 25 attacks with supply chain impact per month. Top 3-5 Exploitable Technology Risks •Zero-day vulnerabilities in widely used enterprise software, especially Microsoft, Apple, Ivanti, Google, and VMware products, were actively highlighted as a major risk. •Managed file transfer software remains a high-value target, with CL0P known for exploiting platforms such as MOVEit Transfer, GoAnywhere MFT, and Accellion FTA. •Software supply chain dependencies create downstream exposure when IT, technology, telecommunications, cloud, identity, or service providers are compromised. |
| Cyble | 2025 | Threat Intelligence Vendor |
| 403 | Global Threat Landscape Report 1H 2023 | Bottom Line Up Front (BLUF) Fortinet’s 1H 2023 threat data shows attackers becoming more selective, organized, and harder to detect, with ransomware, exploit activity, credential theft, and evasion techniques remaining central risks. For SMBs and insurance teams, the key takeaway is that even common vulnerabilities and familiar attack methods can create serious loss exposure if patching, visibility, and response processes are weak. Top 3-5 Most Notable Statistics •41 of 138 MITRE-tracked APT groups, or 30%, showed activity in the first half of 2023. •Ransomware activity ended 1H 2023 13 times higher than it began as a share of all malware detections. •The share of organizations detecting ransomware fell from 22% five years ago to 13% in 1H 2023, which Fortinet links to more targeted and sophisticated ransomware operations. •Unique exploit detections increased 68% over five years, while exploitation attempts per organization dropped 75%, suggesting more targeted attack behavior. •Vulnerabilities in the top 1% of EPSS scores saw exploitation within seven days 22% of the time and within one year 85% of the time. Top 3-5 Exploitable Technology Risks •Public-facing applications, including the MOVEit Transfer SQL injection vulnerability, which Fortinet observed being targeted within days of disclosure. •Unpatched endpoint vulnerabilities, especially those with high EPSS scores, because attackers prioritize vulnerabilities likely to be exploitable in the wild. •Removable media replication, including malware that disguises files in ways users are likely to open. |
| Fortinet | 2023 | Network Security Vendor |
| 404 | Global Threat Landscape Report 2025 | Bottom Line Up Front (BLUF) Fortinet’s 2025 report shows attackers are moving faster, scanning more broadly, and using automation, stolen credentials, cloud weaknesses, and ransomware services to find and exploit targets. For SMBs and insurance teams, the key takeaway is that exposure management, identity monitoring, and fast remediation are now central to reducing breach and ransomware risk. Top 3-5 Most Notable Statistics •Active scanning rose 16.7% worldwide in 2024, with Fortinet observing billions of scan attempts each month and roughly 36,000 scans per second. •Fortinet detected over 97 billion exploitation attempts during the year. •Infostealer-related credential logs on darknet forums increased 500%, with 1.7 billion stolen credential records shared. •More than 20% of recorded exploitation attempts targeted IoT devices. •In cloud incidents, 70% involved new logins from unexpected geographies. Top 3-5 Exploitable Technology Risks •Exposed SIP, RDP, Modbus TCP, and other internet-facing services that attackers scan to identify easy entry points. •Older but still heavily targeted vulnerabilities, including Windows SMB information disclosure, Apache Log4j remote code execution, and Netcore Netis hardcoded password issues. •IoT routers, cameras, firewalls, and network hardware with default credentials, outdated firmware, or exposed management interfaces. |
| Fortinet | 2025 | Network Security Vendor |
| 405 | Global Threat Landscape Report 2H 2023 | Bottom Line Up Front (BLUF) Fortinet’s 2H 2023 threat data shows attackers are exploiting known weaknesses faster, reusing old vulnerabilities, and increasingly targeting organizations where downtime creates pressure to pay. For SMBs and insurance teams, the main takeaway is that basic control failures—unpatched systems, exposed remote access, weak account controls, and connected backups—remain central to costly incidents. Top 3-5 Most Notable Statistics •New exploit activity moved quickly: attacks occurred on average 4.76 days after discovery, 43% faster than the prior period. •41% of organizations detected exploit activity for vulnerabilities less than one month old. •Fortinet found that 86% of investigated unauthorized-access cases involving exploited vulnerabilities used a vulnerability that was already known and had a patch available. •Industrial sectors experienced 44% of all ransomware and wiper detections in 2H 2023. •Threat actors shared more than 3,000 data breaches on prominent dark web forums. Top 3-5 Exploitable Technology Risks •Internet-of-Things devices, including routers, cameras, DVRs, and other network-connected devices, were heavily targeted because they are often under protected or unprotected. •Public-facing applications and web technologies remained major targets, including Apache Log4j, Apache ActiveMQ, PHP-related platforms, PHPUnit, Laravel, Apache Web Server, and WordPress WooCommerce Payments. •Remote access and identity paths were repeatedly exposed, with dark web access commonly advertised through VPN, RDP, and compromised accounts. |
| Fortinet | 2023 | Network Security Vendor |
| 406 | Global Threat Report 2025 | Bottom Line Up Front (BLUF) CrowdStrike’s 2025 report shows attackers are moving faster, relying less on malware, and increasingly using identity compromise, social engineering, cloud/SaaS access, and exposed vulnerabilities to get in. For SMBs and insurance teams, the key takeaway is that many losses may begin with legitimate-looking user activity, help desk manipulation, or compromised cloud accounts rather than obvious malware. Top 3-5 Most Notable Statistics •Average eCrime breakout time fell to 48 minutes, with the fastest observed breakout at 51 seconds. •79% of CrowdStrike detections in 2024 were malware-free, up from 40% in 2019. •Vishing attacks increased 442% between the first and second half of 2024. •Access broker advertisements increased nearly 50% year over year. •Valid account abuse accounted for 35% of cloud incidents in the first half of 2024. Top 3-5 Exploitable Technology Risks •Compromised identities and valid accounts: attackers use stolen or socially engineered credentials to access cloud, SaaS, and internal environments while appearing to be legitimate users. •Help desk and MFA reset abuse: threat actors impersonate employees to persuade IT support teams to reset passwords or enroll attacker-controlled MFA devices. •Remote monitoring and management tools: adversaries use legitimate remote support tools, including Microsoft Quick Assist, to establish access while avoiding malware-based detection. |
| CrowdStrike | 2025 | Endpoint / MDR / XDR Vendor |
| 407 | Global Threat Report 2025 | Bottom Line Up Front (BLUF) Elastic’s 2025 report shows attackers are moving faster and increasingly abusing trusted business tools: cloud accounts, browsers, developer platforms, and built-in operating system features. For SMBs and insurance teams, the key takeaway is that identity controls, cloud monitoring, endpoint behavior detection, and rapid response matter more than ever because the attack lifecycle is now measured in minutes, not months. Top 3-5 Most Notable Statistics •32.05% of malicious Windows behavior mapped to Execution, roughly doubling from about 16% the prior year. •Over 60% of cloud security events concentrated around three goals: Initial Access, Persistence, and Credential Access. •Generic threats increased by 15.5%, which Elastic links to easier creation of simple malicious loaders and tools, potentially aided by large language models. •More than 1 in 8 malware samples analyzed from over 150,000 samples were designed to steal browser data. •Trojans represented 64.49% of all identified malware across supported operating systems. Top 3-5 Exploitable Technology Risks •Cloud identity abuse: attackers focus on valid accounts, phishing, OAuth consent grants, privileged role changes, IAM policy changes, and STS role/token abuse. •Browser credential theft: infostealers target browser-stored data that can be reused to access corporate cloud accounts. •Windows script and execution abuse: PowerShell, Windows Command Shell, JavaScript, Visual Basic, malicious LNK files, fake CAPTCHA lures, and process injection remain prominent. |
| Elastic | 2025 | SIEM / Security Analytics Vendor |
| 408 | Global Threat Report 2026 | Bottom Line Up Front (BLUF) CrowdStrike’s key message is that adversaries are moving faster and hiding inside trusted systems: valid credentials, SaaS applications, cloud identities, edge devices, software supply chains, and AI tools. For SMBs and insurance teams, this means losses may come from normal-looking activity rather than obvious malware, making rapid detection, identity controls, and visibility across environments critical. Top 3-5 Most Notable Statistics •AI-enabled adversary attacks increased 89% year over year. •Average eCrime breakout time dropped to 29 minutes, with the fastest breakout at 27 seconds. •82% of detections in 2025 were malware-free, up from 51% in 2020. •Cloud-conscious intrusions rose 37%, including a 266% increase among state-nexus threat actors. •Zero-day vulnerabilities exploited before public disclosure increased 42%. Top 3-5 Exploitable Technology Risks •Valid account abuse in cloud environments, where attackers use legitimate credentials and identity flows to avoid detection. •Internet-facing edge devices, including VPN appliances, firewalls, gateways, mail servers, and routers, which adversaries exploit for initial access and persistence. •SaaS applications, including Microsoft 365, SharePoint, CRM platforms, document repositories, and payroll or expense systems, which attackers use for data discovery and exfiltration. |
| CrowdStrike | 2026 | Endpoint / MDR / XDR Vendor |
| 409 | Global Threat Roundup Report 2024 | Bottom Line Up Front (BLUF) Forescout’s 2024 data shows attackers are heavily targeting exposed web applications, remote management services, weak credentials, and internet-facing infrastructure devices. For SMBs and insurance teams, the key takeaway is that common, preventable exposure issues remain central to attack activity, while critical infrastructure and operational technology environments are seeing increased attention. Top 3-5 Most Notable Statistics •Forescout analyzed more than 900 million attacks recorded between January and December 2024. •Web applications accounted for 41% of attacked services in 2024, up from 26% in 2023. •Remote management protocols increased to 33% of attacked services in 2024. •Generic usernames such as “root,” “admin,” “user,” and “guest” made up 95% of abused credentials observed. •Reported critical infrastructure incidents rose from 50 in 2022 to 384 globally, a 668% increase. Top 3-5 Exploitable Technology Risks •Exposed web applications and web servers, including attacks such as command injection, cross-site scripting, and SQL injection. •Remote management protocols such as RDP, VNC, SSH, and Telnet, which were mainly attacked through brute forcing and password spraying. •Weak or default credentials, especially generic usernames used across devices and services. |
| Forescout | 2024 | Network Security Vendor |
| 410 | GoDaddy Annual Cybersecurity Report 2024 | Bottom Line Up Front (BLUF) GoDaddy’s 2024 analysis shows that compromised websites remain a practical business risk for SMBs, especially those using WordPress, Magento, WooCommerce, or other content management and e-commerce platforms. The most important takeaway is that attackers are using compromised sites not only to harm the site owner, but also to redirect visitors, steal payment data, spread malware, and manipulate search results. Top 3-5 Most Notable Statistics •70.8 million global website scans were analyzed during 2024. •1,176,701 infected websites were detected with malicious code or unauthorized modifications. •Malware and malicious redirects accounted for 74.7% of detected infections, with 822,651 detections. •SEO spam was detected on 422,741 compromised websites. •Credit card stealing malware was detected on 18,622 websites. Top 3-5 Exploitable Technology Risks •WordPress plugin and theme abuse: attackers used legitimate plugins, widgets, database options, and custom code tools such as WPCode to store malicious code and maintain persistence. •Stolen administrative credentials: compromises increased through stolen WordPress and hosting control panel credentials, linking endpoint compromise to website compromise. •Social engineering through compromised websites: campaigns such as SocGholish used fake browser updates, CAPTCHA prompts, and repair messages to trick visitors into installing malware. |
| GoDaddy | 2024 | Network Security Vendor |
| 411 | Google Cybersecurity Forecast 2025 | Bottom Line Up Front (BLUF) Google forecasts that 2025 will bring faster exploitation, more effective social engineering, continued ransomware and extortion, and greater risk from stolen identities. For SMBs and insurance teams, the central takeaway is that common control gaps—weak authentication, unmanaged cloud environments, slow patching, and limited monitoring—will remain highly exploitable and can quickly turn into disruptive, high-cost incidents. Top 3-5 Most Notable Statistics •Average time-to-exploit for disclosed vulnerabilities fell to 5 days, down from 32 days in Google’s prior analysis. •The number of targeted vendors reached 56 in 2023, more than double the 25 observed in 2018. •Ransomware and extortion operations in 2024 affected more than 100 countries and every industry vertical. •Newly identified data leak sites doubled in 2024 compared with 2023. •Since 2020, reported Web3 heists have resulted in over $12 billion in stolen digital assets. Top 3-5 Exploitable Technology Risks •Stolen credentials from infostealer malware, especially where two-factor authentication is not enforced. •Hybrid identity environments spanning on-premises and multi-cloud systems, where one compromised identity can create downstream access risk. •Internet-exposed edge and network devices such as firewalls, VPN gateways, switches, and routers, including zero-day and n-day exploitation. |
| 2025 | Cloud Provider / Hyperscaler | |
| 412 | GreyNoise Early Warning Signals Attacker Behavior Precedes New Vulnerabilities Report 2025 | Bottom Line Up Front (BLUF) The provided report excerpt does not include the substantive findings, evidence, statistics, or vulnerability details needed to assess attacker behavior or specific SMB exposure. The only clear takeaway from the available text is that GreyNoise positions its intelligence as useful for improving SOC capacity, prioritizing urgent vulnerabilities, and identifying emerging threats. Top 3-5 Most Notable Statistics No strong statistics identified in the report. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs Based on the provided excerpt, the report does not give enough detail to identify specific business impacts such as downtime, financial loss, incident frequency, affected technologies, or likelihood of targeting. For a typical small or medium-sized business, the relevant business theme is operational readiness: the excerpt emphasizes the need to improve security operations capacity, prioritize the most urgent vulnerabilities, and find emerging threats. Those areas matter because SMBs often need to decide which risks require immediate attention when security resources are limited. Insurance & Risk Management Implications The provided excerpt does not include claims data, loss trends, underwriting guidance, coverage issues, or control benchmarks. Insurance teams and SMB risk managers should therefore avoid drawing conclusions from this excerpt about expected claim frequency, severity, or specific control requirements. The excerpt does support one risk-management point: organizations may benefit from processes or tools that help identify emerging threats and prioritize urgent vulnerabilities, especially where security teams must triage many alerts or exposures. Recommended Actions •Review whether the organization has a clear process to prioritize urgent vulnerabilities, rather than treating all issues as equal. |
| GreyNoise | 2025 | Security Research Vendor |
| 413 | GreyNoise Mass Internet Exploitation Report 2025 | Bottom Line Up Front (BLUF) Mass internet exploitation is becoming faster, more automated, and less focused on only newly disclosed vulnerabilities. For SMBs and insurance teams, the key takeaway is that internet-facing systems, older unpatched vulnerabilities, routers, and edge devices can become part of large-scale attacks even when the business is not individually targeted. Top 3-5 Most Notable Statistics •40% of exploited vulnerabilities in 2024 were from 2020 or earlier, with some dating back to the 1990s. •GreyNoise detected exploitation of 29 vulnerabilities before they were added to CISA’s Known Exploited Vulnerabilities catalog. •Ransomware groups leveraged 28% of the CISA Known Exploited Vulnerabilities that GreyNoise tracked in 2024. •A May 2024 exploitation surge was traced to 12,000+ hacked Android devices. •Attackers are exploiting vulnerabilities within hours of disclosure. Top 3-5 Exploitable Technology Risks •Home internet routers, including ISP-provided fiber modems, are being hijacked to build botnets used in global cyberattacks. •Legacy CVEs remain high-risk because attackers continue to revive and automate exploitation of older vulnerabilities. •Newly disclosed vulnerabilities and zero-days are dangerous during the short window between public proof-of-concept release and broad patch deployment. |
| GreyNoise | 2025 | Security Research Vendor |
| 414 | GreyNoise State of the Edge Report 2026 | Bottom Line Up Front (BLUF) GreyNoise’s core finding is that internet-facing “edge” systems—VPNs, routers, remote access services, and emerging AI/LLM servers—are being hit continuously and at scale. For SMBs and insurance teams, the practical takeaway is that exposure on the public internet is no longer a background IT issue; it is a primary path attackers probe for access. Top 3-5 Most Notable Statistics •2.97 billion malicious sessions were observed across 162 days, averaging 212 sessions per second. •Palo Alto GlobalProtect received 16.7 million sessions, more than Cisco and Fortinet combined. •52% of remote code execution attempts came from IPs with no prior GreyNoise history. •A credential-spraying campaign grew from 2,000 to 300,000 participating IPs over 72 days, with 73% classified as residential. •Pre-2015 CVEs generated 7.3 million sessions, 4x more than 2023-2024 CVEs combined. Top 3-5 Exploitable Technology Risks •Internet-facing VPN appliances, especially Palo Alto GlobalProtect, Cisco SSL VPN, and Fortinet SSL VPN, because compromise can provide direct network access. •Remote Desktop services exposed to the internet, especially where credential spraying can test many accounts across many residential IPs. •Router management interfaces, including MikroTik and ASUS router targets, because compromised routers can support later campaigns. |
| GreyNoise | 2026 | Security Research Vendor |
| 415 | GRF Top Risks Report 2026 | Bottom Line Up Front (BLUF) GRF’s 2026 report highlights a convergence of cyber threats, AI adoption risk, business continuity pressure, and governance challenges that can materially disrupt organizations with limited resources. For SMBs and insurance teams, the key takeaway is that cyber resilience now depends not only on security tools, but also on governance, vendor oversight, user training, and disciplined technology adoption. Top 3-5 Most Notable Statistics •58% of respondents in the referenced ISACA report said the number of cyberattacks was higher or the same compared with the prior year. •44% of compromised organizations reported social engineering, including business email compromise, as an attack vector. •37% reported exploited vulnerabilities, including unpatched, misconfigured, and known weaknesses. •43% of organizations were in the early education or experimentation phase for AI within cybersecurity. •20% reported implementing AI in high-priority systems, while 9% reported full integration with modified workflows. Top 3-5 Exploitable Technology Risks •Social engineering and business email compromise, which remain the most cited compromise method in the report’s referenced data. •Unpatched, misconfigured, or known system vulnerabilities that attackers can exploit to gain access or disrupt operations. •Malware and ransomware, which can create operational disruption, financial loss, and recovery challenges. |
| GRF | 2026 | Consulting / Analyst Firm |
| 416 | GRIT Ransomware Report 2022 Annual Report | Bottom Line Up Front (BLUF) Ransomware remained a high-frequency, high-impact threat in 2022, with GuidePoint tracking thousands of publicly posted victims across many industries and countries. For SMBs and insurance teams, the key takeaway is that ransomware risk is broad, recurring, and increasingly tied to both encryption and data theft, not just business interruption from locked systems. Top 3-5 Most Notable Statistics •2,507 publicly posted ransomware victims were tracked in 2022. •Ransomware groups publicly posted an average of 6.87 victims per day. •GuidePoint tracked 54 ransomware groups using double-extortion methods. •Western countries represented 77% of publicly posted victims, with the United States accounting for 38.9%. •Q4 had 656 publicly posted victims, 30 tracked ransomware groups, and an average posting rate of 7.13 victims per day. Top 3-5 Exploitable Technology Risks •Vulnerability exploitation was described as one of the most effective methods for initial access, with some critical vulnerabilities exploited at disclosure or weaponized within days. •Open RDP and SSH exposed to the internet remained commonly exploited by threat actors. •Unpatched and dated vulnerabilities continued to be successfully used for initial access. |
| GuidePoint Security | 2022 | Consulting / Analyst Firm |
| 417 | GRIT Ransomware Report 2023 Annual Report | Bottom Line Up Front (BLUF) Ransomware and extortion activity rose sharply in 2023, with publicly observed victim postings nearly doubling year over year. For SMBs and insurance teams, the key takeaway is that both sophisticated ransomware groups and lower-skill, short-lived actors are creating more frequent, more varied, and less predictable loss scenarios. Top 3-5 Most Notable Statistics •GuidePoint Security observed 4,519 publicly posted ransomware victims in 2023. •Public ransomware victim postings increased 80.1% from 2022 to 2023. •The United States accounted for 2,199 victims, or 49% of observed ransomware attacks. •The top ten most impacted industries represented 62% of all posted victims. •Manufacturing and Technology were the two most impacted industries, representing 12.9% and 7.9% of victims, respectively. Top 3-5 Exploitable Technology Risks •Internet-exposed managed file transfer software, highlighted by Clop’s mass exploitation of MOVEit, enabled large-scale data theft and extortion. •Zero-day vulnerabilities in enterprise software were used to compromise victims at scale and are expected to remain attractive to ransomware operators. •Help desk and account recovery processes were exploited through social engineering to gain access to privileged accounts and bypass identity and access management. |
| GuidePoint Security | 2023 | Consulting / Analyst Firm |
| 418 | GRIT Ransomware Report 2024 | Bottom Line Up Front (BLUF) Ransomware activity remained elevated in Q1 2024 despite law enforcement disruption of major groups, with more victims and more active groups than the prior year. For SMBs and insurance teams, the key takeaway is that disruption of large ransomware brands does not remove the risk; affiliates can shift to other groups, and lower-sophistication attacks such as phishing, exposed Remote Desktop Protocol, and weak baseline security remain highly relevant. Top 3-5 Most Notable Statistics •1,024 publicly posted ransomware victims were observed in Q1 2024, a 19.2% increase over Q1 2023. •Active ransomware groups increased from 29 in Q1 2023 to 45 in Q1 2024, a 55% increase. •The United States accounted for 537 of 1,024 observed victim posts, or 53% of the total. •US-based healthcare organizations accounted for 53 of 66 observed healthcare victim posts, or 80%. •23 Developing, Rebrand, and Established ransomware groups were responsible for 95.5% of observed victim posts. Top 3-5 Exploitable Technology Risks •Phobos and Faust activity relied primarily on phishing and Remote Desktop Protocol abuse for initial access. •Faust used VBA macros in Microsoft Office documents to trigger PowerShell, download encoded data, and start file encryption. •Exposed RDP Port 3389 was specifically highlighted as a risk when not required for a business purpose. |
| GuidePoint Security | 2024 | Consulting / Analyst Firm |
| 419 | GSMA Mobile Telecommunications Security Landscape 2026 | Bottom Line Up Front (BLUF) GSMA’s 2026 report shows that mobile networks, devices, and consumers are facing a broad and escalating mix of cyberattacks, fraud, scams, and supply chain threats. For SMBs and insurance teams, the key takeaway is that mobile connectivity, cloud/SaaS access, identity controls, and third-party services are now practical attack paths that can lead to data theft, service disruption, fraud losses, and incident response costs. Top 3-5 Most Notable Statistics •BT reported detecting 2,000 potential attack signals per second across its network, equal to 200 million per day. •Deutsche Telekom reported 70 million attacks per day on its honeypot systems. •Virgin Media O2 blocked 1 billion scam text messages on its mobile network. •The report cites $1.4 trillion in global banking fraud losses and separately describes the scam economy as costing victims $1 trillion worldwide. •A major smishing campaign reportedly used 194,000 domains. Top 3-5 Exploitable Technology Risks •Software and API weaknesses: attackers exploit vulnerable code, open-source components, code repositories, and APIs that can expose powerful functions and data. •Weak cyber hygiene: known vulnerabilities, poor patching, weak account security, plaintext passwords, insufficient logging, and poor segmentation remain effective attack paths. •Identity and MFA abuse: threat actors use stolen credentials, token/session reuse, SIM swapping, MFA fatigue, and help desk social engineering to bypass controls. |
| GSMA | 2026 | ISAC / Industry Consortium |
| 420 | GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools | Bottom Line Up Front (BLUF) Google reports that threat actors have moved beyond using AI only for productivity and are now experimenting with AI-enabled malware that can change behavior during execution. For SMBs and insurance teams, the key concern is that AI is lowering the skill barrier for phishing, malware development, reconnaissance, command-and-control development, and data theft across the attack lifecycle. Top 3-5 Most Notable Statistics •First time GTIG identified malware families using large language models during execution to dynamically generate scripts, obfuscate code, or create malicious functions on demand. •2025 saw a maturing underground marketplace for AI-enabled tooling supporting phishing, malware development, vulnerability research, reconnaissance, and technical support. •Threat actors from North Korea, Iran, and the PRC continued misusing generative AI tools across all stages of cyber operations. •PROMPTFLUX variants attempted source-code regeneration on an hourly basis to evade detection. •GTIG observed the first malware in live operations querying an LLM to generate commands for execution, tracked as PROMPTSTEAL. Top 3-5 Exploitable Technology Risks •AI-enabled malware that generates commands or modifies code during execution, including PROMPTSTEAL, PROMPTFLUX, and PROMPTLOCK. •Phishing and social engineering supported by AI-generated lure content, translation, deepfake images and video, and impersonation of trusted organizations or individuals. •Email server exploitation, including activity involving Roundcube, Zimbra, and n-day exploits, plus tooling to steal emails from compromised inboxes. |
| 2025 | Cloud Provider / Hyperscaler | |
| 421 | Hacker-Powered Security Report 2023 | Bottom Line Up Front (BLUF) HackerOne’s 2023 report shows that exploitable vulnerabilities remain the core security concern, and human-led testing is positioned as a practical way to find issues that automated tools may miss. For SMBs and insurance teams, the main takeaway is that web applications, APIs, access controls, and emerging GenAI systems need focused review because these are areas where ethical hackers are actively finding meaningful weaknesses. Top 3-5 Most Notable Statistics •59% of customers said exploited vulnerabilities are their organization’s greatest concern. •91% of HackerOne customers said hackers provide more impactful and valuable vulnerability reports than AI or scanning solutions. •98% of hackers said they hack websites, and 55% said they hack APIs. •The median price of a bug on the HackerOne platform is $500, with a $3,000 90th percentile bounty. •Average remediation time improved by 28%, from 35.5 days to 25.5 days. Top 3-5 Exploitable Technology Risks •Improper access control: The most common valid vulnerability type on the platform, representing 13% of reports, and a recurring high-impact issue. •Information disclosure: The leading high and critical vulnerability category at 12%, creating risk around exposed sensitive or internal data. •Insecure direct object references (IDOR): Highlighted as difficult to scan for and dependent on human testing, making it a key risk for applications handling user data. |
| HackerOne | 2023 | Threat Intelligence Vendor |
| 422 | Hacker-Powered Security Report 2024 | Bottom Line Up Front (BLUF) HackerOne’s 2024 report shows that vulnerabilities are increasing while AI is expanding both the attack surface and the tools available to defenders. For SMBs and insurance teams, the key takeaway is that continuous, human-led testing across critical assets can uncover high-impact issues that automated tools and periodic reviews may miss. Top 3-5 Most Notable Statistics •48% of surveyed security leaders cited generative AI as one of the most significant risks facing their organizations. •Valid vulnerabilities on the HackerOne platform increased 12% over the past year, with 78,042 valid issues found across 1,300+ customer programs. •27% of valid vulnerabilities were rated high or critical. •AI assets included in HackerOne programs increased by 171% over the past year. •High-impact programs averaged 56 researchers and 60 assets in scope, compared with 97 researchers and 34 assets for lower-impact programs. Top 3-5 Exploitable Technology Risks •Cross-site scripting, or XSS, remains the top vulnerability reported to bug bounty programs and can allow attackers to abuse user interactions in web applications. •Misconfiguration is the top vulnerability found in pentests, indicating that weak or incorrect system settings continue to create exploitable exposure. •Insecure direct object reference, or IDOR, is highlighted as a major concern where weak access controls can allow unauthorized access to sensitive records. |
| HackerOne | 2024 | Threat Intelligence Vendor |
| 423 | Hacker-Powered Security Report 2025 | Bottom Line Up Front (BLUF) HackerOne’s 2025 report shows that AI is rapidly expanding both the attack surface and the speed of vulnerability discovery, while long-standing weaknesses in identity, access control, APIs, and business logic remain central business risks. For SMBs and insurance teams, the key takeaway is that security programs must focus less on one-time testing and more on continuous, prioritized exposure management tied to real business impact. Top 3-5 Most Notable Statistics •Valid AI-related vulnerability reports increased by 210% since 2024. •78% of HackerOne customers said concern over AI risks grew in the past year. •13% of organizations reported an AI-related security incident, and 97% of those lacked proper AI access controls. •HackerOne programs paid $81 million in bounties in 2025, up 13% year over year. •HackerOne estimated $3 billion in mitigated loss savings, equivalent to a 15x return on mitigation. Top 3-5 Exploitable Technology Risks •AI systems vulnerable to prompt injection, model manipulation, exposed endpoints, insecure output handling, and sensitive information disclosure. •Broken access control, including Improper Access Control and IDOR, especially across APIs, microservices, and multi-tenant SaaS environments. •Authentication and session integrity flaws, including account takeover paths, weak recovery flows, and privilege escalation. |
| HackerOne | 2025 | Threat Intelligence Vendor |
| 424 | HiddenLayer AI Threat Landscape Report 2024 | Bottom Line Up Front (BLUF) AI adoption is moving faster than AI security, creating a new attack surface that many organizations do not yet understand or control. For SMBs and insurance teams, the key takeaway is that AI risk is not limited to misuse of chatbots; it includes exploitable weaknesses in models, data, third-party AI tools, MLOps platforms, and supply chains that can lead to breaches, fraud, data leakage, and business disruption. Top 3-5 Most Notable Statistics •77% of surveyed companies reported identifying breaches to their AI in the past year; the remainder were uncertain whether their AI models had been attacked. •98% of IT leaders consider at least some AI models crucial to business success. •92% of companies are building their own models to improve business operations. •89% of IT leaders expressed concern about security vulnerabilities associated with integrating third-party AIs. •61% of IT leaders acknowledged shadow AI as a problem within their organizations. Top 3-5 Exploitable Technology Risks •Malicious or hijacked machine learning models that contain reverse shells, post-exploitation payloads, or ransomware-like functionality, creating an entry point into an organization. •Vulnerable model serialization formats, including Pickle, HDF5, and SavedModel, which can allow arbitrary code execution when a model is loaded. •Data poisoning, where attackers manipulate training or fine-tuning data to introduce bias, reduce model accuracy, plant backdoors, or force insecure code suggestions. |
| HiddenLayer | 2024 | AI Security Vendor |
| 425 | HiddenLayer AI Threat Landscape Report 2025 | Bottom Line Up Front (BLUF) AI is now business-critical, but the report shows that many organizations are adopting AI faster than they are securing it. For SMBs and insurance teams, the main takeaway is that AI risk is no longer theoretical: attackers are abusing AI tools, model repositories, third-party integrations, and AI supply chains in ways that can lead to data exposure, fraud, malware execution, business disruption, and unclear liability. Top 3-5 Most Notable Statistics •100% of surveyed IT leaders said AI and ML projects are critical or important to revenue generation within the next 18 months. •89% reported that most or all AI models in production are critical to their business’s success. •75% said AI attacks have increased or remained the same from the previous year. •88% of IT leaders are concerned about vulnerabilities in third-party AI integrations. •Only 16% reported securing AI models with manual or automated red teaming, and only 32% are deploying a technology solution to address AI threats. Top 3-5 Exploitable Technology Risks •Malicious or unsafe AI models from public repositories, especially where insecure formats such as PyTorch/pickle, Keras, or TensorFlow can enable code execution, malware payloads, or model tampering. •Indirect prompt injection in generative AI tools, where attackers hide malicious instructions in emails, documents, websites, images, or other content that an AI assistant can access. •AI model backdoors such as ShadowLogic, which can manipulate a model’s graph structure and trigger attacker-defined behavior without traditional code execution. |
| HiddenLayer | 2025 | AI Security Vendor |
| 426 | HiddenLayer AI Threat Landscape Report 2026 | Bottom Line Up Front (BLUF) HiddenLayer’s report warns that AI risk is shifting from chatbots that answer questions to agentic systems that can take actions, call tools, move data, and initiate workflows. For SMBs and insurance teams, the key issue is that AI is becoming business-critical while visibility, incident response, and third-party control practices remain uneven. Top 3-5 Most Notable Statistics •76% of organizations identify shadow AI as a known or probable risk. •71% say attacks on AI systems have increased or remained the same compared with the previous year. •31% report uncertainty about whether they experienced an AI security breach in the past year. •93% use open-weight models from repositories such as AWS, Azure, and Hugging Face, while fewer than half consistently scan inbound models. •Only 29% have a dedicated AI incident response plan, and only 19% report performing manual or automated AI red teaming. Top 3-5 Exploitable Technology Risks •Agentic AI systems: attackers can exploit tool poisoning, memory manipulation, context hijacking, identity abuse, and action chains that may lead to data exfiltration or unauthorized actions. •Public model repositories and open-weight models: malware, malicious configuration files, unsafe deserialization, and suspicious model files can compromise users who import models without scanning. •Prompt attacks against GenAI: jailbreaks, indirect prompt injection, prompt obfuscation, and techniques such as policy-style prompts can bypass safety guardrails. |
| HiddenLayer | 2026 | AI Security Vendor |
| 427 | Hiscox Cyber Readiness Report 2024 | Bottom Line Up Front (BLUF) Cyber attacks are increasing in frequency and complexity, and Hiscox highlights reputation damage as a major consequence alongside financial loss and operational disruption. For SMBs and insurance teams, the key takeaway is that cyber resilience now depends as much on people, preparation, and governance as it does on technology. Top 3-5 Most Notable Statistics •67% of firms reported an increase in the number of cyber attacks experienced in the past 12 months. •The average number of cyber attacks per organisation increased from 63 in 2022/23 to 66 in 2023/24. •58% of organisations that experienced cyber attacks reported financial loss due to payment diversion fraud, up from 34% the previous year. •61% of organisations believe reputational damage from a cyber attack would significantly damage their business. •Only 18% of ransomware victims were able to fully recover their data after paying a ransom. Top 3-5 Exploitable Technology Risks •Business email compromise, including credential or server compromise, remained the most common point of entry for cyber attacks. •Corporate servers in the cloud were a leading point of entry, reflecting risk from exploited vulnerabilities on virtual servers. •Employee-driven entry points, including social engineering, spoofing, and phishing, increased in prominence. |
| Hiscox | 2024 | Cyber Insurance Carrier |
| 428 | Hiscox Cyber Readiness Report 2026 | Bottom Line Up Front (BLUF) Hiscox’s 2026 report makes clear that cyber attack exposure is now a practical operating risk for small businesses, not a remote technical issue. More than half of surveyed US small businesses experienced at least one attack in the past year, with impacts ranging from customer notification costs and fines to business performance declines, employee stress, and threats to company viability. Top 3-5 Most Notable Statistics •56% of US small businesses experienced at least one cyber attack in the past 12 months. •The average number of attack attempts per business was 2.38. •After an attack, 31% incurred costs to notify customers, 29% experienced bad publicity, 28% saw reduced business performance, 26% incurred substantial fines, and 25% said solvency or viability was materially threatened. •Of businesses that paid a ransom, only 50% recovered all their data, while 27% sustained another attack. •71% of organizations that experienced a cyber attack reported an impact on employees’ mental health. Top 3-5 Exploitable Technology Risks •Corporate-owned internet of things devices were identified as the most common first point of entry, cited by 30%, making connected business devices a key exposure. •Supply chains were cited as a first point of entry by 28%, showing that third-party relationships can create attack paths into small businesses. •Employees were cited as a first point of entry by 27%, including risks tied to weak passwords and suspicious emails. |
| Hiscox | 2026 | Cyber Insurance Carrier |
| 429 | HitchPartners Global CISO Leadership Report 2026 | Bottom Line Up Front (BLUF) The report’s most important takeaway is that security leadership risk is shifting toward governance gaps: third-party risk, AI oversight, cloud misconfiguration, and liability protection. For SMBs and insurance teams, this matters because weak ownership, immature AI controls, and vendor exposure can create preventable loss scenarios even when a company has security leadership in place. Top 3-5 Most Notable Statistics •43% of CISOs report third-party risk as their top security priority for 2026. •73% of organizations lack mature AI governance, with 52% “developing but inconsistent” and 21% “initial/ad hoc.” •75% of CISOs cite data exposure and privacy breaches as the top risk from AI tool use. •36% of private-company CISOs and 20% of public-company CISOs lack executive liability protection. •84% of security leaders lack full confidence in their organization’s ability to assess AI security technical depth. Top 3-5 Exploitable Technology Risks •Third-party risk: The report ranks vendor and supply chain exposure as the leading 2026 security priority, reflecting concern over external dependencies. •AI-enhanced attacks: CISOs identify AI-enhanced attacks as the second-highest attack-vector priority. •Cloud misconfigurations: Cloud misconfiguration is the third-ranked security priority and remains a practical exposure point in cloud environments. |
| HitchPartners | 2026 | Consulting / Analyst Firm |
| 430 | Holiday Travel & Home Security Report 2025 | Bottom Line Up Front (BLUF) Durin’s 2025 report shows that access codes for homes are widely shared during holiday travel and often remain active long after the need has passed. For SMB owners, insurance teams, and risk managers, the key lesson is straightforward: unmanaged digital access creates a visibility gap, because it becomes hard to know who can enter, when they entered, and whether access should still exist. Top 3-5 Most Notable Statistics •78% of homeowners planning overnight holiday travel say they will share an access code with someone. •75% of homeowners have shared access codes with service providers, and 56% of those do not change them consistently afterward. •22% of homeowners have never changed their primary access code. •45% of homeowners use a single code for everyone, including household members, service providers, neighbors, and others. •40% of homeowners report experiencing, or knowing someone who experienced, at least one access-related security incident. Top 3-5 Exploitable Technology Risks •Shared permanent access codes for smart locks, electronic keypads, and garage entry systems, which may remain valid after the original need ends. •Single-code use across multiple people, which prevents clear attribution of who entered. •Low use of temporary codes, despite availability, because creating and managing them is seen as too burdensome. |
| Durin | 2025 | Threat Intelligence Vendor |
| 431 | Homeland Threat Assessment 2024 | Bottom Line Up Front (BLUF) DHS assesses that financially motivated cybercrime, critical infrastructure targeting, AI-enabled abuse, and economic espionage will remain serious threats in 2024. For SMBs and insurance teams, the most important takeaway is that smaller organizations remain attractive targets when attackers perceive them as vulnerable or likely to pay, with losses driven by ransomware, business email compromise, data theft, and operational disruption. Top 3-5 Most Notable Statistics •E-mail hacking schemes caused losses totaling over $2.7 billion in 2022. •The average business recovery period after a ransomware attack is 22 days, and recovery frequently costs 50 times more than the ransom demand. •The global average cost of a data breach in 2023 was $4.45 million, a 15 percent increase over the last three years. •Known ransomware attacks in the United States increased by 47 percent between January 2020 and December 2022. •Ransomware attackers extorted at least $449.1 million globally during the first half of 2023. Top 3-5 Exploitable Technology Risks •Business e-mail compromise: criminals use social engineering or computer intrusion to take over legitimate business e-mail accounts and conduct unauthorized money transfers. •Ransomware and multilevel extortion: attackers encrypt and steal data, then may threaten public release, DDoS attacks, or harassment of customers to force payment. •Misconfigured or vulnerable public-facing websites, webservers, and election-related IT: DHS highlights these as opportunistic targets for cyber actors. |
| DHS | 2024 | Government / Intelligence Agency |
| 432 | Homeland Threat Assessment 2025 | Bottom Line Up Front (BLUF) DHS assesses that the United States faces a high and complex threat environment in 2025, with cyber actors, nation-states, criminal groups, and extremists targeting critical infrastructure, public trust, and economic security. For SMBs and insurance teams, the most actionable takeaway is that ransomware, social engineering, software vulnerabilities, weak configurations, and AI-enabled deception remain practical pathways for disruption, financial loss, and claims. Top 3-5 Most Notable Statistics •DHS seized over 27,000 pounds of fentanyl in the first 10 months of FY 2024, compared with over 43,000 pounds in 2023, a decline of nearly 40 percent while still remaining elevated. •The healthcare and public health sector experienced an 18 percent increase in reported ransomware attacks in calendar year 2023. •Over the last year, at least 8 non-ideological mass casualty attacks occurred in the United States, killing at least 38 and injuring 68. •There were 18 known deliberate chemical- or biological-related incidents in the Homeland over the last year. •Transnational sex trafficking organizations in the United States earn approximately $2.5 billion annually. Top 3-5 Exploitable Technology Risks •Publicly known software and hardware vulnerabilities that foreign cyber actors and criminals can exploit to gain access to networks. •Poor network security configurations that ransomware actors and other malicious cyber actors use to compromise systems. •Default credentials on operational technology devices, which Iranian IRGC-affiliated actors used to compromise and deface devices used by US critical infrastructure entities. |
| DHS | 2025 | Government / Intelligence Agency |
| 433 | HornetSecurity Cyber Security Report 2023 EN | Bottom Line Up Front (BLUF) Email remains a primary attack path, and Microsoft 365 environments are a major focus for both attackers and defenders. For SMBs and insurance teams, the key takeaway is that routine controls—email security, user training, backup, MFA hardening, permissions management, and patching—remain central to preventing ransomware, business email compromise, and data loss. Top 3-5 Most Notable Statistics •Hornetsecurity analyzed more than 25 billion emails during the reporting period. •40.5% of all scanned emails were categorized as unwanted, a 0.5% increase from 2021. •Of unwanted emails, 94.5% were spam or rejected outright, while just over 5% were flagged as malicious. •The most common malicious attachment types were archive files at 28%, HTML files at 21%, Word documents at 12.7%, PDFs at 12.4%, and Excel files at 10.4%. •Phishing was the leading email attack method at 39.6%, while malicious URLs accounted for 12.5%. Top 3-5 Exploitable Technology Risks •Malicious email attachments, especially archive files, HTML files, Word documents, PDFs, Excel files, LNK files, and disk image files used to deliver malware or evade detection. •Phishing, malicious URLs, brand impersonation, and social engineering aimed at tricking users into giving access or executing payloads. •Microsoft 365 data protection misunderstandings, including weak backup and recovery planning and poorly managed sharing permissions in OneDrive for Business and SharePoint Online. |
| Hornetsecurity | 2023 | Email Security Vendor |
| 434 | HornetSecurity Cyber Security Report 2024 EN | Bottom Line Up Front (BLUF) Email remains a primary attack path, and Hornetsecurity’s analysis shows that organizations across nearly every sector are being targeted. For SMBs and insurance teams, the key takeaway is simple: if a business can pay a ransom or holds useful data, it should expect phishing, malicious links, cloud misconfigurations, and supply-chain exposure to be part of its risk profile. Top 3-5 Most Notable Statistics •Hornetsecurity analyzed more than 45 billion emails during the reporting period. •36.4% of all emails were categorized as unwanted. •43.3% of email-based attacks were phishing, making it the top attack technique. •Malicious URLs accounted for 30.5% of email-based attacks, more than doubling compared with the prior data period. •The most common malicious attachment types were HTML files at 37.1%, PDFs at 23.3%, and archive files at 20.8%. Top 3-5 Exploitable Technology Risks •Phishing and malicious URLs in email, which remain common ways for attackers to gain an initial foothold. •Malicious attachments, especially HTML, PDF, and archive files, which attackers use to deliver payloads or make messages appear legitimate. •Microsoft 365 sharing and permissions issues in SharePoint Online and OneDrive for Business, which can lead to accidental or malicious data leakage. |
| Hornetsecurity | 2024 | Email Security Vendor |
| 435 | HornetSecurity Cyber Threat Report 2021 2022 EN | Bottom Line Up Front (BLUF) Email remains a primary entry point for cyberattacks, with phishing, ransomware, malicious attachments, brand impersonation, and Microsoft-related attacks standing out as major business risks. For SMBs and insurance teams, the report’s key message is that everyday inbox activity can lead to credential theft, malware infection, downtime, data exposure, and extortion losses. Top 3-5 Most Notable Statistics •60% of emails received by Hornetsecurity in the first half of 2021 were classified as unsolicited. •33.6% of malicious email attachments used archive files, making them the most common malware delivery format identified. •24.8% of observed attack tactics were phishing, followed by URL-based attacks at 16.2%. •250,000 Microsoft Exchange servers were estimated to have been affected after vulnerabilities were disclosed and mass exploitation followed. •21% of respondents in a Hornetsecurity survey of more than 820 companies had already fallen victim to a ransomware attack. Top 3-5 Exploitable Technology Risks •Email inboxes remain a major gateway for attacks, especially business email compromise, ransomware, phishing, and malware delivery. •Archive file attachments are heavily used to hide malware and may evade scanning if email systems cannot inspect compressed files effectively. •HTML attachments can embed phishing pages directly in email, helping attackers avoid URL filters. |
| Hornetsecurity | 2022 | Email Security Vendor |
| 436 | Hospitality Sector Risk Radar 2025 | Bottom Line Up Front (BLUF) Hospitality businesses face an unusually broad attack surface because booking portals, guest Wi-Fi, remote access, payment systems, property systems, and vendor platforms must often remain accessible. Trustwave’s key finding is that attackers are heavily exploiting public-facing services, making inventory, patching, access control, and incident readiness essential for SMB operators and insurance teams assessing loss exposure. Top 3-5 Most Notable Statistics •61.5% of initial access attempts exploited publicly exposed services. •95,040 vulnerabilities were discovered across hospitality companies in April 2025. •14,318 critical vulnerabilities were exposed to the public Internet. •1,521 exposed vulnerabilities were listed in the CISA Known Exploited Vulnerabilities catalog. •SNMP exposure was 2x higher than the next most frequently exposed service. Top 3-5 Exploitable Technology Risks •Public-facing applications, especially where attackers target Apache Log4j, cross-site scripting, SQL injection, directory traversal, Zerologon, and Windows DNS Server remote code execution vulnerabilities. •Exposed SNMP services, which can allow unauthorized access, infrastructure manipulation, and plaintext data exposure when weak or default community strings or older SNMP versions are used. •Exposed remote administration and access services, including SSH, VPN-related services, RDP, admin dashboards, and cloud platforms, particularly where MFA is not enforced. |
| Trustwave | 2025 | MSP / MSSP / SOC Provider |
| 437 | Huntress 2026 Cyber Threat Report | Bottom Line Up Front (BLUF) Huntress reports that attackers are increasingly winning by using legitimate access, trusted tools, and user deception rather than relying on obvious malware or traditional exploits. For SMBs and insurance teams, the key takeaway is that risk is shifting toward identity compromise, remote management tool abuse, phishing, and stealthy ransomware preparation that can look like normal business activity. Top 3-5 Most Notable Statistics •RMM abuse increased 277% year over year and accounted for 24% of all incidents observed by Huntress. •ClickFix represented 53.2% of all observed malware loader executions. •Ransomware accounted for 5% of all incidents, while average time-to-ransom increased from 17 hours to 20 hours. •Four ransomware groups—Akira, Medusa, Qilin, and Ransomhub—accounted for over 50% of ransomware incidents. •In identity threat detections, access policy and trust boundary violations accounted for 37.2%, mailbox manipulation and persistence for 19%, and adversary-in-the-middle attacks for 18.9%. Top 3-5 Exploitable Technology Risks •Remote monitoring and management tools: Attackers abused legitimate RMM platforms for persistence, command execution, credential theft, staging, and ransomware operations while blending in with normal IT activity. •Microsoft 365 identity and mailbox abuse: Stolen credentials, session hijacking, OAuth abuse, malicious inbox rules, and mailbox manipulation enabled business email compromise and persistent access. •ClickFix and fake CAPTCHA social engineering: Users were tricked into manually running commands through PowerShell, MSHTA, or other built-in tools, leading to infostealers, RATs, and ransomware precursors. |
| Huntress | 2026 | MSP / MSSP / SOC Provider |
| 438 | Identity Security Insights 2024 | Bottom Line Up Front (BLUF) ManageEngine’s report shows that identity security is now a core business risk because attackers increasingly target user accounts, privileged access, and social engineering rather than only networks or devices. For SMBs and insurance teams, the main concern is that many organizations believe they are better protected than their IT and security teams say they are, creating blind spots that can lead to unauthorized access, delayed response, breaches, and compliance issues. Top 3-5 Most Notable Statistics •77% of CISOs reported experiencing an identity-related cyberattack in 2023. •Only 27% of respondents said their organizations were already at zero standing privileges, meaning no permanent user access permissions. •73% to 79% of C-suite respondents said their identity security solutions were “Very capable,” compared with only 54% of ITOps respondents. •CISOs reported 92% visibility and control over enterprise resources, while ITOps and infrastructure experts reported only 48%. •68% of surveyed organizations felt they needed even more tools to meet current identity security needs. Top 3-5 Exploitable Technology Risks •Privileged identity blind spots: Many organizations lack complete visibility into privileged identities and resources, which can allow unauthorized access to go unnoticed. •Permanent access permissions: Low adoption of zero standing privileges leaves users with ongoing access that can be abused if credentials are compromised. •Social engineering and phishing: The report identifies social engineering as a top concern, including AI-generated phishing and attempts to steal privileged identities. |
| ManageEngine | 2024 | Endpoint / MDR / XDR Vendor |
| 439 | Incident Response Analyst Report 2023 | Bottom Line Up Front (BLUF) Kaspersky’s 2023 incident response cases show that attackers most often gained entry through exposed public-facing applications, compromised accounts, and trusted relationships with service providers. For SMBs and insurance teams, the core takeaway is that preventable access weaknesses can quickly turn into ransomware, data leakage, and Active Directory compromise. Top 3-5 Most Notable Statistics •Public-facing applications were the most common initial compromise vector, appearing in 42.37% of cases. •Ransomware was involved in 33.3% of incidents, down from 39.8% the prior year but still described as the primary threat across sectors and industries. •Files were encrypted in 33.33% of service requests, while data leakage appeared in 21.09%. •Compromised accounts accounted for 20.34% of initial access cases, with brute force separately identified in 8.47%. •Evidence of adversary use of legitimate utilities was found in 39.18% of investigated attacks. Top 3-5 Exploitable Technology Risks •Exposed public-facing applications, especially where known vulnerabilities remain unpatched, were the leading entry point and were tied to rapid attacks and ransomware outcomes. •Weak or compromised credentials, including brute force, password spraying, and previously compromised accounts, enabled attackers to access systems using valid accounts. •Trusted relationships and service provider access created a path for attackers to reach multiple victims through one compromised organization. |
| Kaspersky | 2023 | Endpoint / MDR / XDR Vendor |
| 440 | Incident Response Analyst Report 2024 | Bottom Line Up Front (BLUF) Kaspersky’s 2024 incident response data shows that ransomware, exposed systems, stolen credentials, and delayed patching remain the most important practical risks for organizations. For SMBs and insurance teams, the key takeaway is that many serious incidents begin with preventable weaknesses and can lead quickly to encrypted files, data leakage, and extended remediation. Top 3-5 Most Notable Statistics •41.6% of incidents involved files encrypted, making ransomware-style impact the leading visible outcome. •39.2% of incidents began through exploitation of public-facing applications. •31.4% of incidents began with valid accounts, showing the importance of credential protection. •Over 90% of exploited vulnerabilities in 2024 were more than a year old. •Rush attacks had a median attack duration of less than 1 day, while long-lasting attacks had a median duration of 253 days. Top 3-5 Exploitable Technology Risks •Public-facing applications: attackers most often gained initial access by exploiting internet-exposed applications. •Valid accounts: attackers frequently used legitimate credentials, which may indicate prior compromise and credential leakage. •Unpatched vulnerabilities: Microsoft, OpenSSH, Cisco IOS XE, FortiClient EMS, Veeam Backup & Replication, Bitrix Site Manager, Exchange, Active Directory, and SharePoint vulnerabilities were observed in incidents. |
| Kaspersky | 2024 | Endpoint / MDR / XDR Vendor |
| 441 | Incident Response Report 2024 | Bottom Line Up Front (BLUF) Attackers are moving faster, exploiting internet-facing vulnerabilities, stolen credentials, and weak identity processes to steal data before many organizations can respond. For SMBs and insurance teams, the main takeaway is that prevention and response speed now directly affect downtime, extortion pressure, claim severity, and recovery options. Top 3-5 Most Notable Statistics •45.6% of 2023 cases with data exfiltration involved attackers stealing data in less than one day after compromise. •75% of ransomware attacks and breaches handled by Unit 42’s Incident Response Team resulted from internet-facing attack surface exposure. •49% increase in alleged victims posted to dark web leak sites when comparing similar periods in 2022 and 2023. •56% of investigated matters involved malware in some way. •The top six industries accounted for 63% of Unit 42 cases: professional and legal services, high technology, manufacturing, healthcare, finance, and wholesale and retail. Top 3-5 Exploitable Technology Risks •Internet-facing software vulnerabilities, including large-scale exploitation campaigns involving MOVEit, Citrix Bleed, Microsoft Exchange remote code execution, and SugarCRM. •Previously compromised credentials, which the report says grew significantly as an intrusion vector over two years. •Social engineering of IT help desks, self-service password reset abuse, MFA fatigue, and SIM swapping. |
| Palo Alto Networks Unit 42 | 2024 | Network Security Vendor |
| 442 | India Cyber Threat Report 2025 | Bottom Line Up Front (BLUF) India’s cyber threat environment is high-volume, broad-based, and increasingly complex, with Seqrite reporting 369.01 million detections across 8.44 million endpoints. For SMBs and insurance teams, the key takeaway is that risk is not limited to large enterprises or major metro areas: attackers are targeting cloud environments, endpoints, mobile users, email channels, and sectors that hold personal, financial, or operationally critical data. Top 3-5 Most Notable Statistics •Seqrite observed 369.01 million security detections across 8.44 million endpoints, averaging 702 potential threats per minute. •85.44% of detections relied on signature-based methods, while 14.56% came from behavior-based detection, indicating a growing need to detect unknown or evolving threats. •Healthcare was the most attacked sector at 21.82% of attacks, followed by hospitality at 19.57% and banking at 17.38%. •Cloud environments accounted for 62% of total detections, compared with 38% for on-premises environments. •Trojans represented 140.48 million detections, or 43.25% of malware detections. Top 3-5 Exploitable Technology Risks •Cloud environments and insecure cloud adoption, including misconfigured cloud environments and insecure APIs, which the report identifies as likely targets. •Email phishing, malicious links, and malicious attachments used to deliver Trojans, remote access tools, and other malware. •Removable media and network-shared drives used by worms and file infectors to spread across systems. |
| Seqrite | 2025 | Endpoint / MDR / XDR Vendor |
| 443 | India Cyber Threat Report 2026 | Bottom Line Up Front (BLUF) Seqrite’s 2026 report shows a high-volume, continuous threat environment where Indian organizations are being scanned, probed, and attacked at scale. For SMBs and insurance teams, the key takeaway is that common weaknesses such as poor patching, credential reuse, exposed remote services, legacy systems, and social engineering remain enough to drive ransomware, data theft, fraud, and operational disruption. Top 3-5 Most Notable Statistics •265.52 million detections were recorded across more than 8 million endpoints, averaging 505 detections every minute. •Trojans and file infectors dominated with about 88.4 million and 71.1 million detections, together making up nearly 70% of malware detections. •Behaviour-based protections blocked about 34 million advanced threats, including fileless and encryption-based attacks. •Network-based exploits exceeded 9.2 million scans, targeting systems such as WordPress, Apache Tomcat, and SysAid. •Ransomware peaked in January 2025 with 185 incidents and 113,000 detections. Top 3-5 Exploitable Technology Risks •Unpatched internet-facing systems, especially WordPress plugins, Apache Tomcat, SysAid, and MailEnable, were actively exploited and can provide entry into business networks. •Exposed remote access and credential reuse were linked to ransomware, cryptojacking, and remote service compromise. •Legacy Windows environments, USB-based infections, AutoRun, SMB weaknesses, and older endpoint infrastructure continued to support worms, infectors, and lateral movement. |
| Seqrite | 2026 | Endpoint / MDR / XDR Vendor |
| 444 | Infiltrate and Escalate: The 2025 Access Brokers Report | Bottom Line Up Front (BLUF) Initial Access Brokers are selling compromised business access cheaply and at scale, often bundled with privileges that make follow-on attacks easier. For SMBs and insurance teams, the key issue is that a company whose access appears on a broker forum has already been compromised and may soon face a second-stage attack such as data theft, ransomware delivery, or broader network escalation. Top 3-5 Most Notable Statistics •71.4% of access broker sales included more than a single access vector, adding at least one privilege or multiple access/privilege combinations. •The average base sale price across Exploit, XSS, and BreachForums was $2,726, with many sales clustered in the $500 to $1,000 range. •VPN access appeared in 23.5% of sales across the three forums, followed by Domain User access at 19.9% and RDP at 16.7%. •39% of all base pricing across the three forums fell inside the $500 to $1,000 range. •Rapid7 observed valid credentials without sufficient MFA in 56% of Q1 2025 incident response cases, and exposed RDP services abused in 44% of observed attacks. Top 3-5 Exploitable Technology Risks •VPN access using valid credentials without sufficient MFA, allowing attackers to blend in with expected remote access traffic. •Exposed RDP services, which brokers sell as direct remote access into business environments. •Domain User, Domain Admin, and Local Admin accounts, which can support network exploration, lateral movement, and escalation. |
| Rapid7 | 2025 | Threat Intelligence Vendor |
| 445 | Information Risk Insights Study 2025: It's About Time | Bottom Line Up Front (BLUF) Cyber incidents are becoming more frequent and more expensive, and SMBs are not outside the target zone. The report shows smaller businesses account for the largest overall share of incidents, while losses have grown enough that even a single event can materially affect revenue, claims severity, and insurability. Top 3-5 Most Notable Statistics •On average, about 3,000 significant security incidents are publicly reported or discovered each quarter, a 650% increase over 15 years. •The annual probability of any given organization experiencing a cyber event has almost quadrupled since 2008. •The probability of a firm under $100M in annual revenue suffering an incident has more than doubled. •Typical security incident losses have risen 15-fold, from about $190K to almost $3 million. •Extreme “tail loss” events have increased 5-fold, reaching $32 million. Top 3-5 Exploitable Technology Risks •Compromised user credentials remain the most common intrusion technique, fluctuating between 43% and 60% of incidents over the last decade. •Phishing remains a persistent way attackers obtain credentials and gain initial access. •Exploitation of public-facing applications has risen sharply and is especially relevant for smaller firms. |
| Cyentia | 2025 | Research Organization |
| 446 | Infrastructure as Code Security Insights 2021 | Bottom Line Up Front (BLUF) Infrastructure as Code can speed up cloud deployment, but the report shows that many organizations are still finding security issues too late, after infrastructure is already running. For SMBs and insurance teams, the key takeaway is that automated security testing in release pipelines materially improves how quickly teams detect and fix misconfigurations, reducing the time a business may operate with exposed cloud or container infrastructure. Top 3-5 Most Notable Statistics •76% of teams with fully automated security checks said they can fix an issue in under one day, compared with 59% for teams with no or partial automation and 38% for teams that only check after deployment. •63% of companies are just starting out with Infrastructure as Code, while only 7% say they have implemented it to the best of current industry capabilities. •60% of respondents said their Infrastructure as Code and configuration code goes through continuous integration testing, but only 32% include security checks in those pipelines. •52% of respondents usually remediate a security issue by directly changing the infrastructure instead of fixing the Infrastructure as Code source. •61% cited speed-related issues as a reason for manually remediating security issues. Top 3-5 Exploitable Technology Risks •Cloud and container misconfigurations that remain undiscovered until after deployment, leaving running environments exposed. •Known vulnerabilities and misconfigurations in containers that could have been remediated before deployment. •Direct manual changes to live infrastructure instead of fixing the Infrastructure as Code source, which can create drift or cause the same misconfiguration to return on the next deployment. |
| Snyk | 2021 | Threat Intelligence Vendor |
| 447 | Inside the Mind of a Hacker 2024 (Volume 8) | Bottom Line Up Front (BLUF) Bugcrowd’s 2024 survey shows that hackers are rapidly adopting AI while also seeing AI systems and connected hardware as expanding attack surfaces. For SMBs and insurance teams, the key takeaway is that AI-enabled tools, smart devices, and internet-connected hardware can create new paths to data exposure, operational disruption, and reputation damage if security testing remains narrow or one-time. Top 3-5 Most Notable Statistics •77% of hackers use AI technologies to hack. •86% say AI has fundamentally changed their approach to hacking. •93% say companies using AI tools have introduced a new attack vector for threat actors to exploit. •82% believe the AI threat landscape is evolving too rapidly to adequately secure. •81% of hardware hackers encountered a new vulnerability type in the past 12 months. Top 3-5 Exploitable Technology Risks •AI-powered applications and tools: hackers overwhelmingly view AI systems as a new attack vector, including risks such as prompt injection and misconfigured AI bots that may expose backend systems. •Internet-connected hardware and IoT devices: network-enabled devices expand the attack surface and may provide access to other devices or cloud infrastructure. •AI-powered hardware and software: hardware hackers report confidence in attacking AI-powered systems, raising concern for products that combine physical devices, software, and cloud services. |
| Bugcrowd | 2024 | Security Research Vendor |
| 448 | Insider Risk Report 2026 | Bottom Line Up Front (BLUF) Insider risk is now a routine operational and financial exposure, not an occasional employee misconduct issue. Gurucul’s survey shows rising incident frequency, higher remediation costs, and growing risk from AI tools that operate inside trusted business systems, making this especially important for SMBs and insurance teams assessing preventable losses. Top 3-5 Most Notable Statistics •90% of organizations experienced at least one insider incident in the past 12 months. •56% reported six or more insider incidents annually. •52% of insider incidents cost $500,000 or more to remediate, and 28% exceeded $1 million. •94% said rapid AI adoption is increasing insider risk exposure. •66% still struggle with insider threat detection accuracy, while 58% cite tool and data fragmentation as a primary obstacle. Top 3-5 Exploitable Technology Risks •Excessive or accumulated access privileges, especially when access is not consistently reviewed. •Cloud applications, web exposure, and collaboration platforms where sensitive data is widely distributed. •AI copilots and generative AI tools that can access email, documents, calendars, and connected systems using employee privileges. |
| Gurucul | 2026 | SIEM / Security Analytics Vendor |
| 449 | Insider Threat Report 2024 | Bottom Line Up Front (BLUF) Insider threats are becoming more frequent, costly, and difficult to manage, especially as organizations operate across hybrid work, cloud services, SaaS applications, and new technologies. For SMB owners and insurance teams, the key takeaway is that trusted users with legitimate access can create serious financial and operational losses when monitoring, access control, training, and response plans are weak. Top 3-5 Most Notable Statistics •48% of organizations said insider attacks became more frequent over the past 12 months. •51% of organizations experienced six or more insider attacks in the last year. •29% of respondents reported average remediation costs exceeding $1 million after an insider attack. •45% of organizations said recovery from an insider attack can take up to a week or longer. •71% of organizations feel at least moderately vulnerable to insider threats. Top 3-5 Exploitable Technology Risks •Complex IT environments, including remote access, cloud services, and SaaS applications, expand the attack surface and make insider activity harder to control. •Adoption of new technologies such as IoT and AI can increase vulnerabilities and create new attack vectors. •Inadequate security measures, including insufficient data protection and inconsistent policies, enable insider risk. |
| Gurucul | 2024 | SIEM / Security Analytics Vendor |
| 450 | Insider Threats Loom while Ransom Payment Rates Plummet | Bottom Line Up Front (BLUF) Coveware reports that ransom payments fell sharply in Q3 2025, but ransomware and extortion risk remains highly relevant to SMBs because mid-market companies are still heavily impacted by high-volume RaaS campaigns. Attackers are increasingly exploiting identity, remote access, social engineering, configuration gaps, and data theft to create pressure even when backups reduce the need to pay for decryption. Top 3-5 Most Notable Statistics •Average ransom payment fell to $376,941, down 66% from Q2 2025; median ransom payment fell to $140,000, down 65%. •Overall ransom payment rates across encryption, data exfiltration, and other extortion fell to a historical low of 23%. •Data exfiltration-only incidents resulted in payment in 19% of cases, another record low. •Akira was the leading ransomware variant with 34% market share, followed by Qilin at 10%. •Exfiltration was observed in 76% of Coveware cases, and lateral movement appeared in 73%. Top 3-5 Exploitable Technology Risks •Remote access compromise through VPNs, cloud gateways, and SaaS integrations, especially where credentials are weak, old, or poorly monitored. •Configuration debt, including old local accounts, unrotated credentials, and insufficiently monitored OAuth tokens. •Helpdesk and SaaS support social engineering, including abuse of help-desk processes to gain OAuth authorization. |
| Coveware | 2025 | Consulting / Analyst Firm |
| 451 | Insights for Software Supply Chain Attacks 2025 | Bottom Line Up Front (BLUF) Software supply chain attacks are a high-impact risk because a single compromised open-source library, package, or development workflow can spread across many applications and systems before a business realizes it is exposed. For SMBs and insurance teams, the key takeaway is that dependency visibility, AI-generated code review, and early detection of attacker behavior are now central to reducing breach, downtime, and claims risk. Top 3-5 Most Notable Statistics •Top 25 software supply chain attacks are highlighted by Armis Labs, with associated methods and mitigation strategies. •AI coding tools may generate code snippets with exploitable flaws in as many as half of cases, according to the report. •“Vibe coding” with LLM-generated code suggestions showed vulnerabilities 40% of the time. •The slopsquatting package ccxt-mexc-futures was downloaded more than 1,065 times before removal. •A compromised GitHub Actions incident affected 23,000 repositories, depending on whether memory-scanning succeeded. Top 3-5 Exploitable Technology Risks •AI-suggested nonexistent packages, or “slopsquatting,” where attackers register hallucinated package names and place malicious code in public repositories. •Open-source dependency compromise, including malicious code injected into libraries and propagated to downstream users. •Dependency confusion and typo-style package attacks that mimic legitimate packages. |
| Armis | 2025 | OT/ICS Security Vendor |
| 452 | Intangible Versus Tangible Risks Comparison Report 2024 | Bottom Line Up Front (BLUF) Aon’s 2024 report shows that organizations often face greater loss potential from information assets, cyber events, AI, and intellectual property than from physical property, yet they insure and manage those intangible risks less consistently. For SMBs and insurance teams, the key takeaway is that cyber and IP exposures can create serious financial disruption, but coverage, controls, and risk assessment often lag behind the actual exposure. Top 3-5 Most Notable Statistics •56% of organizations experienced a material or significantly disruptive security exploit or data breach one or more times in the past 24 months. •The average financial impact of those cyber incidents was $5 million. •Organizations estimated average probable maximum loss from stolen or destroyed information assets at $1.155 billion, compared with $846 million for PP&E. •Only 19% of information assets are covered by insurance on average, compared with 60% of PP&E assets. •70% of respondents said their organizations are not purchasing standalone cyber insurance coverage. Top 3-5 Exploitable Technology Risks •Human error, mistakes, and negligence: 53% of respondents said this was the root cause of their data breach or security exploit, but only 33% said insurance covers it. •External attacks by cyber criminals: these remain a major covered incident type, with 78% of insured respondents reporting coverage for them. •Malicious or criminal insiders: 76% of insured respondents reported coverage for insider incidents. |
| Aon | 2024 | Cyber Insurance Carrier |
| 453 | International AI Safety Report 2026 | Bottom Line Up Front (BLUF) General-purpose AI is improving quickly and is already being used in real-world fraud, cyber operations, and high-stakes business workflows. For SMBs and insurance teams, the key takeaway is that AI can increase the speed and sophistication of familiar risks while current safeguards, testing, and governance practices remain incomplete. Top 3-5 Most Notable Statistics •700 million people use leading AI systems weekly, with adoption exceeding 50% of the population in some countries but likely below 10% across much of Africa, Asia, and Latin America. •In one premier cyber competition, an AI agent identified 77% of vulnerabilities in real software, placing in the top 5% of more than 400 mostly human teams. •One AI developer reported a threat actor used AI models to automate 80–90% of the effort involved in an intrusion, with humans intervening at critical decision points. •Participants misidentified AI-generated text as human-written 77% of the time, and listeners mistook AI-generated voices for real speakers 80% of the time. •12 companies published or updated Frontier AI Safety Frameworks in 2025. Top 3-5 Exploitable Technology Risks •AI-generated voice, video, image, and text content can support fraud, extortion, impersonation, defamation, and social engineering. •AI systems can help attackers identify software vulnerabilities, generate malicious code, and automate technical cyberattack tasks. •Semi-autonomous cyber operations can reduce the need for human effort, even though fully autonomous end-to-end attacks have not been reported. |
| Crown International | 2026 | Research Organization |
| 454 | Internet Crime Report | Bottom Line Up Front (BLUF) Internet crime losses reported to the FBI reached a new high, with fraud driving most reported financial harm and ransomware remaining a major cyber threat to critical infrastructure. For SMBs and insurance teams, the most important takeaway is that common business processes—email, payments, customer support interactions, and incident reporting—remain central to both loss creation and loss recovery. Top 3-5 Most Notable Statistics •$16.6 billion in reported losses in 2024, a 33% increase from 2023. •859,532 complaints were reported to IC3 in 2024; 256,256 complaints reported an actual loss. •Cyber-enabled fraud accounted for 333,981 complaints and $13.7 billion in losses, representing 83% of all reported losses. •Business Email Compromise caused $2.77 billion in reported losses from 21,442 complaints. •Cryptocurrency-related complaints totaled 149,686, with $9.32 billion in reported losses. Top 3-5 Exploitable Technology Risks •Phishing and spoofing: attackers use email, text messages, and calls that appear legitimate to obtain personal, financial, or login information. •Business Email Compromise: criminals compromise email accounts or other communications, including phone numbers and virtual meeting applications, to trigger unauthorized fund transfers. •Ransomware: malicious software blocks access to systems until money is paid; IC3 identified ransomware as the most pervasive threat to critical infrastructure. |
| Federal Bureau of Investigation | 2026 | Threat Intelligence Vendor |
| 455 | Internet Crime Report | Bottom Line Up Front (BLUF) Cryptocurrency-enabled fraud produced very high reported losses in 2023, with investment scams driving the largest share. For SMBs and insurance teams, the key takeaway is that criminals are exploiting trust, fake platforms, fast irreversible payments, and cryptocurrency kiosks to convert social engineering into large financial losses that may be difficult to recover. Top 3-5 Most Notable Statistics •IC3 received 69,468 cryptocurrency-related complaints in 2023. •Reported cryptocurrency-related losses totaled $5.6 billion. •Cryptocurrency-related losses increased 45% since 2022. •Investment fraud accounted for $3.96 billion in cryptocurrency-related losses. •Cryptocurrency kiosk scams generated more than 5,500 complaints and over $189 million in losses. Top 3-5 Exploitable Technology Risks •Fraudulent cryptocurrency investment websites and apps: criminals use fake platforms to show false profits, encourage more deposits, and block withdrawals. •Cryptocurrency wallets and private keys: transfers can be made quickly with a private key and an Internet connection, and transactions are generally irreversible. •Decentralized applications and token permissions: victims may connect wallets to scam sites or apps that later drain funds. |
| Federal Bureau of Investigation | 2026 | Threat Intelligence Vendor |
| 456 | Internet Organized Crime Threat Assessment 2025 | Bottom Line Up Front (BLUF) Europol’s 2025 IOCTA identifies stolen data and stolen access as core fuel for cybercrime, with criminals repeatedly stealing, selling, reusing, and reselling credentials, personal data, payment data, and access to business systems. For SMBs and insurance teams, the main concern is that ordinary business technologies such as email, VPNs, cloud environments, web servers, online shops, and remote access services are being actively exploited through both human deception and technical weaknesses. Top 3-5 Most Notable Statistics •394,000 Windows computers globally were identified by Microsoft as infected by the Lumma infostealer. •LabHost was linked to at least 40,000 phishing domains and around 10,000 users worldwide. •Initial Access Broker activity surged in 2024, with advertised access prices increasing by almost 50%. •Cracked had over 4 million users and more than 28 million posts advertising cybercrime tools and stolen information, generating approximately USD 4 million in revenue. •Nulled had more than 5 million users and over 43 million posts advertising cybercrime tools and stolen information, generating approximately USD 1 million per year. Top 3-5 Exploitable Technology Risks •Stolen credentials for remote services such as RDP, VPNs, firewalls, network devices, cloud environments, and corporate accounts, which can be sold as initial access to business systems. •Phishing kits and fraudulent websites used to steal login credentials from employees and customers. •Infostealer malware that extracts credentials, application tokens, session cookies, browser data, device details, and other sensitive information. |
| Europol | 2025 | Government / Intelligence Agency |
| 457 | Interpol Africa Cyberthreat Assessment Report 2025 (4th Edition) | Bottom Line Up Front (BLUF) Cybercrime is accelerating across Africa, with online scams, phishing, ransomware, business email compromise, and digital sextortion identified as leading threats. For SMBs and insurance teams, the key takeaway is that financially motivated attacks are widespread, increasingly sophisticated, and capable of causing direct theft, operational disruption, data exposure, and recovery costs. Top 3-5 Most Notable Statistics •Cyber incidents across Africa caused estimated financial losses exceeding USD 3 billion between 2019 and 2025. •Cybercrime accounts for more than 30% of all reported crimes in both Western and Eastern Africa. •Phishing accounts for 34% of all cyber incidents detected across Africa. •90% of surveyed agencies said law enforcement or prosecution capacity needs some or significant improvement. •Operation Serengeti led to over 1,000 arrests, the dismantling of 134,000 malicious online infrastructures, and the identification of more than 35,000 victims. Top 3-5 Exploitable Technology Risks •Phishing and social engineering: Attackers impersonate trusted organizations through email, messaging platforms, fraudulent websites, smishing, vishing, and social media to steal credentials, financial data, and personal information. •Business email compromise: Criminals use phishing, impersonation, lookalike domains, bank account detail change fraud, and WhatsApp-based social engineering to manipulate payments. •Ransomware and double extortion: Ransomware groups encrypt systems, steal data, and threaten public leaks, creating both downtime and privacy exposure. |
| Interpol | 2025 | Threat Intelligence Vendor |
| 458 | INTERPOL Asia and South Pacific Cyber Threat Assessment Report 2025/2026 | Bottom Line Up Front (BLUF) Cybercrime in the Asia and South Pacific region is growing in scale, sophistication, and business impact, with online scams, infostealers, ransomware, phishing, and AI-enabled fraud leading the threat landscape. For SMBs and insurance teams, the key takeaway is that attackers are exploiting both people and weak digital controls to steal credentials, disrupt operations, and enable follow-on fraud or ransomware. Top 3-5 Most Notable Statistics •More than 135,000 ransomware-related attacks were recorded in the region in 2024, affecting sectors including real estate, manufacturing, and financial services. •5.5 out of every 1,000 individuals in the region clicked phishing links monthly, with cloud applications accounting for 28% of phishing clicks. •DDoS attacks surged by 92% in 2024 compared with the previous year. •Threat monitoring identified 3,878,757,062 email-based threats blocked in 2024, making email the primary channel for phishing, malware distribution, and social engineering. •66.7% of surveyed law enforcement respondents reported adopting AI tools and systems. Top 3-5 Exploitable Technology Risks •Phishing and social engineering, including spear-phishing, smishing, and AI-generated messages, remain highly effective because they exploit human trust rather than only technical weaknesses. •Infostealer malware such as RedLine, LummaC2, Loki, Negasteal, and ZBot can harvest credentials, financial data, crypto wallet information, and personally identifiable information, enabling account takeover, fraud, and follow-on ransomware. •Ransomware and ransomware-as-a-service are significant risks, including attacks using double extortion that combine encryption with data theft. |
| Interpol | 2026 | Threat Intelligence Vendor |
| 459 | Intezer AI SOC Report 2026 | Bottom Line Up Front (BLUF) Intezer’s 2026 AI SOC Report shows that real threats are often hidden inside alerts that security teams commonly ignore, especially low-severity, identity, phishing, endpoint, and cloud alerts. For SMBs and insurance teams, the key takeaway is that alert volume and severity labels alone are not reliable indicators of risk; missed triage, misconfigurations, and trusted-service abuse can create meaningful loss exposure. Top 3-5 Most Notable Statistics •25 million security alerts were analyzed across live enterprise SOC environments. •Over 60% of alerts are ignored by SOC and MDR teams, especially low-severity alerts. •Nearly 1% of real threats came from low-severity alerts; for organizations with 450,000 alerts per year, this equates to roughly 54 real threats per year, or about one per week, never investigated. •Intezer investigated 9.25 million endpoint alerts; 43% were informational or low severity, and nearly 2% of those were real incidents. •Over 550,000 user-reported phishing emails were analyzed, with 42,000 confirmed phishing emails. Top 3-5 Exploitable Technology Risks •Low-severity and informational alerts can contain real incidents, creating risk when teams auto-close or deprioritize them. •Endpoint protection may not fully mitigate threats: over half of endpoint alerts were not automatically mitigated, and in more than half of confirmed compromised endpoints reviewed through live scans, the endpoint protection had reported the alert as mitigated. •Phishing increasingly abuses trusted brands, cloud services, code sandboxes, and file formats such as SVG, PDF, OneDrive shares, and OpenXML documents to bypass controls and harvest credentials. |
| Intezer | 2026 | Threat Intelligence Vendor |
| 460 | Kibu Quarterly Threat Report Q1 2026 | Bottom Line Up Front (BLUF) Kibu’s Q1 2026 report argues that identity verification, especially in remote hiring, has become a critical security gap. For SMBs and insurance teams, the key issue is that North Korean “fake employees” can bypass traditional defenses by being hired legitimately, receiving valid credentials, and then stealing data, intellectual property, or wages. Top 3-5 Most Notable Statistics •98% of successful cyber intrusions in 2024 are estimated to have begun with a social engineering attempt. •Scam-related financial losses rose 121% in 2024, surpassing digital payment fraud as the leading fraud category. •A survey of 3,000 IT and cybersecurity professionals ranked AI-driven social engineering as the top cyber threat for 2026. •Illegal cyber attacks are estimated to provide 40% of North Korea’s WMD funding, with these operations generating an estimated $2 billion for the DPRK regime. •SentinelOne reportedly received more than 1,000 DPRK-linked job applications. Top 3-5 Exploitable Technology Risks •Remote hiring processes that accept fabricated identities, synthetic faces, fake documents, or AI-generated voices. •Valid employee credentials issued to malicious actors, allowing them to bypass defenses by operating as insiders. •Legacy credential weaknesses, including hanging credentials, exposed weak passwords, and stolen credentials from SIM swapping. |
| Kibu | 2026 | Threat Intelligence Vendor |
| 461 | KnowBe4 Cybersecurity Culture Report 2021 | Bottom Line Up Front (BLUF) KnowBe4’s 2021 report shows that security culture remains a material business risk: no industry reached a “Good” security culture score, and the global average remained only moderate. For SMBs and insurance teams, the key takeaway is that employee behavior, phishing readiness, password hygiene, and incident reporting access are directly tied to ransomware, credential misuse, data theft, and business interruption risk. Top 3-5 Most Notable Statistics •More than 320,000 employees across 1,872 organizations were included in the largest stated study of security culture. •94% of surveyed security leaders reported that security culture is the most important element in their security strategy. •Organizations with poor security culture had a 52 times higher risk of employees sharing credentials. •The mean and median total security culture score was 73, which falls in the “Moderate” range. •77% of employees reported they do not use any means to securely store their passwords. Top 3-5 Exploitable Technology Risks •Phishing and social engineering: the report states phishing surpassed other techniques as the most common method used by hackers to gain access in ransomware cases. •Credential sharing and password reuse: poor security culture is associated with much higher credential-sharing risk, and one in four employees reuse passwords across services. •Weak password understanding: 24% of employees think short and simple passwords do not increase organizational attack risk. |
| KnowBe4 | 2021 | Cybersecurity Services / Consultancy |
| 462 | KnowBe4 Cybersecurity Culture Report 2022 | Bottom Line Up Front (BLUF) KnowBe4’s 2022 report shows that security culture is a measurable business risk factor, and every industry benchmarked remains only in the Moderate range. For SMBs and insurance teams, the key takeaway is that people-related risk—phishing, ransomware readiness, policy compliance, reporting, and day-to-day security behavior—needs the same management attention as technical controls. Top 3-5 Most Notable Statistics •The report is based on 2,910 surveyed organizations and more than 530,356 employees across 18 industry sectors. •The Security Culture Index rates organizations from 0 to 100, with Moderate defined as 70 to 79. •No industry sector showed Poor or Mediocre security culture in 2022, the first time the report did not identify industries in those lower ranges. •Education and Hospitality had the lowest reported industry scores at 70, on the edge of the Mediocre range. •The Insurance sector reported an overall score of 76, with Communication at 80, Attitude at 78, and Compliance at 77. Top 3-5 Exploitable Technology Risks •Phishing emails used to obtain remote access, enabling ransomware or business email compromise attacks. •Ransomware attacks that can make systems inoperable, disrupt services, and pressure organizations to pay for restored access. •Expanded attack surfaces from remote work, hybrid work, telemedicine, patient portals, apps, and online collaboration. |
| KnowBe4 | 2022 | Cybersecurity Services / Consultancy |
| 463 | KnowBe4 Cybersecurity Culture Report 2024 | Bottom Line Up Front (BLUF) KnowBe4’s 2024 report shows that human behavior remains central to cyber risk: social engineering, phishing, ransomware, and employee misunderstanding continue to drive major incidents. For SMBs and insurance teams, the key takeaway is that security culture is not a “soft” issue; it directly affects breach likelihood, downtime, claims severity, and third-party risk acceptability. Top 3-5 Most Notable Statistics •74% of data breaches stem from social engineering techniques, human error, or oversight, according to the report’s cited Verizon 2023 DBIR reference. •KnowBe4 collected insights from 816,733 employees across 4,078 organizations. •The global security culture score is 72, categorized as low moderate and unchanged from the prior year. •The report covers 18 industries, 6 continents, and 111 countries. •In Oceania, major 2023 breaches affected 12 million Latitude Financial customer records, 9.8 million Optus customers, and 9.7 million Medibank health records and personal information. Top 3-5 Exploitable Technology Risks •Social engineering and phishing, including phishing as the top attack vector in Europe and a primary method used to deploy ransomware. •Ransomware, including attacks that cause system shutdowns, downtime, service diversion, extortion, and large financial losses. •Compromised credentials, identified as a key attack vector in financial services and healthcare/pharmaceuticals. |
| KnowBe4 | 2024 | Cybersecurity Services / Consultancy |
| 464 | Law enforcement doxxing raises risk profile for threat actors | Bottom Line Up Front (BLUF) Ransomware remains a major risk for small and medium-sized businesses, with attackers continuing to favor VPN abuse, credential theft, lateral movement, data theft, and encryption. The report’s most important takeaway for SMBs and insurance teams is that practical controls such as multi-factor authentication, access restrictions, network segmentation, data preparation, and monitoring of remote tools directly address the attack patterns Coveware observed in Q3 2024. Top 3-5 Most Notable Statistics •Ransom payment rates declined from over 80% in 2019 to 32% in Q3 2024. •Average ransom payment in Q3 2024 was $479,237, up 23% from Q2 2024. •Median ransom payment in Q3 2024 was $200,000, up 18% from Q2 2024. •Lateral movement appeared in 84% of cases, up from 71%. •Data exfiltration appeared in 76% of cases, while actual data encryption occurred in 92% of Q3 cases. Top 3-5 Exploitable Technology Risks •VPN compromise through unpatched vulnerabilities, brute-forced accounts without multi-factor authentication, and stolen or leaked credentials collected by infostealers. •Remote Desktop Protocol, PSexec, SSH, and VMware ESXi access used for lateral movement across victim environments. •Credential theft from host systems using tools such as Mimikatz, Lazagne, and WebBrowserPassView. |
| Coveware | 2024 | Consulting / Analyst Firm |
| 465 | Lightspeed Venture Partners CISO Survey 2024 | Bottom Line Up Front (BLUF) Lightspeed’s 2024 CISO survey shows cybersecurity teams are moving past platform consolidation and refocusing on newer risks created by AI, cloud adoption, identity, data exposure, and application security. For SMBs and insurance teams, the key takeaway is that attackers are exploiting expanding technology surfaces faster than many organizations can mature their controls. Top 3-5 Most Notable Statistics •214 members of Lightspeed’s CxO network were polled for the CISO survey. •More than 80% of CISOs were expected to have completed XDR projects by the end of 2023. •Approximately 70% of CISOs were expected to have completed SASE projects by the end of 2023. •89% of CISOs want their SASE and XDR technologies to work together. •Only 34% of organizations were already using or implementing AI application security tools as of September 2023. Top 3-5 Exploitable Technology Risks •AI-enabled attacks and attacks against AI/ML systems, including concerns about attackers using AI and risks to LLMs and AI models. •Cloud infrastructure exposure as mission-critical workloads and data move to cloud environments, expanding the surface area attackers can target. •Identity and access management weaknesses, including cloud identity, boundary policies, privileged access, and access review gaps. |
| Lightspeed Venture Partners | 2024 | Consulting / Analyst Firm |
| 466 | M-Trends 2021 | Bottom Line Up Front (BLUF) Mandiant’s 2021 report shows that ransomware has shifted from simple file encryption to “multifaceted extortion,” where attackers also steal data, threaten publication, pressure employees and partners, and disrupt operations. For SMBs and insurance teams, this means ransomware losses can look like both a business interruption event and a data breach, making backups necessary but not sufficient. Top 3-5 Most Notable Statistics •59% of investigated incidents were initially detected internally by organizations, a 12-point improvement from the prior year. •Global median dwell time fell to 24 days in 2020, the first time Mandiant observed it below one month. •Investigations involving ransomware increased from 14% in 2019 to 25% in 2020. •78% of ransomware intrusions had dwell times of 30 days or fewer, compared with 44% of non-ransomware intrusions. •Mandiant observed attackers use 63% of MITRE ATT&CK techniques during 2020 investigations. Top 3-5 Exploitable Technology Risks •Multifaceted ransomware/extortion operations that combine encryption, sensitive data theft, public leak threats, employee harassment, partner notification, and sometimes denial-of-service pressure. •Overly broad privileged access in Active Directory, including large numbers of highly privileged accounts and privileged non-computer accounts configured with service principal names. •Abuse of built-in administration tools such as PowerShell, Windows services, Remote Desktop Protocol, WMI, and cmd.exe to move through networks while blending in with normal activity. |
| Mandiant | 2021 | Cybersecurity Services / Consultancy |
| 467 | M-Trends 2022 | Bottom Line Up Front (BLUF) Mandiant’s 2022 findings show that organizations are detecting intrusions faster, but attackers are also moving quickly, especially in ransomware cases. For SMBs and insurance teams, the most important takeaway is that exploitable public-facing systems, supply chain compromise, weak remote access, and poor recovery preparation can turn a security incident into prolonged downtime, data theft, and extortion pressure. Top 3-5 Most Notable Statistics •Global median dwell time fell to 21 days in 2021, down from 24 days in 2020. •Externally notified intrusions were reported faster, with median dwell time dropping from 73 days to 28 days. •Ransomware was involved in 23% of intrusions, with a median dwell time of 5 days, compared to 36 days for non-ransomware intrusions. •Exploits were the leading identified initial infection vector, accounting for 37% of intrusions where the vector was known. •Supply chain compromise accounted for 17% of identified initial infection vectors, up from less than 1% in 2020. Top 3-5 Exploitable Technology Risks •Public-facing application vulnerabilities, including issues affecting Microsoft Exchange, SonicWall Email Security, Pulse Secure VPN appliances, and Apache Log4j, were used to initiate and advance intrusions. •Software supply chain compromise created broad access opportunities across multiple victim environments. •External remote services and valid accounts remained important initial access paths, especially where authentication controls were weak. |
| Mandiant | 2022 | Cybersecurity Services / Consultancy |
| 468 | M-Trends 2023 | Bottom Line Up Front (BLUF) Mandiant’s 2023 findings show that organizations are detecting intrusions faster, but many still learn about compromises from outside parties rather than their own tools or teams. For SMBs and insurance teams, the key takeaway is that prevention alone is not enough: fast detection, strong identity controls, and readiness for ransomware, extortion, and social engineering are central to reducing loss. Top 3-5 Most Notable Statistics •Organizations were notified of breaches by external entities in 63% of incidents in 2022. •Global median dwell time fell to 16 days, down from 21 days in the prior M-Trends report. •42% of intrusions were detected within one week or less. •18% of intrusions involved ransomware in 2022, down from 23% in 2021; ransomware dwell time was 9 days. •The most observed initial access technique was exploitation of public-facing applications at 21.2%, followed by phishing at 16.5%. Top 3-5 Exploitable Technology Risks •Public-facing applications: attackers frequently exploited internet-accessible systems to gain initial access. •Phishing and spearphishing: email-based and service-based lures remained major entry points. •External remote services: remote access pathways were a notable initial access technique. |
| Mandiant | 2023 | Cybersecurity Services / Consultancy |
| 469 | M-Trends 2024 | Bottom Line Up Front (BLUF) Mandiant’s 2024 findings show attackers are increasingly using exploits, edge devices, stolen access, and evasive techniques to get in quickly and avoid detection. For SMBs and insurance teams, the key takeaway is that faster detection is improving outcomes, but ransomware, extortion, and data theft still create major business and claims risk. Top 3-5 Most Notable Statistics •54% of compromised organizations first learned of an intrusion from an external source, while 46% detected it internally. •Global median dwell time fell to 10 days in 2023, down from 16 days in 2022. •43% of intrusions were detected in one week or less. •Ransomware-related investigations increased to 23% of investigations, up from 18% in 2022. •Exploits were the leading identified initial infection vector at 38%, followed by phishing at 17% and prior compromise at 15%. Top 3-5 Exploitable Technology Risks •Public-facing application exploits, which were the most common identified initial infection vector and included mass exploitation campaigns. •Edge devices and appliances, including MOVEit Transfer and Barracuda Email Security Gateway, which attackers used for data theft, persistence, and evasion. •Known vulnerabilities such as CVE-2023-34362 in MOVEit Transfer, CVE-2022-21587 in Oracle E-Business Suite, and CVE-2023-2868 in Barracuda Email Security Gateways. |
| Mandiant | 2024 | Cybersecurity Services / Consultancy |
| 470 | M-Trends 2025 | Bottom Line Up Front (BLUF) Mandiant’s most important finding is that attackers are taking advantage of basic exposure points: exploitable vulnerabilities, stolen credentials, unsecured data, and gaps in cloud identity controls. For SMBs and insurance teams, this means the highest-priority loss prevention work is still practical and control-focused: patch exposed systems, strengthen identity security, improve visibility, and reduce the impact of stolen credentials. Top 3-5 Most Notable Statistics •Exploits were the most common initial infection vector for the fifth year in a row, accounting for 33% of intrusions where the vector was identified. •Stolen credentials rose to 16% of identified initial infection vectors, overtaking email phishing at 14%. •Mandiant found evidence of data theft in 37% of 2024 investigations. •In cloud compromises, data theft was observed in 66% of cases. •Financially motivated attackers represented 55% of observed threat groups, and the financial sector accounted for 17.4% of investigations. Top 3-5 Exploitable Technology Risks •Internet-facing security and edge devices, including vulnerabilities affecting Palo Alto Networks PAN-OS and Ivanti Connect Secure / Policy Secure appliances, were heavily targeted and in some cases exploited as zero-days. •Stolen credentials from infostealer malware remain a major access path, especially where users or contractors use personal devices, browser password storage, browser syncing, or reused passwords. •Cloud and SaaS identity weaknesses, including weak or missing MFA, insecure MFA registration changes, password reset portals, and over-privileged accounts, can allow attackers to expand from one compromised account into broader cloud access. |
| Mandiant | 2025 | Cybersecurity Services / Consultancy |
| 471 | M-Trends 2025 | Bottom Line Up Front (BLUF) Mandiant’s 2025 findings show attackers are taking advantage of basic security gaps: exploitable vulnerabilities, stolen credentials, infostealer malware, unsecured data repositories, and cloud identity weaknesses. For SMBs and insurance teams, the practical takeaway is that many high-impact incidents begin with preventable access failures and can lead to data theft, ransomware, extortion, or business email compromise. Top 3-5 Most Notable Statistics •Exploits were the most common initial infection vector, starting 33% of intrusions where the vector was identified. •Stolen credentials rose to 16% of intrusions, overtaking email phishing at 14%. •Data theft was identified in 37% of 2024 investigations. •Financially motivated attackers represented 55% of observed threat groups. •In cloud compromises, data theft was observed in 66% of cases. Top 3-5 Exploitable Technology Risks •Internet-facing and edge security devices: Mandiant highlighted frequently exploited vulnerabilities affecting security devices, including Palo Alto Networks PAN-OS CVE-2024-3400 and Ivanti Connect Secure / Policy Secure vulnerabilities CVE-2023-46805 and CVE-2024-21887. •Stolen credentials and infostealer malware: Attackers used credentials exposed by malware, data leaks, underground forums, contractor systems, and personal devices used for work. •Weak cloud and SaaS identity controls: Attackers abused compromised cloud credentials, single sign-on access, MFA reset processes, and cloud administration paths. |
| Mandiant | 2025 | Cybersecurity Services / Consultancy |
| 472 | M-Trends 2026 | Bottom Line Up Front (BLUF) Mandiant’s 2026 report shows that most successful intrusions still come from exploitable systems, social engineering, weak identity controls, and gaps in recovery infrastructure—not from AI-driven “new” attacks. For SMBs and insurance teams, the most important shift is that ransomware is increasingly a resilience problem: attackers are targeting backups, identity systems, and virtualization platforms to make recovery harder and increase pressure to pay. Top 3-5 Most Notable Statistics •32% of identified initial infection vectors were exploits, making exploits the top entry point for the sixth consecutive year. •11% of 2025 intrusions involved voice phishing, making it the second-most common initial infection vector. •Global median dwell time rose to 14 days, up from 11 days. •Ransomware-related intrusions accounted for 13% of Mandiant investigations in 2025. •Mandiant identified evidence of data theft in 59% of cloud compromises. Top 3-5 Exploitable Technology Risks •Unpatched software vulnerabilities and exposed edge or core network devices, since exploits remained the most common initial access method. •Voice phishing against help desks and staff, including requests for password resets, MFA changes, and authorization of attacker-controlled SaaS applications. •Cloud and SaaS environments where attackers can use valid credentials, native utilities, and bulk API operations to collect and steal large datasets. |
| Mandiant | 2026 | Cybersecurity Services / Consultancy |
| 473 | Managed Detection and Response Analyst Report 2024 | Bottom Line Up Front (BLUF) Kaspersky’s 2024 MDR data shows fewer high-severity incidents than in 2023, but more complex investigations and a larger share of human-driven targeted attacks. For SMBs and insurance teams, the key takeaway is that prevention alone is not enough: fast detection, clear response authority, phishing resilience, and control over accounts and system configurations directly affect loss prevention. Top 3-5 Most Notable Statistics •High-severity incidents decreased by 34% compared to 2023, while mean time to investigate and report increased by 48%. •Human-driven targeted attacks accounted for 43% of high-severity incidents, up 74% from 2023. •Medium-severity incidents made up 69.39% of reported incidents; low severity accounted for 25.92% and high severity for 4.69%. •77% of incidents were successfully remediated after the first relevant security alert was received. •Kaspersky reported an average time to report of 53.99 minutes for high-severity incidents, 41.03 minutes for medium-severity incidents, and 37.85 minutes for low-severity incidents. Top 3-5 Exploitable Technology Risks •Phishing and user execution: Phishing remained a leading initial access method, including spearphishing links and malicious attachments that rely on users clicking or opening content. •Account abuse and manipulation: Attackers used valid accounts, activated disabled accounts, and added users to privileged groups to gain persistence and bypass controls. •Living-off-the-land tools: Common built-in tools such as powershell.exe, rundll32.exe, reg.exe, comsvcs.dll, msiexec.exe, certutil.exe, mshta.exe, msbuild.exe, and esentutl.exe were observed in attacks. |
| Kaspersky | 2024 | Endpoint / MDR / XDR Vendor |
| 474 | Mass Data Exfiltration Campaigns Lose Their Edge in Q4 2025 | Bottom Line Up Front (BLUF) Coveware’s Q4 2025 data shows that mass data-exfiltration extortion is losing financial effectiveness, while ransomware incidents remain concentrated among small and mid-sized organizations. For SMBs and insurance teams, the key takeaway is that downtime, weak recovery, and identity-based access failures are now more important loss drivers than the mere threat of stolen data being published. Top 3-5 Most Notable Statistics •Ransom payment rates reached approximately 20%, a new historical low. •The average ransom payment was $591,988, up 57% from Q3 2025; the median payment was $325,000, up 132% from Q3. •Confirmed data exfiltration occurred in 94% of incidents overall, and in 62% of cases where encryption was present. •The median company size impacted was 200 employees, down 45% from Q3 2025. •Companies with 11 to 100 employees accounted for 38% of attacks, while those with 101 to 1,000 employees accounted for 31%. Top 3-5 Exploitable Technology Risks •Remote access compromise, including VPNs, RDP, SaaS administrative access, OAuth tokens, API integrations, and delegated trust relationships. •Identity and access hygiene failures, including stale credentials, legacy local accounts after migrations, residual credentials, and insufficient visibility into cloud identity and token usage. •Social engineering that enables remote access, including help desk manipulation, OAuth consent abuse, impersonation, vishing, SEO poisoning, and abuse of trusted vendors or integrations. |
| Coveware | 2026 | Consulting / Analyst Firm |
| 475 | McKinsey State of AI Trust 2026 | Bottom Line Up Front (BLUF) McKinsey’s 2026 survey shows that AI adoption is moving into a more autonomous “agentic” phase faster than governance, controls, and response capabilities are maturing. For SMBs and insurance teams, the key issue is not just whether AI produces inaccurate outputs, but whether AI systems can take unintended actions, misuse tools, or operate outside appropriate guardrails. Top 3-5 Most Notable Statistics •74 percent of respondents identify inaccuracy as a highly relevant AI risk. •72 percent cite cybersecurity as a highly relevant AI risk. •Nearly two-thirds of respondents cite security and risk concerns as the top barrier to fully scaling agentic AI. •AI-related incident frequency remains roughly 8 percent, but almost 60 percent of organizations that experienced incidents report satisfactory or negative views of their response. •Organizations with clear RAI ownership average a maturity score of 2.6, compared with 1.8 for organizations without clear accountability. Top 3-5 Exploitable Technology Risks •Agentic AI systems taking unintended actions, especially where they can trigger actions or interact with other systems. •AI tools operating beyond appropriate guardrails, creating risk when oversight and controls are weak. •Cybersecurity risks tied to expanded AI adoption and a broader technology attack surface. |
| McKinsey | 2026 | Consulting / Analyst Firm |
| 476 | Microsoft Digital Defense Report 2023 | Bottom Line Up Front (BLUF) Microsoft’s 2023 report shows that SMBs are directly in the path of modern cybercrime, especially ransomware, identity attacks, phishing, and business email compromise. The most important takeaway is that basic security hygiene can prevent the vast majority of attacks, but gaps around unmanaged devices, identity controls, patching, and monitoring continue to create exploitable openings. Top 3-5 Most Notable Statistics •Microsoft states that minimum security standards can protect against over 99% of attacks. •70% of organizations encountering human-operated ransomware had fewer than 500 employees. •Human-operated ransomware attacks are up more than 200% since September 2022. •80-90% of successful ransomware compromises originate through unmanaged devices. •17% of intrusions involved known remote monitoring and management tools. Top 3-5 Exploitable Technology Risks •Unmanaged or bring-your-own devices: These are a major ransomware entry point and can expose corporate credentials or enable compromise through infected personal systems. •Identity attacks and MFA bypass: Microsoft highlights brute force, password spray, adversary-in-the-middle attacks, token replay, and MFA fatigue as active identity threats. •Remote monitoring and management tools: Attackers abuse legitimate RMM software for persistence, privileged commands, file transfer, information theft, and ransomware delivery. |
| Microsoft | 2023 | Cloud Provider / Hyperscaler |
| 477 | Microsoft Digital Defense Report 2025 | Bottom Line Up Front (BLUF) Microsoft’s 2025 report shows that attackers are increasingly “logging in” rather than breaking in, using stolen credentials, identity abuse, social engineering, and exposed systems to gain access. For SMBs and insurance teams, the key takeaway is that basic control failures around identity, patching, cloud visibility, and incident readiness can quickly become ransomware, data theft, or business email compromise losses. Top 3-5 Most Notable Statistics •Microsoft processes more than 100 trillion security signals daily. •Modern multifactor authentication reduces the risk of identity compromise by more than 99%. •More than 97% of identity attacks are password spray or brute force attacks. •ClickFix accounted for 47% of initial access methods observed in Microsoft Defender Experts notifications, ahead of phishing at 35%. •In Azure environments, Microsoft observed a 26% increase in incidents, an 87% increase in disruptive campaigns, and a 58% increase in attempts to extract sensitive data from storage accounts and databases when comparing the first and second 100-day periods of 2025. Top 3-5 Exploitable Technology Risks •Stolen or weak credentials, including password spray, brute force, infostealers, and access broker activity that enables follow-on ransomware or data theft. •Public-facing applications, external remote services, and unpatched known vulnerabilities in enterprise and third-party IT tools. •ClickFix social engineering, where users are tricked into pasting malicious commands that execute PowerShell or mshta.exe and may evade traditional phishing controls. |
| Microsoft | 2025 | Cloud Provider / Hyperscaler |
| 478 | Mid-Year Cyber Threat Landscape Report H1 2025 | Bottom Line Up Front (BLUF) CyberProof’s H1 2025 report shows a faster, more organized threat landscape where ransomware, supply chain compromise, phishing, and attacks on critical services are intensifying. For SMBs and insurance teams, the key takeaway is that attackers are increasingly using trusted access paths, third-party platforms, remote tools, and identity-based methods to create disruption and extortion pressure. Top 3-5 Most Notable Statistics •Ransomware attacks surged by 60% compared to the previous period. •Akira ransomware was responsible for 72 attacks in January. •Manufacturing was the most targeted industry, with 75 incidents globally in January 2025. •The United States was the primary target geography, with 259 incidents. •India-Pakistan tensions drove more than 650 confirmed DDoS and defacement incidents, with at least 45 hacktivist groups active. Top 3-5 Exploitable Technology Risks •SAP NetWeaver Visual Composer Framework CVE-2025-31324: The report says this flaw allows unauthenticated file upload and remote code execution, creating risk of full system compromise when patching is delayed. •IT supply chain providers and privileged access platforms: Threat actors targeted remote management tools, cloud applications, and privileged access management platforms to reach downstream customers through trusted relationships. •Identity-based attacks and helpdesk social engineering: Scattered Spider posed as employees to deceive IT helpdesks into resetting passwords, enabling internal access and ransomware deployment. |
| CyberProof | 2025 | Threat Intelligence Vendor |
| 479 | Midyear 2024 Cyber Risk Report: Cyber Claims Trends and Analysis | Bottom Line Up Front (BLUF) Cyber losses are increasingly driven by interconnected business systems: vendors, software platforms, acquisitions, and outsourced technology providers. For SMBs and insurance teams, the key takeaway is that a company can suffer major downtime and recovery costs even when its own systems are not the original point of attack. Top 3-5 Most Notable Statistics •Vendor-related claims rose from 35% of claims in 2023 to 40% in the first half of 2024. •Ransomware accounted for roughly half of claims but slightly more than 80% of losses over the last 18 months. •Ransomware event severity increased 411% in 2023 compared with 2022 in Resilience’s claims data. •Only 9.7% of Resilience-insured ransomware victims paid extortion fees in 2023-24. •Software vulnerabilities accounted for only 6% of total claims but 15% of losses. Top 3-5 Exploitable Technology Risks •Vendor and supplier dependency: attacks or outages at critical providers can disrupt downstream businesses, as shown by Change Healthcare and CDK Global. •Phishing: it remained the leading point of failure for incurred claims and often led to ransomware or email compromise. •Software vulnerabilities: exploited flaws, including the PAN-OS GlobalProtect VPN vulnerability, can give attackers deep network access. |
| Resilience | 2024 | Threat Intelligence Vendor |
| 480 | MNP Risk Trends: 2026 and Beyond | Bottom Line Up Front (BLUF) MNP’s core message is that cyber, AI, vendor, data, and operational risks are converging faster than traditional risk management can handle. For SMBs and insurance teams, the biggest concern is not one isolated threat, but the way ransomware, AI-enabled fraud, cloud and vendor dependence, privacy exposure, and operational disruption can combine into larger losses. Top 3-5 Most Notable Statistics •Canadian households lost more than $500 million to cyber fraud in a single year, while law enforcement estimates only 10 percent of cybercrimes were reported. •82 percent of businesses now have cyber insurance, up from 59 percent in 2021. •62 percent of organizations experienced a supply chain disruption due to cyber security incidents, a 13 percent increase from the previous year. •Only 10 percent of small and medium-sized businesses regularly use generative AI platforms, with concerns including data privacy, response quality, and legal exposure. •Canada experienced $30 billion in cumulative insured losses from natural disasters over the last 10 years. Top 3-5 Exploitable Technology Risks •AI-powered phishing, deepfakes, and malware that make fraud harder to detect and can bypass traditional controls. •Ransomware targeting IT and operational technology systems, with potential to halt production, disable services, or interrupt transportation networks. •Misconfigured cloud environments and complex multi-cloud setups that can lead to data leaks and unauthorized access. |
| MNP | 2026 | Threat Intelligence Vendor |
| 481 | Mobile Security Index 2021 | Bottom Line Up Front (BLUF) Mobile devices are now core business tools, but Verizon’s 2021 report shows they remain a meaningful path to compromise, data exposure, lost productivity, and cloud or credential abuse. For SMBs and insurance teams, the key issue is not just lost phones; it is that mobile devices can become a gateway into business email, cloud apps, sensitive data, and operations. Top 3-5 Most Notable Statistics •23% of surveyed organizations were aware of a mobile device-related security compromise in the past year. •53% of organizations that suffered a compromise said the consequences were major. •96% of respondents that experienced a mobile-related compromise faced business consequences, and 23% said they directly lost business. •76% said they had come under pressure to sacrifice mobile device security for expediency, and 75% of those gave in. •Lookout saw a 364% increase in mobile phishing attempts in 2020 versus 2019. Top 3-5 Exploitable Technology Risks •Phishing and social engineering on mobile devices, where small screens can make malicious emails and websites harder for users to identify. •Credential theft, including attacks that capture credentials from mobile devices and then use them to access cloud apps or other systems. •Malicious or risky apps, including apps with hidden backdoors and malware distributed through social media, instant messaging apps, or even official app stores. |
| Verizon | 2021 | Telco / Network Operator |
| 482 | Mobile Security Index 2022 | Bottom Line Up Front (BLUF) Mobile devices are now business-critical and are increasingly involved in incidents that cause data loss, downtime, and lasting harm. For SMBs and insurance teams, the key takeaway is that mobile risk is no longer a side issue: remote work, BYOD, phishing, cloud apps, public Wi-Fi, and ransomware all expand the paths attackers can exploit. Top 3-5 Most Notable Statistics •45% of surveyed companies suffered a compromise involving a mobile device that led to data loss or downtime in the past 12 months. •73% of respondents affected by a mobile-related compromise described the impact as major, and 42% said it had lasting repercussions. •46% of SMBs that suffered a mobile-related compromise said the impact was major and had lasting repercussions. •79% of respondents agreed that recent changes to working practices had adversely affected their organization’s cybersecurity. •77% of respondents said cybersecurity spending increased in the previous 12 months. Top 3-5 Exploitable Technology Risks •Mobile phishing across email, SMS, social media, and messaging apps, where smaller screens and simplified interfaces can hide warning signs. •BYOD devices that are harder to secure than company-owned devices, especially without strong policies, MDM, monitoring, and access restrictions. •Unauthorized personal apps and cloud storage, which can enable sensitive data to leave the company and make phishing or compliance issues harder to detect. |
| Verizon | 2022 | Telco / Network Operator |
| 483 | Mobile Security Index 2023 | Bottom Line Up Front (BLUF) Mobile devices are now a major entry point to business systems, cloud data, and sensitive resources, but many organizations still treat them as secondary security concerns. For SMBs and insurance teams, the key issue is not just data stored on phones or tablets; it is the role mobile devices can play in phishing, malware, remote-work compromise, cloud access, and lateral movement into critical systems. Top 3-5 Most Notable Statistics •61% of CISOs and 53% of CEOs said their organization is unprepared to cope with a targeted cyberattack in the next 12 months. •84% of organizations experienced at least one successful phishing attack between September 2021 and August 2022. •62% of companies suffered a security breach connected at least partly to remote working in the past two to three years. •More than 60% of ransomware victims had annual revenue under $50 million. •71% of users did not change the default password on their home Wi-Fi, and 31% did not password-protect home Wi-Fi at all. Top 3-5 Exploitable Technology Risks •Mobile phishing and smishing, especially on smaller screens where hidden URLs and simplified interfaces can make malicious links harder to spot. •MFA spamming attacks, where attackers repeatedly send approval prompts until a user accepts one out of fatigue or confusion. •Malicious or modified mobile applications, including fake or altered versions of legitimate apps that may contain malware. |
| Verizon | 2023 | Telco / Network Operator |
| 484 | Mobile Security Index 2024 | Bottom Line Up Front (BLUF) Verizon’s 2024 Mobile Security Index shows that mobile and IoT devices are now core business infrastructure, but many organizations have not extended security controls fast enough to match that dependence. For SMBs and insurance teams, the key takeaway is that mobile and IoT compromise is no longer a niche risk: it can lead directly to data loss, downtime, expensive remediation, and business interruption. Top 3-5 Most Notable Statistics •53% of respondents experienced an organizational security incident involving a mobile or IoT device that resulted in data loss or downtime. •47% reported that mobile or IoT compromises had major impacts on their organizations. •85% of respondents said risks from mobile device threats increased in the past year. •95% of surveyed organizations use at least some IoT devices, and 62% reported mature, full-scale IoT deployments. •55% of respondents have no formal disaster recovery plan in place. Top 3-5 Exploitable Technology Risks •Mobile phishing and credential theft: threat actors increasingly target users’ mobile phones to steal credentials and gain access to corporate infrastructure and sensitive data. •IoT devices with weak security: the report highlights weak default passwords, embedded credentials, missing authentication, limited processing capacity, and difficulty applying security updates. •Unpatched mobile operating systems and apps: mobile app incidents involved malware and unpatched vulnerabilities, and the report notes extensive iOS and Android vulnerability activity. |
| Verizon | 2024 | Telco / Network Operator |
| 485 | Mobile Security Index 2025 | Bottom Line Up Front (BLUF) Mobile devices are now a major business risk because AI-assisted attacks are increasing while employee mistakes remain common. For SMBs and insurance teams, the key issue is not just device compromise; it is the downstream impact: downtime, data loss, fines, reputational harm, and cyber insurance penalties. Top 3-5 Most Notable Statistics •85% of surveyed organizations cited rising mobile device attacks. •77% believe AI-assisted deepfake and SMS phishing attacks are likely to succeed. •93% report employees are using generative AI tools on mobile devices in daily workflows. •47% of organizations that experienced a mobile-related security incident reported downtime, and 45% reported data loss. •36% experienced cyber insurance penalties such as higher premiums, reduced coverage, or denied claims. Top 3-5 Exploitable Technology Risks •AI-assisted phishing, smishing, and deepfakes that make social engineering more convincing and scalable. •Employees entering sensitive information into generative AI tools on mobile devices, creating data compromise risk. •Personal and unmanaged devices, with 70% of mobile devices impacted by an attack reported as personal rather than corporate-issued. |
| Verizon | 2025 | Telco / Network Operator |
| 486 | Model Context Protocol: A View from the Trenches | Bottom Line Up Front (BLUF) Clutch Security’s report finds that Model Context Protocol adoption is growing rapidly and often invisibly, with employees running local MCP servers that can access business credentials such as API keys, tokens, and service account credentials. For SMBs and insurance teams, the key issue is not just AI usage, but unmanaged software running with access to critical systems and little security visibility. Top 3-5 Most Notable Statistics •2,200% growth in published MCP servers over 13 months, from 3 servers in October 2024 to 6,878 in November 2025. •15.28% of enterprise employees analyzed were running at least one local MCP server. •In a 10,000-person organization, the report estimates 3,056 total MCP server installations across 1,528 users. •86% of MCP users adopted local servers, compared with 14% using remote alternatives. •38% of deployed servers were unofficial implementations, and 3% of published servers contained valid hardcoded credentials in source code. Top 3-5 Exploitable Technology Risks •Local MCP servers running on employee endpoints with developer privileges and access to plaintext credentials. •Unofficial MCP implementations from npm, GitHub, PyPI, and marketplaces, where package verification is limited or absent. •Use of `npx -y` or similar single-command execution, allowing arbitrary code from unknown authors to run quickly without review. |
| Clutch Security | 2025 | Identity Security Vendor |
| 487 | Monthly Vulnerability Review November 2025 | Bottom Line Up Front (BLUF) Flexera’s November 2025 review shows vulnerability volume remains unusually high, with 2025 already exceeding 2024 year-to-date advisory totals by a wide margin. For SMBs and insurance teams, the key issue is prioritization: actively exploited browser and Windows vulnerabilities, incomplete public vulnerability data, and patch timing gaps can quickly turn routine software exposure into business disruption. Top 3-5 Most Notable Statistics •13,562 advisories year-to-date in 2025, an 18.6% increase over the 11,437 advisories reported year-to-date in 2024. •1,289 advisories were reported for the month, ranked #6 since 2002. •6 zero-day advisories were reported for Microsoft Windows and Server, Microsoft Edge, and Google Chrome. •More than 26,000 CVEs remain unanalyzed by the National Vulnerability Database. •Threat intelligence identified 39 advisories with ransomware links and 382 linked to malware. Top 3-5 Exploitable Technology Risks •Microsoft Edge and Google Chrome: a zero-day V8 type confusion vulnerability allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page and was marked as actively exploited. •Windows 10, Windows 11, and Windows Server 2019, 2022, and 2025: multiple zero-day vulnerabilities could support information disclosure, denial of service, privilege escalation, security bypass, and system compromise. •Windows Kernel CVE-2025-62215: an actively exploited race condition vulnerability could allow a local attacker with low-level privileges to gain SYSTEM-level access. |
| Flexera | 2025 | Security Research Vendor |
| 488 | N2K WiCyS Cyber Talent Study 2024 | Bottom Line Up Front (BLUF) The most important takeaway is that cybersecurity workforce capability is measurable, and targeted training can strengthen readiness in critical business areas. For SMBs and insurance teams, the report reinforces that cyber risk management depends not only on technology, but also on whether staff have the skills to govern, secure, train, and respond effectively. Top 3-5 Most Notable Statistics •399 WiCyS members completed N2K’s NICE Workforce Diagnostic. •WiCyS members outperformed others in 17/20 specialty areas assessed. •WiCyS members outperformed across every NICE category, including Oversee & Govern, Protect & Defend, Analyze, Investigate, and Securely Provision. •Highest highlighted functional group scores included Cyber/IT Policy & Governance, Risk, and Compliance at 64.3%, Cyber/IT Leadership & Management at 64%, Cyber Workforce Training & Awareness at 62.3%, and Communications & Network Security at 60.6%. •Areas identified for development included Software Development at -3, Incident Response at -2, and Systems Analysis at -2 compared with other diagnostic participants. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs For a typical SMB, the report’s findings point to the practical importance of having people who can manage cybersecurity governance, train employees, secure networks, and support leadership decisions. The report does not quantify breach costs, downtime, or likelihood of being targeted, but it does show that workforce strengths and gaps can be assessed against a recognized framework. The identified development areas—Software Development, Incident Response, and Systems Analysis—are especially relevant because weaknesses in these areas can affect how well an organization builds secure systems, understands technical issues, and responds when incidents occur. |
| N2K WiCyS | 2024 | Education / Academic |
| 489 | N2K WiCyS Cyber Talent Study 2025 | Bottom Line Up Front (BLUF) The N2K WiCyS Cyber Talent Study 2025 is a workforce capability study, not a technical threat report. Its main takeaway is that WiCyS members demonstrated stronger cybersecurity knowledge and readiness than non-WiCyS peers across most NICE Cybersecurity Workforce Framework areas, which matters to SMBs and insurance teams because workforce skill gaps directly affect how organizations plan, govern, defend, and respond. Top 3-5 Most Notable Statistics •604 WiCyS members completed the cybersecurity skills diagnostic in the expanded 2025 study. •WiCyS members outperformed peers in 16 of 20 NICE Framework Specialty Areas assessed. •WiCyS members achieved an overall composite score 4 points higher, described as nearly a 10% overall performance advantage. •The original 2023 study cohort included 399 participants. •The strongest reported functional performance areas included Cyber/IT Policy & Governance at 67.8%, Cyber/IT Leadership & Management at 64.8%, and Cyber Workforce, Training & Awareness at 63.3%. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs For SMBs, the report’s value is in workforce planning rather than threat detection. It shows that structured skills assessment can identify where cybersecurity teams are strong and where further development is needed. The study highlights strengths in leadership, governance, operational planning, cybersecurity management, and related areas, all of which are important for organizing security work and making informed decisions. It also notes that some areas were equal to or slightly lower than peer results, reinforcing that even capable teams need targeted development across multiple cybersecurity functions. |
| N2K WiCyS | 2025 | Education / Academic |
| 490 | NACD Directors Handbook Cyber Risk 2026 | Bottom Line Up Front (BLUF) NACD’s core message is that cyber risk is now a strategic business risk, not just an IT issue. For SMBs and insurance teams, the practical takeaway is to focus less on check-the-box compliance and more on measurable resilience: tested incident response, clear governance, third-party risk oversight, and quantified financial exposure. Top 3-5 Most Notable Statistics •Microsoft tracked more than 600 million cyberattacks per day globally. •Estimated economic losses from cyberattacks may soon approach $20 trillion annually, up from $8 trillion in 2022. •72 percent of directors said they are likely to pursue technology investments as a growth initiative in 2026. •76 percent of directors said AI investments will probably or definitely factor into their organization’s 2026 growth strategy. •A ransomware attack on Change Healthcare disrupted claims and payment processing for 1 in 3 U.S. patients, and 74 percent of hospitals reported direct patient care disruption. Top 3-5 Exploitable Technology Risks •Legacy systems and technical debt: The report describes outdated systems as easy targets for attackers and a growing source of enterprise and supply chain risk. •Ransomware against core systems: The report highlights ransomware as a persistent threat that can disrupt operations, payments, claims processing, suppliers, and essential services. •Third-party and supply chain exposure: The report emphasizes that attacks can originate through vendors and cascade across customers, suppliers, and partners. |
| NACD | 2026 | ISAC / Industry Consortium |
| 491 | National Cyber Threat Assessment 2025–2026 | Bottom Line Up Front (BLUF) Canada’s cyber threat environment is becoming more complex, disruptive, and relevant to everyday business operations. For SMBs and insurance teams, the main takeaway is that ransomware, fraud, supply chain compromise, and exploited vendor dependencies are no longer isolated IT issues; they can interrupt services, expose data, increase claims severity, and create cascading losses. Top 3-5 Most Notable Statistics •The Government of Canada allocated $917.4 million in Budget 2024 to enhance intelligence and cyber operations programs. •In the MOVEit exploitation campaign, CL0P impacted an estimated 2,750 enterprises and 94 million individuals. •CL0P amassed approximately $100 million USD in ransom payments from the MOVEit exploitation. •Amazon, Microsoft, and Google together make up an estimated 65% of the global cloud market. •Major disrupted ransomware groups were linked to over 1,000 compromises worldwide before law enforcement action. Top 3-5 Exploitable Technology Risks •Unpatched vulnerabilities in widely used software, including file transfer applications such as GoAnywhere and MOVEit, can enable large-scale supply chain compromise. •Edge devices such as routers, firewalls, and VPN solutions are attractive targets because attackers can use them to enter networks, monitor traffic, exfiltrate data, or move deeper into systems. •Phishing and spear phishing remain major attack paths, with Phishing-as-a-Service kits and AI-powered chatbots making convincing phishing easier for less-skilled criminals. |
| Government of Canada | 2025 | Threat Intelligence Vendor |
| 492 | Navigating the Cyber Claims Landscape: Key Insights from Chubb's Global Cyber Risk Team | Bottom Line Up Front (BLUF) Chubb’s claims data show that ransomware, privacy liability, and widespread technology events are driving meaningful cyber loss activity, especially in the U.S. For SMBs and insurance teams, the key takeaway is that strong resilience planning, privacy awareness, and Zero Trust controls can materially affect both claim outcomes and recovery options. Top 3-5 Most Notable Statistics •Ransomware-related losses accounted for nearly 72% of cyber claim dollars in 2023-2024, compared with 63% from 2020-2022. •In the U.S., ransomware represented 68% of total reported cyber losses in 2024. •The frequency of subsequent third-party litigation from ransomware incidents in 2024 was up approximately 75% over the 2020-2021 average. •In the U.S., the proportion of third-party claims related to privacy liability doubled in 2023-2024 versus 2020-2022. •The July 2024 CrowdStrike outage crashed 8.5 million systems and was estimated to produce $400M-$1.5B in insured losses. Top 3-5 Exploitable Technology Risks •Ransomware attacks, including double and triple extortion, where attackers demand payment to restore systems, prevent data disclosure, or avoid further operational harm. •Social engineering against IT help desks, where attackers manipulate support processes to gain access or control. •SIM swap attacks, which can help attackers bypass account protections and compromise access. |
| Chubb | 2025 | Cyber Insurance Carrier |
| 493 | NCC Group Cyber Threats in Sport 2026 | Bottom Line Up Front (BLUF) NCC Group’s report shows that sports organisations face high cyber exposure because valuable data, money movement, connected venues, third parties, and high-profile individuals are increasingly tied together. For SMBs and insurance teams, the core lesson is clear: cyber insurance alone is not enough if basic controls, incident response, identity security, and third-party assurance are weak. Top 3-5 Most Notable Statistics •The global sports industry is projected to generate more than $700 billion in revenue in 2026. •A 2020 NCSC survey found at least 70% of sports organisations experienced a cyber incident or breach. •Football ticket scam victims suffered an average loss of £410 per fan in one cited 2022 example. •The Royal Dutch Tennis Association was fined €525,000 after selling personal data of more than 350,000 members to sponsors. •NCC Group found 60% of generic email addresses used by Premier League football clubs appeared in known public breaches; one club’s email address appeared in 16 unique public data breaches. Top 3-5 Exploitable Technology Risks •Phishing attacks against employees, which the report identifies as a likely entry point for ransomware and data breach activity. •Weak identity and access management, including reliance on passwords without stronger authentication and poor user/account governance. •Bring Your Own Device use by coaching and management staff, where personal laptops, phones, or tablets may access or store sensitive organisational information without proper security. |
| NCC Group | 2026 | Threat Intelligence Vendor |
| 494 | NCCGroup Annual Research Report 2024 | Bottom Line Up Front (BLUF) NCC Group’s 2024 research shows that practical exploitation remains concentrated around exposed edge devices, identity systems, connected devices, ransomware tradecraft, and newer AI-enabled applications. For SMBs and insurance teams, the key takeaway is that many high-impact incidents still begin with manageable weaknesses: unpatched systems, misconfigured identity controls, weak monitoring, and limited forensic readiness. Top 3-5 Most Notable Statistics •NCC Group highlighted 25 years of cybersecurity research, including exploitation, cryptography, incident response, IoT, and AI security. •The report identified 18 critical vulnerabilities in PandoraFMS Enterprise v7.0NG.767, including unauthenticated admin account takeover, remote code execution, XSS, and SQL injection. •NCC Group reported that TikTok privacy-enhancing technology assurance work was intended to protect over 175 million European users. •NCC Group’s Exploit Development Group won $90,000 at Pwn2Own Automotive 2024 after compromising two in-vehicle entertainment systems and one electric vehicle charger. •Cryptopals had 18 hands-on cryptography challenges available by the end of 2024. Top 3-5 Exploitable Technology Risks •Edge devices such as VPN gateways, firewalls, and routers remained a major concern, with NCC Group observing the 2023 increase in compromised edge devices continuing with greater force in 2024. •Active Directory weaknesses were highlighted across DCSync attacks, LDAP injection, ADCS exploitation, and pass-the-hash attacks, showing how identity misconfigurations can enable credential theft and privilege escalation. •Business applications and infrastructure platforms, including PandoraFMS Enterprise, Qlik Sense servers, Redis on Alpine Linux, and Netgear routers, were shown to contain exploitable flaws that could support takeover, code execution, or ransomware access. |
| NCC Group | 2024 | Threat Intelligence Vendor |
| 495 | NetDiligence Cyber Claims Study 2024 | Bottom Line Up Front (BLUF) The NetDiligence 2024 Cyber Claims Study shows that SMB-sized organizations generate nearly all reported cyber claims, while ransomware remains the dominant driver of cost. For SMB owners, underwriters, and claims teams, the key takeaway is that ransomware, business email compromise, business interruption, recovery expense, and third-party incidents are the areas most likely to shape loss severity and insurance outcomes. Top 3-5 Most Notable Statistics •10,464 cyber claims were analyzed from incidents occurring during 2019–2023. •SMEs represented 98% of claims and 49% of total incident cost, while large companies represented 2% of claims and 51% of total incident cost. •Ransomware accounted for 2,580 SME claims and $1.1B in SME incident cost, representing 65.7% of SME incident cost by cause of loss. •The top four SME causes of loss—ransomware, business email compromise, hackers, and wire transfer fraud—accounted for 68% of claims and 84% of total incident cost. •For SMEs, claims with business interruption had a five-year average incident cost more than 450% greater than claims without business interruption. Top 3-5 Exploitable Technology Risks •Ransomware affecting critical files, systems, databases, or networks, especially where recovery is slow or incomplete. •Business email compromise, which remains one of the leading claim categories for SMEs. •Hacker incidents, identified as one of the top SME causes of loss. |
| NetDiligence | 2024 | Cyber Insurance Carrier |
| 496 | NetDiligence Cyber Claims Study 2025 | Bottom Line Up Front (BLUF) NetDiligence’s 2025 claims study shows that cyber incidents are becoming more expensive for small and medium enterprises, with ransomware remaining the main loss driver. For SMB owners, insurers, claims teams, and underwriters, the key takeaway is that preparation, response planning, and third-party risk management directly affect claim severity and recovery outcomes. Top 3-5 Most Notable Statistics •10,402 cyber claims were analyzed from incidents occurring between 2020 and 2024. •98% of claims came from SMEs with less than $2 billion in annual revenue, but those claims represented 49% of total incident cost. •SME five-year average incident cost increased from $205K in last year’s study to $264K, an increase of almost 30%. •Ransomware accounted for 2,571 SME claims and 68.8% of total SME incident cost by cause of loss. •For SMEs, claims involving business interruption had an average incident cost over 650% greater than claims without business interruption. Top 3-5 Exploitable Technology Risks •Ransomware: The report identifies ransomware as the primary driver of losses, with rising ransom demands, business interruption, recovery costs, and operational disruption. •Business email compromise: BEC was the second-largest cause of claims overall and remains a major source of loss for SMEs. •Third-party and supply chain compromise: The report highlights third-party incidents, vendor vulnerabilities, shared software ecosystems, and supply chain events as growing sources of cascading losses. |
| NetDiligence | 2025 | Cyber Insurance Carrier |
| 497 | New Ransomware Reporting Requirements Kick in as Victims Increasingly Avoid Paying | Bottom Line Up Front (BLUF) Coveware’s key finding is that ransomware victims are increasingly avoiding payment, with Q4 2023 ransom payment rates falling to a record low. For SMBs and insurance teams, this reinforces the value of resilience, incident planning, reporting readiness, and controls that reduce the need to rely on a criminal’s decryption tool or data-leak promise. Top 3-5 Most Notable Statistics •The share of ransomware victims that paid dropped to a record low of 29% in Q4 2023. •The median victim organization size fell to 231 employees, down 32% from Q3 2023. •Coveware estimates close to 100% of active-case victims make some form of law enforcement notification at the time of incident. •Coveware estimates less than 10% of those victims continue collaborating with law enforcement months or years later. •The “big four” impacted industries remained Professional Services, Healthcare, Consumer Services, and Public Sector. Top 3-5 Exploitable Technology Risks •Brute-force attacks against RDP, especially affecting smaller enterprises, remain a basic but effective entry path. •CVE exploitation was used by mid-to-large enterprise-focused actors, with Cisco ASA vulnerability CVE-2023-20269 highlighted as a heavily documented ingress point, particularly in Akira attacks. •Social engineering against internal help desks was used to reset credentials and gain control of high-level IT accounts. |
| Coveware | 2024 | Consulting / Analyst Firm |
| 498 | Open Source Security and Risk Analysis Report 2021 | Bottom Line Up Front (BLUF) Open source is now deeply embedded in commercial software, but Synopsys found that many codebases contain vulnerable, outdated, or legally risky components. For SMBs and insurance teams, the key issue is visibility: businesses cannot fix or assess risk in software dependencies they have not identified and inventoried. Top 3-5 Most Notable Statistics •84% of the 1,500+ codebases audited in 2020 contained at least one public open source vulnerability. •60% of audited codebases contained high-risk open source vulnerabilities, up from 49% in 2019. •The average audited codebase contained 528 open source libraries. •65% of audited codebases contained open source with license conflicts. •91% of audited codebases contained open source dependencies with no development activity in the last two years, and 85% contained dependencies more than four years out of date. Top 3-5 Exploitable Technology Risks •High-risk open source vulnerabilities: Synopsys defines these as vulnerabilities that have been actively exploited, have proof-of-concept exploits, or are remote code execution vulnerabilities. •Outdated dependencies: Many codebases used libraries with newer versions available, including cases where fixes had been available for known vulnerabilities. •Lodash vulnerability CVE-2019-10744: This critical vulnerability appeared in 29% of audited codebases in both 2019 and 2020. |
| Synopsys | 2021 | Threat Intelligence Vendor |
| 499 | Open Source Security and Risk Analysis Report 2022 | Bottom Line Up Front (BLUF) Open source software is present in nearly all commercial codebases reviewed by Synopsys, and most codebases contained known vulnerabilities. For SMBs and insurance teams, the central risk is not open source itself, but unmanaged open source: businesses may not know which components they use, whether those components are outdated, or whether a newly disclosed vulnerability affects them. Top 3-5 Most Notable Statistics •97% of the 2,409 audited commercial codebases contained open source. •81% of audited codebases contained at least one known open source vulnerability. •49% of audited codebases contained at least one high-risk open source vulnerability, down from 60% the prior year. •88% of codebases with risk assessments contained open source components with no development activity in the last two years. •88% of codebases with risk assessments contained outdated versions of open source components where an update or patch was available. Top 3-5 Exploitable Technology Risks •Apache Log4j2 / Log4Shell: the report highlights Log4Shell as a zero-day vulnerability allowing arbitrary code execution on vulnerable servers, with active scanning and attack attempts reported. •Outdated open source components: many codebases used versions where updates or patches were available but not applied, increasing exposure to known issues. •Unmaintained open source components: components with no development activity for two years may not receive feature updates, code improvements, or security fixes. |
| Synopsys | 2022 | Threat Intelligence Vendor |
| 500 | Open Source Security and Risk Analysis Report 2023 | Bottom Line Up Front (BLUF) Open source is now present in nearly all commercial software reviewed by Synopsys, but many organizations are not tracking, updating, or validating it effectively. For SMBs and insurance teams, the main takeaway is that unmanaged open source creates real software supply chain risk: known vulnerabilities, outdated components, abandoned projects, and licensing issues can remain hidden until they affect operations, transactions, or claims. Top 3-5 Most Notable Statistics •96% of the 1,703 audited codebases contained open source. •84% of codebases contained at least one known open source vulnerability. •48% of codebases contained high-risk vulnerabilities, defined as actively exploited, having proof-of-concept exploits, or involving remote code execution. •91% of assessed codebases contained outdated open source components, meaning an update or patch was available but had not been applied. •54% of audited codebases had open source license conflicts, and 31% used code with no discernible license or a customized license. Top 3-5 Exploitable Technology Risks •Known vulnerable open source components, including commonly observed vulnerable components such as jQuery, Lodash, Bootstrap, jackson-databind, Spring Framework, Netty, XStream, and Apache Tomcat. •High-risk vulnerabilities that are actively exploited, have documented proof-of-concept exploits, or enable remote code execution. •Outdated components where patches or newer versions exist but have not been applied. |
| Synopsys | 2023 | Threat Intelligence Vendor |
| 501 | Open Source Security and Risk Analysis Report 2024 | Bottom Line Up Front (BLUF) Open source is now embedded in nearly all commercial software, but many organizations are not maintaining it well enough to control security, licensing, and software supply chain risk. For SMBs and insurance teams, the most important takeaway is that unmanaged open source can create exploitable vulnerabilities, sensitive data exposure, legal issues, and costly remediation delays. Top 3-5 Most Notable Statistics •96% of the 1,067 scanned codebases contained open source. •77% of all source code and files scanned originated from open source. •84% of codebases assessed for risk contained at least one known open source vulnerability. •74% of codebases assessed for risk contained high-risk vulnerabilities, up from 48% in 2022. •91% of codebases assessed for risk contained components that were 10 versions or more behind the current version. Top 3-5 Exploitable Technology Risks •Outdated open source components: many codebases used components far behind current versions, increasing exposure to known vulnerabilities. •High-risk vulnerabilities: the report defines these as vulnerabilities that have been actively exploited, have proof-of-concept exploits, or involve remote code execution. •Cross-site scripting in older jQuery versions: one highlighted jQuery vulnerability could allow untrusted code execution and exposure of passwords or credit information. |
| Synopsys | 2024 | Threat Intelligence Vendor |
| 502 | OpenAI AI and Covert Influence Operations 2024 | Bottom Line Up Front (BLUF) OpenAI found that covert influence operators are using AI mainly to generate text, translate content, debug automation, and fake engagement, but the investigated campaigns did not meaningfully increase real audience reach. For SMBs and insurance teams, the key takeaway is that AI can make deceptive content operations faster and cheaper, even when those operations still struggle to gain authentic traction. Top 3-5 Most Notable Statistics •OpenAI disrupted covert influence activity linked to operators in Russia, China, Iran, and a commercial company in Israel across 5 case studies. •None of the 5 operations scored higher than 2 on the Breakout Scale, meaning activity appeared on multiple platforms but did not break out to authentic audiences. •Bad Grammar was assessed as Category 1, with posting activity on a single platform and no evidence of significant outside amplification. •IUVM-branded accounts identified on TikTok, VKontakte, and Odnoklassniki had 10, 76, and 274 followers or subscribers, respectively. •Some Doppelganger posts on 9GAG received about 5-10 upvotes and 15-200 downvotes, with users often calling out the accounts as bots. Top 3-5 Exploitable Technology Risks •Generative AI for bulk content creation: actors used models to produce large volumes of comments, articles, headlines, tags, and social posts in multiple languages. •Automation support: Bad Grammar used models to debug code apparently designed to automate posting on Telegram. •Fake engagement: campaigns generated replies to their own posts to create the false appearance of real discussion. |
| OpenAI | 2024 | Research Organization |
| 503 | Organizing Security Digital Transformation 2024 | Bottom Line Up Front (BLUF) Google’s report emphasizes that secure digital transformation is mainly an organizational challenge, not just a technology project. For SMBs and insurance teams, the key takeaway is that cloud adoption can increase speed and capability, but unclear ownership, weak governance, manual processes, and skill gaps can create security and operational risk. Top 3-5 Most Notable Statistics •Google based this guidance on experience working with hundreds of customers moving to the cloud. •Current estimates cited in the report indicate more than 3.5 million unfilled cybersecurity jobs globally. •The report cites approximately 700,000 unfilled cybersecurity jobs in the United States. •Google’s DevOps research draws from tens of thousands of professionals across industries and company sizes. •The report frames transformation across 4 stages: Experimentation and Disintegration, Dissolution, Transformation, and Integration. Top 3-5 Exploitable Technology Risks •Cloud environments exposed to unauthorized access, malicious activity, misconfigurations, and data exfiltration when monitoring and controls are immature. •Weak or unclear access control, data encryption, and incident response policies in cloud environments. •Vulnerabilities that are detected but not clearly assigned for correction, creating delays in patching and remediation. |
| 2024 | Cloud Provider / Hyperscaler | |
| 504 | OT Cyber Threat Report 2026 | Bottom Line Up Front (BLUF) Waterfall Security reports that publicly recorded cyber incidents causing physical impacts in industrial operations declined in 2025, but the decline is not a reason to relax controls. For SMBs with manufacturing, logistics, energy, facilities, or critical suppliers, the key risk remains business interruption from ransomware, exposed control systems, weak IT/OT separation, and third-party operational dependencies. Top 3-5 Most Notable Statistics •57 breaches met the report’s strict criteria in 2025, a 25% decline from 76 in 2024. •Nation-state and hacktivist attacks doubled in 2025, with 14 attacks identified and 5 linked to the Russia-Ukraine conflict. •65% of public incident reports did not provide enough detail to determine how cyberattacks impaired physical operations. •Critical infrastructure sectors accounted for 7 breaches, or 12%, while transportation accounted for 14 breaches, or 25%. •The Jaguar / LandRover incident reportedly involved USD $258M in direct recovery costs, roughly USD $1B in company losses, and an estimated USD $2.5B impact on the UK economy. Top 3-5 Exploitable Technology Risks •Internet-exposed control systems, including web-accessible control panels and exposed industrial automation, which attackers used to interfere with dams and power plants. •Ransomware affecting IT systems that support production, distribution, shipping, receiving, or industrial operations. •Weak IT/OT connectivity boundaries that allow attack information to move from less trusted IT or Internet-connected networks into operational environments. |
| Waterfall Security | 2026 | Threat Intelligence Vendor |
| 505 | OT Cyber Threat Report: Navigating the Future of OT Security | Bottom Line Up Front (BLUF) Cyber attacks on organizations with physical operations are increasingly causing real-world disruption, not just data loss. For SMBs and insurance teams, the key takeaway is that ransomware, weak separation between IT and OT, remote access exposure, and supplier dependencies can translate quickly into shutdowns, delivery delays, safety concerns, and large business interruption losses. Top 3-5 Most Notable Statistics •76 attacks caused physical consequences to OT organizations in 2024, a 5% increase over 2023. •Sites suffering physical impairment rose 146%, from 412 sites in 2023 to 1,015 in 2024. •87% of identifiable attacks in 2024 were ransomware. •Nation-state attacks with physical consequences tripled in 2024 compared with the prior year. •Transportation represented 37% of all attacks with physical consequences in 2024. Top 3-5 Exploitable Technology Risks •Ransomware impacting IT systems that physical operations depend on, leading to production stoppages, delayed fulfillment, and shutdowns. •Poor IT/OT segmentation, including incidents where attacks pivoted from compromised IT assets into OT environments. •Remote access weaknesses, with the report highlighting newer guidance encouraging more secure remote access protections than VPNs, including hardware-enforced approaches for OT. |
| Waterfall Security | 2025 | Threat Intelligence Vendor |
| 506 | OT/ICS Cybersecurity Report: Year in Review 2025 | Bottom Line Up Front (BLUF) Dragos reports that OT/ICS environments are being targeted more often by ransomware groups, hacktivists, and state-linked threat groups, and many attacks rely on basic exposure rather than advanced techniques. For SMBs that operate manufacturing, utilities, building systems, or industrial equipment, the most important takeaway is that internet-exposed devices, weak remote access, poor visibility, and limited segmentation can turn a routine intrusion into operational downtime. Top 3-5 Most Notable Statistics •Ransomware attacks against industrial organizations increased 87% over the previous year. •Dragos observed 1,693 industrial organizations with sensitive data and information posted to ransomware leak sites in 2024. •Manufacturing represented 1,171 ransomware victims across 26 manufacturing subsectors. •Dragos tracked nearly 80 ransomware groups impacting OT/ICS in 2024, a 60% increase from 50 groups in 2023. •70% of vulnerabilities resided deep within the network, while 22% of advisories were network exploitable and perimeter facing. Top 3-5 Exploitable Technology Risks •Internet-exposed OT/ICS assets, including HMIs, controllers, VPNs, and industrial devices, were highlighted as major attack paths because adversaries can find them using public scanning tools. •Ivanti Connect Secure VPN exploitation using CVE-2023-46805 and CVE-2024-21887 enabled remote code execution, configuration theft, reverse tunneling, webshell installation, and log tampering. •Modbus TCP/502 exposure created risk from FrostyGoop-style activity, which can read and write Modbus registers and potentially affect multiple Modbus-speaking devices. |
| Dragos | 2025 | OT/ICS Security Vendor |
| 507 | OT/IoT Cybersecurity Trends and Insights (2024 2H Review) | Bottom Line Up Front (BLUF) Nozomi’s 2024 second-half review shows that OT and IoT environments face converging risks from wireless weaknesses, exploitable device vulnerabilities, botnets, ransomware, and OT-specific malware. For SMBs that operate manufacturing, transportation, energy, facilities, or connected industrial equipment, the main takeaway is that operational downtime risk depends on visibility, credential hygiene, vulnerability prioritization, and continuous monitoring. Top 3-5 Most Notable Statistics •94% of observed Wi-Fi networks had Managed Frame Protection disabled, leaving them insufficiently protected against deauthentication attacks. •CISA released 241 ICS advisories covering 619 vulnerabilities across approximately 70 vendors in the second half of 2024. •About 71% of OT vulnerabilities with available CVSS scores were rated High or Critical, with an average CVSS score of 7.43. •Nozomi observed 4 Known Exploited Vulnerabilities and 20 vulnerabilities with an EPSS score above 1%, indicating higher exploitation likelihood. •IoT botnet activity peaked at 1,595 unique attacker IPs in early September, with an average of 758 daily unique attacking machines during the period. Top 3-5 Exploitable Technology Risks •Wi-Fi deauthentication exposure: networks without 802.11w Managed Frame Protection can be disrupted by forged management messages. •Unmonitored industrial wireless environments: legacy protocols, unsecured channels, rogue devices, drones, interception, jamming, and unauthorized access attempts create blind spots. •Weak or default SSH and Telnet credentials on OT, IT, and IoT devices: attackers repeatedly used root/admin-style credential pairs for initial access. |
| Nozomi Networks | 2025 | OT/ICS Security Vendor |
| 508 | Picus Red Report 2025 | Bottom Line Up Front (BLUF) Picus Security’s 2025 report shows that attackers are concentrating on a small set of repeatable techniques that help them steal credentials, evade defenses, maintain access, and disrupt systems. For SMBs and insurance teams, the key takeaway is that focusing controls on these high-frequency behaviors can materially improve resilience against common malware, infostealers, and ransomware-style attacks. Top 3-5 Most Notable Statistics •Picus Labs analyzed more than 1 million malware samples collected during 2024. •93% of observed malicious actions were linked to the top ten MITRE ATT&CK techniques. •Malware targeting credential stores increased from 8% in 2023 to 25% in 2024, a 3X surge. •Typical modern malware performed an average of 14 malicious actions and 12 ATT&CK techniques per sample. •Process Injection was observed in 31% of malicious files, making it the most prevalent technique in the report. Top 3-5 Exploitable Technology Risks •Process injection, where malicious code is inserted into legitimate processes to evade basic detection and potentially gain higher privileges. •Command and scripting interpreter abuse, including PowerShell, Bash, Visual Basic, and cloud APIs, allowing attackers to run commands, download payloads, and automate malicious activity. •Credential theft from password stores, including password managers, browser-stored credentials, and cached login data, enabling lateral movement and privilege escalation. |
| Picus Security | 2025 | Cybersecurity Services / Consultancy |
| 509 | Picus Red Report 2026 | Bottom Line Up Front (BLUF) Picus Security’s 2026 report shows attackers are shifting from quick, noisy disruption toward stealthy, long-term access using legitimate tools, identities, cloud services, and remote access methods. For SMBs and insurance teams, the key risk is that incidents may stay hidden longer, increasing the chance of credential theft, data extortion, business interruption, and more complex claims. Top 3-5 Most Notable Statistics •Picus analyzed over 1.1 million malicious files and more than 15.5 million adversarial actions from 2025. •80% of the top ten techniques are focused on evasion, persistence, or stealthy command and control. •Data Encrypted for Impact fell from 21.00% of samples to 12.94%, a 38% relative decrease. •Process Injection was the most prevalent technique, appearing in 30.07% of malicious samples. •Credentials from Password Stores appeared in 23.49% of samples, roughly double the prevalence of data encryption. Top 3-5 Exploitable Technology Risks •Process injection: Attackers insert malicious code into legitimate processes to hide activity, evade basic detection, persist, and potentially gain higher privileges. •Command and scripting interpreters: PowerShell, Bash, Python, network device CLIs, and similar tools can be abused to execute payloads in memory, bypass policies, and reduce file-based evidence. •Password stores and cloud secrets stores: Attackers target browser-saved passwords, password managers, API keys, service principal secrets, and cloud vaults to log in rather than break in. |
| Picus Security | 2026 | Cybersecurity Services / Consultancy |
| 510 | Post Quantum Cryptography for 5G Roaming 2026 | Bottom Line Up Front (BLUF) GSMA’s core message is that non-terrestrial networks, including satellite links used for backhaul, direct-to-phone, and IoT connectivity, need a planned migration to post-quantum cryptography without disrupting existing operations. For SMBs and insurance teams, the practical takeaway is to identify where satellite, roaming, IoT, VPN, TLS, IPsec, certificates, and vendor-managed links are used, because weak or legacy cryptography can expose sensitive data and create operational resilience risks. Top 3-5 Most Notable Statistics •GEO satellites have typical latency of 500 msec, which can slow user traffic, IPsec connection establishment, and IPsec key re-establishment. •MEO satellites have latency of around 125 msec. •LEO satellites have latency between 2 and 20 msec. •Satellite maintenance cycles can exceed six months, making compensating controls and defence-in-depth important. •3GPP NTN architecture describes two implementation scenarios: transparent payload and regenerative payload. Top 3-5 Exploitable Technology Risks •RF jamming against satellite links, especially terminal-to-satellite and satellite-to-ground station segments, can disrupt connectivity. •Insecure application-layer protocols such as HTTP or FTP, if used without TLS or SSH, can expose telemetry, software updates, or bulk data to interception or tampering. •Unencrypted links between ground stations and the Satellite Network Operator EPC may be intercepted if IPsec is not used. |
| GSMA | 2026 | ISAC / Industry Consortium |
| 511 | Post Quantum Cryptography for 5G Roaming Use Case | Bottom Line Up Front (BLUF) GSMA’s core message is that 4G and 5G roaming interfaces need a planned migration to post-quantum cryptography because sensitive roaming data can be harvested today and decrypted later if a cryptographically relevant quantum computer becomes available. For SMBs and insurance teams, the issue is most relevant where the business operates telecom infrastructure, provides mobile services, or depends on mobile providers handling subscriber, authentication, location, call, or billing data. Top 3-5 Most Notable Statistics No strong statistics identified in the report. Top 3-5 Exploitable Technology Risks •Classical key exchange in TLS 1.2, TLS 1.3, IKEv2, and IPSec may be vulnerable to Harvest Now, Decrypt Later attacks if encrypted roaming traffic is captured now and decrypted later using a future quantum computer. •5G N32 roaming interfaces carry sensitive subscriber information, including session keys, profiles, call data, CDRs, authentication material, authorization tokens, and location information. •Roaming intermediaries such as IPX providers may have access to signaling messages in hop-by-hop TLS models because messages are decrypted and re-encrypted at each hop. •ECDSA-based signatures used for SEPP, IPX, JSON Web Signature, or JSON Web Token authentication could become vulnerable to impersonation, spoofing, or tampering if quantum attacks become practical. •Diameter roaming messages do not provide integrity or confidentiality protection by default and rely on IPSec or TLS for hop-by-hop protection rather than end-to-end protection. Key Business Impact for SMBs For most SMBs, this report is not a direct checklist for internal IT systems; it is focused on mobile network operators, IPX providers, roaming partners, and telecom infrastructure. The business impact is strongest for companies that provide telecom services, operate mobile network components, handle subscriber data, or rely on mobile roaming as part of customer-facing services. The report identifies privacy exposure, leakage of subscriber information, exposure of internal network identifiers, service degradation, theft of services, and denial-of-service as possible outcomes if roaming interfaces are compromised or if authentication and integrity protections fail. |
| GSMA | 2025 | ISAC / Industry Consortium |
| 512 | Privacy in Practice 2023 | Bottom Line Up Front (BLUF) ISACA’s 2023 privacy survey shows that many organizations still lack enough skilled staff, funding, training maturity, and board-level support to manage privacy risk effectively. For SMBs and insurance teams, the key issue is not only compliance; weak privacy programs can lead to breaches, customer complaints, regulatory exposure, reputational damage, and higher loss potential. Top 3-5 Most Notable Statistics •53% of respondents said technical privacy teams are somewhat or significantly understaffed. •42% reported that their enterprise privacy budget is somewhat or significantly underfunded. •49% identified lack of training or poor training as a common privacy failure. •42% identified data breach/leakage as a common privacy failure, and 42% also identified not practicing privacy by design. •69% expect demand for technical privacy roles to increase in the next year, while 62% expect demand for legal/compliance privacy roles to increase. Top 3-5 Exploitable Technology Risks •Social engineering was identified as a common privacy failure, creating risk that employees may be manipulated into exposing personal information. •Data breach/leakage was identified as a common privacy failure, directly affecting the confidentiality of personal information. •Bad or nonexistent detection of personal information was identified as a common privacy failure, making it harder to know where sensitive data exists or whether it has been exposed. |
| ISACA | 2023 | ISAC / Industry Consortium |
| 513 | ProcessUnity State of Third-Party Risk Assessments 2026 | Bottom Line Up Front (BLUF) ProcessUnity’s 2026 survey shows a clear gap between having third-party risk processes and actually reducing third-party incidents. For SMBs and insurance teams, the key takeaway is that vendor risk is frequent, operationally disruptive, and often poorly measured, even when organizations believe their programs are mature. Top 3-5 Most Notable Statistics •90% of organizations experienced at least one third-party breach or security incident in the past 12 months, with an average of 12 incidents per organization. •92% of small organizations experienced at least one third-party breach, compared with 89% of large organizations. •64% of organizations reported operational disruption from third-party incidents, while 52% reported financial loss and 42% reported reputational damage. •63% of third-party assessments require more than 40 hours of team effort, including 28% that require more than 160 hours. •64% of organizations use spreadsheets and 67% use homegrown tools for third-party risk assessments. Top 3-5 Exploitable Technology Risks •Third-party breaches and security incidents: the report shows these are common across organization sizes and industries, making vendors a recurring source of exposure. •Fourth-party risk blind spots: 58% of organizations do not assess subcontractor risk at all, reducing visibility into parties that may still affect business operations. •Incomplete remediation before onboarding: only 16% of organizations complete 90–100% of remediation before onboarding, leaving known issues unresolved when vendor relationships begin. |
| ProcessUnity | 2026 | Compliance / GRC Vendor |
| 514 | Protecting People 2019 | Bottom Line Up Front (BLUF) Proofpoint’s central finding is that cyber risk is concentrated around people, not just executives or systems. SMBs and insurance teams should pay close attention to cloud account compromise, shared email aliases, and highly exposed roles because attackers use these paths to reach multiple users, internal processes, customers, and supply-chain partners. Top 3-5 Most Notable Statistics •Proofpoint analyzed more than 1,000 cloud service tenants covering over 20 million user accounts. •The report observed more than 15 million unauthorized cloud login attempts, including 400,000 successful attempts. •In education and food and beverage, more than 7 in 10 cloud attack campaigns resulted in successful compromise. •Even in regulated sectors, 2 in 10 attack campaigns against financial services and 4 in 10 against healthcare resulted in successful compromise. •Nearly 20% of the highest-risk email addresses from email attacks were shared or generic aliases. Top 3-5 Exploitable Technology Risks •Shared email aliases such as sales@ or inquiries@ can expose multiple employees from a single malicious email and are harder to protect with multifactor authentication. •Cloud accounts, especially unused or rarely monitored accounts, are vulnerable to unauthorized login and brute-force password attacks. •Compromised cloud accounts can be used for spam, malware, phishing, internal phishing, and fraud. |
| Proofpoint | 2019 | Email Security Vendor |
| 515 | PushSecurity Identity Attacks 2024 | Bottom Line Up Front (BLUF) Identity attacks, especially account takeover against SaaS and cloud apps, are presented as the top cyber threat facing organizations in 2024. For SMBs and insurance teams, the key lesson is that attackers often no longer need to break through networks; they can log in with stolen credentials, bypass weak MFA, steal data, and move quickly to extortion. Top 3-5 Most Notable Statistics •~165 Snowflake customer tenants were targeted using stolen credentials, with hundreds of millions of end-customers affected. •79.7% of accounts used by the Snowflake threat actor had prior credential exposure, according to the report’s cited analysis. •Push reports 1 in 5 users reuse passwords, increasing the chance that one breached password can unlock multiple apps. •2 in 5 accounts lack MFA, rising to 4 in 5 where a password is the only registered login method. •Change Healthcare’s ransom payment was allegedly $22 million, following an attack that began with stolen credentials and no MFA on a Citrix remote access service. Top 3-5 Exploitable Technology Risks •SaaS accounts without MFA, especially local app logins that remain active even when SSO is configured. •Weak, reused, or previously breached passwords that enable credential stuffing across many business apps. •Infostealer malware that captures browser-stored passwords, session cookies, autofill data, and downloaded file information. |
| Push | 2024 | Identity Security Vendor |
| 516 | PwC Cyber Threats Retrospect 2022 | Bottom Line Up Front (BLUF) PwC’s 2022 threat review shows that attackers continued to rely on known vulnerabilities, phishing, stolen credentials, ransomware, and cloud identity abuse rather than only novel techniques. For SMBs and insurance teams, the key takeaway is that preventable weaknesses—unpatched systems, weak identity controls, poor logging, and unmanaged remote access tools—remain central to many serious incidents. Top 3-5 Most Notable Statistics •63% of PwC-analyzed incident response cases in 2022 resulted from financially motivated threat actors. •Nearly half of those financially motivated incident response cases involved ransomware attacks. •The top five sectors posted to ransomware leak sites in 2022 were manufacturing (15%), construction (10%), professional services (9%), technology (8%), and retail (8%). •LockBit, tracked by PwC as White Janus, posted 907 victims to its leak site in 2022, compared with 460 in 2021. •Red Scylla targeted at least 70 organisations around the world. Top 3-5 Exploitable Technology Risks •Log4Shell in Apache Log4j allowed remote code execution and remained exploitable in unpatched environments throughout 2022. •Microsoft Exchange vulnerabilities, including ProxyShell and ProxyNotShell, were highlighted as routinely exploited paths into victim environments. •ISO and LNK files became common malware delivery methods after Microsoft changed macro behavior, allowing attackers to disguise malicious payloads as legitimate documents. |
| PwC | 2022 | Consulting / Analyst Firm |
| 517 | PwC Global Digital Trust Insights 2022 | Bottom Line Up Front (BLUF) PwC’s 2022 report argues that cyber risk is rising, but much of it remains preventable when organizations simplify operations, strengthen controls, and make cybersecurity a business priority. For SMBs and insurance teams, the key takeaway is that complexity, weak third-party visibility, poor data governance, and delayed security involvement can increase the likelihood and cost of incidents. Top 3-5 Most Notable Statistics •69% of organizations expect cyber spending to rise in 2022, up from 55% the prior year. •More than 50% expect a surge in reportable cyber incidents above 2021 levels. •75% of respondents say avoidable organizational complexity creates concerning cyber and privacy risks. •Only 40% say they thoroughly understand third-party cyber and privacy risks through formal enterprise-wide assessments. •56% expect an increase in reportable incidents from software supply chain attacks, while only 34% have formally assessed their exposure. Top 3-5 Exploitable Technology Risks •Cloud services and cloud migration: executives expect increases in attacks on cloud services, while only a minority report realizing benefits from cloud security investments. •Software supply chain attacks: the report highlights malware via software updates and attacks through trusted vendors, suppliers, and contractors. •Third-party and supplier weaknesses: many organizations lack formal visibility into risks from vendors and extended “nth-party” relationships. |
| PwC | 2022 | Consulting / Analyst Firm |
| 518 | PwC Global Digital Trust Insights 2023 | Bottom Line Up Front (BLUF) PwC’s 2023 findings show that cyber risk is rising as organisations rely more on remote work, cloud services, digital supply chains, operational technology, and customer data. For SMBs and insurance teams, the main takeaway is that common, exploitable pathways such as cloud misconfigurations, email compromise, ransomware, third-party exposure, and weak resilience planning can create costly disruption, data loss, notification costs, and reputational damage. Top 3-5 Most Notable Statistics •65% of executives expect cybercriminals to significantly affect their organisation in 2023 compared with 2022. •42% of senior executives say cyber breaches of their systems have increased since 2020. •More than 25% had a consequential data breach in the past three years costing more than $1 million; around 10% reported costs of $10 million or more. •Fewer than 40% say they have fully mitigated cyber risks tied to major digital initiatives such as remote work, cloud adoption, IT/OT convergence, IoT, and digital supply chains. •Only 19% of CIOs, CISOs, CTOs, and other senior IT and security executives are very confident their cloud environment is secured against all four common cloud-breach pathways highlighted in the report. Top 3-5 Exploitable Technology Risks •Cloud weaknesses, including credential and secrets management gaps, resource permissioning errors, public/private storage configuration issues, cloud misconfigurations, and poor API management. •Email-based attacks, including business email compromise and account takeover, which executives expect to increase. •Ransomware, including ransomware operations run as businesses and deployed at scale through affiliate models. |
| PwC | 2023 | Consulting / Analyst Firm |
| 519 | Q1 2025 State of API Security | Bottom Line Up Front (BLUF) APIs are now central to cloud migration, system integration, and digital business operations, but the report shows that API security controls are not keeping pace with growth. For SMBs and insurance teams, the key concern is that exposed, poorly monitored, or misconfigured APIs can create direct paths to data exposure, fraud, downtime, and delayed application launches. Top 3-5 Most Notable Statistics •99% of organizations encountered API security issues in the past year. •55% slowed the rollout of a new application because of API security concerns. •95% of API attack attempts analyzed by Salt Labs came from authenticated users. •98% of attack attempts targeted external-facing APIs. •Only 20% of organizations continuously monitor APIs in real time, and only 15% are very confident in the accuracy of their API inventories. Top 3-5 Exploitable Technology Risks •External-facing APIs: Salt Labs found that nearly all observed attack attempts targeted external APIs, making public API endpoints a major attack surface. •Authenticated API abuse: Most attack attempts came from authenticated sources, showing that stolen credentials, compromised accounts, or misuse by valid users can bypass defenses that rely mainly on login controls. •Security misconfiguration: The report identifies OWASP API8 security misconfiguration as the largest mapped attack category, including issues such as excessive permissions, exposed sensitive data, and weak configuration controls. |
| Salt Security | 2025 | Threat Intelligence Vendor |
| 520 | Q1 Cyber Threat Report 2025 | Bottom Line Up Front (BLUF) Ransomware activity reached another record high in Q1 2025, driven by both mass exploitation and repeatable access methods that are easier for less-skilled attackers to use. For SMBs and insurance teams, the key takeaway is that attackers now have more automated, scalable ways to break in through credentials, remote access tools, social engineering, and unpatched edge systems. Top 3-5 Most Notable Statistics •2,241 ransomware victims were posted on leak sites between January 1 and March 30, 2025. •Q1 ransomware leak-site activity increased 35% from the prior quarter and was more than double the level seen in Q1 2024. •Cl0p’s mass exploit led to at least 373 victims being posted on leak sites, including over 200 in March alone. •Ransomhub attacked over 200 victims in early 2025 before appearing to shut down or merge with another group. •In healthcare, approximately 276 million U.S. patient records were compromised in 2024, and ransomware incidents accounted for 69% of compromised patient records that year. Top 3-5 Exploitable Technology Risks •Severe vulnerabilities in managed file transfer and storage technology, including CVE-2024-50623 and CVE-2024-55956, which allowed unrestricted file uploads/downloads and arbitrary command execution. •Enterprise VPNs and firewalls exposed to brute-force attacks using weak or reused credentials. •Public-facing login pages, remote desktops, websites, and VPN devices targeted by automated credential-checking tools such as TMChecker and Golden Checker. |
| Travelers | 2026 | Cyber Insurance Carrier |
| 521 | Q2 Cyber Threat Report 2025 | Bottom Line Up Front (BLUF) Travelers’ key message is that business email compromise and social engineering remain consistent, costly claim drivers, even as ransomware activity eased from Q1 2025 levels. For SMBs and insurance teams, the practical takeaway is that fraud prevention cannot rely on email trust alone; payment verification, phishing-resistant authentication, and disciplined procedures are central loss-control issues. Top 3-5 Most Notable Statistics •Ransomware leak site listings declined from 2,241 incidents in Q1 2025 to 1,485 incidents in Q2 2025. •Q2 2025 ransomware activity remained above Q1 2024’s 1,066 incidents and in line with the longer-term upward trend observed by Travelers. •U.S. businesses reported more than $2.7 billion in BEC losses in 2024 across more than 20,000 reported incidents. •Global reported BEC losses over the past decade exceeded $50 billion. •BEC and social engineering fraud represented roughly half of all Travelers cyber claims over the past five years. Top 3-5 Exploitable Technology Risks •Compromised business email accounts used to impersonate executives, vendors, or employees and authorize fraudulent payments. •Phishing, spear phishing, and adversary-in-the-middle attacks used to steal credentials or bypass weak authentication. •Multifactor authentication configured to allow SMS authentication, which Travelers’ case study identified as exploitable in an AiTM attack. |
| Travelers | 2026 | Cyber Insurance Carrier |
| 522 | RaaS devs hurt their credibility by cheating affiliates in Q1 2024 | Bottom Line Up Front (BLUF) Coveware’s Q1 2024 ransomware report shows a disrupted and less trusted ransomware ecosystem, but not a reduced risk environment for SMBs. Affiliates are shifting among ransomware brands or running their own operations, while attackers continue to exploit known, unpatched vulnerabilities and weak internal controls to create business disruption and data-theft extortion events. Top 3-5 Most Notable Statistics •Average ransom payment fell to $381,980, down 32% from Q4 2023. •Median ransom payment rose to $250,000, up 25% from Q4 2023. •The share of victims choosing to pay reached a record low of 28%. •In data-theft-only extortion cases, 23% of victims paid. •Akira remained the most common ransomware variant, representing 21% of observed attacks. Top 3-5 Exploitable Technology Risks •Unpatched Cisco VPN products affected by CVE-2023-20269, leveraged by Akira. •Unpatched Netscaler VPN virtual servers affected by CVE-2023-4966, leveraged by RansomHouse, BlackSuit, Play, and LockBit. •Unpatched ScreenConnect instances affected by CVE-2024-1708-9, used for remote code execution by Mamba and RansomHouse. |
| Coveware | 2024 | Consulting / Analyst Firm |
| 523 | Ransomware actors pivot away from major brands in Q2 2024 | Bottom Line Up Front (BLUF) Coveware’s Q2 2024 ransomware data shows attackers are moving away from stable, recognizable ransomware brands and toward unaffiliated “lone wolf” operations or smaller groups, while reusing familiar attack techniques. For SMBs and insurance teams, the key lesson is to focus less on the ransomware name and more on repeatable controls against credential abuse, VPN compromise, data theft, lateral movement, and VMware ESXi disruption. Top 3-5 Most Notable Statistics •Over 10% of Coveware-handled Q2 incidents were attributed to unaffiliated ransomware activity. •The average ransom payment was $391,015, up 2.4% from Q1 2024. •The median ransom payment was $170,000, down 32% from Q1 2024. •36% of clients chose to pay a ransom in Q2, compared with 28% in Q1. •Exfiltration appeared in 77% of cases, while lateral movement appeared in 71%. Top 3-5 Exploitable Technology Risks •VPN compromise remained the highest confirmed initial access vector, involving possible stolen credentials, brute force access with single-factor authentication, CVE exploitation, or a combination. •Weakly secured Snowflake instances were used in data exfiltration attempts, showing how third-party cloud applications can become easy targets. •Callback phishing and help desk social engineering were used to coerce employees into installing remote access tools such as ZohoAssist or QuickAssist. |
| Coveware | 2024 | Consulting / Analyst Firm |
| 524 | Ransomware Defense Report 2022 | Bottom Line Up Front (BLUF) SpyCloud’s 2022 report shows ransomware is becoming more frequent, more successful, and harder to prevent with traditional defenses alone. For SMBs and insurance teams, the key takeaway is that prevention must focus on the real entry points attackers exploit: unpatched systems, phishing, unmanaged devices, compromised credentials, malware-infected endpoints, and stolen web sessions. Top 3-5 Most Notable Statistics •90% of surveyed organizations were affected by ransomware at least once in the past year, up from 72.5% the prior year. •77.7% of surveyed organizations reported being hit between two times and more than ten times in the past year, up from 51.7% the prior year. •65% of organizations hit by ransomware paid the ransom, but only slightly more than half of those fully recovered their data. •Ransomware-specific insurance riders increased from 50.4% to 72.3% year over year. •87% of respondents said credential-stealing malware increased concern about unmonitored personal devices as ransomware entry points. Top 3-5 Exploitable Technology Risks •Unpatched vulnerabilities, ranked as the riskiest ransomware entry point, give attackers a practical path to infect systems and gain access. •Phishing emails with infected attachments or links remain a major route for malware and credential theft. •Unmanaged devices, including personal devices used for work access, create visibility gaps that security teams may not be able to monitor. |
| SpyCloud | 2022 | Threat Intelligence Vendor |
| 525 | Ransomware Defense Report 2023 | Bottom Line Up Front (BLUF) SpyCloud’s report shows that ransomware defense is increasingly an identity and access problem, not just a device or backup problem. For SMBs and insurance teams, the key takeaway is that infostealer malware, stolen credentials, and stolen session cookies can create a path to ransomware even when organizations believe they have strong controls in place. Top 3-5 Most Notable Statistics •81% of surveyed organizations were affected by ransomware at least once in the past 12 months. •48% of affected organizations paid a ransom, down from 65% the prior year. •39% of affected organizations reported cumulative ransomware costs of at least $1 million. •30% of North American and European ransomware victim companies had at least one infostealer infection before being attacked. •98% of respondents agreed that better visibility into malware-exfiltrated data and automated remediation workflows would improve their overall security posture. Top 3-5 Exploitable Technology Risks •Infostealer malware, especially Raccoon, Vidar, and Redline, which was associated with ransomware events within an average of 16 weeks after infection. •Stolen session cookies and tokens, which can allow criminals to hijack active sessions and bypass authentication controls such as MFA and passkeys. •Phishing and social engineering, ranked as the riskiest ransomware entry point by respondents. |
| SpyCloud | 2023 | Threat Intelligence Vendor |
| 526 | Ransomware Review: First Half of 2024 | Bottom Line Up Front (BLUF) Ransomware activity remained high in the first half of 2024, with Unit 42 observing more leak-site compromise announcements than in the same period of 2023 despite major law enforcement disruptions. For SMBs and insurance teams, the key takeaway is that ransomware risk is not concentrated in a few gangs; when major groups are disrupted, other operators quickly move in to fill the gap. Top 3-5 Most Notable Statistics •1,762 new ransomware leak-site posts were observed across 53 dedicated leak sites in the first half of 2024. •Ransomware compromise announcements increased 4.3% year over year compared with the first half of 2023. •The top six ransomware groups accounted for more than half of observed compromises. •Manufacturing represented 16.4% of observed ransomware posts, followed by healthcare at 9.6% and construction at 9.4%. •The U.S. accounted for 917 compromises, representing 52% of total observed attacks. Top 3-5 Exploitable Technology Risks •Known and newly disclosed vulnerabilities used for initial access, privilege escalation, and lateral movement across victim environments. •Fortinet SSL VPN vulnerability CVE-2018-13379. •ConnectWise ScreenConnect vulnerabilities CVE-2024-1708 and CVE-2024-1709. |
| Palo Alto Networks Unit 42 | 2024 | Network Security Vendor |
| 527 | Ransomware Risk Report 2025 | Bottom Line Up Front (BLUF) Ransomware success declined modestly in 2025, but the report shows ransomware remains a high-probability business disruption event. For SMBs and insurance teams, the key issue is not only whether an attack occurs, but whether the business can recover without paying, avoid repeat attacks, and prove that core identity systems and backups are resilient. Top 3-5 Most Notable Statistics •78% of responding organizations were targeted by ransomware in the past 12 months. •56% of targeted organizations experienced a successful attack, and 73% of successful victims were attacked multiple times. •69% of successful attacks resulted in ransom payment; 55% of organizations that paid did so multiple times. •50% of attacks compromised identity infrastructure. •15% of ransomware victims that paid did not receive usable decryption keys, and another 3% received usable keys but later found their stolen data had been published or illegally used. Top 3-5 Exploitable Technology Risks •Identity infrastructure compromise, including environments involving Active Directory, Entra ID, and Okta, which the report identifies as a major area of attack and recovery concern. •Legacy systems and technical debt, which respondents cited as a top cybersecurity challenge and which can leave exploitable weaknesses unaddressed. •Internet-facing devices that are not patched, specifically called out as needing attention to reduce ransomware risk. |
| Semperis | 2025 | Identity Security Vendor |
| 528 | Ransomware Trends 2023 | Bottom Line Up Front (BLUF) Ransomware recovery depends heavily on whether backups survive the attack and can be safely restored. For SMBs and insurance teams, the report’s clearest message is that paying a ransom is unreliable, while recoverable, immutable, and tested backups are central to reducing downtime, data loss, and claim severity. Top 3-5 Most Notable Statistics •85% of organizations suffered at least one cyberattack in the preceding twelve months, up from 76% the prior year. •63% paid the ransom and recovered data, while 19% paid but still could not recover data. •In at least 93% of cyber-events, criminals attempted to attack backup repositories. •76% of organizations lost at least some backup repositories during the attack. •Cyber insurance impacts were significant: 75% saw increased premiums, 42% saw increased deductibles, and 13% saw coverage benefits reduced. Top 3-5 Exploitable Technology Risks •Backup repositories are a direct target: attackers attempted to attack them in at least 93% of events, reducing the victim’s ability to restore without paying. •Non-survivable or corruptible backup storage creates recovery risk when attackers can delete, alter, or otherwise affect backup repositories. •Weak separation between cyber and backup teams can undermine response, with 55% saying significant improvement or a complete overhaul is needed between those teams. |
| Veeam | 2023 | Backup & Recovery Vendor |
| 529 | Ransomware Trends 2024 | Bottom Line Up Front (BLUF) Ransomware remains a high-frequency, high-impact business risk, and paying a ransom does not reliably restore operations. For SMBs and insurance teams, the report’s most important message is that recovery capability, especially clean, protected backups and a practical recovery plan, is central to reducing data loss, downtime, and claim severity. Top 3-5 Most Notable Statistics •75% of organizations surveyed reported being hit by ransomware in 2023 at least once, while only 25% believed they were not hit. •41% of production data was successfully encrypted in attacks, and only 57% of affected data was recoverable. •Organizations can reasonably expect to lose 18% of data per cyberattack based on affected and recoverable data rates. •81% of organizations ended up paying a ransom, but roughly one in four that paid still could not recover. •83% of organizations believed they had insurance, but 24% of those policies specifically excluded ransomware. Top 3-5 Exploitable Technology Risks •Backup repositories were directly affected: on average, 37% of backup repositories were affected by a successful attack, showing that attackers actively target recovery systems. •Insufficient immutable backup storage remains a risk: only 50% of overall backup storage was immutable among organizations surveyed. •Lack of recovery location planning is a major operational gap: 67% did not have an alternate infrastructure plan for where to recover after a site-level crisis. |
| Veeam | 2024 | Backup & Recovery Vendor |
| 530 | Read, Replied, Compromised: Employee Engagement Trends 2025 | Bottom Line Up Front (BLUF) Vendor email compromise is a high-risk email fraud threat because employees frequently read, reply to, or forward messages that appear to come from trusted vendors. For SMBs and insurance teams, the key concern is financial loss from fake invoices, fraudulent wire transfers, or changed banking details, especially when attacks blend into normal business workflows. Top 3-5 Most Notable Statistics •44.2% overall employee engagement rate with vendor email compromise messages across all organizations. •98.5% of text-based advanced attacks that employees read were not reported. •$300M in attempted vendor fraud was observed during the reporting period. •1.46% employee reporting rate for read text-based advanced attacks. •$80K median amount saved per organization by stopping vendor fraud. Top 3-5 Exploitable Technology Risks •Vendor email compromise using trusted external identities, where attackers pose as known vendors to request fake invoice payments, fraudulent wire transfers, or banking changes. •Compromised vendor accounts and hijacked email threads, which can make malicious messages appear to come from legitimate accounts with normal communication history. •Look-alike domains and spoofed sender addresses, which increase the appearance of authenticity and can be difficult for employees to notice. |
| Abnormal Security | 2025 | Email Security Vendor |
| 531 | Recorded Future Cloud Threat Hunting and Defense Landscape 2025 | Bottom Line Up Front (BLUF) Recorded Future identifies cloud environments as a major and growing attack surface, with the most important risks coming from misconfigurations, stolen credentials, cloud abuse, exploitation, and cloud ransomware. For SMBs and insurance teams, the key takeaway is that attackers often do not need advanced exploits; they can use exposed endpoints, weak or stolen credentials, and legitimate cloud tools to gain access, increase costs, steal data, or disrupt operations. Top 3-5 Most Notable Statistics •5 major cloud threat vectors are highlighted: cloud abuse, exploitation, endpoint misconfiguration, cloud ransomware, and credential abuse/account takeover. •39% of private respondents in a cited PwC survey said their entire operations had moved to cloud environments. •Cloud adoption accounted for $1 trillion in global GDP, with a projected increase to $12 trillion between 2024 and 2030. •74% of surveyed companies that optimized cloud environments reported increased profitability, and 65% reported increased cost savings. •Nearly 20% of public Docker Hub repositories, totaling nearly 3 million repositories, were reported as being used to distribute malware and phishing scams. Top 3-5 Exploitable Technology Risks •Misconfigured cloud endpoints that attackers can find with open-source scanners and use for initial access. •Stolen or weak cloud credentials, including credentials obtained through initial access brokers, phishing, leaked secrets, or prior compromise. •Public-facing cloud services and appliances with unpatched vulnerabilities, including examples involving Citrix NetScaler, Ivanti CSA, Oracle WebLogic, and Veeam Backup & Replication. |
| Recorded Future | 2025 | Threat Intelligence Vendor |
| 532 | Recorded Future Malware and Vulnerability Trends 2025 | Bottom Line Up Front (BLUF) Recorded Future reports that H1 2025 threats were driven by fast exploitation of vulnerabilities, especially in Microsoft products and edge security appliances such as VPNs, firewalls, and gateways. For SMBs and insurance teams, the key takeaway is that exposed systems, delayed patching, weak monitoring, and social engineering can quickly lead to malware, ransomware, payment fraud, or data theft. Top 3-5 Most Notable Statistics •23,667 CVEs were published in H1 2025, a 16% increase from H1 2024. •Threat actors actively exploited 161 vulnerabilities; 42% had public proof-of-concept exploit code. •69% of exploited vulnerabilities required no authentication, and 30% enabled remote code execution. •Microsoft products and edge security or gateway appliances each accounted for 17% of actively exploited vulnerabilities. •Command-and-control activity was the most frequently observed malware tactic, with over 194,000 detections. Top 3-5 Exploitable Technology Risks •Internet-facing Microsoft products and widely deployed enterprise software, which remained major targets for active exploitation. •Edge security and gateway appliances, including SSL-VPNs, next-generation firewalls, secure gateways, and remote access portals, which can give attackers privileged entry into a network. •Public-facing applications and web application weaknesses, including cross-site scripting, SQL injection, cross-site request forgery, injection flaws, and missing authorization. |
| Recorded Future | 2025 | Threat Intelligence Vendor |
| 533 | Recorded Future State of Security 2026 | Bottom Line Up Front (BLUF) Recorded Future’s central message is that cyber risk in 2026 is being shaped by global fragmentation: state actors, criminals, hacktivists, and influence operators are overlapping more often and creating faster-moving, less predictable threats. For SMBs and insurance teams, the practical concern is not only a major breach, but persistent access, identity abuse, social engineering, ransomware disruption, fraud, and reputational damage during geopolitical or criminal campaigns. Top 3-5 Most Notable Statistics •289 new ransomware variants were identified in 2025, a 33% increase from the previous year. •Russian threat actors showed an approximately 70% year-over-year increase in use of application layer and web protocols. •Abuse of command and scripting interpreters by Russian threat actors increased by roughly 27%. •Synthetic identity document fraud rose by 300% in Q1 2025. •Deepfake-enabled fraud increased more than tenfold since the start of 2024. Top 3-5 Exploitable Technology Risks •Identity systems, cloud environments, and edge infrastructure are high-value targets because persistent access can support espionage now and disruption later. •Email and collaboration platforms, including Roundcube, Zimbra, and Microsoft Exchange, remain dominant targets because they expose sensitive communications and credentials. •Network perimeter devices, including Fortinet, Citrix, and Cisco, are being exploited for initial access and long-term persistence. |
| Recorded Future | 2026 | Threat Intelligence Vendor |
| 534 | Recorded Future State of Threat Intelligence 2025 | Bottom Line Up Front (BLUF) Recorded Future’s 2025 report shows that threat intelligence is becoming a core business and security decision tool, not just a technical feed for security teams. For SMBs and insurance teams, the key takeaway is that better intelligence can help prioritize vulnerabilities, improve incident response, reduce noise, and support more informed risk decisions. Top 3-5 Most Notable Statistics •76% of surveyed enterprise organizations invest $250,000 or more per year in external threat intelligence products. •91% plan to increase threat intelligence investment in 2026. •68% use threat intelligence to enhance existing security tool detection capabilities. •65% say threat intelligence supports security technology purchasing decisions, and 58% say it guides business risk assessment. •51% consider their threat intelligence maturity less than advanced, while 87% expect improved maturity in the next two years. Top 3-5 Exploitable Technology Risks •Vulnerability exploitation as an initial access vector increased 34%, highlighting the need to prioritize remediation based on real threat activity. •Third-party-related breaches doubled in 2025, making vendor, partner, and supply chain visibility a major risk area. •Phishing domains remain a practical attack path; one report example described blocking potential phishing domains before they affected the network. |
| Recorded Future | 2025 | Threat Intelligence Vendor |
| 535 | RecordedFuture Cyber Threat Analysis Report 2023 | Bottom Line Up Front (BLUF) Recorded Future characterizes 2023 as “the year of the enterprise software hack,” with threat actors using vulnerabilities in widely deployed third-party tools to affect many organizations through a single weakness. For SMBs and insurance teams, the most important takeaway is that risk increasingly comes not only from an insured’s own systems, but from file transfer tools, backup platforms, cloud services, business process vendors, and software dependencies they rely on. Top 3-5 Most Notable Statistics •Enterprise software vulnerabilities exploited in attacks rose by approximately 290% in 2023 compared with 2022. •CL0P’s MOVEit campaign was estimated to affect 2,750 enterprises and approximately 94 million individuals. •CL0P was estimated to earn between $75 million and $100 million from the MOVEit hack alone. •Reported software supply-chain attacks increased by 11.8% from 2022 to 2023. •Recorded Future observed a 135% rise in harvested credentials and a 166% increase in credentials associated with cookies. Top 3-5 Exploitable Technology Risks •Managed file transfer platforms, including MOVEit, GoAnywhere, WS_FTP, IBM Aspera Faspex, and CrushFTP, were repeatedly exploited because they can hold large volumes of sensitive data and enable attacks at scale. •Backup software, including Veritas Backup Exec and Veeam Backup & Replication, was exploited for initial access, including attacks using vulnerabilities that had already been patched. •Internet-facing enterprise and network infrastructure, including Citrix NetScaler, remained attractive because attackers could discover vulnerable systems through public scanning. |
| Recorded Future | 2023 | Threat Intelligence Vendor |
| 536 | RecordedFuture Cyber Threat Analysis Report 2024 | Bottom Line Up Front (BLUF) Recorded Future’s most important finding is that attackers are getting more value from stolen credentials because businesses rely on many SaaS and cloud applications, often with inconsistent MFA and identity controls. For SMBs and insurance teams, this means common security gaps such as weak remote access, unmanaged devices, and misconfigured cloud identity can lead to major data theft, ransomware, downtime, and extortion. Top 3-5 Most Notable Statistics •The average company uses approximately 371 SaaS applications, up 39.4% from 2021. •Stolen or exposed credentials are used in 77% of web application attacks. •Databases for sale on criminal forums increased by 20% over the last year. •Ransomware payments reached $459.8 million through June 2024, with the largest recorded payment at approximately $75 million. •Huntress reported a 214% increase in incidents involving remote monitoring and management tools between January and October 2024. Top 3-5 Exploitable Technology Risks •SaaS identity gaps: attackers abused stolen credentials, weak SSO configuration, and missing MFA to access cloud and remote-access environments. •Infostealer malware: credentials stolen from personal and SMB-owned devices increased risk to business SaaS accounts, especially where users log in outside centralized identity controls. •Remote monitoring and management tools: attackers abused legitimate tools such as AnyDesk, TeamViewer, ConnectWise, and ScreenConnect to hide in normal IT activity. |
| Recorded Future | 2024 | Threat Intelligence Vendor |
| 537 | RecordedFuture Malware and Vulnerability Trends 2024 | Bottom Line Up Front (BLUF) Recorded Future’s H1 2024 findings show that attackers are concentrating on widely used remote access, security, Windows, and e-commerce technologies while improving malware techniques to avoid detection. For SMBs and insurance teams, the main takeaway is that common business tools can become high-impact entry points quickly, especially when patches are delayed or stolen credentials and payment-card data are involved. Top 3-5 Most Notable Statistics •Magecart e-commerce skimming infections increased by approximately 103% between H2 2023 and H1 2024. •Recorded Future identified over 21,000 Ivanti Secure Connect hosts running on the internet. •Ivanti reports over 40,000 customers, including 96 of the Fortune 100, use its products. •Palo Alto Networks reports over 85,000 customers worldwide use its network security products. •Threat actors used SnifferByFleras to infect at least 488 e-commerce websites between March and July 2024. Top 3-5 Exploitable Technology Risks •Ivanti Connect Secure vulnerabilities, including authentication bypass, command injection, and server-side request forgery, were heavily exploited and sometimes chained together. •Palo Alto Networks PAN-OS GlobalProtect vulnerability CVE-2024-3400 could allow unauthenticated attackers to execute code with root privileges on affected firewalls. •Microsoft Windows SmartScreen vulnerability CVE-2024-21412 allowed attackers to bypass security warnings and deliver malware. |
| Recorded Future | 2024 | Threat Intelligence Vendor |
| 538 | RedCanary Threat Detection Report 2020 | Bottom Line Up Front (BLUF) RedCanary’s 2020 report shows that common endpoint and Windows administration features are repeatedly abused by adversaries, especially for stealth, persistence, lateral movement, and payload delivery. For SMBs and insurance teams, the key takeaway is to prioritize visibility into endpoint behavior, PowerShell, email attachments, scheduled tasks, admin shares, and security-tool tampering. Top 3-5 Most Notable Statistics •RedCanary analyzed more than 15,000 confirmed threats from January through December 2019. •The report was built from 6M investigative leads across customer environments. •Process Injection was the top technique, representing 17% of total threats. •Process Injection affected 35% of organizations and appeared in 2,734 confirmed threats. •Remote File Copy rose from rank 19 to rank 5 and affected 29% of organizations, with 1,393 confirmed threats. Top 3-5 Exploitable Technology Risks •Process Injection: attackers run malicious code inside legitimate processes, helping them hide activity, inherit privileges, and evade security tools. •Scheduled Tasks: adversaries use scheduled jobs to run scripts, execute payloads, and maintain persistence on endpoints. •Windows Admin Shares and Remote File Copy: attackers use administrative shares, PsExec-like tools, and SMB-related activity to move malware between systems. |
| RedCanary | 2020 | MSP / MSSP / SOC Provider |
| 539 | RedCanary Threat Detection Report 2021 | Bottom Line Up Front (BLUF) Red Canary’s 2021 report shows that attackers most often succeed by abusing normal business tools already present in Windows environments, especially PowerShell, Windows Command Shell, signed Microsoft utilities, services, scheduled tasks, and credential access paths. For SMBs and insurance teams, the key takeaway is that loss prevention depends less on buying niche tools and more on monitoring common administrative behavior, restricting risky execution paths, and responding quickly when phishing or credential theft activity appears. Top 3-5 Most Notable Statistics •Red Canary analyzed roughly 20,000 confirmed threats from customer environments, based on 14M investigative leads. •Command and Scripting Interpreter activity was the top technique, appearing in 24% of total threats and affecting 72.2% of organizations. •PowerShell affected 48.7% of organizations, while Windows Command Shell affected 38.4%. •Signed Binary Process Execution represented 19% of total threats; Create or Modify System Process and Obfuscated Files or Information each represented 16%. •TA551 was the most prevalent named threat, affecting 15.5% of customers; approximately two-thirds of observed TA551 detections did not progress beyond opening the malicious attachment. Top 3-5 Exploitable Technology Risks •Abuse of PowerShell and Windows Command Shell to execute commands, scripts, downloads, and obfuscated instructions. •Signed Windows utilities such as Mshta, Regsvr32, Rundll32, and renamed binaries used to execute malicious content while appearing legitimate. •Malicious creation or modification of Windows services using tools such as sc.exe and reg.exe for persistence or payload execution. |
| RedCanary | 2021 | MSP / MSSP / SOC Provider |
| 540 | RedCanary Threat Detection Report 2022 | Bottom Line Up Front (BLUF) Red Canary’s 2022 report shows that SMB risk is driven less by exotic attacks and more by repeatable intrusion paths: ransomware precursors, exposed remote access, exploitable enterprise software, supply chain compromise, and abuse of legitimate tools. For SMB owners and insurance teams, the key takeaway is that prevention alone is not enough; early detection of malware, post-exploitation tools, and suspicious administrative activity is critical before incidents become ransomware, data theft, or business disruption. Top 3-5 Most Notable Statistics •Red Canary analyzed over 30,000 confirmed threats detected across customer environments. •Red Canary’s platform collects as much as 1 petabyte of security telemetry every day. •The report references roughly 3,000 detection analytics used to surface potential threats. •Confirmed testing represented 23.4% of all confirmed threats detected in 2021. •Kaseya estimated approximately 50 direct customers and between 800 and 1,500 other businesses were impacted by the VSA breach. Top 3-5 Exploitable Technology Risks •Internet-facing Remote Desktop Protocol without multi-factor authentication, identified as a common ransomware vector. •Microsoft Exchange vulnerabilities ProxyLogon and ProxyShell, which enabled remote code execution, web shell deployment, reconnaissance, lateral movement, and in some cases ransomware. •Kaseya VSA vulnerabilities, where adversaries exploited remote administration software to infect managed customer endpoints with ransomware. |
| RedCanary | 2022 | MSP / MSSP / SOC Provider |
| 541 | RedCanary Threat Detection Report 2023 | Bottom Line Up Front (BLUF) Red Canary’s 2023 report shows that attackers continue to succeed through early-stage intrusion paths that many preventive controls miss: email, identity compromise, malicious downloads, abused legitimate tools, and removable media. For SMBs and insurance teams, the key takeaway is that ransomware and fraud often begin with detectable precursor activity, so loss prevention depends on finding and stopping intrusions before data theft, encryption, or payment fraud occurs. Top 3-5 Most Notable Statistics •Red Canary detected and responded to nearly 40,000 threats in 2022 that customers’ preventive controls missed. •The report is based on activity across 800+ customer environments. •The top detected threats by customer impact were Qbot at 6.1%, Impacket at 5.6%, AdSearch at 5.3%, Gootloader at 4.4%, and Mimikatz at 4.4%. •Known authorized testing accounted for 40% of detected threats in 2022, a year-over-year increase of roughly 20%. •Proofpoint reported a 1,675% increase in LNK files in malicious campaigns between October 2021 and June 2022. Top 3-5 Exploitable Technology Risks •Email-based malware delivery, including Qbot and Emotet, remains a major entry point and can lead to follow-on payloads such as Cobalt Strike or ransomware. •Container and compressed files such as ISO, VHD, ZIP, and RAR files were used to bypass Mark-of-the-Web protections and deliver malware. •Malvertising and SEO poisoning tricked users into downloading malicious installers, fake software, or document-themed payloads. |
| RedCanary | 2023 | MSP / MSSP / SOC Provider |
| 542 | RedCanary Threat Detection Report 2024 | Bottom Line Up Front (BLUF) Red Canary’s 2024 report shows that attackers are still succeeding through familiar paths: stolen identities, phishing, exposed systems, cloud account abuse, and legitimate tools used maliciously. For SMBs and insurance teams, the key takeaway is that practical controls around identity, patching, cloud access, and early detection can reduce the chance that an intrusion becomes ransomware, data theft, or business disruption. Top 3-5 Most Notable Statistics •Red Canary analyzed nearly 60,000 confirmed threats across more than 1,000 customers. •Cloud Accounts was the 4th most prevalent ATT&CK technique detected, with a 16-fold increase in detection volume and affecting 3 times as many customers as the prior year. •Red Canary ingested 216 petabytes of security telemetry in 2023. •The platform generated 37 million investigative leads, reduced them to 10 million events, and confirmed more than 58,000 threats. •Red Canary observed that adversaries often rely on the same small set of 10-20 techniques across industries. Top 3-5 Exploitable Technology Risks •Compromised identities and MFA bypass: attackers used phishing, social engineering, SIM swapping, help desk abuse, session tokens, and stolen credentials to gain access to cloud and SaaS environments. •Internet-facing vulnerabilities: ransomware intrusions began through exposed systems such as Confluence or Veritas, including exploitation of older vulnerabilities. •Phishing and malicious file delivery: attackers used OneNote files, MSIX installers, ZIP/RAR archives, ISO/VHD container files, QR-code phishing, and Teams-based lures. |
| RedCanary | 2024 | MSP / MSSP / SOC Provider |
| 543 | RedCanary Threat Detection Report 2025 | Bottom Line Up Front (BLUF) Red Canary’s 2025 report shows that attackers are increasingly succeeding through identity compromise, browser-based social engineering, VPN abuse, cloud misconfigurations, and ransomware precursors rather than only through traditional malware. For SMBs and insurance teams, the main takeaway is that common business tools—identity platforms, VPNs, remote access tools, browsers, and cloud services—are now central attack paths that need stronger monitoring and access controls. Top 3-5 Most Notable Statistics •Red Canary detected nearly 93,000 confirmed threats in 2024. •The report is based on telemetry from 1,400 customers across more than 4 million identities, endpoints, and cloud resources. •Red Canary ingested 308 petabytes of security telemetry and generated 30 million investigative leads. •About 25,000 confirmed threats were high severity, meaning more than a quarter of detected threats could have represented significant risk. •Red Canary detected 4 times as many identity threats in 2024 as the year before. Top 3-5 Exploitable Technology Risks •Weak or poorly protected VPN access, including password spraying against accounts without multi-factor authentication, especially where VPN appliances provide a path into the network. •Identity compromise through phishing, stealer malware, credential stuffing, password spraying, session hijacking, and MFA bypass techniques. •Publicly exposed or unpatched edge and remote access technologies, including Fortinet FortiClient EMS, ScreenConnect, and various VPN products. |
| RedCanary | 2025 | MSP / MSSP / SOC Provider |
| 544 | RedCanary Threat Detection Report 2026 | Bottom Line Up Front (BLUF) Red Canary’s 2026 report shows that identity compromise is now the central security risk: identity threats rose sharply and made up more than half of confirmed detections. For SMBs and insurance teams, this means losses are increasingly tied to stolen credentials, abused remote access tools, browser-based attacks, and unpatched systems rather than only traditional malware. Top 3-5 Most Notable Statistics •Red Canary analyzed more than 110,000 confirmed threats across 4.5 million endpoints, networks, cloud infrastructure, identities, and SaaS applications. •Identity threats increased by 850 percent from 2024 to 2025. •Identity threats accounted for 53 percent of overall detection volume in 2025, up from 20 percent in 2024. •Red Canary detected 34,000 higher-severity threats that could have represented significant risk if not detected. •The National Vulnerability Database listed 48,172 CVEs in 2025, more than a 20 percent increase from 2024. Top 3-5 Exploitable Technology Risks •Cloud and SaaS identities: Adversaries are prioritizing valid account compromise to access cloud systems, SaaS apps, and corporate AI tools. •MFA bypass and token theft: Device code phishing, consent phishing, adversary-in-the-middle phishing, MFA fatigue, and stolen session tokens can give attackers access even where MFA exists. •Unpatched edge and business-critical software: The report highlights exploitation of SonicWall VPNs, Veeam Backup & Replication, SAP NetWeaver, Atlassian Confluence, SharePoint, and Microsoft Windows Server Update Services. |
| RedCanary | 2026 | MSP / MSSP / SOC Provider |
| 545 | RedHelix Cyber Security Trends Report 2026 | Bottom Line Up Front (BLUF) Red Helix’s 2026 outlook says cyber risk is accelerating because AI, identity compromise, cloud exposure, supply-chain dependency, and ransomware are converging. For SMBs and insurance teams, the key takeaway is that attackers do not need advanced access if they can exploit weak identity controls, misconfigured systems, employee AI use, or third-party connections. Top 3-5 Most Notable Statistics •48% of surveyed organisations cited AI-automated attack chains as their greatest ransomware threat. •85% expressed concern that traditional detection tools are becoming inadequate against AI-enhanced attacks. •European organisations accounted for approximately 22% of global ransomware and extortion victims. •Credential theft accounted for approximately 61% of breaches in organisations with cloud-first architectures. •There were at least 85 active extortion groups globally in 2025. Top 3-5 Exploitable Technology Risks •AI-enabled phishing, deepfake impersonation, and synthetic documents that can trick employees into approving payments, sharing credentials, or trusting fraudulent requests. •Prompt injection, model manipulation, and poorly governed AI agents that may expose sensitive data or trigger unintended actions. •Stolen credentials, session hijacking, multi-factor authentication fatigue attacks, token-based intrusions, and attacks against Active Directory. |
| Red Helix | 2026 | Consulting / Analyst Firm |
| 546 | ReliaQuest Annual Threat Report 2023 | Bottom Line Up Front (BLUF) ReliaQuest’s 2023 report shows that attackers continue to rely on practical, high-return entry points: exposed remote access, stolen credentials, exploitable vulnerabilities, and phishing-related infrastructure. For SMBs and insurance teams, the key takeaway is that preventable weaknesses can quickly become ransomware, data theft, fraud, and business interruption events. Top 3-5 Most Notable Statistics •ReliaQuest analyzed 35,024 true-positive incidents from February 1, 2022 to February 1, 2023. •The average ReliaQuest customer could expect 71 incidents over a year, with construction, transportation, and wholesale trade above average. •RDP was the most common initial access type advertised by initial access brokers, accounting for 24.4% of access listings. •RDP access was also the costliest access type observed, with an average median price of about $1,000. •LockBit was the most active ransomware group observed, with 946 victim posts on its data-leak site. Top 3-5 Exploitable Technology Risks •Exposed remote services, including VPNs, RDP, Citrix, and TeamViewer, were the most commonly detected attack technique and are used for initial access or persistence. •Credential exposure was the most common digital risk alert and continues to support account takeover and network access. •Open ports, including services that should only be exposed internally such as Port 445, create opportunities for scanning and exploitation. |
| ReliaQuest | 2023 | MSP / MSSP / SOC Provider |
| 547 | ReliaQuest Annual Threat Report 2024 | Bottom Line Up Front (BLUF) ReliaQuest’s 2024 annual threat report shows that financially motivated attacks remain the dominant risk, with phishing, business email compromise, ransomware/extortion, stolen credentials, and “living off the land” techniques driving many serious incidents. For SMBs and insurance teams, the key takeaway is that attackers are exploiting both people and exposed systems to move quickly from initial access to financial theft, data exposure, or operational disruption. Top 3-5 Most Notable Statistics •Phishing links or attachments were used in 71.1% of all incidents. •Extortion activity increased by 74.3%, with 4,819 compromised entities named on data-leak websites. •Financial theft was the desired impact in 88.4% of customer incidents. •ReliaQuest found more than 6 billion exposed credentials in 2023, bringing its total discovered exposed credentials to more than 36 billion. •Living off the land binaries accounted for 22.3% of critical security incidents; 92% of those involved Rundll32, Msiexec, and Mshta. Top 3-5 Exploitable Technology Risks •Phishing and BEC attacks using credential harvesters and adversary-in-the-middle techniques to bypass multifactor authentication and capture session tokens. •Public-facing applications, web servers, databases, network administration tools, and other internet-accessible services with software vulnerabilities or misconfigurations. •RDP and SMB used for lateral movement, appearing in 59.3% of incidents involving lateral movement. |
| ReliaQuest | 2024 | MSP / MSSP / SOC Provider |
| 548 | Report on the Cybersecurity Insurance Market 2025 | Bottom Line Up Front (BLUF) The U.S. cyber insurance market contracted in premium for the first time in 2024, even as reported claims rose sharply and threats such as ransomware, business email compromise, credential abuse, and third-party outages remained highly active. For SMBs and insurance teams, this means coverage may be more competitively priced, but underwriting focus on controls, incident readiness, and exposure visibility remains critical. Top 3-5 Most Notable Statistics •U.S. cyber insurance direct written premium was approximately $9.14 billion in 2024, down 7.11% from 2023. •U.S.-domiciled insurers reported $7.08 billion in direct written premium, a 2.3% decline from 2023. •Reported cyber claims rose almost 40%, with nearly 50,000 claims reported. •Policies in force were essentially flat at 4,368,614, a 0.03% decrease from the prior year. •Ransomware was present in 44% of breaches, while the human element was involved in 60% of breaches. Top 3-5 Exploitable Technology Risks •Ransomware and ransomware-as-a-service: Attackers encrypt systems and exfiltrate data to pressure victims through double extortion. •Credential abuse and infostealers: Malware harvests login credentials, cookies, and sensitive data, enabling unauthorized access and supply chain compromise. •Business email compromise: Attackers manipulate employees into transferring funds or granting access, creating significant financial loss. |
| NAIC | 2025 | Cyber Insurance Carrier |
| 549 | Report on the Cybersecurity Posture of the United States 2024 | Bottom Line Up Front (BLUF) The United States’ cybersecurity posture improved in 2023, but the report makes clear that ransomware, supply chain compromise, cloud and identity weaknesses, and critical infrastructure targeting remain serious risks. For SMBs and insurance teams, the most important takeaway is that smaller organizations are explicitly identified as targets that may be ill-equipped to defend themselves, especially against ransomware and third-party technology failures. Top 3-5 Most Notable Statistics •The National Cybersecurity Strategy Implementation Plan included 69 Federal initiatives, with 33 completed in its first year. •The next implementation plan adds 31 new initiatives to continue national cybersecurity efforts. •CISA’s Ransomware Vulnerability Warning Pilot notified critical infrastructure owners and operators of 1,754 vulnerable devices in 2023. •The Bipartisan Infrastructure Law provides $1 billion to improve State, local, Tribal, and territorial cybersecurity capacity, including $375 million made available through the State and Local Cybersecurity Grant Program and $18 million through the Tribal Cybersecurity Grant Program in 2023. •U.S. Cyber Command’s Cyber National Mission Force deployed 22 times to 17 countries in 2023 for hunt-forward operations. Top 3-5 Exploitable Technology Risks •Legacy Internet and communications technologies, including Border Gateway Protocol weaknesses and outdated encryption protocols, can enable traffic hijacking, route manipulation, and compromised communications. •Hybrid cloud environments can create complex logging and authentication gaps that allow malicious actors to evade detection or abuse identity management systems. •Software and IT supply chains create scale risk when attackers compromise technology providers, identity and access management firms, developer systems, or enterprise communications platforms. |
| White House | 2024 | Threat Intelligence Vendor |
| 550 | ReturnOnSecurity The State of Cybersecurity 2022 | Bottom Line Up Front (BLUF) ReturnOnSecurity’s main takeaway is that cybersecurity demand remained high in 2022, but economic pressure changed how security is bought, funded, and delivered. For SMBs and insurance teams, the practical issue is that smaller organizations may face tighter budgets, fewer vendor options aimed at them, and continued exposure to common risks such as compromised credentials, APIs, no-code tools, and scams. Top 3-5 Most Notable Statistics •Overall cybersecurity funding for 2022 was expected to be around $18.4B. •The report identified over 700 funding transactions from 642 unique cybersecurity companies. •Publicly available acquisition and merger activity totaled about $50.1B across over 260 transactions. •The broader tech sector saw over 150,000 layoffs, and cybersecurity companies were not spared. •Tech company valuations across sectors dropped to less than half of prior-year levels. Top 3-5 Exploitable Technology Risks •Compromised credentials and identity permissions: the report describes compromised credentials as the most common form of attack in 2022 and highlights the need to understand the “blast radius” of roles and permissions. •APIs and customer-facing web services: API security is expected to merge into broader web application and API protection, including blocking, monitoring, bot protection, DDoS defense, intrusion detection, and web application firewalls. •No-code and low-code platforms: the report notes that their cyber risks are not well understood and that visibility into what data these platforms can view, store, and edit is needed. |
| ReturnOnSecurity | 2022 | Threat Intelligence Vendor |
| 551 | ReturnOnSecurity The State of Cybersecurity 2023 | Bottom Line Up Front (BLUF) ReturnOnSecurity’s 2023 review shows a cybersecurity market under financial pressure but still actively reshaping through early-stage investment, AI security growth, and major acquisitions. For SMBs and insurance teams, the key takeaway is that vendor stability, product category maturity, and AI-related security needs should be reviewed carefully when making risk, underwriting, and purchasing decisions. Top 3-5 Most Notable Statistics •684 cybersecurity funding rounds across 100+ product categories totaled about $12.7B in 2023. •259 M&A transactions across 70+ product categories totaled about $40.5B in 2023. •Total cybersecurity funding dollars dropped about 38% from approximately $20.6B in 2022. •U.S. cybersecurity funding fell about 30% to $10.6B, while Europe fell about 74% to $405.3M. •AI Security funding increased by approximately 4,000% to about $95.2M. Top 3-5 Exploitable Technology Risks •AI systems: The report highlights AI Security as software designed to maintain the integrity of AI systems and shield them from misuse. •AI applications: The report identifies Security of AI as focused on protecting AI applications from cyberattacks, unauthorized access, and manipulation. •Sensitive data in AI processes: The report identifies AI Privacy Assurance as focused on safeguarding sensitive data and personal information used in AI processes. |
| ReturnOnSecurity | 2023 | Threat Intelligence Vendor |
| 552 | ReturnOnSecurity The State of Cybersecurity 2024 | Bottom Line Up Front (BLUF) ReturnOnSecurity’s 2024 report shows a cybersecurity market that is recovering, consolidating, and being reshaped by AI, data resilience, and hybrid product/service delivery models. For SMBs and insurance teams, the key takeaway is that the security vendor landscape is becoming more selective and strategic, with major investment flowing toward cloud security, data protection, identity, managed services, and AI security. Top 3-5 Most Notable Statistics •621 cybersecurity funding rounds totaled $14B across 112 product categories. •271 M&A transactions totaled $45.7B across 59 product categories. •AI-focused cybersecurity funding grew 96% year over year, from $181.5M in 2023 to $369.9M in 2024. •Product-based cybersecurity companies received $12.3B, or 88% of total funding, while services companies received $1.7B. •The United States accounted for $10.9B, or 83% of global cybersecurity funding. Top 3-5 Exploitable Technology Risks •Cloud security and cloud workload protection: cloud platforms remained a major investment area, including the year’s largest funding round for a cloud workload protection and posture management platform. •Data protection, backup, and disaster recovery: the report highlights growing investor and acquirer focus on operational recovery, resilience, and data protection. •Identity, certificate, and secrets management: identity and access management appeared among leading categories, and certificate and secrets management featured in a major acquisition. |
| ReturnOnSecurity | 2024 | Threat Intelligence Vendor |
| 553 | ReversingLabs Software Supply Chain Security Report 2025 | Bottom Line Up Front (BLUF) Software supply chain risk is becoming more sophisticated and harder to see, affecting both open-source packages and trusted commercial software. For SMBs and insurance teams, the key takeaway is that widely used software can contain malware, exploitable flaws, exposed secrets, or tampering even when it comes from reputable sources. Top 3-5 Most Notable Statistics •Developer secrets and sensitive information exposed through open-source repositories increased by 12%. •A survey of 30 npm, PyPI, and RubyGems packages covered more than 650 million total downloads. •Those packages had a median of 27 security flaws per package, with an average of 68. •The same package set had a median of 2 critical-severity flaws per package, with an average of 6. •Malicious packages across npm, PyPI, and RubyGems declined by more than 70%, from 12,130 in 2023 to 3,580 in 2024. Top 3-5 Exploitable Technology Risks •Open-source package compromises, including malicious updates, typosquatting, and “flip” attacks where packages start benign and later become malicious. •Compromised build pipelines and maintainer accounts, as seen in attacks involving widely used libraries and development ecosystems. •Commercial software binaries containing malware, tampering, exposed credentials, weak hardening, licensing issues, and known exploitable or patch-mandated vulnerabilities. |
| ReversingLabs | 2025 | Research Organization |
| 554 | Review 2022 | Bottom Line Up Front (BLUF) Cisco Talos’ 2022 review shows that attackers continued to succeed by exploiting known weaknesses: unpatched public-facing systems, Log4j exposure, phishing-delivered loaders, dual-use tools, and even USB-based malware. For SMBs and insurance teams, the key takeaway is that many high-impact incidents begin with preventable gaps in patching, visibility, email security, and basic endpoint controls. Top 3-5 Most Notable Statistics •Log4j-related Snort alerts increased by nearly 40% in January 2022 and remained in the tens of millions per month afterward. •In Q3, nearly 15% of Cisco Talos Incident Response engagements involved adversaries identifying or exploiting misconfigured public-facing applications. •The top five Log4j detection signatures accounted for 95% of total Log4j-related hits. •LockBit accounted for over 20% of ransomware data leak site victim posts monitored by Talos. •At least 8 ransomware groups made up 75% of monitored ransomware data leak site posts. Top 3-5 Exploitable Technology Risks •Log4j vulnerabilities in widely used and embedded software, including vulnerable VMware Horizon servers, remained a major infection vector because they are difficult to inventory and patch. •Misconfigured or publicly exposed applications and servers were exploited through methods including SQL injection and Log4Shell targeting. •Dual-use and “living-off-the-land” tools, including Cobalt Strike, Sliver, Brute Ratel, PowerShell, rundll32, WMI, and legitimate remote management tools, helped attackers blend into normal administrative activity. |
| Cisco Talos | 2022 | Network Security Vendor |
| 555 | Review 2023 | Bottom Line Up Front (BLUF) Cisco Talos’ 2023 review shows that ransomware, credential abuse, phishing, unpatched vulnerabilities, and network-device compromise remained central to real-world attacks. For SMBs and insurance teams, the key takeaway is that many high-impact incidents still begin with preventable weaknesses: old software flaws, weak credentials, exposed services, and users tricked by convincing email lures. Top 3-5 Most Notable Statistics •Ransomware and pre-ransomware accounted for 20% of Talos incident response engagements. •LockBit accounted for over 25% of posts on ransomware data leak sites, while LockBit, ALPHV, Clop, and BianLian together accounted for nearly 50%. •Phishing represented 25% of identified initial access vectors in Talos incident response engagements. •PDFs were the top blocked attachment file extension at 36%, followed by HTML at 14%. •Talos reported 289 vulnerabilities to vendors across 141 advisories related to SOHO and industrial router research. Top 3-5 Exploitable Technology Risks •Unpatched older vulnerabilities in common applications, including Microsoft Office and WordPad, Microsoft Exchange Server, Microsoft Netlogon, and multiple antivirus products, were heavily targeted. •Public-facing applications and file transfer platforms were exploited, including PaperCut, GoAnywhere MFT, and MOVEit Transfer. •Network devices were targeted through unpatched vulnerabilities, weak or default credentials, insecure configurations, and exposed management interfaces. |
| Cisco Talos | 2023 | Network Security Vendor |
| 556 | Review Report 2022 | Bottom Line Up Front (BLUF) Dragos reports that industrial cyber risk increased in 2022, driven by more ransomware against industrial organizations, new ICS-focused malware capabilities, and persistent weaknesses in OT visibility, segmentation, remote access, and vulnerability management. For SMBs and insurance teams, the key takeaway is that even attacks starting in ordinary IT systems can disrupt production, suppliers, customer operations, and safety-related industrial environments when IT and OT networks are poorly separated. Top 3-5 Most Notable Statistics •Ransomware attacks against industrial organizations increased 87% over the prior year. •72% of ransomware attacks targeted manufacturing entities, covering 437 entities across 104 manufacturing subsectors. •Dragos tracked 20 threat groups in 2022 and identified 2 new groups: CHERNOVITE and BENTONITE. •Dragos analyzed 465 vulnerability advisories containing 2,170 CVEs; investigated vulnerabilities increased 27% over 2021. •In service engagements, 53% had undisclosed or uncontrolled external connections to OT, 50% had network segmentation issues, and 83% lacked separate IT and OT user management. Top 3-5 Exploitable Technology Risks •Internet-facing and remote access assets: BENTONITE exploited vulnerable remote access or internet-exposed assets, including Log4J and VMware Horizon vulnerabilities, to gain access. •Remote desktop protocol and remote desktop software: Dragos identified these as enabling initial access in typical LockBit ransomware attacks. •Poor IT/OT separation: Shared IT and OT credentials and weak segmentation make it easier for attackers to move from business systems into operational environments. |
| Dragos | 2022 | OT/ICS Security Vendor |
| 557 | Review Report 2023 | Bottom Line Up Front (BLUF) Dragos reports that industrial cyber risk increased in 2023, driven by more ransomware, more active OT-focused threat groups, and continued exploitation of public-facing systems and weak segmentation. For SMBs in manufacturing, utilities, transportation, and other operational environments, the most important takeaway is that attackers often reach OT through exposed IT systems, poor firewall configuration, remote access, or known vulnerabilities. Top 3-5 Most Notable Statistics •Dragos tracked 905 reported ransomware incidents impacting industrial organizations in 2023, a 49.5% increase from 2022. •Manufacturing accounted for 638 ransomware incidents, or 71% of industrial ransomware incidents. •Dragos observed 50 active ransomware groups impacting industrial organizations, a 28% increase over the prior year. •Approximately 70% of OT-related incidents observed by Dragos originated from within the IT environment. •Dragos found segmentation issues or improperly configured firewalls in 28% of its 2023 engagements. Top 3-5 Exploitable Technology Risks •Public-facing services and devices, including VPNs, RDP servers, Citrix appliances, Sierra Wireless devices, and exposed OT devices, were repeatedly used or targeted for initial access. •Weak network segmentation and improperly configured firewalls allowed incidents originating in IT environments to threaten OT environments. •Recently disclosed vulnerabilities, including Citrix Bleed and MOVEit, were rapidly exploited by ransomware groups against industrial organizations and related service providers. |
| Dragos | 2023 | OT/ICS Security Vendor |
| 558 | Ripples Across the Risk Surface 2025 | Bottom Line Up Front (BLUF) Cyber incidents increasingly create “ripple events,” where one organization’s breach or disruption causes losses for suppliers, partners, or customers. For SMBs and insurance teams, the key takeaway is that third-party cyber risk is now a direct business and claims exposure, not just a vendor management issue. Top 3-5 Most Notable Statistics •RiskRecon examined more than 1,500 ripple incidents from 2008 to 2024, involving more than 1.2K generating firms and more than 12K receiving firms. •The modeled likelihood of a single-party incident is about 8.4%, compared with about 0.7% for ripple events. •Typical losses for ripple generators were $4.7M, compared with $1.8M for ripple receivers and $469.1K for single-party incidents. •Extreme losses reached $371.0M for ripple generators, versus $57.0M for receivers and $26.5M for single-party incidents. •Larger organizations are about 2x as likely, on a per-firm basis, to both generate and receive ripple events compared with SMBs. Top 3-5 Exploitable Technology Risks •Third-party and vendor exposure: ripple events spread through interconnected suppliers, partners, and customers, creating downstream loss for firms that were not the initial victim. •System intrusions: the report identifies system intrusion as a major pattern in both single-party and multi-party incidents. •DoS attacks: denial-of-service attacks are more common among ripple incidents and can disrupt multiple connected organizations. |
| RiskRecon | 2025 | Security Research Vendor |
| 559 | Risk Barometer 2025 | Bottom Line Up Front (BLUF) Cyber incidents are the leading global business risk for 2025 and the top risk for large, mid-size, and smaller companies. For SMBs and insurance teams, the core concern is not just a cyberattack itself, but the resulting data breach, ransomware loss, business interruption, claims cost, and recovery disruption. Top 3-5 Most Notable Statistics •Cyber incidents rank as the #1 global risk, selected by 38% of respondents. •Business interruption ranks #2 globally, selected by 31% of respondents. •Natural catastrophes rank #3 globally, selected by 29% of respondents. •Ransomware accounted for 58% of the value of large cyber claims over €1mn in the first half of 2024. •The survey included 3,778 respondents from 106 countries and territories. Top 3-5 Exploitable Technology Risks •Ransomware attacks, increasingly targeting sensitive data to increase financial pressure on companies. •Data breaches, identified as the cyber exposure companies fear most. •IT network and service disruptions, including outages that can trigger business interruption. |
| Allianz | 2025 | Cyber Insurance Carrier |
| 560 | Risk Based Security Year-End Data Breach QuickView Report 2021 | Bottom Line Up Front (BLUF) Publicly disclosed breaches remained a major business risk in 2021, with ransomware, exposed data, and delayed disclosure standing out as the most important themes. For SMBs and insurance teams, the report reinforces that breach frequency alone understates the risk: data exposure, downtime, notification delays, and sensitive information loss can drive significant cost and reputational harm. Top 3-5 Most Notable Statistics •4,145 publicly disclosed breaches were reported in 2021, about 6% below 2020 at the time of reporting, but Risk Based Security expected the final 2021 count to rise to 4,352 to 4,560 as more incidents surfaced. •22.7 billion records were exposed in 2021, the second-highest annual total in the report’s eight-year comparison. •The three largest breaches accounted for 82% of exposed records; the largest alone contributed 16 billion records, or 70% of the total. •Ransomware appeared in 874 publicly reported breaches, representing 21% of incidents. •The average time from discovery to disclosure reached 89 days, close to the prior high of 91 days in 2014. Top 3-5 Exploitable Technology Risks •Ransomware and malware attacks, which continued despite law enforcement successes and caused financial, reputational, and operational harm. •Advertised admin- or user-level access to Remote Desktop Protocol, virtual private networks, and content management systems, which could lead to compromise of personal or financial information. •Phishing and stealer malware, identified among the most discussed malware types and hacking services in underground forums. |
| Risk Based Security | 2021 | Threat Intelligence Vendor |
| 561 | Risk Based Security Year-End Vulnerability QuickView Report 2021 | Bottom Line Up Front (BLUF) Risk Based Security’s 2021 report shows that vulnerability volume reached a record high, making “patch everything” unrealistic for most organizations. For SMBs and insurance teams, the key takeaway is that risk-based vulnerability prioritization is essential, especially for remotely exploitable issues with public exploit code and available fixes. Top 3-5 Most Notable Statistics •28,695 vulnerabilities were disclosed in 2021, the highest number on record in the report. •4,108 disclosed vulnerabilities were remotely exploitable, had a public exploit, and had documented solution information. •Prioritizing those 4,108 vulnerabilities could reduce immediate remediation workload by 86%. •CVE/NVD failed to report 8,215 known disclosed vulnerabilities in 2021, equal to 29% of the total. •Including CVE entries in RESERVED status, 9,530 vulnerabilities, or 33%, were not actionable through CVE/NVD at the time of writing. Top 3-5 Exploitable Technology Risks •Apache Log4j “Log4Shell” remote code execution: The report describes Log4Shell as a “mega-vulnerability” with rapid growth, broad vendor/product impact, and active threat actor interest. •Remotely exploitable vulnerabilities with public exploit code: These are highlighted as the most important category to prioritize because they are easier for attackers to use and have available remediation information. •Third-party libraries and dependencies: The report specifically notes that VulnDB tracks vulnerabilities in third-party libraries and dependencies, and Log4Shell illustrates how one library issue can affect many products and vendors. |
| Risk Based Security | 2021 | Threat Intelligence Vendor |
| 562 | Risk Radar 2025 | Bottom Line Up Front (BLUF) Trustwave’s Risk Radar 2025 shows that energy and utilities organizations face rising ransomware pressure, expanded exposure from IT/OT convergence, and serious operational risk from legacy systems. For SMBs in this sector or supporting it, the key takeaway is that attackers are exploiting practical entry points such as phishing, public-facing applications, remote services, and weak credentials, which can lead to downtime, financial loss, regulatory exposure, and cascading business disruption. Top 3-5 Most Notable Statistics •Ransomware activity against energy and utilities increased by 80% year over year. •The United States accounted for 47% of ransomware attacks against the sector. •Phishing was used in 84% of observed initial access techniques. •Attackers relied on remote services for lateral movement in 96% of observed cases. •Brute force accounted for 67% of observed credential access techniques. Top 3-5 Exploitable Technology Risks •Phishing and user execution of malicious files, which attackers use to gain initial access and run payloads. •Public-facing applications, including attacks associated with Apache Log4J, which provide an external entry point. •Remote services such as SMB/Windows Admin Shares and Remote Desktop Protocol, which attackers use to move laterally and maintain persistence. |
| Trustwave | 2025 | MSP / MSSP / SOC Provider |
| 563 | Risk Radar 2025 | Bottom Line Up Front (BLUF) Trustwave’s Risk Radar 2025 shows that healthcare organizations face high-impact cyber risk from ransomware, phishing, exposed public-facing applications, weak credentials, and third-party supply chain compromise. For SMB healthcare providers and insurance teams, the most important takeaway is that these attacks can cause more than data loss: they can disrupt patient care, delay treatment, expose protected health information, and create regulatory and financial consequences. Top 3-5 Most Notable Statistics •45% of initial access attempts came from phishing, and 45% came from exploiting public-facing applications. •56% of exploited public-facing applications involved Log4j. •51% of healthcare ransomware incidents in the dataset targeted US-based organizations. •21% of ransomware attacks targeted public health and government healthcare services, followed by ambulatory healthcare services at 19% and hospitals and medical centers at 18%. •Average healthcare data breach costs exceeded $9.7 million, compared with a cross-industry average of $4.8 million. Top 3-5 Exploitable Technology Risks •Public-facing applications, especially systems vulnerable to Log4j, SQL injection, TP-Link Archer AX21 command injection, and Laravel Ignition remote code execution. •Stolen or weak credentials, including compromised RDP credentials, VPN logins, administrator accounts, credential reuse, and exposed plaintext credentials. •Poorly segmented networks, including sensitive areas such as medical devices, cameras, patient rooms, shared drives, and other internal systems. |
| Trustwave | 2025 | MSP / MSSP / SOC Provider |
| 564 | Risk Radar Report 2023 | Bottom Line Up Front (BLUF) Trustwave’s report shows that financial services organizations remain high-value targets because they hold money, customer records, account data, and other sensitive information that can be monetized through theft, fraud, extortion, and ransomware. For SMBs and insurance teams, the most important takeaway is that attackers are still succeeding through familiar paths: phishing, stolen or weak credentials, exposed systems, unpatched vulnerabilities, ransomware, and third-party software or service providers. Top 3-5 Most Notable Statistics •The average cost of a data breach in financial services was $5.9 million, compared with an overall industry average of $4.4 million. •A 2022 survey of 130 global financial institutions found that 74% experienced at least one ransomware attack over the prior year. •Trustwave observed malicious email attachments in financial services where 78% were HTML files and 14% were executables. •Credential access was used in about 20% of reported incidents across Trustwave’s client base. •Among ransomware groups targeting financial services, Clop accounted for 39%, followed by LockBit 3.0 at 24% and ALPHV/BlackCat at 10%. Top 3-5 Exploitable Technology Risks •Phishing and business email compromise: Attackers use malicious attachments, links, spoofing, payroll diversion, and contact-request lures to steal credentials or deliver malware. •Weak, default, stolen, or purchased credentials: Attackers can gain access simply by logging in, especially where password hygiene is poor or valid accounts are abused. •Exposed remote access and administrative services: RDP, cloud administration portals, server monitoring systems, network device interfaces, phone management interfaces, and Apache admin interfaces were observed exposed to the internet. |
| Trustwave | 2023 | MSP / MSSP / SOC Provider |
| 565 | Risk Radar Report 2024 | Bottom Line Up Front (BLUF) Trustwave’s 2024 Risk Radar Report shows that financial services organizations remain high-value targets because attackers can monetize sensitive financial data, customer credentials, and business disruption. For SMBs and insurance teams, the most important takeaway is that phishing, ransomware, insider threats, and credential abuse are practical, active loss drivers that require stronger controls before an incident occurs. Top 3-5 Most Notable Statistics •49% of initial access techniques used against financial services organizations were phishing. •73% of credential access techniques were brute-force attempts. •97% of lateral movement techniques used remote services, primarily RDP and SMB/Windows admin shares. •65% of reported ransomware breaches affecting financial services organizations involved US companies. •The average cost of a financial services breach was reported as $6.08 million, making it the second most expensive sector behind healthcare. Top 3-5 Exploitable Technology Risks •Phishing-as-a-service campaigns using HTML and PDF attachments to hide or redirect to phishing URLs and malware. •Public-facing application exploitation, including vulnerabilities such as Apache Log4J, SQL injection, and potential ZeroLogon attempts. •Remote services such as RDP and SMB/Windows admin shares used for lateral movement after initial compromise. |
| Trustwave | 2024 | MSP / MSSP / SOC Provider |
| 566 | Risk Report 2024 | Bottom Line Up Front (BLUF) SERC’s 2024 report shows that electric grid reliability risk is being driven by interconnected pressures: supply chain constraints, extreme weather, cyber and physical threats, legacy technology, fuel dependence, and fast-growing electricity demand. For SMBs and insurance teams, the key takeaway is that power availability, vendor resilience, cloud dependence, and cyber controls are now tightly linked business interruption risks. Top 3-5 Most Notable Statistics •SERC’s region covers approximately 630,000 square miles and serves more than 97 million people. •The report identifies 10 top regional reliability risks for 2024. •SERC reviewed and scored 30 risks in its consolidated risk registry. •Some areas are experiencing forecasted annual load increases of over 8 percent due to rapid nontraditional load growth. •Natural gas accounts for more than 40 percent of generation within the SERC footprint, with reported SERC capacity data showing gas at 50.1 percent in 2024. Top 3-5 Exploitable Technology Risks •Supply chain cyber exposure: Smart technology, Internet of Things integrations, software, hardware, and critical services can introduce vulnerabilities through vendors and suppliers. •Exploitation of vulnerabilities: The report highlights advanced tools and processes used to exploit bulk power system weaknesses, including ransomware. •Legacy architecture compatibility: Older systems may be difficult to patch, update, support, or integrate with newer technologies, creating reliability and security weaknesses. |
| SERC Regional | 2024 | Threat Intelligence Vendor |
| 567 | Riskiest Devices Report 2025 | Bottom Line Up Front (BLUF) Forescout’s 2025 report shows that network equipment, especially routers, has overtaken traditional endpoints as the riskiest device category in organizational networks. For SMBs and insurance teams, the key takeaway is that attackers are increasingly targeting exposed, poorly monitored, or hard-to-manage connected devices across IT, IoT, OT, and healthcare environments, not just laptops and servers. Top 3-5 Most Notable Statistics •Industry-wide average device risk increased by 15%, rising from 7.73 in 2024 to 8.98 in 2025. •Average device risk by country increased by 33%, from 6.53 in 2024 to 9.1 in 2025 among the highest-risk countries analyzed. •12 of the 20 riskiest device types are new to this year’s list, the largest year-over-year change observed by Forescout. •More than 50% of devices with the most critical vulnerabilities are routers. •More than 50% of non-legacy Windows devices across all five analyzed industries still run Windows 10, with retail and healthcare both over 70%. Top 3-5 Exploitable Technology Risks •Routers, firewalls, and application delivery controllers are high-risk because they are often exposed at the network perimeter and affected by high-severity vulnerabilities, including actively exploited zero-day threats. •IPMI server management interfaces are risky because they enable remote management even when systems are powered off and have critical vulnerabilities, including some with public exploits. •Domain controllers are prime ransomware targets because they store credentials and security policies and can be used for lateral movement after initial access. |
| Forescout | 2025 | Network Security Vendor |
| 568 | RPC Annual Insurance Review 2026 | Bottom Line Up Front (BLUF) RPC’s 2026 review shows that cyber, AI, supply chain disruption, regulatory scrutiny, and underinsurance are now central insurance issues rather than specialist concerns. For SMBs and insurance teams, the most important takeaway is that losses may arise indirectly through vendors, data handling, AI use, or inadequate coverage, even where the business itself has not suffered a direct system compromise. Top 3-5 Most Notable Statistics •Cyber-attacks with supply chain implications averaged 26 a month since April 2025, twice the rate seen between early February 2024 and March 2025. •Underlying cyber claim frequency remained stable, while severity dropped by 50% year over year. •More than 800 consumer privacy bills were introduced at state level in the United States in 2025. •FCA non-financial misconduct rule changes will extend regulatory focus to about 37,000 more firms from September 2026. •In Asia, an estimated 82.8% of natural catastrophe losses remain uninsured. Top 3-5 Exploitable Technology Risks •Supply chain cyber incidents affecting outsourced providers such as payroll services and CRM systems, creating disruption, notification duties, and litigation risk for businesses with limited control over the incident. •Ransomware attacks on online platforms, illustrated by an attack on a South Korean ticketing platform that caused cancellations and postponements when booking systems were taken offline. •Deepfakes used for identity fraud and to bypass security systems. |
| RPC | 2026 | Cyber Insurance Carrier |
| 569 | runZero Research Report Volume 1 2024 | Bottom Line Up Front (BLUF) runZero’s central finding is that attack surfaces are expanding faster than many organizations can track, especially across cloud, operational technology, remote access systems, and unusual connected devices. For SMBs and insurance teams, the key risk is not only known vulnerabilities, but unknown or poorly managed assets that may be exposed, unsupported, or reachable from the Internet. Top 3-5 Most Notable Statistics •The report is based on nearly 4 million assets and almost 50 million distinct data points. •More than 7% of ICS systems in the sample were connected directly to the public Internet. •Limited-visibility devices made up 45.46% of discovered physical devices, while “dark matter” devices made up another 19.09%. •In the first four months of 2024, runZero published 23 Rapid Responses covering 60+ vulnerabilities, with more than half actively exploited in the wild. •In the Cisco IOS-XE case, more than 10,000 systems were estimated infected before disclosure, and more than 50,000 were estimated compromised within days. Top 3-5 Exploitable Technology Risks •Publicly exposed OT/ICS systems, which can be high-value targets because compromise may disrupt industrial or utility operations. •Internet-exposed remote management and gateway systems, including products such as Cisco IOS-XE and Ivanti Connect Secure, where active exploitation was observed. •End-of-life systems and devices, including D-Link NAS products where no patch was available and replacement was recommended. |
| runZero Research | 2024 | Research Organization |
| 570 | SaaS Security Posture Management 2025 | Bottom Line Up Front (BLUF) SaaS applications are now core to business operations, but unchecked adoption creates blind spots that attackers can exploit. For SMBs and insurance teams, the central issue is SaaS sprawl: applications, identities, permissions, and integrations can grow faster than security teams can track or control. Top 3-5 Most Notable Statistics •32% of surveyed C-level executives said cloud is the most crucial part of their digital transformation journey. •49% of surveyed executives said SaaS Security Posture Management is already used in daily security operations. •40% said they planned to add SaaS Security Posture Management by the end of 2024. •The global SaaS Security Posture Management market recorded estimated revenue of $290.7 million in 2024, with 75.3% year-on-year growth. •Frost & Sullivan projects a 51% compound annual growth rate from 2024 to 2029, reaching $2.28 billion in revenue by 2029. Top 3-5 Exploitable Technology Risks •SaaS sprawl, where business units adopt applications without security team visibility, creating unmanaged entry points. •Poorly configured SaaS applications or applications lacking proper security controls. •Excessive permissions across human and non-human identities, including API tokens, service accounts, OAuth keys, and connected devices. |
| CrowdStrike | 2025 | Endpoint / MDR / XDR Vendor |
| 571 | SailPoint Horizons of Identity Security 2024 | Bottom Line Up Front (BLUF) Identity security is a core business risk control, not just an IT function. SailPoint’s survey shows that organizations with more mature identity and access management reduce identity-related security issues, improve productivity, and may have stronger positioning with cyber insurers that increasingly assess IAM capabilities before setting premiums. Top 3-5 Most Notable Statistics •41% of surveyed organizations remain at Horizon 1, the lowest identity security maturity level. •63% of organizations that reached mature identity security reported more than a 10% reduction, and up to 30%, in identity-related security issues. •Horizon 3 and 4 organizations have 20-50% higher coverage of third-party and machine identities. •77% of surveyed organizations reported cyber insurance premium increases over the past three years. •73% of cyber insurance customers consider IAM capabilities among the top three capabilities influencing insurance assessments. Top 3-5 Exploitable Technology Risks •Poor coverage of machine identities, including non-human accounts used by cloud workloads, copilots, machine learning models, and bots, can expand the attack surface. •Limited third-party identity coverage creates risk from contractors, partners, and other non-employee users with business access. •Manual IAM processes can lead to over-provisioning, delayed deactivation, non-executed permission changes, and compliance issues. |
| SailPoint | 2024 | Identity Security Vendor |
| 572 | SailPoint Horizons of Identity Security 2025 | Bottom Line Up Front (BLUF) Identity security is moving from a basic access control into a core security function for detecting, containing, and remediating threats, but most organizations are not keeping pace. For SMB owners and insurance teams, the report’s main message is that weak identity governance, especially around privileged access, cloud entitlements, machine identities, and AI agents, can create preventable exposure and make incidents harder to contain. Top 3-5 Most Notable Statistics •63% of organizations remain in Horizons 1 or 2, meaning their identity programs are typically tactical, manually driven, and limited in automation, AI governance, or cross-environment controls. •IAM was ranked the highest-ROI security domain by 30% of respondents, ahead of endpoint detection and response at 22%. •AI agents are governed in less than 4 in 10 organizations today, while over one-third expect AI agent growth exceeding 30% in the next 3-5 years. •Only 14% of organizations said their most recent IAM deployment was completely successful; 48% ran over budget and 60% missed timelines by at least a month. •Organizations that deploy agentic AI for identity operations were 2.8x more likely to see cost savings from identity security investments. Top 3-5 Exploitable Technology Risks •Poor governance of non-human identities, including service accounts, bots, machine identities, and AI agents, can leave credentials and permissions unmanaged. •Unmanaged API keys, hardcoded credentials, lack of expiration policies, and excessive privileges are highlighted as major non-human identity risks. •Static privileged access can leave users or accounts with permanently elevated permissions, increasing the risk of lateral movement and privilege abuse. |
| SailPoint | 2025 | Identity Security Vendor |
| 573 | SANS 2023 DevSecOps Survey | Bottom Line Up Front (BLUF) DevSecOps is now a business risk issue, not just an engineering practice: organizations are moving rapidly into cloud and multicloud environments while still struggling to apply security controls consistently. For SMBs and insurance teams, the key concern is whether application changes, cloud workloads, containers, and third-party components are being tested and remediated fast enough to reduce preventable security failures. Top 3-5 Most Notable Statistics •61% of survey respondents came from small organizations with 1,000 or fewer employees. •More than 84% of respondents reported at least some cloud usage, while only 54% said they run 25% or more of applications on-premises, down from 85% in 2021. •Among cloud users, 90% reported applications running on AWS, 84% on Microsoft Azure, and 74% on Google Cloud Platform. •54% of respondents deliver system changes to production at least weekly, and 53% test business-critical applications at least weekly. •16% of respondents said it takes more than 30 days to fix critical security issues. Top 3-5 Exploitable Technology Risks •Multicloud environments: each cloud provider works differently, increasing the chance that accounts, subscriptions, projects, and workloads are not secured consistently. •Underused cloud security controls: CSPM and CWPP tools are widely present but used across only a limited share of cloud environments, leaving configuration and workload protection gaps. •Rapid software releases: frequent production changes create risk when security testing is not integrated into CI/CD pipelines. |
| SANS Institute | 2023 | Education / Academic |
| 574 | SANS 2025 Detection and Response Survey | Bottom Line Up Front (BLUF) The report’s central message is that detection and response programs are improving, but many teams are still constrained by false positives, cloud complexity, skill gaps, and limited budgets. For SMBs and insurance teams, this means the greatest risk is not only whether tools are deployed, but whether the organization can see, prioritize, and respond to real threats quickly enough to limit business disruption. Top 3-5 Most Notable Statistics •73% of respondents cited false positives as a main challenge in detecting cyber threats, up from 64% in 2024. •90% of respondents use automated tools for threat detection, up from 87% in 2024. •89% use endpoint detection and response for threat response, up from 82% in 2024. •58% cited limited cloud security expertise as a main challenge in detecting threats within cloud infrastructure. •28% described detection and response budgets as insufficient, up from 22% in 2024. Top 3-5 Exploitable Technology Risks •Endpoints remain a core risk area because threat actors ultimately operate on endpoints for lateral movement, credential theft, and data exfiltration. •Cloud infrastructure, including cloud service providers, Kubernetes, SaaS such as M365 and Google Workspace, and Functions as a Service, remains difficult to monitor effectively. •Multicloud environments create visibility and management challenges, especially when security tools are not well integrated. |
| SANS Institute | 2025 | Education / Academic |
| 575 | SANS 2025 Threat Hunting Survey: Advancements in Threat Hunting Amid AI and Cloud Challenges | Bottom Line Up Front (BLUF) Threat hunting remains a practical way for organizations, including small businesses, to find suspicious activity before it becomes a larger incident. The report’s most important message for SMBs and insurance teams is that attackers are still using common paths such as business email compromise, ransomware techniques, cloud environments, built-in system tools, and data theft, while many organizations struggle with staffing, cloud visibility, and measurement. Top 3-5 Most Notable Statistics •Business email compromise remains the most detected attack type through threat hunting at 64%. •Ransomware detections dropped to 46%, down from 63% in 2024. •Cloud infrastructure was the hardest area to threat hunt, cited by 39% of respondents. •61% of respondents cited a shortage of skilled personnel as the top threat hunting challenge. •58% of organizations manage threat hunting internally, up from 45% in 2024. Top 3-5 Exploitable Technology Risks •Cloud infrastructure: Respondents identified cloud environments as the hardest area to threat hunt because logs, tooling, formats, and techniques differ from on-premises systems. •Business email compromise: BEC remains the most commonly detected attack type, and the report notes that BEC tactics rarely change, making it a persistent issue. •Ransomware using off-the-shelf tools and “living off the land”: Ransomware actors commonly use available tools and built-in system capabilities to blend into normal activity. |
| SANS Institute | 2025 | Education / Academic |
| 576 | SANS AI Survey 2025 | Bottom Line Up Front (BLUF) SANS finds that AI is already reshaping cybersecurity, but security adoption is not keeping pace with AI-driven threats. For SMBs and insurance teams, the main takeaway is that AI creates both defensive opportunity and new risk: organizations are interested in AI, but many lack governance, training, validation, and visibility needed to use it safely. Top 3-5 Most Notable Statistics •81% of respondents are concerned about emerging AI-powered threats. •50% of organizations currently use AI as part of their cybersecurity strategy, and 30% plan to start within 12 months. •66% report that AI systems or agents generate many false positives, contributing to alert fatigue. •35% have a formal AI risk management and compliance program in place. •83% are worried about highly personalized social engineering attacks, and 73% are concerned about deepfakes. Top 3-5 Exploitable Technology Risks •AI-enabled social engineering, including highly personalized phishing or deception, which respondents identified as a leading concern. •Deepfakes, which can make impersonation and fraud attempts more convincing. •Sensitive data entered into GenAI platforms, which respondents worry could leak to other platform users. |
| SANS Institute | 2025 | Education / Academic |
| 577 | SANS Application and API Security Survey 2024 | Bottom Line Up Front (BLUF) Applications and APIs are increasingly central to how organizations handle sensitive information, but securing them is more complex than traditional infrastructure vulnerability management. For SMBs and insurance teams, the key takeaway is that relying on one testing method is not enough; organizations need a practical mix of early testing, deployed-application visibility, and targeted manual review. Top 3-5 Most Notable Statistics •79.8% of respondents said their organization develops and supports applications and/or APIs. •Traditional form-based web applications are supported by 60.1% of respondents, followed closely by REST APIs at 55.6% and single-page web applications at 48.0%. •35% of respondents consider more than half of their applications or APIs to be microservices. •More than 50% of organizations are implementing some form of runtime protection for applications and APIs. •Runtime protection adoption was reported at 54.5% for applications, with 53% reporting runtime protection for APIs and 53% reporting just-in-time authentication and authorization controls for applications or APIs. Top 3-5 Exploitable Technology Risks •Broken access control and business logic flaws, which the report notes automated tools can struggle to cover effectively. •APIs, including REST, SOAP, and GraphQL APIs, which are widely used and often protect sensitive organizational information. •Microservices-based architectures, which increase application and API diversity and require a broader security toolset. |
| SANS Institute | 2024 | Education / Academic |
| 578 | SANS Cyber Threat Hunting Survey 2024 | Bottom Line Up Front (BLUF) Threat hunting is becoming a core security practice, but many organizations still struggle with skilled staffing, useful data, and consistent methods. For SMBs and insurance teams, the key takeaway is that better threat hunting can reduce exposure, improve detections, and lower remediation effort, but only when it is measured, maintained, and aligned to the organization’s real risks. Top 3-5 Most Notable Statistics •68% of respondents reported business email compromise as the most common attack type detected through threat hunting. •64% reported ransomware as a common attack type detected through threat hunting. •51% of organizations reported having formally defined threat hunting methodologies, up from 35% in 2023. •64% of organizations now measure threat hunting success or effectiveness, up from 34% in 2023. •50% cited lack of skilled staff as the top barrier to threat hunting, down from 73% in 2023. Top 3-5 Exploitable Technology Risks •Business email compromise through compromised mailboxes, typically enabled by phishing or credential theft, especially in cloud-based email environments. •Ransomware activity involving custom malware, targeted data exfiltration, and use of off-the-shelf tools such as Cobalt Strike, Brute Ratel, or remote access tools. •“Living off the land” activity, where attackers use legitimate tools already present in the organization to avoid detection. |
| SANS Institute | 2024 | Education / Academic |
| 579 | SANS Cyber Threat Intelligence Survey 2022 | Bottom Line Up Front (BLUF) The main takeaway from the SANS 2022 Cyber Threat Intelligence Survey is that cyber threat intelligence is becoming more accessible and useful, but many organizations still struggle to measure its value and operationalize it quickly. For SMBs and insurance teams, this matters because CTI can help prioritize response to major threats such as ransomware, targeted vulnerabilities, malware, and third-party exposure. Top 3-5 Most Notable Statistics •More than 200 organizations participated in the survey. •33% of respondents worked for organizations with fewer than 1,000 employees. •75% of respondents said CTI improved their organization’s security prevention, detection, and response. •21% said they did not know whether CTI improved security outcomes. •Only 46% of respondents integrate threat intelligence into defense and response systems, though this increased from 41% the prior year. Top 3-5 Exploitable Technology Risks •Email-based threats remain a major entry point for adversaries into networks, including as a path for ransomware. •Ransomware continues to target organizations large and small, with CTI teams focused on identifying affected third-party vendors and limiting their access. •Targeted vulnerabilities are a major CTI priority, with respondents rating information about vulnerabilities being exploited by attackers as highly useful. |
| SANS Institute | 2022 | Education / Academic |
| 580 | SANS Cyber Threat Intelligence Survey 2023 | Bottom Line Up Front (BLUF) Cyber threat intelligence is no longer only for large enterprises; the survey shows organizations of all sizes are using CTI to prioritize threats, improve prevention, detection, and response, and support security decisions. For SMBs and insurance teams, the key takeaway is that CTI is most useful when it is tied to the organization’s actual assets, vulnerabilities, incidents, and business priorities—not just the latest cybersecurity headlines. Top 3-5 Most Notable Statistics •984 individual respondents participated, representing more than 25 industries. •17% of respondents came from organizations with 101 to 500 employees, and 11% from organizations with fewer than 100 employees. •51% reported having a formal dedicated CTI team, the highest level since 2020. •59% reported having clearly defined CTI requirements, up from 35% in 2022. •87% reported that CTI helped improve security prevention, detection, and response. Top 3-5 Exploitable Technology Risks •Ransomware intrusions are highlighted as a major area where CTI helped inform decisions. •Email attachments were cited by respondents as a threat observed in their networks, leading some organizations to block certain attachments. •Phishing campaign changes were cited as CTI content that can support awareness briefings and security-tool updates. |
| SANS Institute | 2023 | Education / Academic |
| 581 | SANS SOC Survey 2025 | Bottom Line Up Front (BLUF) The SANS SOC Survey 2025 shows that security operations centers are improving, but many remain reactive, understaffed, and heavily dependent on manual processes. For SMBs and insurance teams, the key takeaway is that effective cyber defense depends less on buying more tools and more on having clear response processes, usable data, retained talent, and practical oversight of AI and threat intelligence. Top 3-5 Most Notable Statistics •79% of SOCs operate 24/7, showing broad commitment to continuous monitoring. •85% of respondents say endpoint security alerts are their primary trigger for response. •69% of SOCs still rely on manual or mostly manual processes to report metrics. •62% of SOC professionals say their organization is not doing enough to retain top talent. •42% of SOCs dump all incoming data into a SIEM, often without a retrieval or management plan. Top 3-5 Exploitable Technology Risks •Overreliance on endpoint alerts as the main response trigger can leave organizations reactive rather than proactively searching for threats. •Poor SIEM data management can create visibility issues when organizations store large volumes of data without a clear plan to retrieve, manage, or analyze it. •AI/ML tools used “out of the box” or outside defined workflows can waste budget, add risk, and fail to support operations effectively. |
| SANS Institute | 2025 | Education / Academic |
| 582 | Securing Digital India Against AI & Cyber Threats Leveraging AI Security & Zero Trust | Bottom Line Up Front (BLUF) Zscaler’s report argues that perimeter-based security is no longer adequate for today’s cloud, SaaS, AI, and connected operations. For SMBs and insurance teams, the core takeaway is that cyber risk now centers on identity, access, data exposure, third-party connections, and lateral movement after compromise. Top 3-5 Most Notable Statistics •India recorded 369 million malware detections across 8.44 million endpoints in a single year, averaging 702 detections per minute. •The report cites an 85% reduction in successful ransomware, phishing, malware, and viruses as a sample Zero Trust benefit. •The report cites a 25% reduction in data breach risk as a sample Zero Trust benefit. •Routers are targeted in 75%+ of IoT attacks, according to the report’s IoT/OT discussion. •India’s UPI payments account for 49% of global transactions, highlighting the scale and dependency of digital services. Top 3-5 Exploitable Technology Risks •Implicit trust inside networks: once attackers compromise credentials, trusted network segments, or third-party connections, they can move laterally across systems. •Phishing, ransomware, malware, and insider threats: the report identifies these as main breach types that can disrupt operations, lock data, steal information, or monitor activity. •AI-enabled attacks and unsafe AI use: generative AI can improve the targeting and scale of attacks, while public LLM use can expose sensitive information without guardrails. |
| Zscaler | 2026 | Cloud Security Vendor |
| 583 | Securing the Future of Agentic AI: Building Consumer Trust through Robust API Security | Bottom Line Up Front (BLUF) Agentic AI is becoming a normal part of customer service, automation, and business workflows, but the APIs that allow these AI agents to access data and take actions are now a critical security exposure. For SMBs and insurance teams, the key takeaway is that AI adoption without strong API security can increase the risk of data exposure, fraudulent activity, operational disruption, and loss of customer trust. Top 3-5 Most Notable Statistics •64% of consumers report encountering AI chatbots more frequently than a year ago. •81% of consumers who encountered an AI chatbot said they entered personal details into it. •62% of consumers believe chatbots are more vulnerable to manipulation by hackers than human counterparts. •48% of organizations using agentic AI currently employ between 6 and 20 types of AI agents, while 19% deploy between 21 and 50. •Only 37% of organizations report using a dedicated API security solution. Top 3-5 Exploitable Technology Risks •Poorly secured APIs that connect AI agents to internal databases, CRMs, ERPs, e-commerce systems, and third-party services. •Compromised AI agent credentials, including stolen credentials caused by phishing, poor storage practices, or insecure token handling. •Excessive permissions granted to AI agents, which can allow attackers to access sensitive data, execute fraudulent transactions, or manipulate business operations. |
| Salt Security | 2025 | Threat Intelligence Vendor |
| 584 | Security Annual Report 2023 | Bottom Line Up Front (BLUF) Healthcare cybersecurity risk is rising, and connected medical technologies must be managed securely across their full life cycle, not just at purchase. For SMB healthcare providers, suppliers, and insurance teams, the key takeaway is that patient care, privacy, operations, and trust can be affected when medical devices, software, third-party components, or legacy systems are not actively monitored, patched, and supported. Top 3-5 Most Notable Statistics •Large healthcare breaches in the U.S. increased 93% between 2018 and 2022. •Large breaches involving ransomware increased 278% between 2018 and 2022. •BD has been operating in healthcare technology for more than 125 years. •The Healthcare Sector Coordinating Council Cybersecurity Working Group includes more than 430 industry and government organizations. •In 2023, security researchers reported 2 vulnerabilities to BD through the Biohacking Village at DEF CON engagement. Top 3-5 Exploitable Technology Risks •Software-enabled and connected medical devices can be affected by newly discovered vulnerabilities, requiring coordinated disclosure, mitigations, compensating controls, and patch management. •Third-party software components used with medical products can introduce vulnerabilities that require vendor analysis, validation, and customer notification before patches are released. •Legacy devices and components that approach End of Life or End of Support create security management challenges if customers are not informed and prepared. |
| BD | 2023 | Industrial / Manufacturing Vendor |
| 585 | Security Digitization and the Global Supply Chain 2025 | Bottom Line Up Front (BLUF) Bitsight’s 2025 report shows that digital supply chains are far larger, more concentrated, and more unevenly secured than many organizations may realize. For SMBs and insurance teams, the key takeaway is that a cyber incident at a critical provider can create business disruption far beyond the directly attacked company, while insured losses may cover only a fraction of the overall impact. Top 3-5 Most Notable Statistics •Bitsight examined more than 500,000 consumer organizations, 42,600 products, 12,000 providers, and nearly 61.5 million relationships. •A typical organization manages around 100 products across roughly a dozen providers, not including extended supplier-of-supplier relationships. •Providers use 2.5x more products, have 2.4x more providers, and have 10x more internet-facing assets than consumers. •Some providers serving less than 1% of companies support more than 50% of market share when measured by customer revenue. •Bitsight found major supply chain players with more than 25% market share that also have large attack surfaces, many vulnerabilities, and exceptionally long remediation times. Top 3-5 Exploitable Technology Risks •Open vulnerabilities that remain unresolved for long periods, including examples where major providers take more than a year to fix typical vulnerabilities. •Large internet-facing asset footprints at providers, which increase the number of systems attackers can probe for weaknesses. •Open ports, insecure systems, and exposed services that Bitsight identifies as immediate security risks. |
| Bitsight | 2025 | Compliance / GRC Vendor |
| 586 | Security in Finance 2024 | Bottom Line Up Front (BLUF) HYPR’s report shows that identity security is the central weakness in financial services cybersecurity, with most breaches tied to credential misuse or authentication gaps. For SMBs and insurance teams, the takeaway is clear: customer and workforce login controls are not just technical issues; they directly affect fraud losses, breach costs, regulatory exposure, and customer trust. Top 3-5 Most Notable Statistics •98% of financial services organizations were hit by cyberattacks in the last 12 months. •86% experienced an identity-related cyberattack in the last 12 months. •77% of all financial services organizations experienced at least one breach related to credential misuse or authentication weakness. •Authentication-related breaches caused average losses of $4.57 million in the last 12 months. •80% of consumers said they would likely switch financial institutions if their data was compromised. Top 3-5 Exploitable Technology Risks •Phishing, pharming, and smishing were the most common reported attack types, exploiting users through deceptive messages and login capture. •Credential stuffing and brute-force attacks remain a major risk, especially where customers reuse passwords across accounts. •Push notification attacks, also called MFA prompt bombing, exploit user fatigue or confusion with repeated authentication prompts. |
| HYPR | 2024 | Identity Security Vendor |
| 587 | Security Index 2020 | Bottom Line Up Front (BLUF) Trustwave’s 2020 Data Security Index shows that data is increasingly spread across cloud, on-premises, and hybrid environments, while attackers most often pressure organizations through phishing, malware, ransomware, and application attacks. For SMBs and insurance teams, the key takeaway is that data security risk is not limited to large enterprises: smaller teams must still manage cloud complexity, patching, user access, remote access, and compliance exposure. Top 3-5 Most Notable Statistics •55% of respondents store data in a hybrid model using both public cloud and on-premises databases. •70% of respondents use 2-4 third-party public cloud services. •96% plan to move sensitive data to the cloud over the next two years, including 52% planning to move highly sensitive data. •27% reported phishing/social engineering as the most frequent threat experienced, followed by malware/ransomware at 25%. •91% reported having VPNs and multifactor authentication set up for employees working remotely. Top 3-5 Exploitable Technology Risks •Hybrid and multi-cloud data environments, which increase complexity and require security controls that work across cloud and on-premises systems. •Phishing and social engineering, which were the most frequently experienced threats and can also deliver malware or ransomware. •Malware and ransomware, ranked as the top concern by respondents and identified as a major data security threat. |
| Trustwave | 2020 | MSP / MSSP / SOC Provider |
| 588 | Security Megatrends 2025 | Bottom Line Up Front (BLUF) SIA’s 2025 report shows the security industry moving rapidly toward AI-enabled, cloud-delivered, software-centric, and highly connected systems. For SMBs and insurance teams, the key takeaway is that physical security, IT, operational technology, and cyber risk are increasingly intertwined, so security investments and underwriting reviews should treat these systems as business-critical technology, not standalone devices. Top 3-5 Most Notable Statistics •91% of security solutions developers said their research and development investments are fully, heavily, or somewhat focused on AI, up from 74% reported in 2023. •81% of security industry manufacturers and solution providers said predictive data analytics are a meaningful or very meaningful component of existing or soon-to-be-released products, software, or solutions. •69.6% of survey respondents said channel buyers are changing from the traditional security integrator model. •The report estimates 16 billion IoT devices connected worldwide in 2023, rising to 32 billion by 2030. •Of the estimated over 90 million cameras installed globally, the report says very few currently use AI, but that is changing. Top 3-5 Exploitable Technology Risks •Cloud and SaaS security platforms are becoming more central to security delivery, increasing dependence on software, remote services, customer data, and third-party providers. •IT, operational technology, and physical security systems are converging, creating more complex environments where connected systems, data flows, and proprietary integrations must be managed carefully. •IoT architectures and sensor-heavy environments are expanding the number of connected devices and data sources that businesses must understand, monitor, and integrate. |
| SIA | 2025 | ISAC / Industry Consortium |
| 589 | Security Megatrends 2026 | Bottom Line Up Front (BLUF) Security technology is rapidly becoming software-led, cloud-connected, AI-enabled, and integrated with building and IT systems. For SMBs and insurance teams, the most important takeaway is that physical security and operational technology can no longer be treated as “set it and forget it” infrastructure; outdated or poorly integrated systems may create cybersecurity, operational, and business resilience risk. Top 3-5 Most Notable Statistics •Only 7% of organizations report that 75% of their application stack is SaaS. •Across all industries, an estimated 33% of startups are software-focused, compared with only 6–7% focused on hardware. •There are nearly five times as many software startups as hardware startups across the technology market. •AI is predicted to largely replace human labor for monitoring tasks within seven years. •Security devices and software are moving away from 10-plus-year life cycles toward faster refresh expectations influenced by IT’s three- to five-year cadence. Top 3-5 Exploitable Technology Risks •Outdated operational technology, including security systems, building automation, and smart sensors, is identified as a serious vulnerability because unsecured endpoints can enable lateral attacks across networks. •Legacy security devices and software that remain in place for 10 or 15 years may no longer meet current cybersecurity, interoperability, or AI-driven operational needs. •Fragmented access control, video surveillance, intrusion, and sensor platforms can leave valuable data underused and slow decision-making. |
| SIA | 2026 | ISAC / Industry Consortium |
| 590 | Security Navigator 2024 | Bottom Line Up Front (BLUF) Orange Cyberdefense’s Security Navigator 2024 shows a threat environment where opportunistic cyber extortion, cloud and supplier dependency, and exploitable public-facing systems create outsized business risk. For SMBs and insurance teams, the key lesson is that losses may come not only from direct targeting, but from widely used platforms, service providers, and unmanaged vulnerabilities. Top 3-5 Most Notable Statistics •Orange Cyberdefense investigated 129,395 incidents and confirmed 25,076 true positive security incidents. •Confirmed incidents represented 19% of all investigated incidents, down from 45% in 2020. •Cl0p claimed 514 victims across 43 countries, including 373 victims in 2023. •The Finance and Insurance sector recorded a 106% increase in cyber extortion victims, largely attributed to Cl0p activity. •For small customers, 45.81% of confirmed incidents were attributed to hacking activity. Top 3-5 Exploitable Technology Risks •Internet-facing managed file transfer platforms, including MOVEit Transfer and GoAnywhere, were exploited by Cl0p and caused cascading victim impact. •Cloud and SaaS identity environments were highlighted through incidents affecting Microsoft Exchange Online, JumpCloud, Okta, and downstream customers. •Ivanti Endpoint Manager Mobile vulnerabilities were used against Norwegian government departments, with public proof-of-concept exploit code increasing risk for older versions. |
| Orange | 2024 | Threat Intelligence Vendor |
| 591 | Security Navigator 2025 | Bottom Line Up Front (BLUF) Orange Cyberdefense’s Security Navigator 2025 shows that cyber extortion, internal misuse, shadow IT, AI-related exposure, and operational technology disruption are now practical business risks, not distant enterprise-only issues. For SMBs and insurance teams, the key takeaway is that smaller organizations are being targeted more often, while weak governance, unresolved vulnerabilities, and connected systems can turn routine incidents into costly downtime or extortion claims. Top 3-5 Most Notable Statistics •Orange Cyberdefense analyzed 135,225 potential incidents, of which 20,706 were confirmed true-positive incidents. •Small and medium-sized businesses accounted for over two thirds of cyber extortion victims. •Small businesses saw a 53% increase in cyber extortion attacks, while medium-sized businesses saw a 52% increase. •Manufacturing recorded 920 cyber extortion victims and a 25% increase in incidents, making it the most impacted sector in the report’s scorecards. •Health Care and Social Assistance saw a 50% rise in cyber extortion incidents. Top 3-5 Exploitable Technology Risks •Shadow IT and unapproved hardware, software, scripts, or workarounds, which the report highlights as a persistent source of misuse and policy-violation incidents. •Phishing and spear-phishing, which remain prominent social attack methods and can lead to credential compromise or malware infection. •Web attacks, brute force activity, and port scanning, which are listed among key hacking actions observed in incident data. |
| Orange | 2025 | Threat Intelligence Vendor |
| 592 | Security Navigator 2026 | Bottom Line Up Front (BLUF) Orange Cyberdefense’s Security Navigator 2026 shows that SMB cyber risk is now a business-continuity and dependency issue, not just an IT problem. For SMB owners and insurance teams, the key takeaway is that known vulnerabilities, endpoint and account compromise, security-product weaknesses, and geopolitical activity all create practical loss scenarios that require stronger monitoring, faster remediation, and clearer ownership. Top 3-5 Most Notable Statistics •Across 15 CyberSOCs, 139,373 potential incidents led to 19,053 confirmed incidents, a 13.7% global true positive rate. •In confirmed incidents, 56.9% of actors were internal and 39.1% were external. •The top affected assets were end-user devices at 52.5%, accounts at 17.2%, and servers at 16.5%. •In SMB Micro-SOC data, 1,943 customers and about 1.5 million endpoints generated 1.63 million resolved incidents, with 835,640 confirmed as true positives. •Vulnerability scanning found 1,289,451 findings across 60,837 assets, with most vulnerabilities remaining open for about 6 months. Top 3-5 Exploitable Technology Risks •End-user devices: They were the most affected asset category, making laptops, desktops, and user systems a central point of exposure. •Accounts: Account-related incidents were a major asset category, showing the importance of protecting user access and identity. •Servers: Servers remained a significant affected asset class and can create business disruption when compromised. |
| Orange | 2026 | Threat Intelligence Vendor |
| 593 | Security Observability Report 2021 | Bottom Line Up Front (BLUF) Application and API security should be treated as a core business risk, not just a developer issue. Contrast’s 2021 data shows that serious custom-code vulnerabilities, exploitable application weaknesses, and open-source prioritization problems can expose organizations to data breach, downtime, and wasted remediation effort. Top 3-5 Most Notable Statistics •39% of data breaches in the past year were the result of an application vulnerability, according to the report’s cited breach data. •34% of applications had at least one serious vulnerability, up from 26% the prior year. •39% of identified vulnerabilities were High or Critical, up from 28% last year. •78% of active code in the typical application was custom code, while only 22% came from open-source libraries and frameworks. •54% of Critical CVEs and 49% of Major CVEs were in inactive libraries or classes and would be false positives with traditional software composition analysis tools. Top 3-5 Exploitable Technology Risks •Broken access control: the highest annual RiskScore and present as both a major vulnerability and attack category; attacks targeted 82% of applications. •Cross-site scripting: the second-highest RiskScore and one of the top vulnerability types by affected applications. •SQL injection: rated high impact because successful exploitation can lead to database takeover, data exfiltration, and loss of confidentiality, integrity, and availability. |
| Contrast | 2021 | Application / API Security Vendor |
| 594 | Security Operations 2024 | Bottom Line Up Front (BLUF) PDI Technologies argues that SMBs should move from reactive cybersecurity toward predictive, integrated security operations supported by SOC as a Service, AI, automation, and 24/7 monitoring. For SMB owners and insurance teams, the main takeaway is that fragmented tools and compliance-only thinking can leave businesses slower to detect, prioritize, and respond to threats such as ransomware and phishing. Top 3-5 Most Notable Statistics •The report highlights 24/7 expert monitoring and response as a key SOCaaS capability and notes that cyber insurance policies typically require 24/7 SOC coverage. •Security programs are described as progressing through 4 maturity stages: technology-centric, compliance-driven, threat-aware, and risk-based. •The report identifies an increase in cyberattacks, particularly ransomware and phishing. •It also identifies greater use of AI, machine learning, and generative AI to help close the cyber skills gap and improve detection, response, and prediction. •The report notes growing attention to IoT device security, evolving attacker tactics, and geopolitical factors as cybersecurity trends to watch. Top 3-5 Exploitable Technology Risks •Fragmented standalone tools and data silos, which make it harder for teams to connect events, investigate threats, and act quickly. •Security tools that are not intelligently integrated or lack built-in APIs, limiting automation, orchestration, and proactive detection and response. •Ransomware and phishing, which the report specifically identifies as increasing attack types. |
| PDI Technologies | 2024 | MSP / MSSP / SOC Provider |
| 595 | Security Outcomes Study Vol1 2021 | Bottom Line Up Front (BLUF) Cisco’s study shows that stronger security outcomes are most closely tied to practical program fundamentals: modernized technology, well-integrated tools, timely incident response, and learning from prior incidents. For SMBs and insurance teams, the key takeaway is that reducing cyber risk is not only about buying more controls; it is about keeping tools current, making them work together, and proving that response and recovery processes can limit losses. Top 3-5 Most Notable Statistics •Cisco surveyed over 4,800 IT, security, and privacy professionals across 25 countries. •Out of 275 practice-outcome combinations, 45% showed significant correlation between a security practice and a desired outcome. •The overall rate of security program success was 42%. •Organizations with proactive technology refresh strategies were 11% to 15% more likely to report successful security programs, averaging 12.7%. •Meeting compliance requirements had a 47.9% success rate, while minimizing unplanned work had a 35.5% success rate. Top 3-5 Exploitable Technology Risks •Outdated or rarely upgraded IT and security infrastructure, which the report links to weaker program success and difficulty keeping up with business growth. •Poorly integrated security technologies, which can reduce overall program effectiveness and make operations harder to manage. •Weak vulnerability remediation practices, including difficulty meeting remediation deadlines. |
| Cisco | 2021 | Network Security Vendor |
| 596 | Security Outcomes Study Vol2 2021 | Bottom Line Up Front (BLUF) Cisco’s study finds that security success is strongly tied to five operational practices: proactive technology refresh, well-integrated security tools, accurate threat detection, timely incident response, and prompt disaster recovery. For SMBs and insurance teams, the key takeaway is that reducing outdated, fragmented, and untested security operations can materially improve resilience and response outcomes. Top 3-5 Most Notable Statistics •39% of security technologies used by organizations are considered outdated on average. •Organizations using modern, consolidated, cloud-based architectures are more than 2X as likely to report strong technology refresh capabilities than those using outdated, distributed, on-premises technologies. •Integrated security technologies are almost 7X more likely to achieve high levels of automation across event monitoring, incident analysis, and incident response. •Nearly 92% of organizations with strong people, process, and technology report advanced threat detection and response capabilities. •Organizations that regularly test business continuity and disaster recovery capabilities in multiple ways are 2.5X more likely to maintain business resiliency. Top 3-5 Exploitable Technology Risks •Outdated security tools that may not keep pace with advancing threats and business needs. •Fragmented or poorly integrated security technologies that create blind spots and limit automation. •Weak threat detection and incident response capabilities, especially where people, process, and technology are not all mature. |
| Cisco | 2021 | Network Security Vendor |
| 597 | Security Outcomes Study Vol3 2022 | Bottom Line Up Front (BLUF) Cisco’s study shows that security resilience is now a business priority, not just a technical goal: most organizations have already experienced incidents that affected operations, and executives overwhelmingly view resilience as highly important. For SMBs and insurance teams, the key takeaway is that loss prevention depends on practical readiness: clear priorities, tested response plans, manageable technology environments, and controls that limit incident spread and business disruption. Top 3-5 Most Notable Statistics •96% of executives consider security resilience highly important to their business. •Nearly two-thirds of organizations reported major security incidents that jeopardized business operations. •Network/data breaches and network/system outages were each cited by over 50% of respondents that had prior incidents. •Ransomware and DDoS attacks each affected about 46% of organizations reporting prior incidents. •Organizations with strong security culture saw a 46% increase in resilience scores compared with those with poor security culture. Top 3-5 Exploitable Technology Risks •Network and data breaches: these were among the most common incident types and can directly disrupt operations, expose information, and damage trust. •Ransomware: identified as a common resilience-impacting incident, with potential to cause operational disruption and financial loss. •DDoS attacks: also common among reported incidents and capable of disrupting access to systems and services. |
| Cisco | 2022 | Network Security Vendor |
| 598 | Security Outlook 2026 | Bottom Line Up Front (BLUF) Praetorian’s 2026 outlook finds that many organizations are losing confidence in traditional, periodic security programs because asset changes, vulnerability backlogs, tool sprawl, and alert volume are outpacing security teams. For SMB owners and insurance teams, the key takeaway is that risk visibility matters as much as security spending: if a business cannot continuously identify assets, prioritize exploitable vulnerabilities, and validate defenses, material exposures may remain hidden. Top 3-5 Most Notable Statistics •64% of respondents reported low to moderate confidence in their current security controls. •Only 15% expressed confidence in their ability to track all IT assets. •41% of organizations carried 100-999 unresolved vulnerabilities, while 27% carried 1,000-10,000. •37% used 6-19 vulnerability scanning and asset discovery tools. •90% believed their security would benefit from continuous threat testing and management. Top 3-5 Exploitable Technology Risks •Incomplete IT asset inventories: organizations with unknown or poorly tracked assets may leave public-facing systems exposed without monitoring. •Infrequent external vulnerability scanning: nearly half of organizations scan externally facing applications and infrastructure only quarterly or annually, which can lag behind frequent infrastructure changes. •Large vulnerability backlogs: unresolved vulnerabilities create more opportunities for attackers, especially when teams cannot prioritize based on real-world and business impact. |
| Praetorian | 2026 | Threat Intelligence Vendor |
| 599 | Security Penetration Testing Report 2020 | Bottom Line Up Front (BLUF) Core Security’s 2020 report shows that penetration testing is widely viewed as important, but many organizations struggle to act on the findings. For SMBs and insurance teams, the key issue is not just whether testing occurs, but whether discovered weaknesses are remediated, retested, and tied to business risks such as lost revenue or interruption of critical services. Top 3-5 Most Notable Statistics •97% of respondents said penetration testing was at least somewhat important to their security posture. •63% cited “getting others to act on the findings” as a penetration testing challenge. •77% identified misconfigurations as a top security concern, followed by phishing at 72% and poor passwords at 60%. •15% reported that they never conduct penetration testing. •95% said penetration testing held some level of importance for compliance initiatives. Top 3-5 Exploitable Technology Risks •Misconfigurations: The most cited concern, and a practical entry point attackers can exploit when systems are not consistently configured or maintained. •Phishing: The report describes phishing as a common way for attackers to gain employee credentials and access organizational systems. •Poor passwords: Weak password practices can expose accounts and systems, and the report notes password tools can help enforce stronger policies. |
| Core Security | 2020 | Security Research Vendor |
| 600 | Security Posture Management 2023 | Bottom Line Up Front (BLUF) Cloud security is a shared responsibility: cloud providers secure the service, but customers remain responsible for how they configure, access, and use it. For SMBs and insurance teams, the key takeaway is that cloud risk often comes from preventable issues such as misconfigurations, excessive permissions, exposed data, and unpatched vulnerabilities. Top 3-5 Most Notable Statistics •Check Point CloudGuard reports coverage for 70+ cloud-native services, more than 50 compliance frameworks, and 2,400 security rules. •Orca Security reports monitoring of over 1000 unique controls across 100+ compliance frameworks. •Skyhawk Security offers a free CSPM tier for up to 1,000 cloud assets. •Skyhawk Security was founded in 2022 as a spinoff of Radware’s Cloud Native Protector business. •Sysdig was founded in 2013 and supports cloud and Kubernetes posture management across AWS, Azure, Google Cloud, IBM Cloud, and Kubernetes. Top 3-5 Exploitable Technology Risks •Cloud misconfigurations: The report repeatedly highlights risky configurations in cloud services, cloud control planes, storage, workloads, and Kubernetes as core CSPM detection areas. •Excessive or abnormal entitlements: Threat actors can exploit excessive permissions, orphan accounts, weak authentication policies, and risky IAM configurations. •Exposed or poorly protected data: Risks include public access to cloud data, data directly exposed to the internet, data stored out of policy, and data without appropriate controls such as encryption. |
| KuppingerCole | 2023 | Threat Intelligence Vendor |
| 601 | Security Report 2021 | Bottom Line Up Front (BLUF) Trustwave’s 2021 report shows that the rapid shift to remote work created exploitable security gaps, especially in VPNs, remote access services, videoconferencing tools, and Windows infrastructure. For SMBs and insurance teams, the key takeaway is that unpatched critical vulnerabilities can quickly turn into ransomware exposure, data theft, downtime, or broader network compromise. Top 3-5 Most Notable Statistics •Trustwave’s research was based on vulnerability scans of millions of servers worldwide. •The SolarWinds SUNBURST malware was distributed to approximately 18,000 SolarWinds customers. •A Shodan search in early January 2021 indicated that more than 100,000 machines were susceptible to SMBGhost exploitation. •Cisco Jabber vulnerability CVE-2020-26085 carried a CVSS severity score of 9.9 out of 10. •BlueKeep exposure declined from more than 200,000 vulnerable machines in January 2021 to about 128,000 in June 2021, with nearly 30,000 results still tied to Windows Remote Desktop Protocol. Top 3-5 Exploitable Technology Risks •Unpatched VPN and gateway platforms, including Pulse Secure Connect, Citrix ADC/Citrix Gateway, and F5 BIG-IP, were actively targeted and could allow credential theft, access behind gateways, or remote code execution. •Videoconferencing platforms introduced risks such as Zoom teleconference hijacking, credential theft through UNC path injection, and Cisco Jabber remote code execution. •Windows vulnerabilities including Curveball, SMBGhost, SIGRed, and Zerologon created risks of certificate spoofing, wormable remote code execution, domain administrator compromise, and privilege escalation. |
| Trustwave | 2021 | MSP / MSSP / SOC Provider |
| 602 | Security Services Global Report 2026 | Bottom Line Up Front (BLUF) Kaspersky’s 2026 report shows that the most damaging incidents still center on human-driven attacks, exposed systems, valid accounts, and ransomware-style data encryption. For SMBs and insurance teams, the key takeaway is that loss prevention depends on finding attacks early, reducing exposed access points, and ensuring recovery is possible before files are encrypted or destroyed. Top 3-5 Most Notable Statistics •High-severity incidents declined from a peak of 14.3% in 2021 to 3.8% in 2025, while medium- and low-severity incidents made up more than 96% of all cases. •Data encrypted for impact was the most common resulting damage in IR cases, at 39.4%. •The most common reason for requesting Incident Response was files encrypted, at 33.1%, followed by suspicious endpoint activity at 24.3%. •Median attack duration varied sharply: rapid attacks lasted less than 1 day, average attacks lasted 19 days, and long-lasting attacks lasted 108 days. •Top targeted industries in the report summary were Government at 19%, Industrial at 17%, and IT at 15%. Top 3-5 Exploitable Technology Risks •Public-facing application exploits: The report identifies exploitation of public-facing applications as a leading initial vector and links it to data encryption and other high-impact outcomes. •Valid accounts and weak access controls: Attackers used legitimate accounts, recurring passwords, RDP, and SSH to move through environments and intensify attacks. •Trusted relationships and contractor access: The report highlights trusted relationships as an initial vector, especially relevant to IT, telecom, and supply-chain exposure. |
| Kaspersky | 2026 | Endpoint / MDR / XDR Vendor |
| 603 | Security Status Report 2025 | Bottom Line Up Front (BLUF) Telefónica Tech’s report shows that the most important risks for SMBs are not only headline-grabbing breaches, but everyday exposure: unpatched systems, leaked credentials, malicious links, vulnerable internet-facing tools, and compromised browser or mobile apps. For insurers and risk teams, the report reinforces that preventable weaknesses continue to drive disruption, credential theft, ransomware impact, and operational outages. Top 3-5 Most Notable Statistics •16 billion passwords and login credentials were reported leaked, though the report notes this appeared to be largely a compilation of already circulating data rather than a major new breach. •U.S. cybercrime losses reported to IC3 exceeded $16.6 billion in 2024, compared with $12.5 billion in 2023. •Ransomware payments fell by 35% in 2024, totaling $813.55 million, and only 30% of victims who negotiated eventually paid. •GitHub detected more than 39 million leaked secrets in repositories, including API keys and credentials. •Telefónica Tech’s OT threat analysis detected almost 82 million cybersecurity events in the first half of 2025, an increase of almost 18% compared with the first half of 2024. Top 3-5 Exploitable Technology Risks •Internet-exposed Grafana instances: more than 46,000 vulnerable instances were reported, with risks including account hijacking, credential switching, and potential access to internal systems. •Fortinet/FortiGate exposure: attackers leaked configuration files, IP addresses, VPN credentials, cleartext passwords, private keys, and firewall rules from more than 15,000 FortiGate devices. •PHP for Windows in CGI mode: CVE-2024-4577 was massively exploited for remote code execution, including more than 1,000 unique IPs attempting exploitation in January alone. |
| Telefónica Tech | 2025 | Telco / Network Operator |
| 604 | Shadow AI Report 2025 | Bottom Line Up Front (BLUF) Shadow AI—AI tools used without IT or security approval—is already embedded in business workflows and is creating visibility, data protection, and compliance risk. For SMBs and insurance teams, the key issue is not AI use itself, but unmanaged AI use that may process customer data, employee data, intellectual property, email, cloud storage, or code without oversight. Top 3-5 Most Notable Statistics •53% of all shadow AI usage across assessed enterprises was attributed to OpenAI. •10,000+ enterprise users in the study were tracked using OpenAI, more than the next nine platforms combined. •27% of employees at companies with 11-50 employees used unsanctioned AI tools. •403 days was the median usage duration for CreativeX, and 401 days for System.com, showing shadow AI can remain embedded for over a year. •Breaches among organizations with high levels of shadow AI cost an extra $670,000 according to the report’s cited breach-cost reference. Top 3-5 Exploitable Technology Risks •Unsanctioned AI applications lacking fundamental controls such as multi-factor authentication, single sign-on, audit logging, encryption, compliance attestations, or clear data retention policies. •AI tools connected to business systems such as email, cloud storage, CRM, Box, HubSpot, and Google Drive, creating unmonitored data flows. •High-risk F-rated applications identified by the report: Jivrus Technologies, Happytalk, and Stability AI. |
| Reco | 2025 | Threat Intelligence Vendor |
| 605 | Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software | Bottom Line Up Front (BLUF) CISA’s central message is that software should be secure by design and secure by default, so customers are not forced to carry the full burden of hardening, monitoring, patching, and recovering from insecure products. For SMBs and insurance teams, this means software vendor selection, procurement questions, and default security controls should be treated as core risk-management issues, not just IT preferences. Top 3-5 Most Notable Statistics •No strong statistics identified in the report. Top 3-5 Exploitable Technology Risks •Default passwords: Products shipped with shared default passwords can leave systems exposed unless administrators change them during installation. •Administrator accounts without MFA: The report highlights that many enterprise deployments are managed by administrators who have not protected accounts with multifactor authentication, making privileged accounts high-value targets. •Insecure default configurations: Products that require customers to find and apply hardening guides can leave organizations operating in an insecure posture, especially when guidance is hard to find, complex, or assumes advanced cybersecurity knowledge. •Insufficient security logging: Products that do not generate useful security logs by default can slow incident response and increase uncertainty during suspected or confirmed security incidents. •Memory-unsafe software defects: The report identifies memory safety as a major class of vulnerability and encourages manufacturers to adopt memory-safe programming languages where possible. Key Business Impact for SMBs For SMBs, the report’s message is practical: many organizations do not have the time, budget, or specialist staff to securely configure every product after purchase. When security features are not enabled by default, cost extra, or require complex hardening, SMBs may remain exposed to preventable compromise. The report also emphasizes that relying on customers to constantly monitor, update, configure, and recover from insecure products does not scale, especially in resource-constrained environments. SMBs should therefore favor products that are secure out of the box, include important security controls without added charge, and clearly warn when users choose weaker settings. |
| CISA | 2023 | Government / Intelligence Agency |
| 606 | SilentPush Threat Actor Study 2025 | Bottom Line Up Front (BLUF) Silent Push’s 2025 Threat Actor Study shows that financially motivated attackers and state-backed groups are scaling phishing, malware, credential theft, and fraud through more resilient infrastructure and AI-enabled tactics. For SMBs and insurance teams, the key takeaway is that attackers are increasingly preparing infrastructure before attacks launch, making proactive detection and rapid disruption more important than waiting for confirmed compromise. Top 3-5 Most Notable Statistics •Silent Push tracked over 5,000 FIN7 domains in 2024. •Scattered Spider used new techniques to target over 130 organizations and Silent Push discovered 350+ new high-confidence indicators tied to the group. •Triad Nexus activity included 200,000 unique hostnames proxied through FUNNULL, with a 95%+ domain generation algorithm ratio. •Polyfill JavaScript library exploits affected more than 110,000 of the top websites on the internet. •During one week of NiceNIC analysis, about 1,000 domains used Cloudflare proxying within the first 48 hours of creation, representing about 68% of observed infrastructure registered through that service. Top 3-5 Exploitable Technology Risks •Phishing infrastructure impersonating help desks, single sign-on, VPN, Okta, Microsoft 365, crypto platforms, retail brands, and financial services to steal credentials and data. •Cloudflare proxying and “infrastructure laundering,” where attackers hide malicious infrastructure behind mainstream providers to make detection and takedown harder. •Bulletproof registrars and hosting services, including NiceNIC and BitLaunch, used to register or host phishing, malware command-and-control, crypto scams, and underground market infrastructure. |
| Silent Push | 2025 | Threat Intelligence Vendor |
| 607 | SlashNext The State of Phishing Report 2023 | Bottom Line Up Front (BLUF) SlashNext reports a sharp rise in phishing, driven by generative AI, business email compromise, credential theft, and attacks moving beyond email into mobile and collaboration channels. For SMBs and insurance teams, the core concern is that common business workflows—payroll, invoices, executive requests, text alerts, and login prompts—are increasingly being abused to create fraud, data theft, ransomware access, and claims exposure. Top 3-5 Most Notable Statistics •1,265% increase in malicious phishing emails from Q4 2022 to Q3 2023. •967% increase in credential phishing over the same period. •68% of all phishing emails used text-based business email compromise tactics. •39% of mobile threats consisted of Smishing, or SMS phishing. •46% of surveyed cybersecurity professionals reported receiving a BEC attack. Top 3-5 Exploitable Technology Risks •Generative AI-enabled phishing: Attackers use chatbots and jailbreak prompts to create more persuasive, targeted phishing and BEC messages at scale. •Credential phishing across email, mobile, social, and collaboration tools: Stolen logins remain a major access point for breaches and ransomware activity. •Trusted service abuse: Attackers host phishing and malware on legitimate infrastructure such as Microsoft SharePoint, AWS, Salesforce, and other trusted services to evade reputation-based detection. |
| SlashNext | 2023 | Threat Intelligence Vendor |
| 608 | SMB Threat Report 2023 | Bottom Line Up Front (BLUF) Huntress reports that SMB attacks in Q3 2023 increasingly relied on “malware-free” methods, legitimate remote access tools, and stolen or abused identities rather than obvious malicious files. For SMBs and insurance teams, the key takeaway is that traditional defenses such as anti-malware and spam filtering are no longer enough when attackers can blend into normal administration activity and cloud-based business workflows. Top 3-5 Most Notable Statistics •56% of recorded incidents in Q3 2023 were effectively “malware free.” •65% of incidents involved threat actors using remote monitoring and management software for persistence or remote access. •40% of incidents responded to by Huntress analysts were categorized as “high” or “critical” severity. •64% of observed Microsoft 365 incidents involved suspicious inbox rules or suspicious forwarding activity. •60% of observed ransomware incidents came from uncategorized, unknown, or “defunct” ransomware strains. Top 3-5 Exploitable Technology Risks •Remote monitoring and management tools, including ConnectWise ScreenConnect, AnyDesk, NetSupport, and TeamViewer, were abused to maintain remote access and blend into legitimate IT activity. •Microsoft 365 identities and mailboxes were targeted through suspicious logons, malicious inbox rules, and forwarding changes tied to account takeover and business email compromise. •Built-in scripting and system tools such as PowerShell, WMI, scheduled tasks, and other “living off the land” techniques were used to avoid detection by file-based security tools. |
| Huntress | 2023 | MSP / MSSP / SOC Provider |
| 609 | SMB Threat Report 2025 | Bottom Line Up Front (BLUF) Guardz’s 2025 SMB threat report shows that small and medium-sized businesses remain active targets because attackers see valuable data, weaker defenses, and limited incident response capacity. The most important risk theme is identity-driven compromise: stolen credentials, cloud account abuse, phishing, and token theft are enabling stealthy access that can lead to ransomware, data theft, financial fraud, and operational downtime. Top 3-5 Most Notable Statistics •Malware was the largest detection category, with 5,476 detections, representing 82.1% of classified detections. •Ransomware accounted for 556 detections, while cryptominer activity appeared in 164 detections and infostealers in 79 cases. •More than 80% of breaches involved compromised credentials. •Exchange Online attack attempts included phishing at 1,876, Business Email Compromise at 1,423, credential harvesting at 1,247, AI-enhanced attacks at 893, and supply chain compromise at 682. •Outlook/Exchange represented 41% of Microsoft 365 attacks, followed by SharePoint at 20.5%, Teams at 17.5%, OneDrive at 12.4%, and Power Apps at 8.6%. Top 3-5 Exploitable Technology Risks •Stolen credentials and weak identity controls, especially where multi-factor authentication is not enforced. •Session hijacking and token theft, which can let attackers impersonate authenticated users and bypass traditional login protections. •Microsoft 365 and cloud application abuse, including attacks against Outlook/Exchange, SharePoint, Teams, OneDrive, OAuth app consent, and legacy authentication. |
| Guardz | 2025 | MSP / MSSP / SOC Provider |
| 610 | SOC 2023 | Bottom Line Up Front (BLUF) Tines’ SOC 2023 report shows that security teams are highly engaged but under strain from burnout, manual work, fragmented tools, and growing workloads. For SMBs and insurance teams, the key takeaway is that security outcomes may depend less on intent and more on whether teams have enough time, tooling, and automation to detect, investigate, and respond effectively. Top 3-5 Most Notable Statistics •63% of security professionals report some level of burnout at work. •81% say their workloads increased over the past year. •50% say their SOC team is understaffed. •55% say they are likely to switch jobs in the next 12 months. •93% believe automation at work would improve their work-life balance. Top 3-5 Exploitable Technology Risks •Poor visibility into the environment, which can limit a team’s ability to identify threats quickly. •Too many alerts and high false positive rates, which can slow investigation and make real incidents harder to prioritize. •Slow or delayed log file ingestion and processing, which can increase the time it takes to detect and respond to incidents. |
| Tines | 2023 | Compliance / GRC Vendor |
| 611 | Software Supply Chain Security Report 2024 | Bottom Line Up Front (BLUF) Software supply chain attacks became easier and more common in 2023, affecting proprietary, commercial, and open-source software. For SMBs and insurance teams, the key issue is that trusted software, vendor updates, developer tools, and open-source packages can contain hidden malicious code, leaked credentials, or tampering that traditional security checks may miss. Top 3-5 Most Notable Statistics •ReversingLabs detected more than 11,000 malicious packages across npm, PyPI, and RubyGems in 2023. •Malicious package detections increased 28% over 2022, when slightly more than 8,700 were detected. •ReversingLabs detected a more than 1,300% increase in threats circulating through open-source package repositories between 2020 and 2023. •PyPI threats increased 400% in 2023, with more than 7,000 malicious PyPI package instances detected in the first nine months of the year. •npm accounted for 77% of the more than 40,000 secrets detected across npm, PyPI, RubyGems, and NuGet. Top 3-5 Exploitable Technology Risks •Malicious open-source packages on npm, PyPI, RubyGems, and NuGet that can steal information, download additional malware, or support phishing campaigns. •Typosquatting attacks, where malicious packages use names similar to legitimate packages to trick developers into installing them. •Obfuscated, encrypted, or compiled code that makes malicious functionality harder for conventional application security tools to detect. |
| ReversingLabs | 2024 | Research Organization |
| 612 | Software Supply Chain Security Report 2026 | Bottom Line Up Front (BLUF) Software supply chains became a primary attack surface in 2025, with attackers abusing trusted open-source packages, maintainer accounts, developer tools, and automation to spread malware at scale. For SMBs and insurance teams, the key takeaway is that routine software updates and third-party components can now create serious security exposure if they are trusted by default. Top 3-5 Most Notable Statistics •Malicious open-source package detections increased by 73% in 2025. •npm malware detections more than doubled, rising from 5,290 in 2024 to 10,819 in 2025. •npm accounted for nearly 90% of all open-source malware detected by ReversingLabs in 2025. •Exposed developer secrets rose 11% across major repositories, with PyPI and npm accounting for about 95% of detected leaks. •The Shai-hulud worm compromised close to 1,000 npm packages and exposed roughly 400,000 raw secrets in its second wave. Top 3-5 Exploitable Technology Risks •Compromised npm packages and maintainer accounts, which can turn normal dependency updates into malware delivery. •CI/CD and developer automation abuse, including dependency confusion, GitHub Actions manipulation, and automated pull requests that spread tainted packages. •Exposed developer secrets, including tokens, credentials, and private repository content that attackers can use for deeper compromise. |
| ReversingLabs | 2026 | Research Organization |
| 613 | Software Under Siege 2025 | Bottom Line Up Front (BLUF) Application and API attacks are now a major front line for cyber risk, with the average application facing confirmed, viable attacks every month while also carrying serious exploitable vulnerabilities. For SMBs and insurance teams, the key issue is speed: attackers can exploit weaknesses far faster than many organizations can detect, patch, or contain them. Top 3-5 Most Notable Statistics •The average application is exposed to 81 confirmed, viable attacks per month. •Applications see more than 10,000 probes and unsuccessful attack attempts per month, with total observed attack activity averaging 14,250 attacks per application per month. •The average application contains 109 vulnerability findings, including nearly 30 High or Critical vulnerabilities. •Attackers exploit newly disclosed vulnerabilities in an average of 5 days, while critical application vulnerabilities take an average of 84 days to remediate. •The average application sees more than 17 new vulnerabilities each month, while teams remediate about 6 vulnerabilities per application per month. Top 3-5 Exploitable Technology Risks •Method tampering: attackers manipulate HTTP methods to bypass authentication or authorization controls, potentially enabling unauthorized actions. •Untrusted deserialization: attackers submit malicious serialized objects that can trigger remote code execution, privilege escalation, or service disruption. •OGNL injection: identified among the most prevalent viable application-layer attacks in the report. |
| Contrast | 2025 | Application / API Security Vendor |
| 614 | Software Vulnerability Snapshot 2022: The 10 Most Common Web Application Vulnerabilities | Bottom Line Up Front (BLUF) Synopsys found that web and mobile applications commonly contain exploitable weaknesses, with vulnerabilities discovered in nearly all tested targets. For SMBs and insurance teams, the key takeaway is that application risk is not limited to large enterprises: any business using customer-facing web apps, mobile apps, third-party software, or open source components needs practical testing and remediation controls. Top 3-5 Most Notable Statistics •95% of 4,398 Synopsys application security tests uncovered some form of vulnerability. •25% of tests found high- or critical-risk vulnerabilities. •82% of total test targets had weak SSL/TLS configuration, the most common vulnerability identified. •78% of the 30,731 vulnerabilities discovered mapped to an OWASP Top 10 category. •Web application exploits accounted for 32% of attacks in the Forrester data cited by the report, making them the third-most-common attack type listed. Top 3-5 Exploitable Technology Risks •Weak SSL/TLS configuration: applications often failed to properly protect sensitive network traffic, creating exposure for data and session interception risks. •Cross-site scripting: found in 22% of total test targets and identified as a high-risk vulnerability that can give attackers an entry point into applications. •SQL injection and blind SQL injection: identified as the top critical-risk vulnerability category in the testing data. |
| Synopsys | 2022 | Threat Intelligence Vendor |
| 615 | SonicWall Cyber Threat Report 2022 | Bottom Line Up Front (BLUF) SonicWall’s 2022 report shows ransomware as the dominant business risk, with attacks more than doubling in 2021 and increasingly using data theft and extortion pressure. For SMBs and insurance teams, the key takeaway is that basic control failures, especially weak passwords, lack of multi-factor authentication, unpatched systems, and email-based deception, remain central to costly incidents. Top 3-5 Most Notable Statistics •Ransomware reached 623.3 million attacks globally in 2021, a 105% increase over 2020. •Cryptojacking rose to 97.1 million attacks, up 19%, the highest SonicWall had recorded in a single year. •Encrypted threats increased by 167% year over year. •Business Email Compromise caused reported losses of roughly $1.8 billion in 2020, according to FBI data cited in the report. •SonicWall identified 442,151 never-before-seen malware variants in 2021, a 65% increase year over year. Top 3-5 Exploitable Technology Risks •Unpatched vulnerabilities, including Log4j and other CVEs, can expose organizations to malware, credential theft, and legal consequences when reasonable mitigation is not taken. •Weak, reused, or compromised passwords and missing multi-factor authentication were highlighted in major incidents such as Colonial Pipeline, JBS, and NEW Cooperative. •Business Email Compromise relies on impersonation, fraudulent invoices, payroll diversion, and executive-style requests, often without malware or malicious links. |
| SonicWall | 2022 | Network Security Vendor |
| 616 | SonicWall Cyber Threat Report 2023 | Bottom Line Up Front (BLUF) SonicWall’s 2023 report shows a threat landscape shifting rather than easing: ransomware declined globally, but malware, cryptojacking, IoT malware, and intrusion attempts rose. For SMBs and insurance teams, the key takeaway is that attackers are adapting toward quieter, harder-to-detect methods while ransomware and extortion remain serious loss drivers. Top 3-5 Most Notable Statistics •Malware rose to 5.5 billion attacks, a 2% year-over-year increase and the first increase since 2018. •Ransomware fell to 493.3 million attacks, down 21%, but remained above levels seen in 2017, 2018, 2019, or 2020. •Cryptojacking reached a record 139.3 million attempts, up 43%. •IoT malware jumped to 112.3 million attacks, an 87% year-over-year increase. •Overall intrusion attempts hit 6.3 trillion, up 19%, while malicious intrusion attempts fell to 10.6 billion, down 10%. Top 3-5 Exploitable Technology Risks •Log4j and Log4Shell exposure remained a major risk because many organizations lack visibility into where Log4j exists across applications, dependencies, and new assets. •Unpatched VMware Horizon and other publicly exposed systems were exploited for initial access, credential compromise, cryptomining, persistence, and lateral movement. •Exposed Redis servers are risky because authentication is not enabled by default and attackers can compromise them for cryptojacking. |
| SonicWall | 2023 | Network Security Vendor |
| 617 | SonicWall Cyber Threat Report 2024 | Bottom Line Up Front (BLUF) SonicWall reports that cyberattack volumes rose across most major categories in 2023, with SMB-relevant threats including malware, intrusions, encrypted attacks, cryptojacking, phishing, and ransomware remaining significant. For SMB owners and insurance teams, the key takeaway is that smaller organizations should expect to be targeted and should prioritize basic controls that reduce common entry points, especially MFA, patching, employee training, encrypted traffic inspection, and cloud protection. Top 3-5 Most Notable Statistics •6.06 billion malware attacks were recorded in 2023, an 11% year-over-year increase and the highest global malware volume since 2019. •7.6 trillion intrusion attempts were recorded in 2023, up 20% from 2022; malicious intrusions reached 11.3 billion, up 6%. •15.7 million encrypted attacks were observed, a 117% year-over-year increase and the highest level SonicWall has reported for this metric. •1.06 billion cryptojacking hits were recorded, a 659% increase over 2022. •317.6 million ransomware attacks were recorded, down 36% year over year but still the third-highest annual total on record. Top 3-5 Exploitable Technology Risks •Unpatched software and appliances: SonicWall states that most exploit attempts target vulnerabilities that are months or years old, giving attackers an entry point when patching lags. •Encrypted traffic over HTTPS/TLS: attackers increasingly use encryption to hide malware, ransomware, zero-day attacks, and other threats from controls that cannot inspect encrypted traffic. •Malicious PDFs and QR-code phishing: PDFs were increasingly used to deliver malicious URLs, QR codes, fake login pages, and brand impersonation. |
| SonicWall | 2024 | Network Security Vendor |
| 618 | SonicWall Cyber Threat Report 2025 | Bottom Line Up Front (BLUF) SonicWall’s 2025 report shows attackers are moving fast, exploiting public vulnerabilities within days and using ransomware, business email compromise, IoT attacks, and AI-assisted techniques to increase impact. For SMBs and insurance teams, the main takeaway is that delayed patching, weak credentials, unmanaged devices, and poor recovery planning can quickly turn common security gaps into costly downtime, ransom events, and claims. Top 3-5 Most Notable Statistics •61% of the time, hackers leveraged new exploit code within 48 hours. •SonicWall sensors defended against more than 6 billion critical network attacks for the third consecutive year. •The average ransomware payment in 2024 was $850,700, while total related losses often exceeded $4.91 million when downtime and recovery were included. •IoT attacks rose 124%, and encrypted threats rose 93% globally. •Business email compromise accounted for 33% of reported cyber insurance events, up from 9% year over year. Top 3-5 Exploitable Technology Risks •Publicly disclosed vulnerabilities in Microsoft Exchange, IoT devices, third-party software, MOVEit-like file transfer products, and JetBrains TeamCity were exploited rapidly after proof-of-concept disclosure. •Unpatched and internet-facing systems, including a Windows-based check-in kiosk, enabled initial access, lateral movement, and persistence. •Living Off the Land Binaries such as schtasks.exe, cmd.exe, and powershell.exe were abused to evade detection, move laterally, hunt credentials, and disable defenses. |
| SonicWall | 2025 | Network Security Vendor |
| 619 | SpyCloud Identity Threat Report 2025 | Bottom Line Up Front (BLUF) Identity is now the central attack surface: stolen credentials, session tokens, phishing data, and malware-exposed identity records are enabling ransomware, account takeover, and follow-on attacks. For SMBs and insurance teams, the key issue is not only whether security tools exist, but whether exposed identities are found, remediated, and shut down quickly enough to prevent business disruption. Top 3-5 Most Notable Statistics •85% of organizations were affected by ransomware incidents in the past year, and 31% were affected 6-10 times. •56% of surveyed organizations reported ransomware-related cumulative costs exceeding $1 million. •Only 41% of organizations consistently revoke or reset credentials after a phishing attack. •Only 54% routinely reset passwords after malware infections, and just 33% invalidate exposed user sessions. •92% of organizations agree that AI-powered cybercrime has intensified risk, while only 47% currently use AI tools in their security stack. Top 3-5 Exploitable Technology Risks •Phishing and social engineering, including phishing-as-a-service platforms that steal credentials, MFA tokens, and session cookies. •Infostealer malware on managed and unmanaged devices, which can collect credentials, financial data, session tokens, password vaults, and 2FA secrets. •Stolen cookies and tokens that enable session hijacking and can bypass MFA until sessions are invalidated. |
| SpyCloud | 2025 | Threat Intelligence Vendor |
| 620 | State of Agentic AI Cyber Risk Report 2026 | Bottom Line Up Front (BLUF) Apono’s survey shows that security leaders see agentic AI as a high-impact cyber risk before most organizations have experienced real incidents. For SMBs and insurance teams, the key issue is not that AI creates entirely new security problems, but that autonomous systems can amplify existing weaknesses in identity, access, visibility, and control. Top 3-5 Most Notable Statistics •100% of respondents agreed that attacks targeting agentic workflows would cause greater damage than traditional cyber tactics. •98% said they have not experienced or observed an incident involving AI agents or autonomous workflows. •57% reported limited use of agentic AI in specific workflows, while 42% are still in testing or prototype phases. •99% expect agentic-workflow attacks to be harder to detect and contain than traditional attacks. •Only 21% said their organization is prepared to manage attacks involving agentic AI or autonomous workflows. Top 3-5 Exploitable Technology Risks •Agentic AI or autonomous workflow attacks, where compromised systems could move data, execute tasks, or trigger workflows at scale. •Weak identity governance, especially where organizations lack clear control over who or what can access sensitive resources. •Overprivileged access, which becomes more dangerous when autonomous systems can act at machine speed. |
| Apono | 2026 | Identity Security Vendor |
| 621 | State of Agentic AI in Pentesting 2026 | Bottom Line Up Front (BLUF) Agentic AI is becoming a major part of penetration testing because organizations cannot manually test enough of their attack surface. For SMBs and insurance teams, the key takeaway is that testing coverage, speed, oversight, and governance are becoming central indicators of cyber risk management maturity. Top 3-5 Most Notable Statistics •95% of organizations rank penetration testing as a top or high priority, but on average they test only 32% of their attack surface. •87% of organizations have moved beyond evaluating agentic AI and are planning a pilot, testing it, or have already integrated it into pentesting. •91% of organizations using agentic AI report that it has allowed them to conduct pentesting more regularly. •87% of organizations using agentic AI report that it has made it easier to test a higher percentage of their global attack surface. •64% of organizations identify an agent-led, human-oversight model as their preferred operating approach. Top 3-5 Exploitable Technology Risks •Untested attack surface: the report states that organizations are leaving an average 68% of their environment untested, creating blind spots adversaries can exploit. •Cloud-native applications: 59% of respondents identify these as a top pentesting priority because they are distributed, containerized, and rapidly changing. •AI systems: 57% of respondents prioritize testing AI systems themselves, recognizing that AI deployments also need to be hardened against attack. |
| Synack | 2026 | Threat Intelligence Vendor |
| 622 | State of Agentic AI Security Report 2025 | Bottom Line Up Front (BLUF) Agentic AI is becoming a new security surface because agents can call tools, access data, use APIs, authenticate into systems, and trigger actions across business workflows. The report’s central warning for SMBs and insurance teams is that adoption is moving faster than inventory, governance, monitoring, and runtime controls, creating hard-to-see exposure before many organizations are prepared to manage it. Top 3-5 Most Notable Statistics •69% of organizations are already piloting or running early production agent deployments. •79% of respondents operate with partial, outdated, or nonexistent visibility into agents and MCP connections. •21% maintain a complete, up-to-date inventory of AI agents and MCP integrations. •79% of organizations do not have a security and governance policy for AI agents and MCPs. •60% have not conducted a formal AI or agentic risk assessment in the last 12 months. Top 3-5 Exploitable Technology Risks •Supply chain risk from LLM plug-ins, agents, and MCP integrations, where compromised or unvetted integrations can redirect agents, steal data, or trigger unsafe actions. •Data leakage or unauthorized exposure through agent outputs, logs, cross-agent workflows, or unclear data lineage. •Prompt injection or manipulation attacks that steer agents into unsafe actions, unauthorized tool calls, or altered logic. |
| Akto | 2025 | Application / API Security Vendor |
| 623 | State of AI Cybersecurity 2025 | Bottom Line Up Front (BLUF) AI-powered cyber threats are already affecting organizations, especially through more convincing social engineering and attacks that move faster and at greater scale. For SMBs and insurance teams, the key takeaway is that traditional defenses and understaffed security teams may not be enough; risk reduction now depends on clear AI governance, better tool integration, stronger user controls, and practical use of defensive AI. Top 3-5 Most Notable Statistics •78% of CISOs believe AI is having an impact on cyber threats today. •45% of surveyed cybersecurity professionals believe their organizations are not adequately prepared for AI-powered threats. •74% of participants agree that AI-powered threats now pose a significant challenge for their organization. •95% agree that AI-powered cybersecurity solutions can significantly improve the speed and efficiency of their defenses. •56% of participants did not know exactly which types of AI were being used in their cybersecurity solutions. Top 3-5 Exploitable Technology Risks •AI-powered social engineering attacks, including more targeted and convincing malicious emails that can bypass conventional email security tools. •Faster, larger-scale attacks enabled by easy access to AI, allowing less capable threat actors to deliver more advanced attacks. •Attacks targeting AI systems themselves, including machine learning models, training data, APIs, and interfaces. |
| Darktrace | 2025 | Network Security Vendor |
| 624 | State of AI Data Security Report 2025 | Bottom Line Up Front (BLUF) AI use has moved faster than AI security controls: most organizations already use AI, but few can see, govern, or block risky AI activity. For SMBs and insurance teams, the key concern is sensitive business data entering AI tools, agents, or prompts without adequate visibility, access control, or enforcement. Top 3-5 Most Notable Statistics •83% of organizations already use AI in some capacity, but only 13% report good or full visibility into AI usage. •57% lack the ability to block or restrict risky AI activities. •76% say autonomous AI agents are the hardest AI interaction type to secure, and 70% cite external prompts to public large language models. •66% have identified AI tools accessing more data than necessary. •Only 7% have a dedicated AI governance committee, and only 11% consider themselves fully prepared for AI data governance regulation. Top 3-5 Exploitable Technology Risks •Autonomous AI agents performing actions beyond intended scope, creating risk of excessive access or unauthorized activity. •External prompts to public AI tools, where sensitive information may be entered into systems outside normal enterprise control. •Prompt injection, where crafted inputs can manipulate AI systems into exposing data or behaving unexpectedly. |
| Cyera | 2025 | Compliance / GRC Vendor |
| 625 | State of AI in Cybersecurity Report 2025 | Bottom Line Up Front (BLUF) AI is improving cybersecurity operations, especially threat prioritization, SOC efficiency, and response speed, but organizations still struggle with legacy systems, complexity, privacy, and vendor validation. For SMBs and insurance teams, the key takeaway is that AI can strengthen detection and response, but only when paired with clear governance, skilled oversight, and practical integration into existing security workflows. Top 3-5 Most Notable Statistics •70% of respondents say it is difficult to integrate AI-based security technologies with legacy systems. •51% of respondents say their organization had at least one cyberattack in the past 12 months, up from 45% in 2024. •Only 42% say their organizations are very or highly effective at mitigating risks, vulnerabilities, and attacks across the enterprise. •53% of organizations have reached full adoption or mature stages of AI use in cybersecurity, up from 47% in 2024. •48% say AI makes compliance with privacy and security mandates highly difficult, and 53% say safeguarding confidential and personal data in AI is highly difficult. Top 3-5 Exploitable Technology Risks •Phishing and social engineering remain a primary security threat, giving attackers a direct path to deceive users and gain access. •Malicious insider attacks increased, highlighting the risk of trusted users misusing access or causing harm from inside the organization. •Credential theft remains a major attack type, creating risk when attackers obtain valid usernames and passwords. |
| MixMode | 2025 | SIEM / Security Analytics Vendor |
| 626 | State of AI in SecOps 2025 | Bottom Line Up Front (BLUF) Security teams are overwhelmed by alert volume, and the report shows that many organizations are knowingly leaving alerts uninvestigated or suppressing detection rules to keep up. For SMBs and insurance teams, the key issue is not whether security tools exist, but whether alerts are being reviewed fast enough to prevent data exposure, downtime, or operational disruption. Top 3-5 Most Notable Statistics •40% of alerts are never investigated on average. •61% of security teams reported ignoring an alert that later proved critical. •57% of organizations suppress detection rules due to limited triage and investigation capacity. •Average alert dwell time is about 56 minutes, while mean time to investigate is about 70 minutes. •55% of organizations currently use AI in some capacity for alert triage, investigation, or remediation. Top 3-5 Exploitable Technology Risks •Suppressed detection rules create blind spots attackers can exploit, especially when rules are disabled because teams lack capacity. •Cloud detection gaps are a major concern; 65% of respondents would enable more cloud detections if they had more resources. •Identity detection gaps are also prominent; 61% would enable more identity detections, increasing concern around credential abuse going unnoticed. |
| Prophet | 2025 | Threat Intelligence Vendor |
| 627 | State of AI in the Cloud 2024 | Bottom Line Up Front (BLUF) AI adoption in cloud environments is already widespread, with managed AI services present in over 70% of environments analyzed by Wiz. For SMBs and insurance teams, the main issue is not whether AI is being used, but whether the business has visibility, governance, cost control, and security ownership around rapidly expanding AI services and tools. Top 3-5 Most Notable Statistics •Over 70% of cloud environments use managed AI services. •Azure OpenAI instances grew by 228% over a 4-month period in 2023. •32% of organizations appear to still be experimenting, with fewer than 10 managed AI service instances. •53% of cloud environments use OpenAI or Azure OpenAI SDKs. •Self-hosted AI and ML software is found in nearly 69% of cloud environments. Top 3-5 Exploitable Technology Risks •Shadow AI: AI services or tools used without full security visibility or governance, creating blind spots in the cloud environment. •Rapid AI adoption without established standards or controls, which can leave security teams unable to keep pace with new risks. •Accidental exposure of AI-related data, highlighted by the report’s example of Microsoft’s accidental exposure of 38 terabytes of AI data. |
| Wiz | 2024 | Threat Intelligence Vendor |
| 628 | State of AI in the Cloud 2025 | Bottom Line Up Front (BLUF) AI is now widespread in cloud environments, with more than 85% of organizations using managed or self-hosted AI services or tools. For SMBs and insurance teams, the main takeaway is that AI adoption is moving faster than governance and security controls, creating risks around data exposure, unauthorized AI use, vulnerable AI infrastructure, and third-party AI tools. Top 3-5 Most Notable Statistics •85% of organizations are using some form of AI, either managed or self-hosted. •Managed AI service adoption increased from 70% of cloud environments in 2024 to 74% in 2025. •Use of self-hosted AI models rose from 42% last year to 75% in 2025. •67% of cloud environments are using OpenAI or Azure OpenAI SDKs, up from 53% last year. •DeepSeek adoption among organizations using self-hosted AI models more than doubled in January 2025, reaching roughly 7%, with approximately 4% using DeepSeek-R1. Top 3-5 Exploitable Technology Risks •NVIDIA GPU container vulnerability CVE-2024-0132: Wiz describes this as a critical NVIDIA AI vulnerability affecting containers using NVIDIA GPUs, including over 35% of cloud environments, and presenting a high level of risk to AI workloads. •SAP AI Core vulnerabilities: The report highlights vulnerabilities that could allow malicious actors to take over the service and access customer data, including private AI artifacts and cloud keys. •Ollama remote code execution: Wiz identifies an easy-to-exploit Remote Code Execution vulnerability in the open-source AI infrastructure project Ollama. |
| Wiz | 2025 | Threat Intelligence Vendor |
| 629 | State of AI Security 2026 | Bottom Line Up Front (BLUF) Cisco’s report argues that AI security has shifted from theoretical risk to active exploitation, especially as organizations adopt autonomous agents, Model Context Protocol connections, and third-party AI models faster than they can secure them. For SMBs and insurance teams, the key issue is that AI systems can now access data, run commands, interact with tools, and make decisions, creating new paths for data theft, credential exposure, and unauthorized business actions. Top 3-5 Most Notable Statistics •83 percent of surveyed organizations planned to deploy agentic AI capabilities, while only 29 percent felt ready to use them securely. •As few as 250 poisoned documents injected into training data can compromise LLM safety without degrading normal model performance. •26 percent of 31,000 analyzed agent skills contained at least one vulnerability. •A reported state-backed operation allegedly used AI agents to automate 80-90 percent of an attack chain. •Multi-turn jailbreak attacks against tested open-weight models reached a 92.78 percent attack success rate. Top 3-5 Exploitable Technology Risks •Prompt injection and jailbreaks: Attackers can manipulate AI prompts to bypass guardrails, extract proprietary information, or make agents perform unintended actions. •Agentic AI with excessive authority: Agents that can access databases, execute processes, push code, or interact with other systems can become high-speed attack paths if compromised or misconfigured. •Model Context Protocol exposure: MCP tools and servers can enable tool poisoning, remote code execution, sandbox escape, private message exfiltration, and credential theft when agents connect to malicious or vulnerable servers. |
| Cisco | 2026 | Network Security Vendor |
| 630 | State of AI Security Report 2024 | Bottom Line Up Front (BLUF) AI adoption in cloud environments is moving faster than security controls, and many organizations are accepting risky default settings. For SMBs and insurance teams, the main concern is not only AI-specific attacks, but familiar cloud risks—exposed keys, excessive privileges, weak network controls, unpatched packages, and insufficient encryption—now attached to powerful AI services and data. Top 3-5 Most Notable Statistics •56% of organizations have adopted AI models for custom applications. •62% of organizations have deployed an AI package with at least one CVE. •98% of organizations using Amazon SageMaker have not disabled root access for notebook instances. •77% of organizations using Amazon SageMaker have not configured IMDSv2 for notebook instances. •20% of organizations using OpenAI have at least one exposed OpenAI access key. Top 3-5 Exploitable Technology Risks •Exposed AI access keys in code repositories or commit history, which can allow unwanted access to AI services, models, code, and accounts. •Amazon SageMaker notebook instances with root access enabled by default, giving attackers broad control if they gain access. •Amazon SageMaker buckets using predictable default names, which can create risk of data leakage or manipulation. |
| Orca | 2024 | Cloud Security Vendor |
| 631 | State of AI: Bi-Annual Snapshot 2026 | Bottom Line Up Front (BLUF) ICONIQ’s 2026 AI snapshot shows that AI adoption has moved from experimentation to execution: software companies are now focused on scaling AI products, managing costs, proving value, and building trust. For SMBs and insurance teams, the key takeaway is that AI risk is increasingly operational—centered on data readiness, model reliability, agent permissions, governance, and measurable business impact. Top 3-5 Most Notable Statistics •Nearly 70% of surveyed companies are building vertical AI applications. •49% of teams cite application-layer innovation as their primary source of AI differentiation. •Companies use an average of 3.1 model providers, up from 2.8 six months earlier. •Only 52% of builders use automated evaluation frameworks or third-party tools to assess AI model performance and reliability. •Among customer-facing AI agents in infrastructure/developer tools, 63% have read, write, and delete permissions. Top 3-5 Exploitable Technology Risks •Customer-facing AI agents with read, write, and delete permissions create execution risk if workflows are not governed carefully. •Hallucination risk remains a key concern, with companies using human oversight, automated validation, monitoring, guardrails, data grounding, fine-tuning, and prompt optimization to reduce unreliable outputs. •Data foundations are often not fully ready to support accurate AI workflows, especially at larger companies, increasing the risk of poor outputs and unreliable automation. |
| ICONIQ | 2026 | Research Organization |
| 632 | State of API Exposure 2024 | Bottom Line Up Front (BLUF) Escape’s 2024 report shows that exposed APIs are a major security weakness, even among large organizations with significant resources. For SMBs and insurance teams, the key takeaway is clear: unmanaged, public-facing, development, legacy, or poorly secured APIs can expose sensitive data, credentials, and business systems to unauthorized access. Top 3-5 Most Notable Statistics •30,784 exposed API services were identified across Fortune 1000 and CAC 40 domains. •107,368 total API vulnerabilities were found, including 2,038 classified as highly critical. •3,945 publicly accessible development APIs were found, including 3,650 among Fortune 1000 companies. •1,816 sensitive secrets were found accessible through vulnerable APIs, including access tokens, API keys, and authentication credentials. •713 high-impact CVEs were identified, including older vulnerabilities that remain unpatched. Top 3-5 Exploitable Technology Risks •Publicly exposed development APIs that may lack production-level security controls and can reveal internal systems, configurations, and vulnerabilities. •Broken authentication and weak authorization, including Broken Object Level Authorization, which can allow unauthorized data access or privilege escalation. •Security misconfigurations, including exposed Spring Boot Actuator endpoints that can reveal environment variables, API routes, credentials, and operational details. |
| Escape | 2024 | Application / API Security Vendor |
| 633 | State of Application Risk 2025 | Bottom Line Up Front (BLUF) Legit Security’s 2025 report finds that application risk is widespread across modern software development environments, especially from exposed secrets, misconfigured pipelines, weak branch protections, excessive permissions, and software supply chain issues. For SMBs and insurance teams, the key takeaway is that losses may originate not only from vulnerable code, but from the broader “software factory” used to build, test, and deploy applications. Top 3-5 Most Notable Statistics •100% of organizations had high or critical application risks in their environments. •100% of organizations had exposed secrets, and 53% had exposed secrets in public assets. •89% of organizations had pipeline misconfiguration issues. •85% of organizations had least privilege violations, and 85% had stale collaborators. •78% of organizations had duplicate software composition analysis scanners, creating duplicated or conflicting findings. Top 3-5 Exploitable Technology Risks •Exposed secrets such as cloud keys, GitHub personal access tokens, CI/CD server keys, and personal information, which attackers can use as an initial foothold. •Pipeline misconfigurations in systems such as Jenkins and GitHub Actions, including build systems exposed to the Internet or having unnecessary access to cloud storage. •Weak branch protection, including allowing unsigned commits, missing required code review, unprotected default branches, and the ability to merge without full reviewer approval. |
| Legit Security | 2025 | Supply Chain Security Vendor |
| 634 | State of Application Security 2023 | Bottom Line Up Front (BLUF) Armorcode’s 2023 report shows that application security teams are struggling less with finding issues and more with prioritizing and managing them. For SMBs and insurance teams, the key concern is unmanaged application risk: vulnerabilities, cloud exposure, and software supply chain blind spots can remain unresolved because teams lack process, visibility, funding, or leadership support. Top 3-5 Most Notable Statistics •53% of teams have unmanaged risk in their application portfolio. •86% agree that security tools are interchangeable and that process is most important. •66% say shipping fast takes priority over shipping secure. •Over 50% of organizations are increasing security spend despite the global economic downturn. •Over 20% of respondents had no Software Bill of Materials usage at all. Top 3-5 Exploitable Technology Risks •Unmanaged application portfolio risk, where known issues may remain unresolved across business applications. •Vulnerabilities in production, especially critical vulnerabilities that are not remediated quickly. •Cloud application exposure, with more than half of respondents deploying 75% or more of applications in the cloud. |
| Armorcode | 2023 | Application / API Security Vendor |
| 635 | State of Application Security 2025 | Bottom Line Up Front (BLUF) Application security is a major operational and financial risk because many organizations are releasing insecure code, finding vulnerabilities too late, and lacking enough capacity to do core security work. For SMBs and insurance teams, the key takeaway is that application-layer weaknesses can create breach, downtime, customer trust, and claims exposure unless security is built earlier into development and supported with better monitoring and expert help. Top 3-5 Most Notable Statistics •62% of companies admit to shipping insecure code. •60% of respondents say security issues are more likely to delay product launches than feature bugs. •Nearly 43% believe their team would detect a breach within a week, while 54% estimate detection could take up to a month. •Only 51% report that OWASP Top 10 threats are fully addressed and actively monitored; 46% are still improving. •83% of respondents have considered outsourcing at least part of their application security program. Top 3-5 Exploitable Technology Risks •Insecure code released to meet deadlines, which can leave known weaknesses exposed in production applications. •Late security involvement in the software development life cycle, with many teams waiting until testing or deployment, increasing rework and leaving risks unresolved longer. •API and token exposure, including broken API permissions, internal API endpoints without proper authentication checks, and insecurely stored API tokens in mobile apps. |
| Cypress | 2025 | Media / Independent Research |
| 636 | State of Application Security Posture Management 2025 | Bottom Line Up Front (BLUF) Cycode’s 2025 survey shows that application security teams are struggling with a larger, faster-moving software attack surface driven by GenAI, rapid code growth, and too many disconnected security tools. For SMBs and insurance teams, the key issue is not simply whether more security tools are in place, but whether the business has clear visibility, prioritization, and ownership for fixing the risks that matter most. Top 3-5 Most Notable Statistics •59% of security professionals agree that today’s attack surface is unmanageable. •70% say GenAI has made existing visibility challenges worse. •Organizations use an average of 50 security tools across security and development teams. •77% admit their organization lacks a full understanding of where the annual security budget is being spent. •66% say managing too many alerts is challenging, and 65% struggle to know what vulnerabilities to fix. Top 3-5 Exploitable Technology Risks •GenAI-driven code growth: GenAI is increasing code volume and visibility challenges, while bad actors are also using the same technology to conduct more sophisticated, large-scale attacks faster. •Expanding code attack surface: The report identifies exponential code growth as a major blindspot, making it harder for teams to maintain visibility and respond effectively. •Software supply chain security: Ranked as a top application security concern and blindspot, especially as modern applications depend on complex development pipelines and external components. |
| Cycode | 2025 | Application / API Security Vendor |
| 637 | State of Apps and API Security 2025 | Bottom Line Up Front (BLUF) Akamai’s 2025 report shows that web applications and APIs are now major attack targets, with attackers using automation and AI to find weaknesses faster and abuse exposed services at scale. For SMBs and insurance teams, the key takeaway is that API visibility, authentication, rate limiting, and monitoring are no longer optional controls; they directly affect breach, downtime, fraud, and compliance risk. Top 3-5 Most Notable Statistics •Akamai observed more than 311 billion web application and API attacks in 2024, a 33% year-over-year increase. •Akamai documented more than 150 billion API attacks from January 2023 through December 2024. •OWASP API Security Top 10–related incidents increased by 32% during the report’s 30-day sample period. •More than 83 billion API request constraint violation attacks were recorded over two years, with a 24% increase from 2023 to 2024. •Quarterly Layer 7 DDoS attacks grew by 94% between Q1 2023 and Q4 2024. Top 3-5 Exploitable Technology Risks •Externally accessible AI-powered APIs with inadequate authentication, which can expose sensitive data and functions. •Broken API authorization and authentication issues, including Broken Object Level Authorization, Broken Object Property Level Authorization, and Broken Function Level Authorization. •Shadow and zombie APIs, which are unmanaged or outdated interfaces that may remain active without proper oversight. |
| Akamai | 2025 | Network Security Vendor |
| 638 | State of Attacks 2026 | Bottom Line Up Front (BLUF) Fluid Attacks’ 2026 report shows that serious application and infrastructure risk remains common even as remediation is improving. For SMBs and insurance teams, the main takeaway is that the highest business risk is concentrated in a small share of high- and critical-severity vulnerabilities, especially authentication, authorization, validation, and cloud access weaknesses. Top 3-5 Most Notable Statistics •70% of assessed systems had at least one high- or critical-severity vulnerability, up from 53.3% in 2024. •High- and critical-severity vulnerabilities made up only 4.5% of all vulnerabilities but accounted for 79.9% of total risk exposure. •The overall vulnerability remediation rate reached 62.2% by the end of 2025, a 21.2 percentage point increase over 2024. •Automated tools identified 88.4% of vulnerabilities, but manual review found 87% of critical-severity vulnerabilities. •Systems using Fluid Attacks’ CI Gate achieved a 72.2% remediation rate, compared with 58% for systems that did not use it. Top 3-5 Exploitable Technology Risks •Authentication mechanism absence or evasion: the top weakness by risk exposure, creating unauthorized access paths. •Improper authorization control for web services: a common high-risk weakness affecting access control in web services. •Lack of data validation: the most widespread weakness by percentage of systems and a driver of injection-related attacks. |
| Fluid Attacks | 2026 | Application / API Security Vendor |
| 639 | State of Backup and Recovery Report 2025 | Bottom Line Up Front (BLUF) Unitrends’ 2025 survey shows that many organizations are expanding into cloud and SaaS faster than their backup and recovery practices can reliably support. For SMBs and insurance teams, the core issue is not whether backups exist, but whether they are secured, tested, monitored, and able to meet recovery expectations during an outage or cyber event. Top 3-5 Most Notable Statistics •3,051 IT professionals, security experts, and administrators were surveyed worldwide. •54% of workloads and applications currently run in the public cloud, expected to rise to over 60% in the next 24 months. •Only about 40% of respondents trust their backup and recovery solution to protect critical data in a crisis. •More than 60% believed they could recover in under a day, but only 35% actually could during downtime events. •34% cited accidental deletion as a top cause of SaaS data loss, followed by misconfiguration at 31%. Top 3-5 Exploitable Technology Risks •Native cloud backup tools without full disaster recovery: 60% of Azure VM native backup setups lacked true disaster recovery capabilities. •Weak SaaS backup assumptions: 19% rely solely on vendor availability, and 7% said SaaS backup is not required. •Missed backup visibility gaps: 19% would not know unless backups failed, 10% would not be informed at all, and 6% do not monitor missed backups. |
| Unitrends | 2025 | Backup & Recovery Vendor |
| 640 | State of Cloud Native Application Security 2021 | Bottom Line Up Front (BLUF) Cloud native adoption is now mainstream, but the report shows that the biggest security losses are still driven by preventable issues: misconfiguration and known unpatched vulnerabilities. For SMBs and insurance teams, the key takeaway is that automation and security testing across the development lifecycle can materially improve visibility and speed of remediation. Top 3-5 Most Notable Statistics •99% of respondents said security is important to their cloud native strategy, and 83% said it is very important. •Over 78% of production workloads are deployed as containers or serverless applications. •45% of respondents reported misconfiguration incidents, and 38% reported incidents involving known unpatched vulnerabilities. •Nearly 60% of respondents said security concerns increased after adopting cloud native technologies. •Over 72% of fully automated teams find and fix critical vulnerabilities in under one week. Top 3-5 Exploitable Technology Risks •Misconfigurations in cloud native environments, which were the most common reported incident type and the biggest area of increased concern. •Known unpatched vulnerabilities, which were the second most common incident type and remain directly exploitable when not remediated. •Secret leaks and exposed API tokens, because cloud native platforms rely heavily on credentials and decentralized access management. |
| Snyk | 2021 | Threat Intelligence Vendor |
| 641 | State of Cloud Native Security Report 2022 | Bottom Line Up Front (BLUF) Cloud adoption accelerated during the pandemic, but many organizations struggled to keep security, compliance, visibility, and automation aligned with that growth. For SMBs and insurance teams, the key takeaway is that cloud security success depends less on spend or team size and more on integrated security practices, automation, and clear governance across cloud environments. Top 3-5 Most Notable Statistics •Organizations expanded cloud use by more than 25% overall during the pandemic. •55% of organizations reported a weak cloud security posture. •Organizations with tightly integrated DevSecOps were over 7X more likely to have strong or very strong security posture and 9X more likely to have low security friction. •Organizations with high security automation were roughly 2X more likely to have low friction and strong security posture than those with low automation. •80% of organizations relying primarily on open source security tools had weak or very weak security posture. Top 3-5 Exploitable Technology Risks •Limited visibility across cloud accounts, services, providers, and resources, which can leave gaps in security oversight. •Misconfigurations in cloud environments, especially where remediation is manual rather than automated. •Lack of security automation across onboarding, alert ticketing, infrastructure-as-code scanning, container image scanning, and runtime protection. |
| Palo Alto Networks Unit 42 | 2022 | Network Security Vendor |
| 642 | State of Cloud Native Security Report 2024 | Bottom Line Up Front (BLUF) Cloud security is now a business risk issue, not just an IT issue. The report shows rising cloud incidents, expanding attack surfaces, tool complexity, and new AI-related risks that can lead to data breaches, downtime, compliance failures, and delayed software releases. Top 3-5 Most Notable Statistics •64% of organizations reported an increase in data breaches over the last 12 months. •48% reported increases in significant compliance violations, and 45% reported increased downtime due to misconfigurations. •Organizations use an average of 12 cloud service providers and 16 cloud security tools. •91% said point tools create blind spots that affect their ability to prioritize risk and prevent threats. •100% of respondents are embracing AI-assisted application development, while 47% have security risks associated with AI-generated code on their radar. Top 3-5 Exploitable Technology Risks •AI-generated code that can accelerate the spread of misconfigurations, vulnerabilities, and bugs into production. •Inadequate access management and overly permissive identities, which can expose sensitive systems and data. •Insecure APIs and unmanaged APIs, which expand the application attack surface. |
| Palo Alto Networks Unit 42 | 2024 | Network Security Vendor |
| 643 | State of Cloud Security 2020 | Bottom Line Up Front (BLUF) Sophos’ 2020 cloud security survey shows that public cloud environments were already a major source of cyber risk, with most surveyed organizations reporting a cloud security incident in the prior year. For SMBs and insurance teams, the key takeaway is that cloud losses are often tied to preventable issues: misconfigurations, weak access controls, exposed data, and insufficient visibility across cloud assets. Top 3-5 Most Notable Statistics •70% of surveyed organizations suffered a public cloud security breach in the last year. •96% of respondents were concerned about their current level of cloud security. •66% of attacks exploited security misconfigurations, while 33% involved stolen cloud provider account credentials. •73% of organizations used two or more public cloud providers, and multi-cloud organizations reported more security incidents than single-cloud organizations. •44% of respondents listed data loss or leakage as a top cloud security concern. Top 3-5 Exploitable Technology Risks •Misconfigured cloud resources, including route tables, storage services, databases, and other cloud services that can expose systems or data to the internet. •Misconfigured web application firewalls, cited as a factor in cloud compromise. •Stolen cloud provider account credentials, which allow attackers to access cloud accounts and services. |
| Sophos | 2020 | Endpoint / MDR / XDR Vendor |
| 644 | State of Cloud Security 2021 | Bottom Line Up Front (BLUF) Cloud misconfiguration is the central cloud security risk highlighted in this report, and it is often caused by human error, manual processes, limited visibility, and inconsistent controls. For SMBs and insurance teams, the key issue is speed: attackers can find exposed cloud resources within minutes, while many organizations still detect and remediate problems too slowly. Top 3-5 Most Notable Statistics •36% of respondents experienced a serious cloud data leak or breach in the past 12 months, and 83% were concerned their organization is at risk. •49% of teams experienced 50 or more cloud misconfigurations per day. •41% cited Identity and Access Management misconfiguration, making it the most commonly reported cloud misconfiguration. •Only 10% of teams remediated misconfigurations before attackers could find them; the report states attackers can typically detect a cloud misconfiguration within 10 minutes of deployment. •45% of respondents failed a cloud compliance audit, and 81% took a week or longer to address compliance issues after an audit. Top 3-5 Exploitable Technology Risks •Identity and Access Management misconfiguration, which can allow attackers to discover resources, move laterally, and access data for extraction. •Security group or firewall rule misconfiguration, including unrestricted SSH exposure, which attackers can scan for automatically. •Object storage access policy errors, such as misconfigured Amazon S3 or Azure Blob Storage access, which can expose sensitive data. |
| Sonatype | 2021 | Security Research Vendor |
| 645 | State of Cloud Security 2023 | Bottom Line Up Front (BLUF) Sonatype’s report shows that open source software supply chain risk remains a practical and growing security issue: vulnerable and malicious packages are being downloaded at large scale even when safer versions often exist. For SMBs and insurance teams, the key takeaway is that software risk is not only about new attacks; it is also about poor visibility, slow upgrades, unmanaged dependencies, and weak development practices. Top 3-5 Most Notable Statistics •1 in 8 open source downloads have known risk. •245,032 malicious packages were logged as of September 2023, meaning the number of malicious packages tripled in the last year. •96% of vulnerable downloaded releases had a fixed version available. •18.6% of open source projects across Java and JavaScript that were maintained in 2022 are no longer maintained today. •10% of surveyed organizations reported security breaches due to open source vulnerabilities in the last 12 months, while 20% were unsure. Top 3-5 Exploitable Technology Risks •Malicious open source packages designed to steal data, install harmful software, gain network control, or compromise systems. •Known vulnerable open source components where fixed versions are already available but not adopted. •Continued downloads of vulnerable Log4j versions, with vulnerable downloads still accounting for nearly a quarter of net new Log4j downloads. |
| Sonatype | 2023 | Security Research Vendor |
| 646 | State of Cloud Security 2024 | Bottom Line Up Front (BLUF) Sonatype’s report shows that open source software supply chain risk is now a core business risk because modern applications can be made up of as much as 90% open source code, while malicious packages and unpatched dependencies continue to grow. For SMBs and insurance teams, the key takeaway is that many risks are preventable through better dependency management, faster upgrades, SBOM use, and software composition analysis integrated into development workflows. Top 3-5 Most Notable Statistics •Open source downloads are estimated at over 6.6 trillion in 2024. •JavaScript npm requests are estimated at 4.5 trillion, with 70% year-over-year growth. •Python PyPI package requests are estimated at 530 billion, driven by AI and cloud adoption. •Sonatype logged 512,847 malicious packages since November 2023, a 156% year-over-year increase. •80% of application dependencies remain un-upgraded for over a year, even though about 95% of vulnerable versions have safer alternatives available. Top 3-5 Exploitable Technology Risks •Malicious open source packages that target developers and automated build environments, often bypassing traditional scanning tools. •Unpatched vulnerable dependencies, including persistent use of vulnerable Log4j versions years after Log4Shell was disclosed. •Dependency confusion and phishing-style packages that pretend to be internal packages and trick build automation into downloading malware. |
| Sonatype | 2024 | Security Research Vendor |
| 647 | State of Cloud Security 2025 | Bottom Line Up Front (BLUF) Cloud risk is increasingly driven by a combination of exposed assets, old vulnerabilities, excessive permissions, and sensitive data stored in cloud environments. For SMBs and insurance teams, the core issue is not just cloud adoption, but whether organizations can find and prioritize the few risks that create real paths to data theft, downtime, or broader compromise. Top 3-5 Most Notable Statistics •38% of organizations with sensitive data in their databases also have those databases exposed to the public. •82% of organizations have at least one unpatched web service. •85% of organizations have plaintext secrets embedded in source code repositories. •89% of organizations have at least one neglected cloud asset that is internet-facing. •93% of organizations using Kubernetes have an overprivileged Kubernetes service account. Top 3-5 Exploitable Technology Risks •Publicly exposed databases containing sensitive data, including PII, PHI, financial records, API keys, and secrets, create direct opportunities for unauthorized access and data theft. •Unpatched web services can be exploited to cause downtime, denial of service, unauthorized remote access, privilege escalation, lateral movement, persistence, and data exfiltration. •Plaintext secrets in source code repositories can let attackers access systems, exfiltrate data, make unauthorized API calls, or move deeper into infrastructure. |
| Orca | 2025 | Cloud Security Vendor |
| 648 | State of Cloud Security Report 2025 | Bottom Line Up Front (BLUF) Cloud security confidence is high, but the report shows major execution gaps in vulnerability management, compliance, automation, and tool coverage. For SMBs and insurance teams, the key takeaway is that cloud risk is less about whether businesses use the cloud and more about whether they can manage security consistently across increasingly complex hybrid and multi-cloud environments. Top 3-5 Most Notable Statistics •96% of security teams say they are confident in their cloud security. •64% of organizations operate in hybrid-cloud environments, and 55% operate in multi-cloud setups. •88% of organizations use open cloud security tools, and 86% report measurable security improvements from those tools. •Organizations using fully or highly automated cloud security processes save an average of 19 hours per week. •37% of organizations failed a compliance audit due to cloud security issues in the past 12 months. Top 3-5 Exploitable Technology Risks •Unauthorized cloud services bypassing security measures, cited by 79% of the teams that are not fully confident in their cloud security. •Incomplete tool coverage across cloud environments, with 71% of less-confident teams saying their current tools cannot cover all aspects of their cloud environment. •Ongoing vulnerability management gaps, despite regular assessments; organizations detect an average of 17 vulnerabilities per week, and 46% still struggle with vulnerability management. |
| Prowler | 2025 | Security Research Vendor |
| 649 | State of Cloud Security Report 2026 | Bottom Line Up Front (BLUF) Cloud security teams are not mainly struggling with a lack of alerts; they are struggling to understand which alerts actually matter and how to act on them quickly. For SMBs and insurance teams, the key takeaway is that cloud risk is increasingly driven by operational overload, weak visibility, excessive permissions, exposed services, and slow manual triage. Top 3-5 Most Notable Statistics •Security teams handle an average of 71 incidents per week, or more than 3,600 annually. •42% cite AI and cloud security talent gaps as a top operational challenge. •39% cite growing compliance complexity as a major burden. •Only 18% report having fully deployed autonomous AI systems at scale. •46% doubt autonomous AI systems, while 53% say AI solutions are too costly or complex. Top 3-5 Exploitable Technology Risks •Overly permissive IAM roles and policies, especially where excessive permissions can be chained with other weaknesses to reach sensitive resources. •Publicly exposed cloud storage, such as exposed S3 buckets, particularly when combined with weak access controls. •Internet-reachable compute resources, including EC2 instances in public subnets with security groups allowing inbound SSH from 0.0.0.0/0. |
| Prowler | 2026 | Security Research Vendor |
| 650 | State of Cloud-Native Security Report 2023 | Bottom Line Up Front (BLUF) Cloud adoption is expanding, but security teams are struggling to keep pace with faster development, complex cloud environments, and too many disconnected tools. For SMBs and insurance teams, the key takeaway is that cloud risk is not only about whether a business uses the cloud, but whether it can see, prioritize, and fix vulnerabilities before they become outages, breaches, or claims. Top 3-5 Most Notable Statistics •53% of cloud workloads are hosted on public clouds, an 8% increase in the past year. •77% of respondents deploy new or updated code to production weekly, and 38% commit new code daily. •90% of organizations cannot detect, contain, and resolve cyber threats within an hour. •76% of respondents say the number of cloud security tools they use creates blind spots, while 77% struggle to identify which tools are necessary. •39% reported an increase in breaches, 36% reported an increase in unplanned downtime, and 42% reported an increase in mean time to remediate. Top 3-5 Exploitable Technology Risks •Risks introduced early in application development, including known vulnerabilities, embedded malware, and sensitive data such as secrets or configuration data. •Workload images containing vulnerabilities or malware. •Vulnerable web applications and APIs. |
| Palo Alto Networks Unit 42 | 2023 | Network Security Vendor |
| 651 | State of Code Security 2025 | Bottom Line Up Front (BLUF) Wiz’s 2025 report shows that code repositories and CI/CD pipelines are a meaningful business risk because they often contain exposed secrets, broad permissions, and weak protections that can lead directly into cloud environments. For SMBs and insurance teams, the key takeaway is that software development systems should be treated as part of the production attack surface, not as isolated developer tools. Top 3-5 Most Notable Statistics •61% of organizations have secrets exposed in public repositories. •GitHub accounts for 81% of total repositories analyzed. •Public repositories make up about 35% of GitHub repositories, compared with less than 10% on other platforms. •Around 80% of GitHub repository workflow permissions are configured insecurely. •About 35% of enterprises use at least one self-hosted runner, and over 5% of GitHub repositories have self-hosted runners configured. Top 3-5 Exploitable Technology Risks •Exposed secrets in public and private repositories, including SaaS API keys, access tokens, and cloud credentials that attackers can use to access cloud or SaaS environments. •Cloud keys stored in repositories, which can enable movement from source code systems into production cloud environments. •GitHub Actions workflows with excessive permissions, including the ability to write content and approve pull requests. |
| Wiz | 2025 | Threat Intelligence Vendor |
| 652 | State of Credential Security Report 2025 | Bottom Line Up Front (BLUF) Dashlane’s 2025 report finds that credential security risk is rising because AI-powered phishing, weak password practices, hybrid work, and shadow IT are overwhelming traditional defenses. For SMBs and insurance teams, the key takeaway is that password-related failures remain a practical and frequent path to data breaches, theft, downtime, and support costs. Top 3-5 Most Notable Statistics •88% of employees and 80% of IT leaders say phishing attempts targeting their organization are on the rise. •74% of IT leaders and 60% of employees say AI poses an increased threat to password security. •96% of IT leaders report dealing with credential-related issues. •73% of IT leaders report employees forgetting passwords or needing resets; 70% report weak and vulnerable passwords. •39% of employees use apps not managed by their company on work devices, and 37% of corporate apps are not behind single sign-on. Top 3-5 Exploitable Technology Risks •AI-powered phishing and spear phishing that use personalized messages, generative AI content, deepfakes, and phishing kits to steal credentials. •Weak, vulnerable, forgotten, or reused passwords that create account takeover and breach risk. •Password sharing through unsecured methods such as Slack or email. |
| Dashlane | 2025 | Identity Security Vendor |
| 653 | State of Customer Identity Report 2025 | Bottom Line Up Front (BLUF) Customer authentication is widely recognized as critical, but many organizations are still relying on methods and systems they do not believe work well. For SMBs and insurance teams, the key takeaway is that weak, inconsistent, or poorly owned customer identity programs can create both security incidents and direct business losses through support burden, customer drop-off, and delayed engineering work. Top 3-5 Most Notable Statistics •87% of surveyed organizations use username/password authentication, but only 2% believe it effectively balances security and user experience. •82% reported negative business impacts from customer authentication issues. •94% have some form of customer MFA, but only 10% have MFA across all customer-facing applications. •51% use workforce identity tools for customer identity, but only 8% would choose that approach if starting over. •73% say their organization struggles to balance security and customer experience. Top 3-5 Exploitable Technology Risks •Password-heavy authentication remains common, creating exposure because respondents view it as poor for both security and user experience. •Incomplete MFA coverage leaves some customer-facing applications protected while others remain unprotected. •Lower-friction approaches such as no MFA or phishable methods like SMS one-time passwords were linked to security incidents. |
| Descope | 2025 | Identity Security Vendor |
| 654 | State of Cyber Security 2026 | Bottom Line Up Front (BLUF) Sopra Steria’s core message is that attackers are succeeding by exploiting identity, trusted tools, cloud dependencies, mobile devices, and familiar weaknesses rather than relying only on novel techniques. For SMBs and insurance teams, this means cyber risk is increasingly tied to everyday business operations, leadership accountability, third-party reliance, and the ability to keep services running during disruption. Top 3-5 Most Notable Statistics •44.4% of security incidents observed in Sopra Steria Scandinavia’s customer base were phishing related. •60% of critical enterprise data is handled through mobile devices. •Mobile Device Management alone mitigates up to 40% of mobile attack techniques, while combining it with Mobile Threat Defence can increase coverage to approximately 90%. •Public administration accounted for 38% of reported cyber incidents in the EU, with 96.2% of those incidents described as hacktivist-led DDoS campaigns. •The digital economy represents about 15% of global GDP, or more than $16 trillion in 2024. Top 3-5 Exploitable Technology Risks •Phishing, credential harvesting, password spraying, and infostealer malware that let attackers “log in rather than break in.” •Unpatched or misconfigured internet-facing systems, including vulnerabilities in SharePoint, Cisco ISE, Citrix NetScaler, Fortinet, and Palo Alto firewalls. •Cloud vendor lock-in, weak portability, exposed identities, rogue credentials, and over-reliance on a single provider or jurisdiction. |
| Sopra Steria | 2026 | Threat Intelligence Vendor |
| 655 | State of Cybersecurity 2021 | Bottom Line Up Front (BLUF) Accenture’s 2021 research shows that cyber attacks are rising, costs remain under pressure, and organizations perform best when cybersecurity is aligned with business priorities. For SMBs and insurance teams, the key takeaway is that resilience is not just more spending: faster detection, faster remediation, secure cloud adoption, and leadership alignment can materially reduce business impact. Top 3-5 Most Notable Statistics •Organizations experienced an average of 270 attacks per company over the year, a 31% increase from 2020. •Successful cyber attacks increased by 32% compared with 2020. •Indirect attacks through the supply chain increased from 44% to 61%. •More than 82% of respondents said IT security budgets increased in the last year, with security reaching 15% of total IT spend. •Cyber Champions found 55% of breaches in less than one day, fixed 100% in 15 days or less, and reported 72% of breaches with no impact. Top 3-5 Exploitable Technology Risks •Supply chain compromise: the report highlights indirect attacks through third parties as a growing source of successful breaches. •Ransomware: the report cites a 160% year-on-year increase in ransomware events in 2020 and notes that remediation can be far more expensive than prevention. •Cloud security gaps: nearly one-third of respondents said security was not part of cloud discussions from the outset and that they were trying to catch up. |
| Accenture | 2021 | Consulting / Analyst Firm |
| 656 | State of Cybersecurity 2023 | Bottom Line Up Front (BLUF) Accenture’s 2023 report argues that cybersecurity performs best when it is built into business change from the start, not added after systems are deployed. For SMBs and insurance teams, the key takeaway is practical: delayed security, weak third-party controls, unclear breach communications, and limited visibility across cloud and legacy environments can increase cost, downtime, and reputational harm. Top 3-5 Most Notable Statistics •5.8X: Organizations that embed cybersecurity into transformation and apply strong operational practices are more likely to experience more effective digital transformations. •26%: “Cyber transformers” reported lower breach and cybersecurity incident costs over the prior 12 months than other organizations. •97%: Nearly all surveyed organizations saw increased cyber threats since the start of the Russia-Ukraine war. •61%: Successful breaches from outside the organization remained high, slightly above the prior year’s 60%. •18%: Some respondents still deploy security controls only after transformation work is finalized and vulnerabilities are detected. Top 3-5 Exploitable Technology Risks •Third-party, supply chain, and external network exposure, which the report identifies as highly susceptible to attack. •Security controls added late in digital transformation, creating opportunities for vulnerabilities, rework, and higher remediation costs. •Expanded attack surface across cloud, legacy environments, devices, software, access, and connectivity. |
| Accenture | 2023 | Consulting / Analyst Firm |
| 657 | State of Cybersecurity 2023 | Bottom Line Up Front (BLUF) Sophos’ 2023 study shows a widening gap between fast-moving attackers and overstretched defenders, with 94% of surveyed organizations experiencing some form of cyberattack in the last year. For SMBs and insurance teams, the key takeaway is that cyber risk is no longer limited to large enterprises: limited staff, alert overload, misconfigured tools, and slow response create real financial and operational exposure. Top 3-5 Most Notable Statistics •94% of organizations experienced a cyberattack of some form in the last year. •93% find the execution of essential security operations tasks challenging. •Only 48% of security alerts are investigated on average. •52% say cyberthreats are now too advanced for their organization to deal with on their own, rising to 64% among organizations with 100-250 employees. •55% say dealing with cyberthreats has negatively impacted the IT team’s work on other projects. Top 3-5 Exploitable Technology Risks •Security tool misconfiguration was the top perceived security risk, creating gaps attackers can exploit. •Stolen access data and credentials were identified as a major risk and are used by attackers to penetrate organizations and move laterally. •Unpatched vulnerabilities were highlighted as a way adversaries gain access and expand inside networks. |
| Sophos | 2023 | Endpoint / MDR / XDR Vendor |
| 658 | State of Cybersecurity 2025 | Bottom Line Up Front (BLUF) ISACA’s 2025 survey shows that cybersecurity teams are under pressure from staffing shortages, budget constraints, skill gaps, and a still-complex threat environment. For SMBs and insurance teams, the key takeaway is that cyber risk is not only about attacks—it is also about whether organizations have enough skilled people, funding, governance, and assessment discipline to detect and respond when incidents occur. Top 3-5 Most Notable Statistics •55% of respondents believe their cybersecurity team is understaffed. •53% believe their cybersecurity budget is somewhat or significantly underfunded. •35% say their organization is experiencing more cyberattacks than a year ago. •Only 41% are completely or very confident in their team’s ability to detect and respond to cyberthreats. •21% report that their organization has used its cyberinsurance policy, while 12% say their organization does not carry cyberinsurance. Top 3-5 Exploitable Technology Risks •Social engineering, including business email compromise, was the most common reported attack vector at 44% among compromised organizations. •Vulnerabilities, including unpatched, misconfigured, and known weaknesses, were reported by 37% of compromised organizations. •Malware was reported by 26%, and ransomware by 19%, showing continued exposure to disruptive malicious software. |
| ISACA | 2025 | ISAC / Industry Consortium |
| 659 | State of Cybersecurity 2025 | Bottom Line Up Front (BLUF) Cybersecurity remains a stated top priority, but many organizations are not matching that priority with funding, skills, metrics, and organization-wide risk management. For SMBs and insurance teams, the key takeaway is that incidents are already causing meaningful disruption, while common weaknesses such as endpoint issues, phishing, ransomware, cloud/data security, and skill gaps continue to strain prevention and response. Top 3-5 Most Notable Statistics •78% of organizations cite cybersecurity as a high priority. •59% report a severe or moderate impact from cybersecurity incidents in the past year. •56% plan to pursue training for the cybersecurity workforce to close skill gaps. •49% say it is easy to procure cybersecurity funds or that budgets are increasing, despite the higher priority placed on cybersecurity. •470,000 U.S.-based job openings included cybersecurity-related skills between May 2023 and April 2024. Top 3-5 Exploitable Technology Risks •Phishing and social engineering: the report highlights these as potent attack vectors that rely on user mistakes and require strong processes and end user training. •Ransomware and cyber extortion: ransomware remains a top concern, while cyber extortion adds pressure by threatening public release of data. •Lost or stolen devices and endpoint malware: lost devices and malware on endpoints were among the most commonly cited cybersecurity incidents. |
| CompTIA | 2025 | Research Organization |
| 660 | State of Cybersecurity in Canada 2025 | Bottom Line Up Front (BLUF) Canadian organizations, including SMBs, face a higher-risk cyber environment driven by ransomware, identity attacks, cloud and IoT misconfigurations, browser-based threats, and software supply chain exposure. For SMBs and insurance teams, the key takeaway is that preventable control gaps, weak vendor oversight, and limited security capacity can quickly turn into downtime, data loss, ransom events, and costly claims. Top 3-5 Most Notable Statistics •82% of breaches are linked in the report to IoT and cloud misconfigurations and human error. •Canada produces fewer than 4,000 cybersecurity graduates annually, compared with demand for up to 25,000 roles. •Browser-based attacks represent 70% of threats observed in one global customer base cited in the report. •90% of organizations experienced at least one identity-related incident in the past year, and 84% suffered direct business impact. •The average cost of a data breach in Canada is cited as USD 4.66 million. Top 3-5 Exploitable Technology Risks •IoT devices with default credentials, open ports, weak update mechanisms, and unsecured MQTT brokers that can enable unauthorized access and data leakage. •Cloud and identity misconfigurations, including excessive privileges, weak role management, and delayed detection of identity anomalies. •Browser-based attacks, including fake software updates, SEO poisoning, and malware delivery through common document or template searches. |
| Government of Canada | 2025 | Threat Intelligence Vendor |
| 661 | State of Cybersecurity in the Finance Sector 2025 | Bottom Line Up Front (BLUF) Darktrace’s report shows that financial organizations face concentrated risk from phishing, credential theft, ransomware, exposed edge systems, and vulnerable third-party software. For SMBs and insurance teams, the key takeaway is that attackers are exploiting practical weaknesses—delayed patching, trusted vendor platforms, remote access, and user credentials—to cause data loss, downtime, extortion, and regulatory exposure. Top 3-5 Most Notable Statistics •Darktrace observed almost 2,400,000 phishing emails across financial sector customer deployments in the first half of 2025. •Almost 30% of phishing emails across financial sector customer deployments targeted VIP users. •In October, Darktrace observed over 214,000 emails with unfamiliar attachments sent to users’ suspected personal addresses. •More than 351,000 emails containing unfamiliar attachments were sent to freemail addresses in October, highlighting data loss prevention concerns. •Business Email Compromise losses exceeded $55 billion globally between 2013 and 2023, and the FBI reported over $2.7 billion in BEC-related losses in 2024. Top 3-5 Exploitable Technology Risks •Phishing, adversary-in-the-middle attacks, and QR code phishing can steal credentials and session cookies, including in environments using MFA. •VPNs, remote access gateways, and GUI-based VPNs are highlighted as focal points for credential spamming and initial access. •Unpatched edge infrastructure, including Citrix Netscaler ADC and Gateway, can enable session hijacking, privilege escalation, and lateral movement. |
| Darktrace | 2025 | Network Security Vendor |
| 662 | State of Cybersecurity Investigations 2025 | Bottom Line Up Front (BLUF) Binalyze’s 2025 report argues that organizations should assume successful cyberattacks will occur and focus on how quickly and clearly they can investigate, contain, recover, and prove what happened. For SMBs and insurance teams, the key takeaway is that weak investigation readiness can increase downtime, raise breach costs, weaken regulatory reporting, and reduce confidence in cyber insurance claims. Top 3-5 Most Notable Statistics •84% of CISOs say a successful cyberattack is “inevitable.” •70% of organizations struggled to effectively remediate and recover from an attack in the past year because they did not understand the root cause, scope, and impact. •Each hour of delay in responding to a known cyberattack costs $114,000, according to CISOs surveyed. •A lack of clarity in investigations costs enterprises an average of $1.1 million. •74% of CISOs have claimed less insurance than they may have been entitled to because of a lack of confidence in the claim’s strength. Top 3-5 Exploitable Technology Risks •AI-powered cyberattacks, which the report says allow attackers to iterate and distribute attacks at previously unimagined scale. •Deepfake-powered phishing, identified as a new attack vector facing security teams. •Expanding attack surfaces across complex IT environments, which create “black holes” where evidence and attacker activity may be hard to see. |
| Binalyze | 2025 | MSP / MSSP / SOC Provider |
| 663 | State of Cybersecurity Investigations 2026 | Bottom Line Up Front (BLUF) Binalyze’s 2026 report argues that successful cyberattacks should be treated as expected events, not exceptions, and that the real differentiator is how quickly and clearly an organization can investigate after compromise. For SMB owners and insurance teams, the key takeaway is that weak investigation capability can increase downtime, reduce claim confidence, impair regulatory reporting, and make repeat attacks more likely. Top 3-5 Most Notable Statistics •84% of CISOs say a successful cyberattack is “inevitable.” •70% of organizations struggled to remediate or recover from an attack in the past year because they did not understand the root cause, scope, and impact. •Each hour of delay in responding to a known cyberattack costs $114,000, according to surveyed CISOs. •A lack of clarity in investigations costs enterprises an average of $1.1 million. •74% of CISOs said their organizations claimed less cyber insurance than they may have been entitled to because they lacked confidence in the claim’s strength. Top 3-5 Exploitable Technology Risks •AI-enabled attacks and deepfake-powered phishing: the report highlights AI as expanding attacker scale and lists deepfake phishing as a newer attack vector. •Expanding IT environments and attack surfaces: larger, more complex environments create more places for attackers to hide and more evidence gaps during investigations. •Visibility “black holes” across IT environments: CISOs reported limited visibility across areas such as supply chain partners, personal devices and software, connected devices, public cloud storage, and corporate devices. |
| Binalyze | 2026 | MSP / MSSP / SOC Provider |
| 664 | State of Cybersecurity Report 2025 | Bottom Line Up Front (BLUF) Wipro’s 2025 report shows that cybersecurity risk is intensifying while budgets are under pressure, making prioritization essential. For SMBs and insurance teams, the most important takeaway is that common attack paths such as phishing, third-party exposure, ransomware, and weak security awareness remain major drivers of breach risk, while AI is making both defense and attack activity faster and more sophisticated. Top 3-5 Most Notable Statistics •65% of surveyed organizations identified email phishing as a top cyber risk. •56% of surveyed organizations identified one or more data breaches in the recent past. •31% of organizations that experienced a breach had a repeat breach within three years. •49% identified third-party risk as a significant cyber risk. •Only 20% of organizations allocate more than 10% of their annual IT budget to security, down from 32% in 2023. Top 3-5 Exploitable Technology Risks •Email phishing: Attackers are using AI to create more convincing phishing schemes, making employee deception a continuing high-risk entry point. •Third-party risk: Interconnected business ecosystems can amplify vulnerabilities outside the organization’s direct control. •Ransomware attacks: The report highlights ransomware as a continuing top risk and emphasizes the need for backup, protection, and incident response strategies. |
| Wipro | 2025 | Consulting / Analyst Firm |
| 665 | State of Cybersecurity Resilience 2025 | Bottom Line Up Front (BLUF) Accenture’s 2025 report finds that AI adoption is moving faster than cybersecurity maturity, leaving most organizations exposed to AI-enabled attacks, fraud, data compromise, and operational disruption. For SMBs and insurance teams, the key takeaway is that AI, cloud, identity, and third-party risks should now be treated as core business risks, not just technical issues. Top 3-5 Most Notable Statistics •90% of companies lack the security maturity needed to counter modern, AI-enabled threats. •77% of organizations lack foundational data and AI security practices needed to protect models, data pipelines, and cloud infrastructure. •72% of organizations report a rise in cyber threats, with ransomware, cyber-enabled fraud, supply chain attacks, malicious insiders, and disinformation ranked as top concerns. •In the third quarter of 2024, organizations faced an average of 1,876 cyberattacks, a 75% year-over-year increase. •Only 10% of organizations are in Accenture’s “Reinvention-Ready Zone,” and those organizations are 69% less likely to be hit by an advanced attack such as an AI-powered cyberattack. Top 3-5 Exploitable Technology Risks •Generative AI systems exposed to prompt injection, data poisoning, model manipulation, model inversion, and AI worms that can hijack AI behavior or compromise sensitive data. •Deepfake-enabled fraud and AI-powered social engineering that can mimic voices, videos, and text to deceive employees and executives. •Cloud misconfigurations and insecure cloud foundations that can expose AI models, training data, and sensitive business information. |
| Accenture | 2025 | Consulting / Analyst Firm |
| 666 | State of Cybersecurity Threats in 2025: Cybersecurity in 2025: A Constant Battle Against Ever-Evolving Threats, Where Vigilance Is the Only Defense | Bottom Line Up Front (BLUF) SilverTree’s 2025 outlook points to a threat environment where SMBs remain attractive targets because attackers are using social engineering, AI, ransomware-as-a-service, cloud weaknesses, IoT devices, and third-party vendors to scale attacks. For insurance and risk teams, the main takeaway is that prevention, vendor oversight, cloud hygiene, identity controls, and incident readiness should be treated as core loss-prevention priorities. Top 3-5 Most Notable Statistics •45% of cyber incidents in 2024 were attributed to social engineering attacks, including phishing, pretexting, and impersonation. •25% of all cyberattacks in 2024 were powered by artificial intelligence, including automated phishing, AI-driven malware, and deepfakes. •Over 20 billion records were exposed in data leaks across various sectors in 2024. •More than 60% of small and medium-sized enterprises were targeted by cyberattacks in 2024. Top 3-5 Exploitable Technology Risks •Cloud misconfigurations and human error, including public-facing storage, exposed databases, and overly permissive access controls that can expose sensitive data. •AI-driven attacks, including deepfake-enabled phishing, AI-powered DDoS, autonomous vulnerability scanning, and malware that adapts to evade detection. •Ransomware-as-a-service, which enables less-skilled attackers to run ransomware campaigns and use double or triple extortion. •IoT vulnerabilities, including poorly secured cameras, routers, smart TVs, thermostats, and other connected devices that can be hijacked into botnets or used as entry points. |
| SilverTree | 2025 | Threat Intelligence Vendor |
| 667 | State of Cyberwarfare 2026 | Bottom Line Up Front (BLUF) Armis’ 2026 report finds that cyberwarfare is becoming faster, more automated, and more financially damaging, with AI-powered attacks widening the gap between confidence and actual readiness. For SMBs and insurance teams, the key takeaway is that ransomware, phishing, cloud misconfiguration, supply chain exposure, and unmanaged assets remain practical loss drivers even as AI raises attacker speed and scale. Top 3-5 Most Notable Statistics •79% of IT decision-makers say AI-powered attacks pose a significant threat to their organization’s security. •66% of organizations report experiencing up to two cybersecurity breaches, up from the prior year. •54% of organizations report being impacted by an AI-generated or AI-led attack in the past 12 months. •52% say their average ransomware payout exceeds their annual cybersecurity budget. •43% still detect and respond to significant attacks reactively, either as the attack occurs or after damage is done. Top 3-5 Exploitable Technology Risks •AI-enabled attacks that can accelerate vulnerability discovery, exploit development, lateral movement, and targeted social engineering. •Phishing and spear-phishing, reported as the most common offensive techniques bypassing security tools. •Exploitation of misconfigured cloud or hybrid environments, which attackers use to bypass defenses and expand access. |
| Armis | 2026 | OT/ICS Security Vendor |
| 668 | State of Data Security Report 2024 | Bottom Line Up Front (BLUF) Immuta’s 2024 survey shows that AI adoption, cloud data growth, and weak visibility into data access are creating practical data security risks faster than many organizations can govern them. For SMBs and insurance teams, the key takeaway is that sensitive data exposure, access workarounds, and inconsistent governance can increase the likelihood of privacy events, compliance issues, and operational disruption. Top 3-5 Most Notable Statistics •88% of data professionals say employees at their organizations are using AI. •50% say their organization’s data security strategy is not keeping up with the pace of AI evolution. •56% cite exposure of sensitive data through an AI prompt as their top AI concern. •57% say data users fall back on quick fixes to access data outside proper data access governance practices. •77% say data security budgets increased over the past year, and 88% believe data security will become an even higher priority in the next 12 months. Top 3-5 Exploitable Technology Risks •Employee use of AI prompts that may expose sensitive information. •Large language models disclosing sensitive information or being used outside their intended context. •Training-data poisoning, where data used to train AI models is manipulated. |
| Immuta | 2024 | Compliance / GRC Vendor |
| 669 | State of Data Security Report 2025 | Bottom Line Up Front (BLUF) Immuta’s 2025 survey shows that organizations are struggling to balance fast data access with privacy, compliance, and security controls. For SMBs and insurance teams, the key takeaway is that weak or manual data access governance can create business delays, compliance exposure, and higher risk as AI and self-service data use expand. Top 3-5 Most Notable Statistics •64% of data leaders face significant challenges providing timely, secure data access to authorized users. •55% agree their data security strategy is not keeping pace with the evolution of AI. •53% say most data governance processes are done manually, and 62% say governance processes slow down access to data. •78% say their data governance or security tools need improvement. •66% say their ability to protect data has improved compared to a year ago, and 75% feel confident in their ability to address data threats. Top 3-5 Exploitable Technology Risks •Manual data governance processes can create inconsistent access decisions, slower reviews, and weaker control over who can use sensitive data. •Lack of centralized data access management can make it harder to enforce policies, monitor usage, and keep data from being overshared. •Legacy tools and processes that lack agility can prevent organizations from scaling secure access as data volumes and users grow. |
| Immuta | 2025 | Compliance / GRC Vendor |
| 670 | State of Data Security Report 2025 | Bottom Line Up Front (BLUF) AI adoption is expanding faster than data security controls, creating major exposure for sensitive business data across cloud, SaaS, and AI tools. For SMBs and insurance teams, the most important takeaway is that identity gaps, excessive permissions, shadow AI, and weak authentication can turn one compromised account into broad data access or exfiltration. Top 3-5 Most Notable Statistics •99% of organizations have sensitive data dangerously exposed to AI tools. •90% of organizations have exposed sensitive cloud data, and 66% have cloud data exposed to anonymous users. •98% of companies have employees using unsanctioned apps, including shadow AI, with 1,200 unofficial apps on average. •88% of organizations have stale but enabled “ghost users,” with 15,000 per organization on average. •1 in 7 organizations do not use or enforce MFA across SaaS and multi-cloud environments. Top 3-5 Exploitable Technology Risks •Shadow AI and unverified OAuth apps: unsanctioned applications can bypass governance, retain access to sensitive data, and be used to exfiltrate information. •Overexposed Microsoft 365 Copilot data: Copilot can surface any data a user can access, and the report found sensitive files exposed broadly across organizations. •Salesforce Agentforce and excessive export permissions: accounts with broad access can export sensitive Salesforce data, while public links can expose internal data to unauthorized users or AI tools. |
| Varonis | 2025 | Threat Intelligence Vendor |
| 671 | State of Detection Engineering 2025 | Bottom Line Up Front (BLUF) Elastic’s report shows that effective security depends on continuous detection engineering: testing rules against real threats, tuning false positives, and expanding visibility across endpoints, cloud, SaaS, and identity systems. For SMBs and insurance teams, the key takeaway is that security controls should not be judged only by whether tools are deployed, but by whether detections are current, tested, measurable, and supported by usable telemetry. Top 3-5 Most Notable Statistics •Elastic processes more than 500 malware samples per day and targets a malware detection rate at or above 99%. •Cloud and SaaS accounted for 15% of new and tuned rules, with AWS CloudTrail and Okta making up nearly 70% of those rules. •Elastic added or tuned more than 50 AWS CloudTrail rules, created more than 40 new AWS rules, and developed 17 threat hunting queries. •Defense Evasion represented approximately 45% of new Endpoint Protection rule efforts and around 26% of new SIEM rule efforts. •Elastic’s objective is to keep Endpoint alerts below 1% of hosts to reduce unnecessary alert volume and disruption. Top 3-5 Exploitable Technology Risks •CUPS vulnerabilities enabling unauthenticated remote code execution on UNIX-based systems, including GNU/Linux distributions, BSDs, ChromeOS, and Solaris. •Windows privilege escalation involving CLFS and DWM, where attackers can abuse system behavior to gain higher privileges. •Cloud credential and IAM abuse across AWS, Okta, Microsoft 365, and related environments, including compromised access keys and overly permissive policies. |
| Elastic | 2025 | SIEM / Security Analytics Vendor |
| 672 | State of DevSecOps 2026 | Bottom Line Up Front (BLUF) Datadog’s 2026 DevSecOps research shows that most organizations are still running deployed services with known exploitable vulnerabilities while also exposing themselves to software supply chain risk through fast adoption of new libraries, images, and CI/CD components. For SMBs and insurance teams, the key takeaway is that application and build-pipeline hygiene are now material loss-prevention issues, not just developer concerns. Top 3-5 Most Notable Statistics •87% of organizations have at least one exploitable vulnerability, affecting 40% of all services. •10% of services use at least one end-of-life language or runtime version; services using end-of-life versions have exploitable vulnerabilities 50% of the time, compared with 37% when no end-of-life version is used. •The median dependency is 278 days behind its latest major version, up from 215 days the prior year. •50% of organizations use third-party libraries within one day of release; 12% use public AMIs and 32% use public Docker images within one day of release. •Only 4% of organizations using GitHub Actions pin the hash for all marketplace actions, while 71% never pin the hash for any actions. Top 3-5 Exploitable Technology Risks •Known exploitable vulnerabilities in deployed services, especially where vulnerable services are exposed in production. •End-of-life languages and runtimes, which are associated with a higher rate of exploitable vulnerabilities. •Outdated third-party libraries, including libraries that are not actively maintained and contain known vulnerabilities. |
| Datadog | 2026 | Cloud Security Vendor |
| 673 | State of Devsecops Report 2021 | Bottom Line Up Front (BLUF) The report’s central message is that application security is still maturing, and many organizations are finding vulnerabilities too late, struggling to interpret findings, and lacking enough security expertise. For SMBs and insurance teams, this matters because smaller companies often have fewer application security staff and tools, which can increase the chance that software weaknesses reach production and become business, legal, regulatory, or brand issues. Top 3-5 Most Notable Statistics •53% of respondents employ only one to five application security team members, a pattern the report associates generally with SMBs. •50% plan to add more application security staff within the next year. •43% say their biggest frustration is security testing done too late in the software development life cycle because it delays launches. •67% perform API security testing, making it the most common application security testing type in the survey. •66% do not use a security champion model within their organization. Top 3-5 Exploitable Technology Risks •APIs are a major concern because modern applications rely heavily on outside functions, data, and dependencies; the report identifies API testing as the most common testing type and notes APIs are becoming an increasing threat. •Open source components and libraries create risk when organizations do not use software composition analysis or open source security testing to identify vulnerabilities and license risks. •Containers and microservices create additional attack surfaces because each container represents an individual attack surface, requiring specialized tooling and updated practices. |
| Checkmarx | 2021 | Application / API Security Vendor |
| 674 | State of Digital Impersonation Fraud Report 2024 | Bottom Line Up Front (BLUF) Website impersonation fraud is a customer-impacting business risk, not just a security issue. Memcyco’s survey shows that many organizations detect fake-site scams only after customers report harm, creating exposure to reimbursement costs, account takeover, reputational damage, customer churn, and operational workload. Top 3-5 Most Notable Statistics •66% of businesses said their most common way of learning about website impersonation attacks is through incident reports from affected customers. •72% use a third-party threat intelligence service to monitor suspicious domains and apply for takedown, but only 6% say their current approach solves the issue completely. •37% first become aware of fake websites when customers publicize their experience on social media. •81% do not reimburse customers scammed by website impersonation, while almost half of that group are aware of upcoming regulation that will force reimbursement. •40% of customers stop doing business with a company after being scammed, and 45% pause transactions for a period of time. Top 3-5 Exploitable Technology Risks •Fake websites impersonating legitimate company sites, especially login or checkout pages, can be used to steal credentials, personal information, or payment-related data. •Phishing and smishing links drive customers to fake sites, where they may unknowingly submit credentials or sensitive information. •Stolen credentials from fake-site scams can lead to account takeover, even after a fake domain is taken down. |
| Memcyco | 2024 | Research Organization |
| 675 | State of Digital Trust Report 2023 | Bottom Line Up Front (BLUF) Digital trust is a business resilience issue, not just a technology or compliance issue. ISACA’s survey shows that organizations see digital trust as highly important, but many are not measuring it, funding it, training for it, or assigning clear accountability—creating avoidable exposure to reputational damage, customer loss, service disruption, privacy breaches, and cybersecurity incidents. Top 3-5 Most Notable Statistics •84% of respondents say digital trust is extremely or very important to organizations today. •64% say their organization prioritizes digital trust at a level matching its importance. •53% are completely or very confident in their organization’s digital trustworthiness; this rises to 81% among organizations that measure digital trust maturity. •Only 24% say their organization currently measures the maturity of its digital trust practices, even though 67% say doing so is extremely or very important. •52% identify lack of skills and training as an obstacle to attaining digital trust. Top 3-5 Exploitable Technology Risks •Social engineering through phishing, smishing, and vishing, especially when compromised personal information makes fraudulent messages more realistic. •Breaches involving personal, financial, demographic, or product information, which can erode trust and trigger customer, regulatory, and remediation consequences. •Digital transformation initiatives that introduce new vulnerabilities when policies and procedures do not keep pace with digitally enabled services and processes. |
| ISACA | 2023 | ISAC / Industry Consortium |
| 676 | State of Exploitation 2025 | Bottom Line Up Front (BLUF) VulnCheck reports that vulnerability exploitation is moving faster in 2025, with nearly one-third of newly known exploited vulnerabilities showing exploitation evidence on or before CVE disclosure. For SMBs and insurance teams, this means patching only after traditional advisories or delayed vulnerability analysis may leave a real exposure window, especially for internet-facing systems and commonly exploited business software. Top 3-5 Most Notable Statistics •432 CVEs were reported as exploited in the wild for the first time and added to VulnCheck KEV in the first half of 2025. •32.1% of known exploited vulnerabilities had exploitation evidence on or before the day the CVE was issued, up from 23.6% in 2024. •26.9% of known exploited vulnerabilities first seen in the first half of 2025 were still awaiting NIST analysis. •181 unique CVEs were attributed to 92 named threat actors across 139 industry reports. •147 of 181 CVEs used by known threat actors had evidence of exploitation before 2025, showing that threat actor attribution often lags initial exploitation evidence. Top 3-5 Exploitable Technology Risks •Content management systems, especially WordPress plug-ins, were the largest category of known exploited vulnerabilities, with 86 KEVs. •Network edge devices accounted for 77 KEVs, making routers, gateways, and similar perimeter systems a major exposure area. •Server software accounted for 61 KEVs, creating risk for systems that support core business applications and services. |
| VulnCheck | 2025 | Threat Intelligence Vendor |
| 677 | State of Exposure Management 2024 | Bottom Line Up Front (BLUF) Xmcyber’s 2024 report shows that cyber risk is driven less by long vulnerability lists and more by exploitable paths attackers can use to reach critical assets. For SMBs and insurance teams, the key takeaway is that remediation should prioritize the small set of exposures that create direct routes or “choke points” to business-critical systems. Top 3-5 Most Notable Statistics •Organizations typically have about 15,000 exploitable exposures, while low-scoring organizations have a median of 30,000. •Traditional CVE-based vulnerabilities account for less than 1% of all exposures and 11% of critical exposures. •Active Directory accounts for 80% of all security exposures and 33% of exposures affecting critical assets. •Cloud platforms contain 56% of critical asset exposures, and attackers can pivot between on-premises and cloud environments in 70% of organizations. •Over 60% of on-premises critical assets can be compromised in one hop, while 88% of cloud critical assets can be compromised in one hop after cloud access is gained. Top 3-5 Exploitable Technology Risks •Active Directory misconfigurations and credential attacks, including credential harvesting, credential dumping, credential relay, domain credentials, group membership abuse, and password reset abuse. •Cached or reused privileged credentials, including highly privileged Active Directory credentials cached on multiple machines. •Cloud identity and permission misconfigurations across AWS, Azure, and GCP that allow privilege escalation or access to critical assets. |
| Xmcyber | 2024 | Threat Intelligence Vendor |
| 678 | State of GraphQL Security 2024 | Bottom Line Up Front (BLUF) GraphQL APIs are increasingly common and often expose serious security weaknesses that can lead to data exposure, unauthorized access, and downtime. For SMBs and insurance teams, the key takeaway is that public GraphQL services may be remotely exploitable without privileged access unless basic controls such as authentication, authorization, input validation, rate limiting, and query limits are consistently applied. Top 3-5 Most Notable Statistics •13,720 total issues were found across 160 public GraphQL services. •33% of scanned API services had at least one high-severity issue, and 72% had medium-severity issues. •68.3% of issues were tied to unrestricted resource consumption, making APIs susceptible to denial-of-service attacks. •4,428 exposed secrets were found in GraphQL API responses, including 1,396 access tokens, 49 passwords, and 2 credit card numbers. •13.4% of vulnerabilities were specific to GraphQL language or framework risks. Top 3-5 Exploitable Technology Risks •Unrestricted resource consumption: Missing limits on query depth, fields, aliases, batching, or timeouts can allow attackers to overload servers and cause denial-of-service conditions. •Security misconfiguration: Improper GraphQL configuration can expose sensitive data or create gaps attackers can abuse. •Broken function-level authorization: Weak or inconsistent access control can allow unauthorized access to resources or administrative functions. |
| Escape | 2024 | Threat Intelligence Vendor |
| 679 | State of GRC 2025 | Bottom Line Up Front (BLUF) Drata’s 2025 survey shows GRC is moving from a back-office compliance function to a business growth and trust driver, but many teams are still held back by manual work, expanding frameworks, and AI-related governance gaps. For SMBs and insurance teams, the key takeaway is that GRC maturity, automation, and AI readiness are becoming practical indicators of operational resilience and customer trust. Top 3-5 Most Notable Statistics •96% of surveyed companies believe GRC is rising in the spotlight. •93% want more critical GRC functions automated because they still require manual intervention. •GRC teams manage an average of 8 compliance frameworks, and companies expect to add 6 more on average in the next 12 months. •100% of companies expect employees to increase their use of AI technologies in the next 12 months, but only 10% say their GRC function is completely prepared to manage it. •98% of respondents see GRC as a business driver, and 91% have a dedicated person in charge of GRC. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs For SMBs, the report highlights a growing operational challenge: compliance expectations are increasing while teams remain stretched. Manual GRC work takes an average of 14 hours per week, pulling time away from strategy, customer support, sales enablement, and risk reduction. As companies add more frameworks, SMBs may face slower security reviews, more difficult customer due diligence, and greater pressure to prove their security and compliance posture. |
| Drata | 2025 | Compliance / GRC Vendor |
| 680 | State of Hardened Container Images Report 2024 | Bottom Line Up Front (BLUF) The report’s central finding is that many widely used container images contain large numbers of known software vulnerabilities, often because they include unnecessary or outdated open source components. For SMBs and insurance teams, this matters because containers are a common building block of cloud applications, and unmanaged vulnerabilities can create security, compliance, and operational remediation burdens. Top 3-5 Most Notable Statistics •Debian-based Docker Official Images analyzed in the report contained, on average, nearly 280 CVEs. •Those same Debian-based images contained, on average, over 30 high or critical severity CVEs. •Updating Debian packages inside a sample of popular images reduced CVEs by less than 6%. •Debloating reduced CVEs by an average of 64%, while equivalent Chainguard Images reduced CVEs by an average of 99%. •Red Hat application images contained, on average, 190 CVEs excluding “will not fix” CVEs and 872 CVEs including them. Top 3-5 Exploitable Technology Risks •Popular container images with hundreds of known CVEs, giving attackers more known weaknesses that may be used to access, manipulate, or compromise systems. •Software bloat in containers, where images include many open source packages that increase the attack surface. •Slow update cycles and out-of-date packages inside containers, leaving known vulnerabilities unresolved. |
| Chainguard | 2024 | Supply Chain Security Vendor |
| 681 | State of HRM Insight Report 2025 | Bottom Line Up Front (BLUF) Human risk is concentrated, measurable, and manageable: Cyentia found that a small share of users drives most risky behavior, while most employees reduce exposure more than they add to it. For SMBs and insurance teams, the key takeaway is that broad visibility and targeted action plans can reduce risk more effectively than security awareness training alone. Top 3-5 Most Notable Statistics •10% of users account for 73% of all risky behavior within their organizations. •Organizations can detect 43% of all human risk activity on average, but those relying only on security awareness training have visibility of about 12%. •Companies with five or fewer visibility streams see 21% of human risk on average, while organizations with 16 or more streams can detect about two-thirds of human risk activity. •78% of users generate more vigilant than risky insights. •Organizations using Living Security’s Unify platform saw risky users fall from 43% to 21%, and users spent 60% less time in a risky state after completing action plans. Top 3-5 Exploitable Technology Risks •Phishing and email social engineering, including real phishing, simulated phish clicks, users entering credentials, and opening attachments. •Identity and access risk, including users susceptible to account compromise and risks tied to access levels or insufficient protections. •Malware threats, including viruses, worms, Trojans, spyware, adware, and ransomware. |
| Cyentia | 2025 | Research Organization |
| 682 | State of Human Risk 2025 | Bottom Line Up Front (BLUF) Mimecast’s 2025 report argues that human risk has become the central cybersecurity challenge, with email, collaboration tools, insider actions, and AI-driven attacks creating higher-impact exposure than technology controls alone can address. For SMBs and insurance teams, the key takeaway is that prevention must focus on how employees, vendors, and contractors handle credentials, messages, collaboration platforms, and sensitive data. Top 3-5 Most Notable Statistics •95% of respondents expect email security challenges in 2025. •61% say it is inevitable or likely their organization will suffer a negative business impact from an attack linked to a collaboration tool in 2025. •43% have seen an increase in internal threats or data leaks initiated by compromised, careless, or negligent employees in the last 12 months. •66% are concerned that insider-driven data loss will increase in the next 12 months. •81% are concerned about sensitive data leaks through GenAI tools, and 55% are not fully prepared with specific strategies for AI-driven threats. Top 3-5 Exploitable Technology Risks •Email phishing and business email compromise, especially as AI makes messages more personalized, convincing, and harder to detect. •Collaboration platforms such as Slack, Zoom, and Microsoft Teams, which the report describes as a growing attack surface with security loopholes that need attention. •Compromised credentials and authentication weaknesses, including attacks where phishing leads to network access and ransomware deployment. |
| Mimecast | 2025 | Email Security Vendor |
| 683 | State of ICS Security 2025 | Bottom Line Up Front (BLUF) Industrial control system and operational technology environments remain exposed to disruptive cyber incidents, especially through unauthorized external access and ransomware. For SMBs that operate plants, field sites, utilities, or industrial processes, the key risk is not just data loss; it is downtime, delayed recovery, safety exposure, and financial loss. Top 3-5 Most Notable Statistics •22% of respondents reported at least one cybersecurity incident in their ICS/OT environment in the past 12 months. •50% of reported incidents involved unauthorized external access, and 38% involved ransomware. •40% of incidents caused disruption to ICS/OT operations, while 13% resulted in financial loss or data compromise. •Nearly 50% of incidents were detected within 24 hours, but 19% took more than a month to remediate. •Only 14% of respondents felt fully prepared for plausible and emerging ICS/OT threats. Top 3-5 Exploitable Technology Risks •Unauthorized external access to ICS/OT environments, including remote access pathways, remains the most prominent incident source. •Ransomware targeting OT environments is a major scenario organizations are planning for and a frequent incident type. •Weak secure remote access controls, including limited use of session recording, ICS/OT-aware access, and real-time session approvals, leave gaps attackers can exploit. |
| SANS Institute | 2025 | Education / Academic |
| 684 | State of Identity Governance 2024 | Bottom Line Up Front (BLUF) Omada’s survey shows that identity governance is a major security concern because many organizations believe users have more access than they need. For SMBs and insurance teams, the practical takeaway is clear: unmanaged permissions, remote users, and third-party identities can increase the chance that a compromised account becomes a larger business-impacting incident. Top 3-5 Most Notable Statistics •Over 90% of respondents are concerned with the risks of identity-related cybersecurity threats. •Over 95% of senior IT and security leaders report being “very concerned” about identity-related threats. •72% of respondents think some people in their organizations have unnecessary access to systems and applications or overly permissive accounts. •Organizations reported 52% more employee identities working remotely since COVID, with increases also among partners, consultants, contractors, and temporary or seasonal help. •76% of organizations choose best-of-breed IAM solutions rather than a single-vendor platform product. Top 3-5 Exploitable Technology Risks •Overly permissive user accounts: Excess access can increase the impact if an account is compromised. •Unnecessary access to systems and applications: Users retaining access they do not need creates avoidable exposure. •Remote and third-party identities: Partners, consultants, contractors, temporary workers, and remote employees can create identity management gaps. |
| Omada | 2024 | Identity Security Vendor |
| 685 | State of Identity Governance 2025 | Bottom Line Up Front (BLUF) Identity governance is a practical risk-control issue, not just an IT administration problem. Omada’s survey shows that many organizations still have excessive user access, manual identity processes, and legacy identity governance tools, which can increase the chance that compromised credentials or misused privileged accounts lead to a security incident. Top 3-5 Most Notable Statistics •95% of respondents agree that identity security is a key component of their organization’s cybersecurity strategy. •89% said IT security teams and resources are better funded than a year ago. •64.4% said their organizations have purchased cyber liability insurance to help offset data breach costs. •73.9% agreed that some people in their organizations have access to systems and applications they do not need, creating unnecessary risk. •58.8% identified restrictive total cost of ownership as a top deficiency in their current identity governance and administration solution. Top 3-5 Exploitable Technology Risks •Overly permissive user accounts: users with access they do not need create unnecessary risk and can expand the damage from compromised credentials. •Misuse of privileged accounts: the report highlights least privilege as critical to mitigating threats such as compromised user credentials and misuse of privileged accounts. •Legacy identity governance systems: 26.9% reported using legacy IGA solutions that do not support modern authentication open standards. |
| Omada | 2025 | Identity Security Vendor |
| 686 | State of Identity Governance 2026 | Bottom Line Up Front (BLUF) Omada’s 2026 survey shows that identity governance is becoming a continuous security control, not a periodic access review process. For SMBs and insurance teams, the key issue is that organizations are adopting Zero Trust, GenAI, agentic AI, and non-human identities faster than they are building visibility, ownership, and control around identity risk. Top 3-5 Most Notable Statistics •577 identity, access management, and cybersecurity professionals participated in the survey, representing U.S.-based enterprises with 1,000 to 10,000 employees. •More than 60% of organizations cite compliance and audit efficiency as primary drivers for identity governance investment. •76% strongly agree identity security is core to their cybersecurity strategy. •95% report some level of Zero Trust adoption, while interoperability gaps remain a top barrier to unified identity visibility and reporting. •85% of organizations are already using or piloting agentic AI, while security is the most frequently cited concern tied to deployment. Top 3-5 Exploitable Technology Risks •Orphaned or unused accounts and delayed access revocation can leave active access in place after role changes or departures. •Excess privileged access and access sprawl increase the risk that compromised accounts or identities can reach sensitive systems. •Credential theft and reuse, phishing, social engineering, session hijacking, token-based attacks, and replay attacks remain major identity-related threats. |
| Omada | 2026 | Identity Security Vendor |
| 687 | State of Identity Security 2024 | Bottom Line Up Front (BLUF) Identity is a major cloud security exposure: Permiso reports that nearly half of surveyed organizations experienced unauthorized access or an identity security breach. For SMBs and insurance teams, the key issue is not only whether identity controls exist, but whether the business can see, manage, and respond to human and non-human identity activity across cloud, SaaS, and hybrid environments. Top 3-5 Most Notable Statistics •45% of organizations reported an identity security breach. •46% of organizations reported unauthorized access into cloud services environments in 2024. •54% of breaches involved impersonation attacks, and 53% involved credential compromise. •56% of organizations assign identity security responsibility to IT departments, while only 7% assign it to dedicated IAM teams. •45% of organizations remain concerned or extremely concerned that their current tools can detect identity attacks. Top 3-5 Exploitable Technology Risks •Compromised credentials and account takeover: The report identifies credential compromise as a leading concern and a major threat vector in unauthorized access. •Impersonation attacks: These were the leading reported threat vector, making trusted identities a practical path for attackers. •SaaS environments: SaaS is ranked as the riskiest environment, with concerns tied to rapid adoption, shadow IT, and oversight challenges. |
| Permiso | 2024 | Identity Security Vendor |
| 688 | State of Industrial AI Report 2026 | Bottom Line Up Front (BLUF) Cisco’s report finds that industrial AI is moving from pilots into production, but scaling it safely depends on modern networks, strong cybersecurity, and coordinated IT/OT governance. For SMBs and insurance teams, the key issue is not whether AI can improve operations, but whether the business has the infrastructure, visibility, and controls to avoid reliability failures and cyber risk as more assets become connected. Top 3-5 Most Notable Statistics •61% of organizations are actively deploying AI at scale. •40% cite cybersecurity concerns as a top obstacle to AI adoption. •48% identify security and segmentation as their biggest networking challenge for AI-enabled operations. •96% say wireless reliability is critical to enabling industrial AI. •43% report little to no IT/OT collaboration on cybersecurity. Top 3-5 Exploitable Technology Risks •Weak security and segmentation in industrial networks can increase exposure as more systems and assets are connected for AI. •Unreliable wireless connectivity can disrupt AI-enabled operations that depend on stable data flows, mobility, and real-time connectivity. •Legacy infrastructure limitations can prevent consistent security, visibility, and reliable performance needed for production AI. |
| Cisco | 2026 | Network Security Vendor |
| 689 | State of Non Human Identity Security 2024 | Bottom Line Up Front (BLUF) Non-human identities such as API keys, service accounts, OAuth tokens, bots, and secrets are now a major identity security exposure because they can access sensitive data and critical systems but are often poorly inventoried, overprivileged, or not rotated. For SMBs and insurance teams, the key issue is that these hidden credentials and automated connections can create exploitable access paths that are harder to detect and control than human user accounts. Top 3-5 Most Notable Statistics •Only 15% of organizations are highly confident they can prevent an attack through non-human identities. •69% of organizations are moderately to very concerned about non-human identities as an attack vector. •38% of organizations report no or low visibility into third-party vendors connected by OAuth apps. •Only 20% have a formal process for offboarding and revoking API keys, and only 16% have one for rotating or rolling them back. •17% of organizations confirmed an NHI-related security incident, while another 35% were unsure. Top 3-5 Exploitable Technology Risks •Service accounts with elevated or excessive permissions, especially existing accounts where permissions are harder to manage. •API keys that are not formally offboarded, revoked, rotated, or rolled back, leaving active access that may be exploitable. •OAuth-connected third-party applications with limited visibility, especially where vendors are untrusted or user-enabled connections are not formally evaluated. |
| Astrix | 2024 | Identity Security Vendor |
| 690 | State of Open Source Security 2023 | Bottom Line Up Front (BLUF) Open source software is central to modern development, but security practices are not keeping pace with how quickly organizations ship code. For SMBs and insurance teams, the key issue is not whether open source is used, but whether the business can identify vulnerable components, including hidden dependencies, and fix them before attackers exploit them. Top 3-5 Most Notable Statistics •80% of organizations ship code daily or weekly, but only 27% continuously audit code for vulnerabilities. •40% of organizations do not use foundational supply chain security technologies such as software composition analysis and static application security testing. •31% of respondents are not monitoring indirect, or transitive, dependencies. •87% of respondents were impacted by one or more open source supply chain security issues in the past year. •62% of respondents said at least 25% of vulnerability alerts were false positives. Top 3-5 Exploitable Technology Risks •Open source dependencies, especially indirect dependencies buried inside other packages, create hidden exposure that may not be visible through basic dependency tracking. •Package-based attacks, including dependency confusion, typosquatting, person-in-the-middle attacks, and malicious code insertion, are highlighted as risks to open source package use. •Java and JavaScript ecosystems show the highest shares of ignored vulnerabilities, with Java at 42.4% and JavaScript at 30.7% among ignored vulnerabilities appearing in at least 20 organizations. |
| Snyk | 2023 | Threat Intelligence Vendor |
| 691 | State of Open Source Security 2024 | Bottom Line Up Front (BLUF) Snyk’s 2024 report shows that open source security progress is slowing while supply chain risk remains under-managed. For SMBs and insurance teams, the core issue is operational: many organizations depend on open source software but lack consistent visibility, prioritization, and review practices to manage vulnerable or malicious components before they create business disruption. Top 3-5 Most Notable Statistics •Roughly one-quarter of respondents still track only direct open source dependencies, and nearly 5% do not track open source dependencies at all. •No surveyed application security method exceeded 70% usage; Software Composition Analysis reached 69.7% and Static Application Security Testing reached 59.5%. •Organizations implementing new tooling and practices for supply chain vulnerabilities dropped from 60.9% in 2023 to 49.6% in 2024; related developer training dropped from 53.2% to 35.4%. •Although 74% of organizations have high-severity vulnerability fix SLAs of one week or less, 52% regularly miss those targets, and 14.8% frequently miss them. •In 2024, 45% of respondents replaced compromised build components, and 42% swapped vulnerable open source libraries. Top 3-5 Exploitable Technology Risks •Incomplete dependency tracking, especially indirect dependencies, can leave vulnerable open source components unidentified. •Missed high-severity vulnerability remediation SLAs increase the window in which known issues remain exploitable. •Immature supply chain controls, including limited use of SBOM verification, artifact signing, package attestation, reproducible builds, and branch protection, leave build pipelines exposed. |
| Snyk | 2024 | Threat Intelligence Vendor |
| 692 | State of Open Source Vulnerabilities 2021 | Bottom Line Up Front (BLUF) Open source vulnerabilities increased sharply in 2020, creating a larger remediation burden for organizations that build or run software using open source components. For SMBs and insurance teams, the key issue is not just the volume of vulnerabilities, but the need to prioritize which weaknesses could most affect the business instead of trying to fix everything at once. Top 3-5 Most Notable Statistics •Published open source software vulnerabilities rose by over 50% in 2020. •Mend’s data shows 9,658 open source vulnerabilities in 2020, up from 6,111 in 2019. •Over 50% of new open source vulnerabilities were rated high or critical. •The 2020 severity breakdown was 45% medium, 38% high, 15% critical, and 3% low. •Go vulnerabilities increased from 1% of vulnerabilities across programming languages in 2019 to 5% in 2020. Top 3-5 Exploitable Technology Risks •Cross-site scripting, or XSS, was the top open source weakness in 2020 and remained dominant across several programming languages, especially those used for web development. •Out-of-bounds write vulnerabilities became a top-five weakness and were especially associated with C. •Out-of-bounds read vulnerabilities were also prominent and related to the broader buffer overflow weakness family. |
| Mend | 2021 | Supply Chain Security Vendor |
| 693 | State of OT Security Report 2024 | Bottom Line Up Front (BLUF) OT cyber risk is now a business-continuity risk, not just a technical issue. For SMBs that operate industrial systems or support industrial customers, the report shows that attacks often start in IT, spread into OT, and can cause shutdowns, lost revenue, remediation costs, regulatory pressure, and higher insurance premiums. Top 3-5 Most Notable Statistics •76% of respondents said their organization had experienced a cyberattack in its OT environment. •75% reported frequent OT attacks, including monthly, weekly, or daily incidents. •72% of attacks targeting OT originated in IT environments. •1 out of 4 organizations experienced a shutdown of operations due to a successful attack in the past year. •Breach remediation for a connected OT/IoT asset is estimated at US$10,000 to US$50,000 per asset. Top 3-5 Exploitable Technology Risks •IT-to-OT attack paths: ransomware and other common IT-borne threats are crossing into OT environments. •Remote access to OT: increased internal and third-party remote access creates security concerns, including man-in-the-middle attack risk. •Supply chain exposure: commercial off-the-shelf solutions in OT can expand the blast radius of supply chain attacks. |
| ABI Research | 2024 | Research Organization |
| 694 | State of Pentesting 2021 | Bottom Line Up Front (BLUF) Cobalt’s 2021 report shows that organizations continue to struggle with long-known, preventable security issues, especially in web applications and APIs. For SMBs and insurance teams, the key takeaway is that common flaws such as misconfigurations, cross-site scripting, broken access control, and outdated software remain exploitable business risks when testing, remediation, and engineering workflows are inconsistent. Top 3-5 Most Notable Statistics •Cobalt analyzed 1,602 pentests performed in 2020. •Nearly 75% of customers requested web application testing or web app and API testing. •Findings were rated 15.4% High risk, 31.0% Medium risk, and 53.6% Low risk. •The top five vulnerability categories were Server Security Misconfigurations at 28.1%, Cross-Site Scripting at 15.5%, Broken Access Control at 14.7%, Sensitive Data Exposure at 8.4%, and Authentication and Sessions at 8%. •Survey respondents pentested only 63% of their application portfolios on average, and 6 out of 10 said fixed issues later re-emerged. Top 3-5 Exploitable Technology Risks •Server security misconfigurations: These were the most common vulnerability category and include issues such as missing security headers, insecure SSL/TLS, insecure cipher suites, and default credentials. •Cross-site scripting: Stored and reflected XSS remained common, allowing attacker-supplied code to be handled by a user’s browser when input is not properly validated or encoded. •Broken access control, especially IDOR: Insecure Direct Object References can let an attacker access another user’s files, records, or sensitive information by changing resource identifiers. |
| Cobalt | 2021 | Security Research Vendor |
| 695 | State of Pentesting 2022 | Bottom Line Up Front (BLUF) Cobalt’s 2022 pentesting data shows that organizations continue to struggle with the same preventable vulnerability categories: misconfigurations, cross-site scripting, broken access control, sensitive data exposure, and authentication/session issues. For SMBs and insurance teams, the key takeaway is that security risk is often driven less by exotic attacks and more by overloaded teams missing basic configuration, patching, and access-control work. Top 3-5 Most Notable Statistics •Cobalt analyzed 2,380 pentests conducted during 2021 and surveyed 602 cybersecurity and software development professionals. •Server Security Misconfigurations accounted for 38% of 2021 findings, the largest vulnerability category. •2021 findings were 54% Low severity, 24% Medium, 10% High, 11% Informational, and 0.88% Critical. •The median time to fix vulnerabilities was 14 days, though some findings took 31 days or longer. •84% of security respondents and 81% of development respondents said someone from their team had left within the past six months. Top 3-5 Exploitable Technology Risks •Stored Cross-Site Scripting: Attackers can inject malicious scripts into user-editable areas that are later executed in another user’s browser. •Insecure Direct Object References: Attackers may manipulate object identifiers to access files or data belonging to other users. •Outdated Software Versions: Unpatched components can expose organizations to known vulnerabilities, including remote code execution scenarios. |
| Cobalt | 2022 | Security Research Vendor |
| 696 | State of Pentesting 2023 | Bottom Line Up Front (BLUF) Cobalt’s 2023 pentesting data shows that many organizations are finding real exploitable weaknesses but are not consistently confirming that fixes work. For SMBs and insurance teams, the key issue is not just whether a pentest was performed, but whether high-risk findings were remediated, retested, and prevented from becoming part of a growing vulnerability backlog. Top 3-5 Most Notable Statistics •Nearly 40% of findings were related to server security misconfigurations. •Cobalt discovered more than 16,000 findings across 3,195 pentests completed in 2022. •Only 25% of 2022 findings had been remediated, retested, and confirmed as fixed at the time of reporting. •Only 61% of critical vulnerabilities had been confirmed as fixed, leaving 39% potentially untreated. •Among affected U.S. security teams, 76% said fewer resources led to a backlog of unaddressed vulnerabilities in 2022, and 82% expected the problem to worsen. Top 3-5 Exploitable Technology Risks •Stored Cross-Site Scripting, where attacker-controlled input can be injected and stored in web applications, was the most common finding and was frequently rated Medium or High severity. •Insecure Direct Object References can let attackers bypass authorization by changing a parameter that points directly to an object in a database. •Server security misconfigurations, including missing security headers, insecure SSL/TLS cipher suites, and fingerprinting or banner disclosure, were the largest category of findings. |
| Cobalt | 2023 | Security Research Vendor |
| 697 | State of Pentesting 2024 | Bottom Line Up Front (BLUF) Cobalt’s 2024 report shows that organizations are testing more, but also finding more vulnerabilities and taking longer to fix them. For SMBs and insurance teams, the key takeaway is that expanding attack surfaces, AI adoption, cloud migration, and staffing constraints are increasing exposure unless security testing and remediation are tightly prioritized. Top 3-5 Most Notable Statistics •Cobalt conducted 4,068 pentest engagements in 2023, a 31% year-over-year increase. •Pentesters found more than 39,000 vulnerabilities across those engagements. •Cobalt observed a 21% increase in findings per pentest engagement year over year. •Critical findings increased by 124% year over year; high and critical findings together increased by 39.26%. •The overall valid fix rate dropped to 29.31%, while security teams also reported layoffs, budget cuts, hiring freezes, and slower remediation. Top 3-5 Exploitable Technology Risks •AI and LLM systems: prompt injection, model denial of service, and sensitive information disclosure were common AI-system findings. •Web and API weaknesses: SQL injection, cross-site scripting, insecure direct object references, missing access control, and insecure output handling can expose data or allow unauthorized actions. •Authentication failures: authentication bypass, weak session controls, default credentials, and access management gaps create direct paths to unauthorized access. |
| Cobalt | 2024 | Security Research Vendor |
| 698 | State of Pentesting 2025 | Bottom Line Up Front (BLUF) Cobalt’s 2025 pentesting data shows a clear gap between security confidence and actual remediation: exploitable findings are common, and many remain open far longer than stated service-level goals. For SMBs and insurance teams, the key issue is not whether testing happens, but whether serious findings are fixed quickly enough to reduce real exposure. Top 3-5 Most Notable Statistics •81% of surveyed organizations are confident their security posture meets regulatory requirements, despite pentests continuing to find hidden vulnerabilities. •Less than half, 48%, of all pentest findings are resolved; for serious findings, the resolution rate rises to 69%. •The median time to resolve all findings is 67 days, far longer than the two-week remediation goal many organizations set. •32% of AI and LLM pentest findings are rated serious, compared with 13% of findings overall. •Only 21% of serious AI and LLM findings are resolved. Top 3-5 Exploitable Technology Risks •Web and API server security misconfigurations, including default settings, unnecessary services, misconfigured permissions, or missing patches. •Missing access controls that allow unauthorized users to reach sensitive data or functions. •Cross-site scripting, sensitive data exposure, and authentication/session weaknesses in web and API environments. |
| Cobalt | 2025 | Security Research Vendor |
| 699 | State of Physical Security 2025 | Bottom Line Up Front (BLUF) Genetec’s 2025 survey shows that physical security is now tightly connected to cybersecurity, data protection, cloud decisions, and IT governance. For SMBs and insurance teams, the key takeaway is that aging cameras, access control, storage, permissions, and poorly planned cloud or AI adoption can create operational, privacy, and cyber resilience risk. Top 3-5 Most Notable Statistics •57% of end users said aging or outdated physical security and/or IT infrastructure was a top challenge in 2024. •49% of end users delayed projects in 2024, and 54% expect economic uncertainty or inflation could cause project delays in 2025. •71% of end users reported educating users on cybersecurity best practices, up from 61% in 2023. •49% of end users reported fully on-premises physical security deployments with no cloud use. •75% of end users expressed concerns about AI design and implementation, especially responsible and ethical guidelines. Top 3-5 Exploitable Technology Risks •Aging physical security and IT infrastructure: outdated systems were a leading challenge, and open-ended responses specifically mentioned vulnerabilities on existing devices and technologies. •Weak access permissions and privileges: the report highlights fine-tuning user permissions and privileges as a major cybersecurity practice, indicating access control remains a key risk area. •Inadequate protection from unauthorized access: end users reported implementing controls to protect systems from unauthorized access, making this a core exposure for connected physical security systems. |
| Genetec | 2025 | OT/ICS Security Vendor |
| 700 | State of Privacy 2024 | Bottom Line Up Front (BLUF) ISACA’s 2024 privacy survey shows that many organizations are trying to meet growing privacy obligations with understaffed teams, uncertain budgets, and uneven business involvement. For SMBs and insurance teams, the key takeaway is that privacy risk is not only a legal issue; weak training, poor data visibility, and limited privacy-by-design practices can increase breach, compliance, and reputational exposure. Top 3-5 Most Notable Statistics •54% of respondents said technical privacy roles were somewhat or significantly understaffed. •43% considered their organization’s privacy budget underfunded, and 51% expected the budget to decrease in the next 12 months. •11% reported a material privacy breach in the last 12 months, while 18% did not know whether one occurred. •86% said their organizations provided privacy awareness training, and 71% said it had a positive impact. •69% said their enterprises practiced privacy by design when building new applications and services. Top 3-5 Exploitable Technology Risks •Weak or nonexistent privacy awareness training, identified as the most common privacy failure, can allow employees to mishandle personal information. •Poor data classification and breach response visibility, reflected by respondents who did not know whether personal information was compromised, can delay effective response. •AI use for privacy-related tasks may create risk if personal information entered into an AI platform is used to train future outputs. |
| ISACA | 2024 | ISAC / Industry Consortium |
| 701 | State of Privacy 2025 | Bottom Line Up Front (BLUF) ISACA’s State of Privacy 2025 shows that privacy risk remains a business risk, driven by staffing pressure, budget concerns, regulatory complexity, new technology risk, and inconsistent privacy-by-design practices. For SMBs and insurance teams, the key takeaway is that privacy failures are not only compliance issues; they can lead to breaches, fines, reputational damage, and loss of customer trust. Top 3-5 Most Notable Statistics •12% of respondents said their organization experienced a material privacy breach in the past 12 months. •43% believed their privacy budget was underfunded. •46% said their technical privacy team was understaffed, while 38% said their legal/compliance privacy team was understaffed. •61% identified experience with different technologies and applications as a top privacy skill gap. •27% reported always practicing privacy by design. Top 3-5 Exploitable Technology Risks •Social engineering was identified as a common privacy failure, meaning employee behavior remains a practical path to privacy incidents. •Data breach or leakage was identified as a common privacy failure and can directly expose personal information. •Bad or nonexistent detection of personal information can make it harder to identify what data was affected after an incident. |
| ISACA | 2025 | ISAC / Industry Consortium |
| 702 | State of Privacy 2026 | Bottom Line Up Front (BLUF) ISACA’s 2026 survey shows privacy teams are getting smaller while budget pressure and technology complexity are increasing. For SMBs and insurance teams, the key takeaway is that privacy risk is not only a compliance issue: weak staffing, poor training, limited monitoring, and low executive support can increase the chance of breaches, complaints, and operational strain. Top 3-5 Most Notable Statistics •Median privacy staff size fell from eight to five. •50% of respondents expect privacy budgets to decrease in the next 12 months. •44% said their privacy program faced obstacles. •14% reported a privacy breach in the past 12 months, up from 12% the prior year. •79% said their organization provides privacy awareness training. Top 3-5 Exploitable Technology Risks •Social engineering was identified as a common privacy failure, meaning employees remain a potential entry point for privacy incidents. •Data breach or leakage was identified as a common privacy failure, directly affecting sensitive personal data. •Bad or nonexistent detection of personal information was identified as a common privacy failure, making it harder to know where sensitive data exists. |
| ISACA | 2026 | ISAC / Industry Consortium |
| 703 | State of Product Security 2026 | Bottom Line Up Front (BLUF) AI-assisted software development is now widespread, but security visibility and governance are not keeping pace. For SMBs and insurance teams, the key concern is that faster code creation can also mean faster scaling of vulnerabilities, shadow tools, supply chain exposure, and compliance gaps. Top 3-5 Most Notable Statistics •100% of surveyed organizations reported AI-generated code in their codebase. •97% are actively using or piloting AI coding assistants. •Only 19% report complete visibility into how AI is used across development. •65% say overall security risk has increased since adopting AI coding assistants. •52% still lack a formal or centralized governance framework for AI adoption. Top 3-5 Exploitable Technology Risks •AI-generated code vulnerabilities: AI output can reintroduce insecure patterns, business logic flaws, and technical debt that may reach production if not reviewed. •Shadow AI tools: Unapproved or unmanaged AI tools can bypass procurement, security review, and compliance checks while handling sensitive or proprietary data. •Software supply chain risk: AI models, plugins, integrations, and dependencies may introduce code or logic with unknown provenance. |
| Cycode | 2026 | Application / API Security Vendor |
| 704 | State of Public APIs 2023 | Bottom Line Up Front (BLUF) Public APIs are a meaningful exposure point for SMBs because the report found security weaknesses, sensitive data leakage, and reliability issues across thousands of publicly documented APIs. For SMB owners and insurance teams, the key takeaway is that APIs should be treated as internet-facing business-critical assets, not just developer tools. Top 3-5 Most Notable Statistics •Escape scanned 6,478 public OpenAPI-documented APIs and sent 83,245 requests to gather the data. •Up to 12% of scanned APIs had more serious vulnerabilities, and around 0.5% had critical vulnerabilities. •The scan found straight 500 errors in 6% of tested APIs. •The dataset had a median response time of 500ms, with most APIs in the 400ms-700ms range and a long tail down to 1400ms p50. •About 90% of API documentations included a description, but 90% of specifications had zero examples. Top 3-5 Exploitable Technology Risks •Public API security weaknesses associated with OWASP API Top 10 categories, including serious and critical findings detected by passive scanning. •Minor security misconfigurations found across a large number of APIs, which may expose weaknesses even without active exploitation testing. •Sensitive data exposed publicly through error messages, including passwords and JSON Web Tokens. |
| Escape | 2023 | Threat Intelligence Vendor |
| 705 | State of Ransomware 2024 | Bottom Line Up Front (BLUF) Ransomware remains a major, high-cost threat even though the reported attack rate fell in 2024. For SMBs and insurance teams, the most important takeaway is that successful attacks are becoming more financially severe, especially when attackers exploit unpatched vulnerabilities, compromise backups, encrypt data, or steal data. Top 3-5 Most Notable Statistics •59% of surveyed organizations were hit by ransomware in the last year, down from 66% in each of the prior two years. •Organizations with less than $10M in revenue were still targeted: 47% were hit by ransomware. •70% of ransomware attacks resulted in data encryption, and in 32% of encryption events, data was also stolen. •94% of organizations hit by ransomware said attackers attempted to compromise backups, and 57% of those attempts succeeded. •Median ransom payments reached $2,000,000, a 5X increase from the $400,000 reported in 2023. Top 3-5 Exploitable Technology Risks •Unpatched vulnerabilities were the leading root cause, involved in 32% of attacks, and were linked to more severe outcomes including higher backup compromise, encryption, ransom payment, and recovery costs. •Compromised credentials accounted for 29% of attacks, showing the continued risk of stolen or abused login details. •Malicious email and phishing together accounted for 34% of attacks, making user-targeted email a major entry point. |
| Sophos | 2024 | Endpoint / MDR / XDR Vendor |
| 706 | State of Ransomware 2025 | Bottom Line Up Front (BLUF) Ransomware remains a major business and insurance loss driver, even though encryption rates, ransom demands, payments, recovery costs, and recovery times improved in 2025. For SMBs and insurance teams, the key takeaway is that preventable weaknesses—especially exploited vulnerabilities, compromised credentials, email attacks, security gaps, and lack of expertise—continue to determine whether an incident becomes a costly claim. Top 3-5 Most Notable Statistics •32% of ransomware attacks were attributed to exploited vulnerabilities, the most common technical root cause for the third year running. •50% of attacks resulted in data encryption, down from 70% in 2024. •49% of victims with encrypted data paid the ransom to get data back, the second-highest payment rate in six years. •The median ransom payment fell 50%, from $2 million in 2024 to $1 million in 2025. •Average recovery cost, excluding ransom payments, fell 44% to $1.53 million. Top 3-5 Exploitable Technology Risks •Exploited vulnerabilities were the leading technical root cause, showing the importance of identifying and closing weaknesses before attackers use them. •Compromised credentials remained a major attack vector and were the most common root cause for organizations with 100–250 employees. •Malicious email was cited as a root cause in 19% of attacks, making email a continued entry point for ransomware. |
| Sophos | 2025 | Endpoint / MDR / XDR Vendor |
| 707 | State of Ransomware in Healthcare 2025 | Bottom Line Up Front (BLUF) Healthcare ransomware remains a material operational and insurance risk, even though 2025 results show lower encryption rates, lower ransom payments, and faster recovery than prior years. For SMB healthcare organizations and insurance teams, the main takeaway is that attackers are still succeeding through preventable weaknesses: exploited vulnerabilities, malicious emails, compromised credentials, security gaps, and limited cybersecurity capacity. Top 3-5 Most Notable Statistics •33% of healthcare ransomware attacks were attributed to exploited vulnerabilities, the leading technical root cause. •34% of healthcare ransomware attacks resulted in data encryption, down from 74% in 2024. •12% of healthcare victims were held to ransom without data encryption, the highest rate reported in the survey. •The median ransom demand fell 91% to about $343K, while the median ransom payment fell to $150K. •Average recovery cost, excluding ransom payments, fell 60% to $1.02 million. Top 3-5 Exploitable Technology Risks •Exploited vulnerabilities were the top technical entry point, showing that unpatched or exposed weaknesses remain a major ransomware pathway. •Malicious emails caused 22% of attacks, making email-borne threats a continued practical risk. •Compromised credentials caused 18% of attacks, indicating that stolen or misused access remains a significant exposure. |
| Sophos | 2025 | Endpoint / MDR / XDR Vendor |
| 708 | State of Ransomware in Manufacturing 2025 | Bottom Line Up Front (BLUF) Ransomware remains a major business risk for manufacturing and production organizations, even though some outcomes improved in 2025. For SMBs and insurance teams, the key issue is that attacks still create high recovery costs, ransom exposure, data theft risk, operational disruption, and measurable pressure on IT and cybersecurity staff. Top 3-5 Most Notable Statistics •Exploited vulnerabilities were the leading technical root cause, used in 32% of ransomware incidents. •Data encryption fell to 40% of attacks, down from 74% in 2024, while 50% of attacks were stopped before encryption. •Among organizations that had data encrypted, 39% also experienced data theft. •51% of manufacturing and production organizations with encrypted data paid the ransom to recover data. •Average recovery cost, excluding ransom payments, was $1.3 million, while the median ransom payment was $1 million. Top 3-5 Exploitable Technology Risks •Exploited vulnerabilities: the most common technical entry point, showing the importance of finding and fixing weaknesses before attackers use them. •Malicious emails: involved in 23% of attacks, making email a continuing route for ransomware delivery. •Compromised credentials: used in 20% of incidents, meaning stolen or misused logins remain a practical attack path. |
| Sophos | 2025 | Endpoint / MDR / XDR Vendor |
| 709 | State of Security 2021 | Bottom Line Up Front (BLUF) Splunk’s 2021 report shows that security risk is being driven by cloud complexity, remote work, and supply chain exposure. For SMBs and insurance teams, the key takeaway is that incidents are not only technical events; they create remediation costs, lost productivity, business disruption, and potential data breach consequences. Top 3-5 Most Notable Statistics •84% of organizations suffered a significant security incident in the past two years. •42% reported business email compromise, 39% reported a data breach, and 31% reported ransomware. •76% of respondents said remote workers are harder to secure, and 53% said attacks increased during the pandemic. •78% of security leaders were concerned about future SolarWinds-style supply chain attacks. •88% said security spending will increase, including 35% who said it will increase significantly. Top 3-5 Exploitable Technology Risks •Business email compromise and phishing: These were among the most common reported incidents and can lead to account compromise, fraud, and data exposure. •Remote work endpoints and configurations: The report highlights challenges ensuring remote employee devices run endpoint security software and have secure configurations. •Multicloud and hybrid environments: Attackers can move across on-premises and cloud environments, making visibility and consistent controls critical. |
| Splunk | 2021 | SIEM / Security Analytics Vendor |
| 710 | State of Security 2022 | Bottom Line Up Front (BLUF) Splunk’s 2022 research shows that cyber incidents are becoming more frequent, more disruptive, and harder for security teams to manage. For SMBs and insurance teams, the main takeaway is that ransomware, business email compromise, insider attacks, cloud visibility gaps, and third-party risk can translate directly into downtime, data loss, remediation costs, and potential claims. Top 3-5 Most Notable Statistics •49% of organizations reported a data breach in the past two years, up from 39% the prior year. •79% of organizations encountered ransomware attacks, and 35% said at least one attack caused loss of access to data and systems. •54% reported unplanned downtime of business-critical applications due to a cybersecurity incident at least monthly. •51% reported business email compromise, up from 42% the prior year. •40% reported a regulatory violation, up from 28% the prior year. Top 3-5 Exploitable Technology Risks •Remote work environments: organizations are supporting far more remote workers than before the pandemic, and 78% said remote workers are harder to secure. •Cloud misconfiguration and poor cloud visibility: key issues include identifying non-compliant workloads, software vulnerabilities, audit trails for privileged accounts, and properly configuring security groups. •Ransomware exposure: many organizations developed formal ransomware playbooks only after being successfully attacked. |
| Splunk | 2022 | SIEM / Security Analytics Vendor |
| 711 | State of Security 2023 | Bottom Line Up Front (BLUF) Splunk’s 2023 research shows that security teams are improving resilience planning, but attacks are still frequent, disruptive, and costly. For SMBs and insurance teams, the key takeaway is that prevention alone is not enough: organizations need faster detection, response, and recovery because incidents are expected and downtime directly affects revenue, productivity, and customer trust. Top 3-5 Most Notable Statistics •53% of respondents said keeping up with security requirements is harder than it was two years ago. •88% reported cybersecurity staffing or skills challenges. •Attackers had an average dwell time of 2.24 months, or about nine weeks, before appropriate parties became aware. •62% reported that cybersecurity incidents take down business-critical applications at least once a month. •Downtime costs consumed 2.7% of annual revenue. Top 3-5 Exploitable Technology Risks •Software supply chain attacks and vulnerabilities, with 46% reporting successful attacks using that vector. •Ransomware, with 49% reporting a ransomware attack in the past two years. •Misconfigured systems, including server workloads, cloud services, and network security controls. |
| Splunk | 2023 | SIEM / Security Analytics Vendor |
| 712 | State of Security 2024 | Bottom Line Up Front (BLUF) Splunk’s 2024 report shows that cybersecurity teams are moving quickly into generative AI while attackers are expected to use the same tools to make familiar attacks faster, more convincing, and more frequent. For SMBs and insurance teams, the main takeaway is clear: basic security controls, faster detection and recovery, AI governance, and incident reporting readiness are now central to reducing business disruption and claim severity. Top 3-5 Most Notable Statistics •93% of respondents say line-of-business users rely on public generative AI tools, while 91% say security teams are also using them. •34% of organizations do not have a generative AI policy in place despite widespread adoption. •52% of respondents experienced at least one data breach in the past two years, and 49% experienced business email compromise. •48% experienced cyber extortion, compared with 45% that experienced ransomware. •55% estimate mean time to detect disruption-causing incidents at 14 days or less, up from 28% the prior year. Top 3-5 Exploitable Technology Risks •Generative AI data leakage: increased AI use is expected to bring more data leakage, yet only 49% are actively prioritizing data leakage prevention. •AI-assisted phishing and social engineering: respondents are concerned attackers will use generative AI to make existing attacks more effective and increase attack volume. •Misconfigured systems: the report identifies misconfigurations as the top threat vector in 2024 and emphasizes asset inventory as a basic control. |
| Splunk | 2024 | SIEM / Security Analytics Vendor |
| 713 | State of Security 2025 | Bottom Line Up Front (BLUF) Splunk’s 2025 survey shows that many security teams are losing effectiveness because of internal inefficiency: too many disconnected tools, too many low-quality alerts, poor data access, and skills gaps. For SMBs and insurance teams, the key takeaway is that breach risk is not only about attackers getting better; it is also about defenders being slowed down when speed, visibility, and coordination matter most. Top 3-5 Most Notable Statistics •66% of respondents experienced a data breach in the past year, making it the most common incident type reported. •41% reported ransomware incidents, and 38% reported insider risk incidents. •46% said they spend more time maintaining tools than defending against threats. •78% said their security tools are dispersed and disconnected, and 69% said this creates moderate to significant challenges. •57% lost valuable investigation time because of gaps in data management strategies. Top 3-5 Exploitable Technology Risks •Disconnected security tools can create visibility gaps, slow investigations, and weaken response when an incident is active. •Poor data quality undermines threat detection, with respondents identifying it as the leading cause of poor detection quality. •Alert overload and false positives can cause analysts to question alert validity or ignore alerts, increasing the chance that real incidents are missed. |
| Splunk | 2025 | SIEM / Security Analytics Vendor |
| 714 | State of Security Vendors: RSAC 2026 | Bottom Line Up Front (BLUF) Duha’s RSAC 2026 analysis shows a cybersecurity vendor market heavily dominated by AI messaging, crowded categories, and unclear differentiation. For SMBs and insurance teams, the key takeaway is that buying or underwriting security controls now requires extra scrutiny: many vendors are emphasizing themes and buzzwords rather than clearly explaining what problem they solve. Top 3-5 Most Notable Statistics •607 security vendor booths were observed in person across the RSAC 2026 show floor. •37% of booths mentioned AI, while 9% mentioned “Platform” and 4% mentioned “Enterprise.” •205 vendors used the term AI on their booth, 60 used “agent” or “agentic,” and 223 used at least one of those terms. •Almost 8% of exhibitors had booths where a security practitioner could not tell what the vendor did unless they already knew the company. •The largest categories identified were Applications at 98 vendors, Identity at 82, and Operations at 61. Top 3-5 Exploitable Technology Risks •Application security, including software supply chain, application testing, runtime security, and web delivery/browser-layer security, was the largest vendor category. •Identity, including IAM, IGA, MFA, ITDR, and non-human identities, was a major focus area and is described as expanding with the rise of agents. •SaaS and third-party ecosystem security were highlighted, especially where vendors discussed AI risk in third parties. |
| Duha | 2026 | Threat Intelligence Vendor |
| 715 | State of Software Security 2025 | Bottom Line Up Front (BLUF) Veracode’s 2025 report shows that software risk is less about whether applications have flaws and more about how quickly organizations find, prioritize, and fix the flaws that matter most. For SMBs and insurance teams, the key concern is security debt: long-unresolved vulnerabilities, especially in third-party and open-source code, that can remain exploitable for months or years. Top 3-5 Most Notable Statistics •80.3% of applications tested had at least one security flaw. •56.2% of applications had high-severity flaws across SAST, DAST, and software composition analysis scans. •74.2% of organizations had security debt, defined as flaws left unresolved for more than one year. •49.9% of organizations had critical security debt: high-severity flaws that remained unresolved for more than one year. •The average number of days to fix flaws increased 47% over five years, from 171 days to 252 days. Top 3-5 Exploitable Technology Risks •Third-party and open-source code flaws: 70% of applications had flaws in third-party code, and most critical security debt comes from third-party code. •High-severity, high-exploitability flaws: Veracode identifies these as the highest-risk region and recommends prioritizing them first. •OWASP Top 10 risks, including categories such as broken access control, cryptographic failures, injection, security misconfiguration, vulnerable and outdated components, and authentication failures. |
| Veracode | 2025 | Security Research Vendor |
| 716 | State of Software Security Report 2024 | Bottom Line Up Front (BLUF) Veracode’s 2024 report shows that software security debt—security flaws left unfixed for more than a year—is widespread and often includes high-severity issues. For SMBs and insurance teams, the key takeaway is that finding flaws is not enough; organizations need a practical process to prioritize and fix the riskiest issues before they become long-term exposure. Top 3-5 Most Notable Statistics •80% of active applications had unresolved flaws detected in their most recent scans. •42% of active applications had security debt, defined as flaws unresolved for more than one year. •71% of organizations had security debt, and 46% had critical security debt. •Third-party flaws took 50% longer to fix, with an 11-month half-life compared with 7 months for first-party flaws. •Only 64% of applications showed enough sustained remediation capacity to eliminate all critical security debt. Top 3-5 Exploitable Technology Risks •Vulnerable third-party and open-source components, which affected 70% of applications and represented a major software supply chain risk. •First-party application code flaws, which appeared in 63% of applications and accounted for most overall security debt. •Persistent high-severity flaws, which become critical security debt when left unresolved for more than a year. |
| Veracode | 2024 | Security Research Vendor |
| 717 | State of Software Security Report 2026 | Bottom Line Up Front (BLUF) Veracode’s 2026 report shows that software vulnerabilities are accumulating faster than organizations can fix them. For SMBs and insurance teams, the core concern is not whether flaws exist, but whether the business can identify its most critical applications, prioritize exploitable issues, and prove that remediation is being managed. Top 3-5 Most Notable Statistics •82% of organizations have security debt, meaning known vulnerabilities left unresolved for more than a year. •60% of organizations have critical security debt, up from 50% the prior year. •High-risk vulnerabilities increased by 36%, rising from 8.3% to 11.3% of flaws in the high-severity and high-exploitability category. •49% of applications now carry security debt, up from 42%. •The overall flaw remediation half-life is 243 days, while third-party flaw remediation half-life is 358 days. Top 3-5 Exploitable Technology Risks •High-severity, high-exploitability vulnerabilities: These are the flaws most likely to create real-world attack exposure and should be prioritized over generic severity-only rankings. •Long-lived unresolved vulnerabilities: Security debt gives attackers more time to find and exploit known weaknesses. •Third-party and open-source components: Third-party code represents 66% of critical security debt and takes longer to remediate than flaws overall. |
| Veracode | 2026 | Security Research Vendor |
| 718 | State of Software Security V12 2021 | Bottom Line Up Front (BLUF) Veracode’s 2021 State of Software Security report shows that application security practices are improving, but software risk remains concentrated in recurring flaw types, third-party libraries, and slow remediation. For SMBs and insurance teams, the key takeaway is that frequent scanning, multiple testing methods, and developer training can reduce security debt before flaws become larger operational or claims issues. Top 3-5 Most Notable Statistics •Organizations are scanning, on average, more than 17 new applications per quarter, more than triple the number from a decade ago. •90% of applications are now scanned more than once a week, with the majority scanned three times a week. •Use of multiple scan types increased by 31% between 2018 and 2021. •In 2017, nearly 35% of libraries used had a known flaw; in recent years that fell to nearly 10%. •77% of flaws in third-party libraries remain unfixed after three months. Top 3-5 Exploitable Technology Risks •Open-source and third-party libraries with known flaws remain a major risk, especially because many applications rely heavily on them. •Slow remediation of software composition analysis findings creates long-lived exposure in third-party components. •Server configuration and information leakage were consistently leading categories of flaws found through dynamic analysis. |
| Veracode | 2021 | Security Research Vendor |
| 719 | State of Software Supply Chain Security 2024 | Bottom Line Up Front (BLUF) Software supply chain security is now a practical business risk because attackers are abusing open source components, package distribution processes, and public vulnerabilities that are built into everyday applications. For SMBs and insurance teams, the key takeaway is that having an SBOM or basic awareness is not enough; organizations need to know whether their tools and processes can actually identify and respond to vulnerable or malicious software components. Top 3-5 Most Notable Statistics •100% of survey respondents said they were aware of a software supply chain attack against their organization at some point. •18% reported an attack within the last year, and 63% within the last two years. •75% of respondents said they were concerned or very concerned about software supply chain security. •Respondents estimated that, on average, 56% of their applications contained open source software. •About 50% request SBOMs from third-party software vendors, but 53% of those said they are not using them effectively. Top 3-5 Exploitable Technology Risks •Open source software packages containing malicious code, which can be built into applications without the organization realizing it. •Publicly disclosed vulnerabilities and zero-day exploit publications, which attackers use to update scanning scripts and target vulnerable public web applications. •Compromised software distribution processes, such as account takeover leading to malicious package versions being released through legitimate channels. |
| Checkmarx | 2024 | Application / API Security Vendor |
| 720 | State of South Korea's Cybersecurity 2026 | Bottom Line Up Front (BLUF) SecurityScorecard’s core finding is that South Korea’s cyber risk is driven less by isolated internal security failures and more by systemic supply chain exposure. For SMBs and insurance teams, the lesson is clear: even organizations with solid internal controls can inherit serious risk through vendors, cloud providers, software platforms, and downstream dependencies. Top 3-5 Most Notable Statistics •94% of the top 100 South Korean companies were exposed through at least one breached third-party vendor. •94% also had fourth-party exposure, with 2,474 fourth-party breach instances identified. •46% of organizations received a D or F security rating, indicating elevated breach probability. •Organizations rated F were 13.8 times more likely to experience a breach than those rated A. •Vendor concentration was high: Google served 82% of the portfolio, Amazon 77%, and Microsoft 70%. Top 3-5 Exploitable Technology Risks •Breached third-party vendors: Attackers can exploit trusted supplier relationships to reach organizations indirectly. •Fourth-party dependencies: Risk can enter through a vendor’s vendors, including cloud infrastructure, file transfer software, open-source components, SaaS platforms, and DevOps/security tools. •Vendor concentration: Heavy reliance on a few major providers creates single points of failure with broad disruption potential. |
| SecurityScorecard | 2026 | Security Research Vendor |
| 721 | State of Supply Chain Threats 2023 | Bottom Line Up Front (BLUF) Supply chain security remains a high-priority but unevenly managed risk: organizations are worried about vulnerable software, malicious open source components, and compromised third-party platforms, yet many still describe their software supply chain as unfinished. For SMBs and insurance teams, the key takeaway is that exposure may come through trusted software, vendors, or developer workflows—not only through direct attacks on the business. Top 3-5 Most Notable Statistics •71% of respondents list third-party risk and supply chain security as one of their top five security initiatives for the coming year. •Only 24% of organizations consider their software supply chain secure, while 55% say it is still a work in progress. •50% maintain a software bill of materials repository, but only 36% create complete SBOMs for all software they build and 41% regularly request SBOMs from vendors and suppliers. •24% of respondents say their organization experienced a supply chain attack over the past year. •Among organizations that experienced a supply chain attack, 34% say developers accidentally downloaded malicious components from public code registries such as npm, PyPI, or Maven. Top 3-5 Exploitable Technology Risks •Vulnerabilities in widely used commercial platforms, which respondents identify as a major concern because attackers can exploit trusted software used across many organizations. •Vulnerabilities in open source software components used in commercial applications, especially where organizations lack full visibility into dependencies. •Malicious packages in public code registries, including attacks using typosquatting, dependency hijacking, brandjacking, and dependency confusion. |
| Mend | 2023 | Supply Chain Security Vendor |
| 722 | State of the Call 2025 | Bottom Line Up Front (BLUF) Voice calling remains essential for sensitive and high-value business communication, but trust in the channel is being eroded by spam, fraud, spoofing, and AI-generated deepfake calls. For SMBs and insurance teams, the key takeaway is that voice-based scams are no longer just a consumer nuisance; they can disrupt sales, damage customer trust, enable social engineering, and create direct financial loss. Top 3-5 Most Notable Statistics •Hiya analyzed 262.8 billion calls and surveyed more than 12,000 consumers, 1,800 workers, and 600 IT and security leaders. •80% of unidentified calls are likely to go unanswered, with 48% of consumers saying they never answer unidentified calls and 33% rarely answering them. •39% of consumers and about half of workers reported experiencing a deepfake communication during a recent three-month period. •25% of spam calls analyzed in Hiya’s Q1 2025 honeypot contained AI-generated audio, and 55% of those AI-generated calls were identified as fraud. •33% of workers said their company lost money because they could not reach customers by phone. Top 3-5 Exploitable Technology Risks •Caller ID spoofing, where criminals use a business’s phone numbers or identity to make scam calls, undermining customer trust and brand reputation. •AI-generated voice deepfakes, which allow attackers to sound like trusted people and support phishing, social engineering, and credential theft. •Unidentified or mislabeled outbound business calls, including legitimate calls marked as spam, reducing answer rates and business reachability. |
| Hiya | 2025 | Threat Intelligence Vendor |
| 723 | State of the Cloud 2023 | Bottom Line Up Front (BLUF) Cloud environments are expanding in size and complexity, and the most immediate SMB risk highlighted by Wiz is preventable data exposure. Publicly exposed databases and storage buckets are common, and attackers can discover exposed cloud storage within hours, creating clear breach, downtime, and claims exposure. Top 3-5 Most Notable Statistics •47% of companies have at least one database or storage bucket publicly exposed to the internet. •Attackers attempted to list exposed S3 buckets with guessable names in as little as 13 hours, and buckets referenced in a public GitHub repository in 7 hours. •57% of companies use more than one cloud platform; 22% use three or more platforms. •Cloud provider API privileges increased by 15% for AWS, 20% for Azure, and 45% for GCP over the past year. •90% of companies use a mix of managed and non-managed database servers, while only 6% use managed database servers exclusively. Top 3-5 Exploitable Technology Risks •Publicly exposed databases and storage buckets, especially where sensitive data is present, create direct opportunities for discovery and access by attackers. •Exposed S3 buckets with common or guessable names, or buckets referenced in public GitHub repositories, can be found rapidly by attackers scanning for cloud data. •AWS EC2 instances using IMDSv1 remain exposed to SSRF-related credential theft risks when the host has other vulnerabilities; IMDSv2 is described as the more secure option. |
| Wiz | 2023 | Threat Intelligence Vendor |
| 724 | State of the Internet 2021 | Bottom Line Up Front (BLUF) The report’s central finding is that organizations often feel confident about cloud security while lacking reliable visibility into their actual cloud assets. For SMBs and insurance teams, this matters because unknown or poorly tracked cloud services can expose remote access, databases, storage, and other systems that attackers can find and exploit. Top 3-5 Most Notable Statistics •52% of respondents either do not know what they use to track cloud assets, do not track them at all, or rely on manual methods such as spreadsheets. •57% of respondents are very or extremely confident in their organization’s visibility into cloud assets, despite weak tracking practices. •82% of respondents say they use four or fewer public cloud providers, while observed Fortune 500 cloud environments averaged 25 different cloud providers. •Censys found 1.9 million RDP exposures across a dozen common cloud providers. •68% of respondents said worry about exposed cloud services keeps them up at night. Top 3-5 Exploitable Technology Risks •Exposed Remote Desktop Protocol services, which can provide remote access paths into cloud environments. •Exposed databases, including MySQL, Postgres, Redis, and Elasticsearch. •Publicly accessible cloud stores, which can lead to data exposure. |
| Censys | 2021 | Security Research Vendor |
| 725 | State of the Internet 2022 | Bottom Line Up Front (BLUF) Censys’ 2022 report shows that the biggest Internet-facing risk is not exotic zero-days, but everyday exposure: unmanaged assets, misconfigurations, weak authentication, and slow patching. For SMBs and insurance teams, the key takeaway is that visibility into public-facing systems is a core control because attackers can find exposed services even when the business does not know they exist. Top 3-5 Most Notable Statistics •Misconfigurations made up roughly 60% of observed Internet-facing risks, exposures 28%, and software vulnerabilities 12%. •HTTP, SSH, SMTP, and FTP represented 87% of Internet services observed; HTTP alone represented 81%. •Organizations studied had an average of 44 domain registrars and presence in 17 hosting providers, including cloud, datacenter, and on-premises equipment. •Censys observed 102,060 services vulnerable to Log4j-related exposure; by March 2022, 36% remained vulnerable. •In the Deadbolt ransomware campaign, Censys observed 4,988 QNAP devices locked in the initial January campaign and later tracked 132 paid ransoms totaling $187,665. Top 3-5 Exploitable Technology Risks •Unencrypted weak authentication pages, which can expose submitted credentials to interception and hash cracking. •Missing common security headers, such as Content Security Policy or Strict Transport Security, which can make services more susceptible to cross-site scripting or data injection. •Self-signed certificates, which reduce identity assurance and can support man-in-the-middle attacks or phishing. |
| Censys | 2022 | Security Research Vendor |
| 726 | State of the Internet 2023 | Bottom Line Up Front (BLUF) Censys’ 2023 report shows that internet-facing risk is driven less by advanced attacks and more by exposed, misconfigured, or outdated web services. For SMBs and insurance teams, the most important takeaway is that basic external exposure management can reduce the chance that a simple mistake becomes a data leak, credential exposure, or broader security incident. Top 3-5 Most Notable Statistics •Censys observed over 740 million hosts running 1.3 billion HTTP services in an early 2023 internet snapshot. •Over 8,000 servers were found hosting potentially sensitive information, including database dumps, backup files, passwords, configuration files, and private keys. •Over 40,000 Prometheus servers were exposed to the internet, monitoring over 219,000 endpoints. •Over 48% of active Prometheus-monitored endpoints existed exclusively in private IP space or internal DNS zones, making internal network details visible from the public internet. •Nearly 95% of encrypted HTTP services supported TLS 1.2 or 1.3, while TLS 1.3 adoption increased by just over 20% since early 2022. Top 3-5 Exploitable Technology Risks •Exposed sensitive files on web servers, including backups, database dumps, passwords, environment variables, and SSL or SSH private keys, which can give attackers direct access or useful footholds. •Internet-exposed Prometheus monitoring servers, which can reveal internal systems, private IP ranges, DNS names, and operational details useful for reconnaissance. •Exposed SwaggerUI and API documentation, which can help attackers identify APIs, understand how they work, and look for paths to sensitive data or unauthorized access. |
| Censys | 2023 | Security Research Vendor |
| 727 | State of the Internet 2024 | Bottom Line Up Front (BLUF) Censys’ 2024 report finds that Internet-exposed industrial control systems, especially human-machine interfaces (HMIs), create a practical and low-complexity path for attackers to manipulate industrial operations. For SMBs and insurance teams, the key takeaway is that remote access convenience can become a direct operational risk when systems are exposed without authentication, VPN protection, or other access controls. Top 3-5 Most Notable Statistics •Censys observes over 145,000 exposed industrial control system services globally. •38% of exposed ICS services are in North America, 35% are in Europe, and 22% are in Asia. •The U.S. accounts for over one third of global ICS service exposures, with over 48,000 exposed services. •Censys identified nearly 7,700 hosts across 80 countries running HMIs. •Of C-More HMIs that Censys could classify by industry, 34% were water and wastewater related and 23% were associated with agriculture. Top 3-5 Exploitable Technology Risks •Internet-exposed HMIs without authentication or VPN protection, which can allow threat actors to view, deface, or manipulate industrial interfaces. •AutomationDirect C-More HMIs, which run a public web server and a proprietary programming protocol that is enabled by default and has weak or no authentication. •Red Lion Crimson HMIs, which are often misconfigured to allow full remote access, including control of automation systems and access to device logs and system information. |
| Censys | 2024 | Security Research Vendor |
| 728 | State of the Internet 2025 | Bottom Line Up Front (BLUF) Censys finds that attacker infrastructure is fast-moving but not invisible: command-and-control services, open directories, and residential proxy networks leave patterns that can be tracked with current and historical Internet visibility. For SMBs and insurance teams, the key takeaway is that exposed services, unmanaged devices, and non-standard ports can become part of attacker operations or create investigation blind spots. Top 3-5 Most Notable Statistics •Censys examined 80 malware detections over 6 months, from December 2024 to May 2025. •Censys observed an average of 2,906 malware detections per snapshot date. •Cobalt Strike represented 34% of observed C2 detections as of May 2025, followed by Viper at 15% and Sliver at 13%. •Malware detections appeared across 62 countries, with China and the United States collectively hosting 55% of observed malware. •For open web directories, 50% vanished from network visibility in less than 1 day, while 50% changed contents within about 3 days. Top 3-5 Exploitable Technology Risks •Cobalt Strike, Viper, and Sliver C2 infrastructure: these tools are used for command-and-control and post-exploitation activity, and their lifespans vary by family and port. •Open web directories: attackers use them to host malicious payloads, and their short network visibility makes them hard to detect through single-point-in-time scanning. •Residential proxy and ORB-like infrastructure: compromised routers, smart speakers, and other IoT devices can relay malicious traffic through trusted residential IP space. |
| Censys | 2025 | Security Research Vendor |
| 729 | State of the Internet/Security Ransomware Report 2025: Building Resilience Amid a Volatile Threat Landscape | Bottom Line Up Front (BLUF) Ransomware is becoming more volatile, easier to launch, and more disruptive because attackers are combining ransomware-as-a-service, AI-assisted social engineering, data theft, DDoS pressure, and regulatory threats. For SMBs and insurance teams, the main issue is not just ransom payment; it is business interruption, recovery cost, legal exposure, and whether required controls were actually in place before the incident. Top 3-5 Most Notable Statistics •Ransomware increased by 37% in 2024 and accounted for 44% of data breaches globally. •In APAC, ransomware accounted for 51% of data breaches; in EMEA, 27% of enterprises experienced a ransomware attack; in LATAM, 29% of enterprises reported an attack. •More than US$724 million in cryptocurrency was extorted from strains linked to the TrickBot malware family. •The average reported downtime after a ransomware incident is 21 days. •When data is encrypted, 35% of companies either do not receive the decryption keys they paid for or the keys do not work. Top 3-5 Exploitable Technology Risks •Default or reused VPN credentials, which can allow unauthorized access and create an entry point for ransomware operators. •Weak internal segmentation, which lets attackers move laterally and encrypt or compromise more systems after initial access. •Web applications, APIs, and newer GenAI-related infrastructure that may not be fully covered by existing web application firewall protections. |
| Akamai | 2025 | Network Security Vendor |
| 730 | State of the Media 2024 | Bottom Line Up Front (BLUF) Cision’s 2024 report is not a cybersecurity threat report; its most important takeaway is that credibility, verified information, and relevance are the core requirements for reaching technology journalists. For SMBs and insurance teams, this matters because public-facing communications can succeed or fail based on whether information is accurate, sourced, timely, and useful to the intended audience. Top 3-5 Most Notable Statistics •43% of technology journalists cited maintaining credibility as a trusted news source and combating accusations of “fake news” as a top industry challenge. •50% of technology journalists use generative AI tools in some form, including research, outlines, brainstorming, and multimedia creation. •77% of technology journalists most want news announcements or press releases from PR professionals, while 68% want original research reports. •More than 60% of technology journalists receive over 50 pitches per week, yet 72% said only 0%–25% of the pitches they receive are relevant. •76% said spamming them with irrelevant pitches would make them block a PR professional or put them on a “don’t call” list. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs For SMBs, the report highlights a communications risk rather than a technical security risk: getting ignored, blocked, or distrusted because outreach is irrelevant, inaccurate, unsourced, or overly promotional. Smaller businesses often have fewer opportunities to build media credibility, so poor communication can damage relationships with journalists who influence public understanding of technology companies and products. The report does not quantify costs, downtime, targeting likelihood, or cyber loss exposure. It does show that journalists value press releases, original research, industry experts, timely responses, and multimedia assets, which means SMBs with clear, factual, and well-supported information may be better positioned to earn coverage. |
| Cision | 2024 | Media / Independent Research |
| 731 | State of the Phish 2022 | Bottom Line Up Front (BLUF) Proofpoint’s 2022 report shows that phishing and social engineering remained widespread and more successful in 2021, with attackers exploiting remote work, cloud collaboration, trusted brands, and employee knowledge gaps. For SMBs and insurance teams, the key takeaway is that people-driven risk is not a minor issue: it is directly tied to credential theft, ransomware, data loss, financial fraud, and business downtime. Top 3-5 Most Notable Statistics •More than 80% of surveyed organizations suffered a successful email-based phishing attack in 2021, a 46% increase from 2020. •86% of organizations faced bulk phishing attacks, 79% saw attacks targeting specific users, 77% faced business email compromise, and 78% saw email-based ransomware attacks. •68% of organizations experienced at least one ransomware infection in 2021, up from 66% in 2020. •83% of working adults received at least one suspicious communication in 2021, and 42% took a dangerous action such as clicking a malicious link, downloading malware, or exposing data or credentials. •Proofpoint customers sent nearly 100 million simulated phishing attacks, with an average failure rate of 11%. Top 3-5 Exploitable Technology Risks •Email-based phishing remains the leading risk, including malicious links, dangerous attachments, credential-harvesting pages, and emails that impersonate trusted senders. •Business email compromise, including payroll redirect and supplier invoicing fraud, creates direct financial loss exposure. •Ransomware delivered through email and first-stage malware is a major concern, with Proofpoint observing malware families linked to later-stage ransomware. |
| Proofpoint | 2022 | Email Security Vendor |
| 732 | State of the Phish 2023 | Bottom Line Up Front (BLUF) Proofpoint’s 2023 report shows that people remain the primary target and weak point in phishing-driven cyber risk, even as attackers adopt more creative methods such as telephone-based scams and MFA bypass. For SMBs and insurance teams, the most important takeaway is that successful phishing is strongly tied to business loss, including ransomware, account compromise, data breach, and direct financial fraud. Top 3-5 Most Notable Statistics •84% of organizations experienced at least one successful email-based phishing attack in 2022. •64% of organizations were infected by ransomware, and 64% of infected organizations paid at least one ransom. •90% of organizations infected by ransomware had cyber insurance. •30% of organizations that suffered a successful attack experienced direct financial loss, a 76% year-over-year increase. •34% of working adults took at least one risky action during the year, such as clicking a phishing link, downloading malware, or giving credentials to an untrustworthy source. Top 3-5 Exploitable Technology Risks •Telephone-oriented attack delivery, where victims are lured into calling an attacker-controlled number and may be guided to download malware, transfer money, or enable remote access. •MFA bypass phishing, including off-the-shelf phishing kits that can defeat multi-factor authentication protections. •Brand abuse using familiar names such as Microsoft, Amazon, DocuSign, Google, DHL, and Adobe to make malicious emails, files, or cloud links appear trustworthy. |
| Proofpoint | 2023 | Email Security Vendor |
| 733 | State of the Phish 2024 | Bottom Line Up Front (BLUF) Proofpoint’s 2024 report shows that the human factor remains a primary path into organizations: employees often take risky actions even when they know those actions are unsafe. For SMBs and insurance teams, this means phishing, business email compromise, ransomware, and credential theft risk cannot be managed by technology or training alone; behavior change, easier security processes, and current threat-aware education are critical. Top 3-5 Most Notable Statistics •71% of users admitted taking a risky action, and 96% of them knew they were doing something risky. •69% of organizations were infected by ransomware. •Proofpoint detected and blocked an average of 66 million targeted BEC attacks per month. •An average of 10 million telephone-oriented attack delivery messages were sent every month. •Around 1 million phishing threats using the EvilProxy MFA-bypass framework were seen every month, while 89% of security professionals still believed MFA fully protects against account takeover. Top 3-5 Exploitable Technology Risks •Phishing and social engineering that exploit users clicking unknown links, opening attachments, responding to unfamiliar senders, or sharing credentials. •MFA-bypass phishing kits, including EvilProxy, that intercept MFA tokens and can help attackers take over accounts despite one-time codes or biometrics. •Telephone-oriented attack delivery, where users are lured into calling malicious call centers that may request remote access, sensitive information, credentials, or malware installation. |
| Proofpoint | 2024 | Email Security Vendor |
| 734 | State of the Software Supply Chain 2021 | Bottom Line Up Front (BLUF) Sonatype’s 2021 report shows that software supply chain risk is growing rapidly as businesses consume more open source software and attackers increasingly target upstream software components, build tools, repositories, and service providers. For SMBs and insurance teams, the key issue is that a company can be exposed through software it did not write, vendors it relies on, or automated development processes that pull in vulnerable or malicious components. Top 3-5 Most Notable Statistics •Software supply chain attacks increased 650% year over year in 2021, up from 430% in the prior report. •Developers are projected to request more than 2.2 trillion open source packages in 2021, representing 73% year-over-year growth. •The top four open source ecosystems contain 37,451,682 component versions and introduced 723,570 new projects in the past year. •Among the top 10% most popular Java, JavaScript, Python, and .NET projects, 29% contain at least one known vulnerability, compared with 6.5% of less popular projects. •Commercial engineering teams actively update only 25% of the components they use, and 70% of remediations are described as suboptimal. Top 3-5 Exploitable Technology Risks •Dependency confusion, where attackers publish malicious public packages using the same names as internal packages, causing build tools to pull the attacker’s version. •Public package repositories that do not strictly enforce namespace ownership, including npm, PyPI, RubyGems, and NuGet, which the report identifies as susceptible to namespace confusion. •Malicious code injection into open source projects, including through stolen maintainer credentials, malicious releases, pull requests, or tampered developer tools. |
| Sonatype | 2021 | Security Research Vendor |
| 735 | State of the Software Supply Chain 2026 | Bottom Line Up Front (BLUF) Sonatype’s report shows that open source software supply chain risk has moved from isolated package issues to a structural business risk driven by massive reuse, automated downloads, malware campaigns, weak vulnerability data, and AI-assisted development. For SMBs and insurance teams, the key concern is that everyday software development workflows can now import malicious, vulnerable, or unsupported components at speed, creating claims-relevant exposure before a business realizes it has a problem. Top 3-5 Most Notable Statistics •9.8 trillion downloads occurred in 2025 across Maven Central, PyPI, npm, and NuGet. •1,233,219 open source malware packages have been logged by Sonatype since 2019. •Over 99% of open source malware in 2025 occurred on npm. •65% of open source CVEs were left without CVSS scoring by the NVD. •Sonatype observed a 27.8% dependency upgrade hallucination rate from a leading LLM. Top 3-5 Exploitable Technology Risks •Malicious open source packages targeting developer machines, credentials, tokens, CI secrets, and build environments. •npm malware campaigns, including self-replicating malware and large-scale malicious package floods. •Vulnerable dependencies that continue to be downloaded even when fixed versions exist, including Log4j and other widely used Java components. |
| Sonatype | 2026 | Security Research Vendor |
| 736 | State of the Threat Report 2021 | Bottom Line Up Front (BLUF) Ransomware is the leading threat for most organizations, and Secureworks emphasizes that many attacks succeed because of gaps in basic security controls. For SMBs and insurance teams, the key issue is operational loss: ransomware can cause total business disruption, while business email compromise and identity abuse can create direct financial loss without requiring malware. Top 3-5 Most Notable Statistics •Ransomware rose 8% as a proportion of Secureworks incident response engagements in Q1 and Q2 2021 compared with the previous year. •Secureworks conducted over 1,300 incident response engagements from July 2020 across a wide range of sectors. •Secureworks processes approximately 2 trillion security events every week from customer environments. •Google Project Zero data cited in the report showed exploited zero-days reached 37 by early August 2021, exceeding the 25 observed across all of 2020. •FBI figures cited in the report showed reported personal and business email compromise losses of $1.85 billion in 2020, with an average BEC wire transfer request of $85,000 in early 2021. Top 3-5 Exploitable Technology Risks •Public-facing, unpatched systems remain a major entry point. The report highlights exploitation of Citrix NetScaler, Pulse Connect Secure, Fortinet FortiOS, Microsoft Exchange Server, Accellion FTA, Kaseya, SolarWinds Orion, and SolarWinds Serv-U vulnerabilities. •Single-factor Microsoft 365 email accounts are highly exploitable in BEC attacks, allowing attackers to steal credentials, monitor invoices, create forwarding rules, and redirect payments. •Identity federation and single sign-on systems can be abused when attackers steal SAML token-signing certificates, add credentials to Azure applications, or modify cloud permissions. |
| Secureworks | 2021 | MSP / MSSP / SOC Provider |
| 737 | State of the Threat Report 2022 | Bottom Line Up Front (BLUF) Ransomware remains the primary strategic threat, but the report shows that many attacks provide a short window for detection before encryption occurs. For SMBs and insurance teams, the key issue is whether basic controls, vulnerability management, and monitoring are strong enough to stop or detect attackers before business disruption and claims costs escalate. Top 3-5 Most Notable Statistics •4.5 days was the median time between initial access and ransomware deployment in 2022 incidents investigated by Secureworks. •52% of ransomware incidents used exploitation of remote services as the initial access vector, replacing credential-based access as the most common path. •39% of ransomware incidents used credentials as the initial access vector. •Over two million credentials obtained by infostealers were observed for sale on one underground marketplace on a single day in June 2022. •Secureworks incident responders saw a 27% year-on-year increase in business email compromise incidents in the first half of 2022 compared with the same period in 2021. Top 3-5 Exploitable Technology Risks •Internet-facing remote services, because exploitation of these services became the most common ransomware access vector. •Unpatched critical vulnerabilities, including Microsoft Exchange ProxyShell, Log4Shell, Fortinet vulnerabilities, and BIG-IP CVE-2022-1388, because attackers used or attempted to exploit them for remote access or code execution. •Weak, stolen, or phished credentials, including credentials gathered by infostealers and used for ransomware or business email compromise. |
| Secureworks | 2022 | MSP / MSSP / SOC Provider |
| 738 | State of the Threat Report 2023 | Bottom Line Up Front (BLUF) Ransomware remains the primary cyber threat to organizations because attacks are frequent, fast, and disruptive. For SMBs and insurance teams, the key issue is speed: Secureworks observed ransomware moving from initial access to payload delivery in a median of just 24 hours, leaving little time to detect and respond once an attacker is inside. Top 3-5 Most Notable Statistics •Ransomware dwell time dropped to a median of 24 hours between initial access and ransomware payload delivery. •Scan-and-exploit and stolen credentials each accounted for approximately 32% of ransomware intrusions investigated by Secureworks. •Commodity malware delivered via phishing emails accounted for 14% of ransomware initial access in investigated engagements. •Russian Market listed over 7 million infostealer logs for sale on a single day in June 2023, up from 2.9 million a year earlier. •The FBI reported 21,832 BEC complaints in 2022 with adjusted U.S. losses of over $2.7 billion. Top 3-5 Exploitable Technology Risks •Unpatched internet-facing systems: attackers use scan-and-exploit to find vulnerable servers and gain access quickly. •Stolen credentials for VPNs, Microsoft Office Web Access, and other remote access services: infostealers and phishing make these a major ransomware precursor. •File transfer and collaboration platforms: GoAnywhere MFT, MOVEit Transfer, Accellion FTA, SolarWinds Serv-U, and Zimbra were highlighted as targets in mass exploitation or extortion activity. |
| Secureworks | 2023 | MSP / MSSP / SOC Provider |
| 739 | State of the Threat Report 2024 | Bottom Line Up Front (BLUF) Cyber risk remains high for organizations of all sizes, with ransomware still the most pressing cybercrime threat and attackers continuing to favor easy, opportunistic access. For SMBs and insurance teams, the key issue is speed: ransomware can move from initial compromise to deployment in hours, especially when basic controls such as patching, phishing-resistant MFA, and effective detection are missing. Top 3-5 Most Notable Statistics •730 ransomware victims were listed on leak sites in March 2024, the busiest month on record in the report’s dataset. •Unpatched vulnerabilities accounted for nearly 50% of known initial access vectors in ransomware attacks. •One or more core defenses were absent in over 50% of incidents handled by Secureworks incident responders. •More than half of observed ransomware incidents had dwell times under 28 hours. •The shortest ransomware dwell time observed was just under 7 hours. Top 3-5 Exploitable Technology Risks •Unpatched internet-facing systems, especially perimeter devices, remain a leading path into victim networks. •Vulnerabilities in products such as Citrix NetScaler, F5 BIG-IP, Ivanti Connect Secure VPN, Ivanti Policy Secure, Oracle WebLogic, MOVEit Transfer, Fortra GoAnywhere, and SysAid were highlighted as exploited or targeted. •Stolen credentials, especially where MFA was absent, remain a major initial access route. |
| Secureworks | 2024 | MSP / MSSP / SOC Provider |
| 740 | State of Threat and Exposure Management Report 2024 | Bottom Line Up Front (BLUF) NopSec’s 2024 report shows that vulnerability risk is less about chasing every “critical” CVSS score or headline vulnerability and more about prioritizing vulnerabilities with real exploitation signals, business context, and asset exposure. For SMBs and insurance teams, the key takeaway is that remediation resources should focus first on vulnerabilities that are exploitable, common in the environment, used in attacks, or tied to malware, credential compromise, privilege escalation, and lateral movement. Top 3-5 Most Notable Statistics •NopSec analyzed 36 million vulnerabilities detected across organizations using its platform. •Microsoft accounted for 11% of published CVEs, affected 55% of organizational assets, and represented 40% of detected vulnerabilities. •49% of detected vulnerabilities had been remediated at the time of analysis. •CVSS rated over 70% of detected vulnerabilities as high or critical, while NopSec’s Business Risk Score rated 20% as high or critical. •The overall average time-to-remediation was 212 days. Top 3-5 Exploitable Technology Risks •Microsoft Exchange Server remote code execution: ProxyLogon can allow unauthenticated admin impersonation, arbitrary file writing, and remote code execution with SYSTEM privileges. •Windows Print Spooler remote code execution: PrintNightmare can allow attackers to run arbitrary code with SYSTEM privileges, install programs, change or delete data, and create full-rights accounts. •Spring Framework JDK 9+ remote code execution: Spring4Shell is associated with public exploits, malware, active exploitation, credential compromise, privilege escalation, and lateral movement scenarios. |
| NopSec | 2024 | Threat Intelligence Vendor |
| 741 | State of Trust Report 2024 | Bottom Line Up Front (BLUF) Vanta’s 2024 State of Trust Report shows that organizations face rising cybersecurity, third-party, AI, and compliance pressures while security teams remain under-resourced. For SMBs and insurance teams, the key takeaway is that trust is now both a security requirement and a business requirement: weak vendor oversight, limited AI governance, and manual compliance processes can increase risk, slow operations, and damage customer confidence. Top 3-5 Most Notable Statistics •55% of organizations say security risks for their business have never been higher. •50% of organizations detect and respond to cybersecurity threats at least once a week. •46% of organizations say a vendor has experienced a data breach since they started working together. •Organizations spend 11 working weeks per year on compliance tasks, up from 10 in 2023. •Only 36% of organizations have, or are in the process of putting, a company AI policy in place, and only 37% conduct or are conducting regular AI risk assessments. Top 3-5 Exploitable Technology Risks •Phishing attacks: Businesses reported more phishing attacks over the last 18 months, making employee targeting a clear ongoing attack path. •AI-based malware: The report notes a rise in AI-based malware, increasing concern as AI becomes more common in business technology stacks. •Third-party vendor breaches: Nearly half of organizations reported a vendor breach, showing that attackers can affect a business through its suppliers and service providers. |
| Vanta | 2024 | Threat Intelligence Vendor |
| 742 | State of Trusted Open Source 2025 | Bottom Line Up Front (BLUF) Chainguard’s report shows that open source risk is concentrated in the “longtail” of less-popular container images, not just in the common technologies most teams actively manage. For SMBs and insurance teams, the key takeaway is that software supply chain exposure may be hiding in overlooked dependencies that still run in production and still require fast vulnerability remediation. Top 3-5 Most Notable Statistics •98% of vulnerabilities remediated in Chainguard images occurred outside the top 20 most popular projects. •The top images represent only 1.37% of available images but account for roughly half of container pulls. •1,436 longtail images make up 61.42% of the average customer’s container portfolio. •44% of Chainguard customers run at least one FIPS image in production. •Critical CVEs were remediated in less than 20 hours on average, with 100% resolved within three days. Top 3-5 Exploitable Technology Risks •Longtail container images outside the top 20 projects, where the report says most vulnerability burden accumulates and patching is hardest to operationalize. •Open source dependencies that engineering teams do not actively manage because they fall outside the core stack, despite being part of production workloads. •Critical and High CVEs across container images, where business risk depends heavily on how quickly fixes are available and applied. |
| Chainguard | 2025 | Supply Chain Security Vendor |
| 743 | State of Vulnerabilities Report 2024 | Bottom Line Up Front (BLUF) Synack’s 2024 report shows that exploitable vulnerabilities remain common, severe, and slow enough to fix that attackers may have meaningful time to act. For SMBs and insurance teams, the key takeaway is to focus less on counting every flaw and more on quickly finding and remediating the vulnerabilities most likely to cause a breach or business disruption. Top 3-5 Most Notable Statistics •Synack analyzed 658,596 hours of human-led penetration testing that surfaced over 14,000 exploitable vulnerabilities. •Real-world vulnerability exploitation surged by 180% as a share of data breaches last year, according to the report’s cited Verizon data. •Synack customers reduced average remediation time for critical vulnerabilities by 24 days and high-severity vulnerabilities by 18 days. •In 2023, almost 37% of all vulnerabilities found by Synack were critical or high severity. •The average time to remediate a critical vulnerability in 2023 was still 56 days. Top 3-5 Exploitable Technology Risks •SQL injection: The report repeatedly identifies SQL injection as a persistent, high-impact flaw, with injection vulnerabilities accounting for roughly a third of vulnerabilities found. •Remote code execution: RCE flaws are described as recurring high-impact vulnerabilities that can create serious exposure if exploited. •Cross-site scripting and content injection: These remain present across industries and, in some cases, increased in severity. |
| Synack | 2024 | Threat Intelligence Vendor |
| 744 | Symantec Ransomware Threat Landscape 2026 | Bottom Line Up Front (BLUF) Ransomware remained at record levels in 2025, but the bigger shift is the growth of extortion attacks that do not encrypt systems and instead rely on stolen data. For SMBs and insurance teams, this means a “no downtime” incident can still become a serious claim involving data theft, ransom demands, customer impact, and recovery costs. Top 3-5 Most Notable Statistics •Ransomware actors claimed 4,737 attacks in 2025, the highest total recorded in the report. •Claimed ransomware attacks increased 0.8% from 2024 to 2025. •When encryptionless extortion is included, total extortion attacks reached 6,182 in 2025, a 23% increase over 2024. •Akira and Qilin each accounted for 16% of claimed ransomware attacks in 2025. •Inc and Safepay each accounted for 6%, while DragonForce accounted for 5% of claimed attacks. Top 3-5 Exploitable Technology Risks •Public-facing applications and appliances, including file transfer, VPN, firewall, SharePoint, Exchange, Fortinet, Cisco, and Oracle E-Business Suite systems, were repeatedly highlighted as entry points. •Remote monitoring and management tools, especially SimpleHelp, ScreenConnect, Atera, AnyDesk, MeshAgent, RustDesk, and PDQ Deploy, were used for access, persistence, deployment, or lateral movement. •Backup and recovery platforms, including Veeam Backup & Replication, were targeted or abused, increasing recovery risk. |
| Symantec | 2026 | Endpoint / MDR / XDR Vendor |
| 745 | Synopsys DevSecOps Practices and Open Source Management 2020 | Bottom Line Up Front (BLUF) Open source software is now a core part of modern application development, but unmanaged open source creates clear security, operational, and compliance risk. For SMBs and insurance teams, the most important takeaway is that slow patching, incomplete inventories, and aging components can turn a known vulnerability into a breach or business interruption. Top 3-5 Most Notable Statistics •63% of respondents reported some level of DevSecOps adoption, including 33% with mature or widely deployed practices and 30% expanding from specific projects. •72% of organizations had a published open source use policy, but only 38% used software composition analysis tools to identify and manage open source components. •51% said it takes 2–3 weeks to fix a critical open source vulnerability, and 24% said it takes a month. •40% globally, and 52% in the United States, said addressing a critical open source patch had impacted software delivery schedules within the past year. •29% said an unpatched open source component had resulted in a security incident within their organization within the past year. Top 3-5 Exploitable Technology Risks •Unpatched open source components, especially after public disclosure, when attackers may attempt exploitation quickly. •Lack of an accurate software inventory or Bill of Materials, making it harder to know which applications contain vulnerable components. •Legacy open source components that may no longer be actively maintained or updated. |
| Synopsys | 2020 | Threat Intelligence Vendor |
| 746 | Targeted social engineering is en vogue as ransom payment sizes increase | Bottom Line Up Front (BLUF) Coveware’s Q2 2025 report shows ransomware and extortion activity shifting toward targeted social engineering, data theft, and larger ransom payments. For SMBs and insurance teams, the key concern is that attackers are exploiting people, remote access, third-party access, and backup weaknesses to create payment pressure even when encryption or visible downtime does not occur. Top 3-5 Most Notable Statistics •Average ransom payment reached $1,130,070, up 104% from Q1 2025. •Median ransom payment reached $400,000, up 100% from Q1 2025. •Overall ransom payment rate remained relatively low at 26%. •Data exfiltration appeared in 74% of Coveware cases, making data theft central to modern extortion. •Organizations with 11 to 1,000 employees made up a combined 64% of incidents. Top 3-5 Exploitable Technology Risks •Exposed VPNs and remote services using stolen or weak credentials, often tied to infostealers or phishing. •Help desk and identity workflows that can be manipulated into issuing new credentials, MFA access, VPN access, or device enrollment. •Remote assistance tools such as ZohoAssist, QuickAssist, and AnyDesk, which attackers use after convincing employees to install them. |
| Coveware | 2025 | Consulting / Analyst Firm |
| 747 | Team8 CISO Village Survey 2023 | Bottom Line Up Front (BLUF) Team8’s survey shows that leading CISOs are prioritizing resilience through continued cybersecurity investment, especially in identity, cloud security, third-party risk, AI security, and human-risk reduction. For SMBs and insurance teams, the key takeaway is that the most urgent risks are not limited to malware or technical vulnerabilities; they increasingly involve cloud migration, supplier dependence, employee behavior, and fast-moving AI adoption. Top 3-5 Most Notable Statistics •130 CISOs participated in the 2023 Team8 CISO Village Survey. •56% of survey respondents reported a cybersecurity budget increase from 2022. •19% reported budget decreases, with cuts concentrated more heavily among larger cybersecurity departments. •48% identified third-party risk management as one of the most pressing organizational cybersecurity challenges. •56% of respondents reported hybrid cloud deployment, with ongoing movement toward greater cloud adoption. Top 3-5 Exploitable Technology Risks •Third-party technology risk: Increased integration with SaaS, PaaS, and logging services can expand exposure through vendors and external platforms. •Identity and access gaps: Remote work and cloud adoption have created unmet needs in identity governance, privileged access, authentication, and machine identity management. •Cloud and multi-cloud complexity: Hybrid and multi-cloud environments add security complexity and require dedicated cloud security capabilities. |
| Team8 | 2023 | Threat Intelligence Vendor |
| 748 | Team8 CISO Village Survey 2024 | Bottom Line Up Front (BLUF) Team8’s 2024 CISO Village Survey shows that cybersecurity leaders are increasing investment because AI-driven attacks, data exposure, third-party risk, and regulatory pressure are all rising at the same time. For SMBs and insurance teams, the key takeaway is that controls around data, vendors, identity, cloud access, and AI use are becoming central to both loss prevention and risk evaluation. Top 3-5 Most Notable Statistics •70% of surveyed CISOs reported an increase in cybersecurity budgets in 2024. •70% of CISOs view AI as a major security threat, while 85% view AI as a key enabler for security. •75% of respondents identify phishing as the most significant AI-powered threat to their organizations. •65% of CISOs identify data security, including DLP and insider threat, as the most acute problem where existing solutions are not meeting needs. •47% of surveyed CISOs identify third-party risk management as a critical pain point. Top 3-5 Exploitable Technology Risks •AI-powered phishing and deepfakes that can deceive employees and bypass traditional security processes. •Poorly secured cloud storage accounts, including lack of MFA and lack of network allow lists. •Sensitive data leakage into third-party AI applications, including tools used by employees for everyday work. |
| Team8 | 2024 | Threat Intelligence Vendor |
| 749 | Tech Trends 2026 | Bottom Line Up Front (BLUF) Deloitte’s Tech Trends 2026 argues that AI has moved from experimentation to operational impact, reshaping infrastructure, workforce models, robotics, technology organizations, and cybersecurity. For SMBs and insurance teams, the key takeaway is that AI adoption is accelerating faster than many governance, security, and operating models can keep up, creating both productivity opportunities and new loss scenarios. Top 3-5 Most Notable Statistics •A leading generative AI tool reached approximately 100 million users in two months, compared with 50 years for telephones to reach 50 million users. •The same AI tool reportedly has over 800 million weekly users, roughly 10% of the planet’s population. •Only 11% of organizations have AI agents in production, while 38% are piloting them. •35% of organizations have no agentic AI strategy, and Gartner predicts 40% of agentic projects will fail by 2027. •Token costs have dropped 280-fold in two years, yet some enterprises are seeing monthly AI bills in the tens of millions. Top 3-5 Exploitable Technology Risks •AI-enabled cyberattacks operating at machine speed, increasing the speed and impact of existing attack patterns. •Physical AI and connected robot fleets, which create attack surfaces that bridge digital systems and physical operations. •Unauthorized access, data breaches, or malicious robot control affecting safety and operational continuity. |
| Deloitte | 2026 | Consulting / Analyst Firm |
| 750 | The 2024 Data Loss Landscape | Bottom Line Up Front (BLUF) Proofpoint’s report shows that data loss is primarily a people-driven risk, not just a technical failure. For SMBs and insurance teams, the key takeaway is that careless users, compromised accounts, departing employees, and cloud-based workflows can create business disruption, regulatory exposure, and reputational harm even without a major “hack.” Top 3-5 Most Notable Statistics •85% of surveyed organizations experienced at least one data loss incident in the past year. •Organizations averaged just over 15 data loss incidents per year, and 10% reported more than 30 incidents. •More than 90% of organizations with at least one incident reported a negative outcome; 56.6% reported business disruption or revenue loss. •1% of users were responsible for 88% of data loss events. •96% of monitored cloud tenants were targeted by brute-force attacks, and 96% were targeted by precision attacks such as targeted phishing. Top 3-5 Exploitable Technology Risks •Misdirected email and wrong attachments: users can send sensitive information to the wrong recipient or send the wrong file to the right person, creating immediate data exposure. •Cloud and SaaS account compromise: attackers used brute-force and precision attacks against cloud tenants, with successful compromise leading to file access, manipulation, or exfiltration. •Common exfiltration channels: copying files to USB, web uploads, cloud sync folders, broad cloud file sharing, and email were highlighted as practical data loss paths. |
| Proofpoint | 2024 | Email Security Vendor |
| 751 | The 2024 Duo Trusted Access Report | Bottom Line Up Front (BLUF) Duo’s 2024 report shows that identity and device trust are now central to access security: MFA adoption is rising, but MFA alone is not enough against credential abuse, push fatigue, unmanaged devices, and identity sprawl. For SMBs and insurance teams, the key takeaway is that stronger authentication must be paired with visibility into users, devices, locations, and account hygiene to reduce breach likelihood. Top 3-5 Most Notable Statistics •Duo analyzed over 16 billion authentications in the last year, across 58 million endpoints and 21 million unique phones. •MFA authentications using Duo rose by 41% in the past year. •Duo Push was enabled by 91.5% of accounts and accounted for 21% of authentications, or over 3.2 billion authentications. •SMS and phone-call authentication fell to 4.9% of authentications, a 22% decrease from 2022. •5% of measured authentications failed, and 28% of those failures were due to users not being enrolled. Top 3-5 Exploitable Technology Risks •Weak or incomplete MFA coverage, including accounts with no MFA or weak MFA, creates openings for credential-based attacks. •Push harassment and push fatigue attacks can trick users into approving fraudulent login attempts. •Out-of-date operating systems, browsers, and devices can contain unpatched vulnerabilities that attackers may exploit. |
| Duo | 2024 | Identity Security Vendor |
| 752 | The 2024 InsurSec Report: Ransomware Edition | Bottom Line Up Front (BLUF) Ransomware rebounded sharply in 2023 and changed in ways that matter directly to SMBs and insurers: attackers increasingly exploited remote access tools, especially self-managed VPNs, and caused more indirect losses through vendors and partners. For SMBs, the report shows ransomware is not only a direct attack risk but also a supply chain and data privacy risk that can create costly claims even when the SMB’s own systems are not breached. Top 3-5 Most Notable Statistics •Overall ransomware claims frequency increased 64% year over year in 2023. •Indirect ransomware claims frequency increased 415% compared to 2022. •Direct ransomware claims frequency increased 17%, including a 48% increase among companies with less than $25M in annual revenue. •Remote access tools accounted for 58% of direct ransomware claims where the entry vector was identified. •Average direct ransomware severity was $370K, while the average ransom payment was $282K. Top 3-5 Exploitable Technology Risks •Self-managed VPNs were the most prominent remote access risk, accounting for 63% of remote-access ransomware events in 2023. •Organizations using Cisco ASA and Citrix SSL self-managed VPNs were 11X more likely to suffer a direct ransomware attack than those using a cloud VPN or no self-managed VPN. •Cisco ASA and Firepower Threat Defense vulnerability CVE-2023-20269 enabled repeated brute-force attempts and was tied to more than 10% of direct ransomware claims where remote access was the initial entry vector. |
| At-Bay | 2024 | Cyber Insurance Carrier |
| 753 | The 2024 Tidelift Maintainer Impact Report | Bottom Line Up Front (BLUF) The report’s core takeaway is that businesses using open source software cannot assume maintainers are responsible for keeping it secure; the organization using the component carries the operational and liability risk. For SMBs and insurance teams, this matters because abandoned, end-of-life, vulnerable, or poorly maintained open source packages can create security exposure, emergency remediation costs, and software supply chain risk. Top 3-5 Most Notable Statistics •Modern applications often contain open source, and in many applications it makes up 70% or more of the code. •One customer saved an estimated $1.1 million in engineering, legal, and security time by improving open source dependency visibility and maintainer-backed coverage. •In the case study, 37% of independently maintained packages were moved from an “unknown future” to reliably secured and maintained, with plans to reach 58% in 2025 and 80% in 2026. •Paid maintainers were, on average, 55% more likely than unpaid maintainers to implement critical security and maintenance practices. •60% of surveyed maintainers were unpaid, and 60% had quit or considered quitting maintaining a project. Top 3-5 Exploitable Technology Risks •Known vulnerable open source package releases, which can expose applications to publicly known weaknesses. •End-of-life packages, which may no longer receive fixes even when vulnerabilities are discovered. •Packages with no security policy in place, making it unclear how vulnerabilities are reported, triaged, or remediated. |
| Tidelift | 2024 | Supply Chain Security Vendor |
| 754 | The 2025 Crypto Crime Report | Bottom Line Up Front (BLUF) Chainalysis finds that crypto crime is becoming more diverse, professionalized, and embedded in many crime types, even as some categories such as ransomware payments declined in 2024. For SMBs and insurance teams, the key takeaway is that crypto-related loss is no longer limited to Web3 companies: ransomware, scams, stolen credentials, crypto ATMs, and laundering services can affect ordinary businesses, customers, and claims workflows. Top 3-5 Most Notable Statistics •Illicit cryptocurrency addresses received $40.9 billion in 2024, with Chainalysis estimating this could later surpass $51 billion as more illicit addresses are identified. •Ransomware attackers received approximately $813.55 million in 2024, a 35% decrease from 2023’s $1.25 billion. •Stolen crypto funds increased approximately 21.07% year over year to $2.2 billion, across 303 hacking incidents. •North Korea-linked hackers stole $1.34 billion across 47 incidents, representing 61% of total stolen crypto value in 2024. •Cryptocurrency scams received at least $9.9 billion on-chain in 2024, and pig butchering grew nearly 40% year over year. Top 3-5 Exploitable Technology Risks •Private key compromise: Chainalysis states that private key compromises accounted for the largest share of stolen crypto in 2024, making key management a critical risk for any business holding digital assets. •Ransomware and data theft extortion: attackers continue to use cryptocurrency for extortion, with negotiations often beginning within hours of data exfiltration. •AI-enabled fraud and KYC bypass: the report highlights increasing use of artificial intelligence in scams, including personalized sextortion and services designed to bypass know-your-customer checks. |
| Chainalysis | 2025 | Crypto / Blockchain Security Vendor |
| 755 | The 2025 Data Security Landscape | Bottom Line Up Front (BLUF) Proofpoint’s 2025 report shows that data loss is still primarily a people-driven problem, now made harder by data sprawl, cloud/SaaS use, GenAI, and emerging AI agents. For SMBs and insurance teams, the key takeaway is that sensitive data exposure is likely to come from everyday user behavior, oversharing, compromised accounts, email mistakes, and weak visibility—not only from sophisticated external attacks. Top 3-5 Most Notable Statistics •85% of surveyed organizations experienced a data loss incident in the last 12 months. •58% cited careless employees or third-party contractors as a cause of data loss incidents. •1% of users were responsible for 76% of data loss events. •64% of tenants had at least one compromised account in the last year; 47% of those accounts showed suspicious post-access data activity. •44% said lack of visibility and data security controls for GenAI tools is a significant challenge for securing sensitive data. Top 3-5 Exploitable Technology Risks •Email data loss, including misdirected emails, incorrect attachments, and intentional exfiltration of sensitive data to personal or unauthorized accounts. •Overprivileged or overshared access to sensitive files, including company-wide sharing or public links in Microsoft 365. •Public cloud storage containers containing sensitive data that are publicly exposed due to misconfiguration or overprivileged access. |
| Proofpoint | 2025 | Email Security Vendor |
| 756 | The 2025 InsurSec Report | Bottom Line Up Front (BLUF) At-Bay’s 2025 InsurSec Report shows that SMB cyber losses are increasingly driven by specific technology choices: exposed or poorly maintained remote access tools, email-based fraud, and dependence on vulnerable third parties. For SMB owners, underwriters, and claims teams, the key takeaway is practical: security controls work, but only when they are properly selected, configured, deployed across the environment, and maintained over time. Top 3-5 Most Notable Statistics •Overall cyber claim frequency increased by 16% in 2024. •Email was the initial entry vector for 43% of all claims and 83% of financial fraud claims. •Direct ransomware claim frequency increased by 19% year over year, returning near 2021 levels. •Remote access tools were the initial entry vector for 80% of direct ransomware claims, up from 63% in 2023. •Average claim severity was $166K, while direct ransomware averaged $468K and indirect ransomware averaged $241K. Top 3-5 Exploitable Technology Risks •Remote access tools, including VPN, RDP, and other remote access platforms, were the dominant entry point for direct ransomware. •Unpatched vulnerabilities and configuration issues in corporate systems were tied to higher-severity incidents. •Legacy or high-risk platforms, including on-premises Microsoft Exchange and VPN appliances from Cisco, Citrix, SonicWall, and Fortinet, continued to attract attacker attention. |
| At-Bay | 2025 | Cyber Insurance Carrier |
| 757 | The 2025 IoT Security Landscape Report | Bottom Line Up Front (BLUF) Bitdefender’s report shows that connected devices are now under constant automated attack, with routers, streaming devices, smart TVs, IP cameras, NAS devices, and smart plugs creating real exposure for homes and small business environments. For SMBs and insurance teams, the key issue is not only device compromise, but the downstream impact: ransomware, privacy incidents, botnet participation, service disruption, and hard-to-detect firmware-level risk. Top 3-5 Most Notable Statistics •Bitdefender analyzed data from 6.1 million smart homes and over 58 million IoT devices. •The report is based on 13.6 billion IoT attacks and 4.6 billion vulnerability exploitation attempts. •Bitdefender smart home technologies block 12 million threats per day globally. •Home network devices face an average of 29+ attacks every 24 hours. •Streaming devices account for 25.94% of vulnerable IoT devices, followed by smart TVs at 21.34% and IP cameras at 8.62%. Top 3-5 Exploitable Technology Risks •Streaming devices and low-cost Android-based IoT hardware: The report highlights BADBOX, where some devices arrive with malicious firmware already installed and can become residential proxies or botnet nodes. •Smart TVs: Long device lifespans, complex Android or Linux software stacks, app stores, browser engines, third-party SDKs, and weak update cycles leave many TVs online and unpatched. •IP cameras: Internet exposure, weak authentication, and poor configuration can turn surveillance devices into backdoors or privacy risks. |
| Bitdefender | 2025 | Endpoint / MDR / XDR Vendor |
| 758 | The 2025 State of Container Security | Bottom Line Up Front (BLUF) Container security is not mainly failing because teams ignore security; it is failing because common container choices add avoidable vulnerabilities, patching workload, and operational complexity. For SMBs and insurance teams, the key issue is whether container environments are built on secure, low-maintenance foundations or on images and runtimes that require constant manual vulnerability management. Top 3-5 Most Notable Statistics •23% of respondents experienced container-related security incidents in the past year, including 18% minor incidents and 5% major incidents. •33% update container images monthly, rarely, or only a few times yearly, while exploitation windows have shrunk from weeks to days. •55% use general-purpose Linux distributions with hundreds of unnecessary packages and unresolved CVEs. •69% use general-purpose JDKs that the report says are shipped with known CVEs and require manual optimization. •48% want pre-hardened, security-focused base images, and 49% cite time and resource constraints as a primary container security challenge. Top 3-5 Exploitable Technology Risks •General-purpose Linux base images add unnecessary packages, each of which can introduce vulnerabilities that still require tracking, patching, and validation. •Shells, package managers, curl/wget, editors, and similar tools inside production containers expand the attack surface, even though they are useful for debugging. •Slow container image update cycles leave known vulnerabilities in production during the gap between disclosure and remediation. |
| Bellsoft | 2025 | Security Research Vendor |
| 759 | The 2026 Crypto Crime Report | Bottom Line Up Front (BLUF) Crypto-enabled crime reached record scale in 2025, but the most relevant takeaway for SMBs and insurance teams is that ransomware and fraud are becoming more operationally industrialized, faster-moving, and increasingly focused on smaller victims. Attackers are relying on shared services such as phishing kits, initial access brokers, bulletproof hosting, money laundering networks, and stablecoins to scale attacks and move funds quickly. Top 3-5 Most Notable Statistics •Illicit cryptocurrency addresses received at least $154 billion in 2025, a 162% year-over-year increase. •Stablecoins accounted for 84% of all illicit transaction volume. •DPRK-linked hackers stole $2 billion, including the nearly $1.5 billion Bybit exploit. •Claimed ransomware victims increased 50% year over year, while median ransom payments rose 368%, from $12,738 in 2024 to $59,556 in 2025. •Initial access brokers received at least $14 million in on-chain payments, supporting ransomware operations that generated approximately $820 million in payments. Top 3-5 Exploitable Technology Risks •Phishing-as-a-service platforms that provide fake website templates, domain setup tools, and detection-evasion features for SMS and messaging-based scams. •Impersonation attacks targeting crypto exchange users and customer service workflows, including schemes enabled by stolen customer data and insider compromise. •Initial access brokers that sell or facilitate entry into compromised networks, allowing ransomware affiliates to deploy attacks more easily. |
| Chainalysis | 2026 | Crypto / Blockchain Security Vendor |
| 760 | The 2026 InsurSec Report | Bottom Line Up Front (BLUF) Cyber claims are becoming both more frequent and more expensive, with ransomware, financial fraud, remote access exposure, and third-party liability driving the risk. For SMBs and insurance teams, the report’s core message is that outcomes depend heavily on preparation: monitored controls, fast escalation, experienced claims response, and attention to legal exposure can materially change the cost of an incident. Top 3-5 Most Notable Statistics •Overall claim frequency increased 7% year over year, while average claim severity reached an all-time high of $221K. •Ransomware average severity increased 16% year over year to $508K, making it the most damaging incident type. •Email was the initial entry vector for 52% of all claims, while remote access incidents averaged $433K in severity. •87% of ransomware claims began through remote access services, and 1 in 3 ransomware claims started with SonicWall. •Financial fraud accounted for 30% of all claims, with average stolen funds reaching $285K and the largest theft hitting $9.7M. Top 3-5 Exploitable Technology Risks •Remote access infrastructure, especially VPNs and RDP, remained the dominant ransomware entry path and was tied to the highest claim severity. •SonicWall devices were heavily associated with Akira ransomware activity, including 55% of remote access ransomware incidents and 86% of Akira attacks where SonicWall was present. •Email-based social engineering continued to enable financial fraud, including business email compromise, vendor impersonation, and invoice manipulation. |
| At-Bay | 2026 | Cyber Insurance Carrier |
| 761 | The 2026 State of AI Traffic & Cyberthreat Benchmark Report | Bottom Line Up Front (BLUF) AI-driven and automated traffic is rapidly changing what “normal” web activity looks like, especially for businesses with online accounts, checkout, product pages, content, or self-service sign-up. For SMBs and insurance teams, the key issue is that legitimate AI automation and malicious automation now look very similar, making account abuse, scraping, carding, and fake account creation harder to distinguish and manage. Top 3-5 Most Notable Statistics •Automated traffic grew 8x faster than human traffic year over year. •Monthly AI-driven traffic grew 187% from January to December 2025. •Agentic AI traffic grew 7,851% year over year. •Post-login account compromise attempts more than quadrupled, with an average of 402,000 attempts per organization. •The median percentage of traffic attempting a scraping attack is approaching 20% globally, nearly double the 2022 rate. Top 3-5 Exploitable Technology Risks •Account takeover, especially post-login compromise, where attackers abuse session tokens, account settings, or weak step-up controls after a legitimate login. •Carding attacks at checkout, where stolen payment cards are tested through repeated payment attempts. •Web scraping attacks against pricing, product catalogs, proprietary content, and paywalled or frequently updated data. |
| Human Security | 2026 | Network Security Vendor |
| 762 | The 2026 Workforce Impersonation Report | Bottom Line Up Front (BLUF) Workforce impersonation is becoming a core identity security risk: attackers are using generative AI, deepfakes, social engineering, MFA bypass, hiring fraud, and AI agent misuse to appear like trusted employees, contractors, or candidates. For SMBs and insurance teams, the key issue is that many controls verify access to a device or credential, not the real person behind the request. Top 3-5 Most Notable Statistics •62% of organizations have experienced a deepfake attack in the past 12 months, according to Gartner as cited in the report. •96% of CISOs in a Portnox survey believe MFA “can’t keep up with today’s threat landscape.” •34% of phishing attacks now come through non-email channels. •A reported DPRK-linked IT worker ring had breached more than 300 American companies and government agencies. •Fake IT workers are estimated to have funneled up to $1 billion to the DPRK regime. Top 3-5 Exploitable Technology Risks •Deepfake audio, video, and image tools that can impersonate executives, employees, candidates, or contractors in verification processes. •Helpdesk social engineering, where attackers use stolen information, credentials, and voice clones to obtain password or MFA resets. •MFA bypass and interception, including push fatigue, SIM swaps, adversary-in-the-middle session token theft, OAuth token harvesting, and weak MFA recovery flows. |
| Nametag | 2026 | Threat Intelligence Vendor |
| 763 | The Agentic AI Security Report 2026 | Bottom Line Up Front (BLUF) Agentic AI is becoming an operational security and fraud risk because AI agents can act inside systems using legitimate credentials, APIs, and automated workflows. For SMBs and insurance teams, the key issue is not only detecting malicious activity, but proving what happened, which identity acted, and whether the action came from a human, legitimate automation, or an adversarial AI agent. Top 3-5 Most Notable Statistics •97% of enterprise leaders expect a material AI-agent-driven security or fraud incident within 12 months. •49% expect an AI-agent-driven incident within six months. •Organizations allocate an average of about 6% of security budgets to AI-agent risk, while 10% do not track it separately. •Only 26% of enterprise leaders are very confident they could prove whether an AI agent caused a security or fraud incident. •57% of organizations report having no formal AI-agent governance controls today, while 88% expect defined or advanced frameworks within three years. Top 3-5 Exploitable Technology Risks •AI agents using legitimate credentials, including service accounts, API tokens, and application identities, can make malicious or unsafe activity look like trusted system activity. •Weak visibility across APIs, applications, internal systems, and external services can make it difficult to reconstruct automated decision chains during an incident. •Current fraud prevention and bot detection tools may struggle as AI-driven attacks evolve, especially when activity occurs inside normal workflows rather than only at the perimeter. |
| Arkose Labs | 2026 | Research Organization |
| 764 | The AI Governance Gap 2026 | Bottom Line Up Front (BLUF) Gravitee’s central warning is that AI agents are being deployed faster than organizations can govern them, creating a gap in identity, authorization, visibility, and auditability. For SMBs and insurance teams, the key issue is not AI adoption itself, but whether autonomous tools have unmanaged access to business systems, sensitive data, APIs, and external AI models. Top 3-5 Most Notable Statistics •71% of large enterprises have deployed AI agents with direct access to core business systems, while only 16% effectively govern that access. •92% of organizations lack full visibility into their AI identities, and 95% doubt they could detect or contain misuse. •86% do not enforce access policies for AI identities. •75% of organizations have discovered unsanctioned AI tools running in their environments. •Only 14.4% of organizations have full IT and security approval for their entire AI agent fleet. Top 3-5 Exploitable Technology Risks •AI agents with direct access to core systems such as business applications, data warehouses, and payment processors, without effective access governance. •Shadow AI tools deployed outside official approval processes, potentially with embedded credentials or elevated system access. •Legacy authentication, session management, and password policies designed for human users, not autonomous systems operating at machine speed. |
| Gravitee | 2026 | Application / API Security Vendor |
| 765 | The B2B Pulse for Telcos: 2026 Edition | Bottom Line Up Front (BLUF) Capgemini’s report shows that business customers increasingly expect telecom providers to deliver secure, integrated digital services beyond basic connectivity, especially around AI, cloud, sovereign infrastructure, and cybersecurity. For SMBs and insurance teams, the key takeaway is that reliance on telcos is expanding while satisfaction gaps remain, creating both operational dependency and risk-management challenges. Top 3-5 Most Notable Statistics •76% of organizations plan to invest in AI-driven security solutions in the next one to two years. •63% expect telcos to provide AI-powered cybersecurity and threat-detection solutions, while only 51% are satisfied with telcos’ current AI/Gen AI-driven cybersecurity. •65% of all organizations, and 79% of small organizations, want telcos to proactively implement quantum-resistant encryption and cybersecurity protocols. •72% of organizations say their telco lags hyperscalers and tech-native firms in AI and cloud services; among small organizations this rises to 85%. •61% of organizations are unhappy with telcos’ post-sales support for complex, integrated solutions. Top 3-5 Exploitable Technology Risks •AI-assisted cyberattacks: The report states that AI is augmenting cybercriminal capabilities and that organizations are seeking AI-powered threat detection to respond. •Quantum-exposed products and encryption: Organizations want telcos to identify products or services vulnerable to quantum-based attacks and upgrade to quantum-resistant encryption. •Network API exposure: Organizations using or planning to use network APIs seek telco guidance on compliance, security, and data privacy, indicating governance and protection needs around APIs such as number verification, OTP validation, SIM swap, KYC, and device location verification. |
| Capgemini | 2026 | Consulting / Analyst Firm |
| 766 | The Builder's Playbook 2025 State of AI Report | Bottom Line Up Front (BLUF) ICONIQ’s 2025 State of AI Report shows that AI adoption is moving from experimentation into scaled product and internal productivity use, with heavy reliance on cloud infrastructure, external AI APIs, and emerging agentic workflows. For SMBs and insurance teams, the key takeaway is that AI can improve productivity and product value, but it also introduces vendor dependency, governance, monitoring, and cost-control risks that should be assessed before AI becomes business-critical. Top 3-5 Most Notable Statistics •300 executives at software companies building AI products were surveyed in April 2025. •80% of respondents rely on third-party AI APIs, while 61% fine-tune existing foundation models and 32% develop proprietary models from scratch. •68% of companies use fully cloud-based AI infrastructure, and 64% rely on external AI API providers for training and inference. •79% of AI-native companies are building agentic workflows, and 47% of AI-native products are already scaling. •Around 70% of employees have access to AI tools for internal productivity, but only about 50% use them on an ongoing basis. Top 3-5 Exploitable Technology Risks •Heavy use of third-party AI APIs and direct model-hosting providers creates dependency on vendor security, service-level agreements, privacy controls, and cost-per-call management. •Cloud-based AI infrastructure is now the dominant deployment model, making vendor selection, governance, and operational oversight strategic risk areas. •Agentic workflows are increasingly being deployed, including in production, which raises the importance of human oversight, safeguards, and clear control boundaries. |
| ICONIQ Capital | 2025 | Research Organization |
| 767 | The CISO Outlook 2025 | Bottom Line Up Front (BLUF) CSC’s 2025 CISO Outlook finds that cyber risk is expected to rise sharply, with domain and DNS-related attacks at the center of concern. For SMBs and insurance teams, the key takeaway is that publicly exposed digital assets—domains, websites, DNS, and email gateways—remain practical targets for attackers and can lead to phishing, fraud, outages, data exposure, and reputational harm. Top 3-5 Most Notable Statistics •300 CISOs, CIOs, and senior IT professionals were surveyed in Q1 2025. •67% said cybersecurity threats were critical or significant in 2024. •70% expect threats to increase in 2025, and 98% expect risks to rise over the next three years. •87% believe AI-powered domain generation algorithms pose a threat. •97% are concerned about giving AI-based third-party systems access to company data. Top 3-5 Exploitable Technology Risks •Domain and DNS hijacking, where attackers compromise domain infrastructure or redirect users to malicious destinations. •Cybersquatting and lookalike domains, including typosquatting, which can support phishing, brand impersonation, and fraud. •Subdomain takeover, especially where abandoned or misconfigured subdomains can be found and abused at scale. |
| CSC | 2025 | Cybersecurity Services / Consultancy |
| 768 | The CISO Report: From Risk to Resilience in the AI Era | Bottom Line Up Front (BLUF) Splunk’s 2026 CISO survey shows that AI is increasing both defensive opportunity and security risk: leaders are investing in AI to improve detection and response, but they are also worried about data leaks, shadow AI, and more convincing attacks. For SMBs and insurance teams, the key takeaway is that resilience now depends on strong governance, practical controls, and people who can interpret threats—not technology alone. Top 3-5 Most Notable Statistics •95% of CISOs say growing threat actor sophistication is a moderate or significant obstacle to cybersecurity strategy. •92% rank improving threat detection and response capabilities as very or most important. •78% rank AI-related data leaks as their top AI concern. •91% cite low cybersecurity fluency among non-technical executives as a top challenge to cross-departmental data sharing. •79% expect some or most cybersecurity skills gaps to remain unfilled. Top 3-5 Exploitable Technology Risks •AI-enabled social engineering: CISOs fear AI will make phishing, fake messages, links, and voice-based impersonation more realistic and harder to detect. •Shadow AI and data leakage: unmanaged AI use can expose sensitive information and weaken governance. •AI-assisted malware evasion: the report highlights proof-of-concept malware that can change code, structure, or behavior to evade endpoint detection and response tools. |
| Splunk | 2026 | SIEM / Security Analytics Vendor |
| 769 | The Correlation Between Dark Web Exposure and Cybersecurity Risk | Bottom Line Up Front (BLUF) SearchLight Cyber and Marsh McLennan found that any dark web exposure tied to an organization is associated with a higher likelihood of a cyber insurance loss. For SMB owners and insurance teams, the key takeaway is that dark web signals can provide early warning before an incident, helping prioritize defensive action and improve risk assessment. Top 3-5 Most Notable Statistics •9,410 organizations were included in the study, with an overall breach rate of 3.7% from 2020 to 2023. •All nine dark web intelligence sources studied had a statistically significant correlation with increased cybersecurity risk. •The strongest individual risk increases were tied to Compromised Users (2.56x), Dark Web Market Listings (2.41x), Outgoing Dark Web Traffic (2.11x), and OSINT Results (2.05x). •Organizations appearing in Dark Web Market Listings had an incident rate of 8.69%, compared with 3.61% for those without such findings. •When five key dark web sources were present together, the organization was 77% more likely to suffer a cybersecurity incident relative to peers. Top 3-5 Exploitable Technology Risks •Compromised user accounts: stolen usernames, passwords, and email addresses can provide a path into the corporate network. •Dark web market listings: company data, access to systems, or infrastructure may be advertised for sale to criminals. •Outgoing dark web traffic: connections from the corporate network to the dark web may indicate command-and-control malware activity or malicious insider behavior. |
| SearchLight Cyber | 2025 | Threat Intelligence Vendor |
| 770 | The Cost of a Data Breach Report 2022 | Bottom Line Up Front (BLUF) Black Kite’s analysis of 2,400 global breach incidents from 2017-2022 shows that data breaches create major direct and indirect costs, often extending beyond the initial incident through regulatory action, lawsuits, customer impact, and reputational damage. For SMBs and insurance teams, the key takeaway is that basic cyber hygiene failures—such as exposed systems, weak credential management, outdated software, and poor vendor oversight—remain central drivers of costly incidents. Top 3-5 Most Notable Statistics •Overall average breach cost was $75.21 million including outliers, and $15.01 million with outliers removed. •51% of analyzed breaches cost between $10,000 and $1 million. •Finance and insurance had 445 incidents, representing 19% of incidents, with an average cost of $35.34 million per incident. •Unsecured servers and databases accounted for 19% of incidents, with an average cost of $112.93 million per incident. •17% of the 1,700 analyzed companies were above the critical threshold for ransomware susceptibility, and 79% were highly susceptible to phishing. Top 3-5 Exploitable Technology Risks •Unsecured external-facing servers and databases, especially where sensitive data or third-party-managed data is involved. •Ransomware exposure, including organizations with high Ransomware Susceptibility Index scores and weak overall cyber hygiene. •SQL injection vulnerabilities in web applications, which can allow attackers to steal, delete, modify data, or gain administrative control. |
| Black Kite | 2022 | Security Research Vendor |
| 771 | The Cost of CVEs 2025 | Bottom Line Up Front (BLUF) Chainguard’s report argues that managing CVEs in containerized environments in-house creates significant hidden cost through engineering time, delayed releases, compliance work, and customer escalations. For SMBs and insurance teams, the key takeaway is that container vulnerability management is not only a technical issue; it can affect revenue, operational resilience, compliance readiness, and breach-related risk. Top 3-5 Most Notable Statistics •Chainguard customers saved an average of $2.1 million annually by outsourcing CVE remediation. •Average total benefits across all industries were $31.0 million, including cost savings, increased revenue, faster innovation, and decreased risk. •Healthcare organizations showed the highest average total impact at $50.4 million, driven largely by decreased risk. •Early-stage organizations reported $6.8 million in average total value unlocked, with $6.6 million tied to faster innovation. •Customer escalation savings averaged $70,000 annually across organizations. Top 3-5 Exploitable Technology Risks •Containerized environments with unresolved CVEs can require extensive scanning, triage, patching, and redeployment, increasing the chance that known vulnerabilities remain exposed. •High-profile vulnerabilities such as Log4Shell and Ingress-NGINX remote code execution CVEs are highlighted as examples of vulnerabilities that disrupted teams because they were difficult and expensive to manage in containers. •Container images pulled from public sources and then scanned may produce large volumes of CVE findings, creating a “CVE doom cycle” where teams spend substantial time triaging and patching. |
| Chainguard | 2025 | Supply Chain Security Vendor |
| 772 | The CyberThreat Report June 2023 | Bottom Line Up Front (BLUF) Trellix’s Q1 2023 threat data shows that ransomware, phishing, cloud account abuse, and unpatched known vulnerabilities remain practical, high-impact risks for organizations of all sizes. For SMBs and insurance teams, the key takeaway is that mid-sized businesses are visibly affected, and many attacks rely on familiar weaknesses: exposed services, stolen or valid accounts, email deception, and delayed patching. Top 3-5 Most Notable Statistics •The insurance sector had the highest share of ransomware detections at 20%, followed by financial services at 17%. •Companies with 51 to 200 employees represented 32% of ransomware leak-site victims, and companies with $10M to $50M in annual revenue represented 38%. •The United States accounted for 48% of victim companies listed on ransomware leak sites. •Cobalt Strike was used in 28% of ransomware incidents and 35% of malicious nation-state activity. •Formbook accounted for 44% of email malware in Q1 2023. Top 3-5 Exploitable Technology Risks •Unpatched known vulnerabilities, including critical issues in Zoho ManageEngine, Control Web Panel, VMware ESXi, and Apple platforms. •Abuse of legitimate Windows tools such as PowerShell, Windows Command Shell, Scheduled Task, RunDLL32, and WMIC. •Credential and account abuse in cloud environments, where valid accounts were the dominant attack technique. |
| Trellix | 2023 | Endpoint / MDR / XDR Vendor |
| 773 | The CyberThreat Report, October 2025 | Bottom Line Up Front (BLUF) Trellix reports an intensified cyber threat landscape between April and September 2025, driven by sophisticated APT activity, ransomware disruption and reformation, AI-enabled criminal tooling, and exploitation of known software weaknesses. For SMBs and insurance teams, the key takeaway is that attackers are moving faster, using legitimate tools to hide activity, and targeting common business technologies before organizations can rely on traditional patching timelines. Top 3-5 Most Notable Statistics •Trellix observed 540,974 APT detections across 1,221 campaigns. •Over half of global APT detections, 57%, were concentrated in Türkiye and the United States. •Telecommunications accounted for 70.8% of APT targeting cited in the report. •Trellix observed 3,280 ransomware victim posts during the past six months. •The United States represented 55.46% of ransomware targeting among the top countries listed. Top 3-5 Exploitable Technology Risks •Legitimate administration tools such as Cmd and PowerShell are being used to evade detection, making normal administrative activity harder to distinguish from malicious behavior. •Microsoft Windows, SharePoint, and Office vulnerabilities were exploited across multiple campaigns, showing continued attacker focus on widely used business software. •Cisco and Fortinet technologies were also heavily targeted, creating risk for organizations that depend on these products for networking or security functions. |
| Trellix | 2025 | Endpoint / MDR / XDR Vendor |
| 774 | The Email Security Breach Report 2025 | Bottom Line Up Front (BLUF) Email security breaches are common, costly, and strongly linked with broader cyber harm, including ransomware. For SMBs and insurance teams, the key takeaway is that delayed detection and response can turn an email incident into downtime, data loss, reputational damage, and materially higher recovery costs. Top 3-5 Most Notable Statistics •78% of surveyed organizations experienced an email security breach in the previous 12 months. •71% of organizations that experienced an email security breach were also hit with ransomware during the year. •$217,068 was the average cost of responding to and recovering from an email security breach. •$1,946 was the average recovery cost per employee for organizations with 50 to 100 employees, compared with $243 for organizations with 1,001 to 2,000 employees. •41% of respondents cited brand and reputational damage as an impact of email-based security breaches. Top 3-5 Exploitable Technology Risks •Phishing and spear phishing: These attacks are identified as common breach types and can serve as the initial entry point for credential theft, malware delivery, business email compromise, account takeover, and ransomware. •Business email compromise: Attackers impersonate trusted individuals or entities to trick employees into transferring money or sensitive information. •Account takeover: Stolen credentials allow attackers to impersonate internal users, making follow-on emails appear more trustworthy. |
| Barracuda | 2025 | Email Security Vendor |
| 775 | The Forrester Wave: IoT Security Solutions, Q3 2025 | Bottom Line Up Front (BLUF) IoT devices are now part of organizations of every size, but they often lack the same built-in security controls as standard endpoints, making them more susceptible to compromise. For SMBs and insurance teams, the key takeaway is that unmanaged IoT assets can create both cyber exposure and operational disruption, especially when critical devices support shipping, facilities, healthcare, industrial, or customer-facing processes. Top 3-5 Most Notable Statistics •Forrester evaluated 9 IoT security solution providers. •Many businesses may need to discover and classify hundreds of thousands to millions of devices across global infrastructure. •IoT asset discovery can take months to complete. •Vendors included in the evaluation needed at least $25 million in annual revenue from their IoT security product over the past four quarters. •Forrester speaks with up to 3 customers of each vendor as part of this type of evaluation. Top 3-5 Exploitable Technology Risks •Unidentified IoT devices: Organizations cannot protect devices they do not know exist, leaving unknown assets exposed. •Weak local security on IoT devices: Resource limits mean IoT devices often lack the same security functions as desktops, servers, and mobile devices. •Vulnerabilities in firmware and network services: The report highlights vulnerability management as a core requirement for reducing IoT risk. |
| Forrester | 2025 | Consulting / Analyst Firm |
| 776 | The Future of Application Security 2024 | Bottom Line Up Front (BLUF) Application security is now a direct business-risk issue because organizations are releasing software faster, using more cloud-native development, and often deploying applications with known vulnerabilities. For SMBs and insurance teams, the key takeaway is that vulnerable applications, weak authentication, cloud misconfigurations, and software supply chain issues can create breach exposure across the full software development lifecycle. Top 3-5 Most Notable Statistics •92% of surveyed organizations experienced at least one breach in the past 12 months due to a vulnerability in an application they developed. •91% of organizations said they knowingly deployed vulnerable applications. •Organizations experienced an average of 2.44 breaches due to vulnerable applications. •67% of applications are currently deployed in the cloud. •Only about 39% of respondents currently use established tools such as SAST, DAST, and SCA, showing that common application security tooling is not universally adopted. Top 3-5 Exploitable Technology Risks •Stolen credentials, secrets, or weak authentication and authorization, identified as a main breach cause. •Cloud resource, infrastructure as code, and container misconfigurations, which expand exposure as more applications move to cloud environments. •Known or unknown vulnerabilities in code released to production, especially when business deadlines override remediation. |
| Checkmarx | 2024 | Application / API Security Vendor |
| 777 | The Future of Application Security in the Era of AI: 2026 Outlook: When a False Sense of Security Meets Breakneck Developer Velocity | Bottom Line Up Front (BLUF) AI-generated code, faster release cycles, and underused application security practices are creating a major gap between security awareness and real-world readiness. For SMBs and insurance teams, the key takeaway is that vulnerable code is increasingly being accepted as a business trade-off, which can lead to downtime, financial loss, reputational harm, and repeat breach exposure. Top 3-5 Most Notable Statistics •98% of surveyed organizations experienced one or more security breaches in the past 12 months as a direct result of a vulnerable application they developed. •81% of organizations admit to knowingly shipping vulnerable code either sometimes or often. •38% of respondents said vulnerable code was deployed to meet a business, feature, or security-related deadline, up from 31% in 2024. •50% of respondents use AI security code assistants, while only 18% have a list of approved AI tools. •67% of respondents said half or more of their organization’s application code consists of open-source software. Top 3-5 Exploitable Technology Risks •AI-generated code without approved tools, audit trails, or AI-specific security policies, creating “Shadow AI” and reduced visibility into code provenance. •Software supply chain compromise and third-party vendor or partner incidents, especially where open-source components make up a large share of application code. •Cloud infrastructure misconfiguration in cloud-native and multi-cloud environments. |
| Checkmarx | 2025 | Application / API Security Vendor |
| 778 | The Human Factor 2023 | Bottom Line Up Front (BLUF) Proofpoint’s 2023 report shows that attackers are still winning by targeting people first, using social engineering across email, mobile, cloud, and web channels. For SMBs and insurance teams, the key takeaway is that losses are not limited to malware: business email compromise, credential theft, cloud account takeover, and deceptive phone-based attacks are major operational and financial risks. Top 3-5 Most Notable Statistics •94% of monitored cloud tenants were targeted every month. •62% of targeted cloud tenants were successfully compromised. •Telephone-oriented attack delivery messages peaked at more than 13 million per month. •Emotet sent more than 25 million malicious messages, making TA542 the top threat actor by message volume. •Business email compromise caused $2.7 billion in reported U.S. business losses, compared with $34 million in reported ransomware losses. Top 3-5 Exploitable Technology Risks •MFA bypass phishing kits, including EvilProxy, Evilginx2, and NakedPages, can steal credentials and authentication tokens despite multifactor authentication. •Cloud account attacks, including brute-force and precision attacks, can lead to compromised email, document storage, and single sign-on access. •Malicious OAuth applications, mailbox rules, and MFA manipulation can help attackers persist after a cloud account compromise. |
| Proofpoint | 2023 | Email Security Vendor |
| 779 | The Identity Crisis: An In-Depth Report of Cyberattacks in 2024 | Bottom Line Up Front (BLUF) The report’s central finding is that many cyberattacks in 2024 did not begin with advanced malware or highly technical exploits; they began with valid identities. For SMBs and insurance teams, this means weak credential security, excessive permissions, and poor visibility into data access can directly increase the likelihood and severity of a breach. Top 3-5 Most Notable Statistics •57% of the cyberattacks examined started with a compromised identity. •In more than 40% of publicly reported incidents, the method of attack was unknown. •Varonis reviewed 35 SEC Form 8-K cyber incident filings disclosed between January and August 2024. •Of more than 60 incidents investigated by Varonis’ MDDR team, 8 of the 9 most common attack methods involved compromised identity. •85% of the cyberattacks examined were still under investigation, suggesting many organizations lacked full visibility into impact. Top 3-5 Exploitable Technology Risks •Compromised credentials and accounts: attackers can use stolen or exposed usernames and passwords to log in as legitimate users. •Phishing, social engineering, password spraying, and brute force attacks: common methods used to obtain or abuse credentials. •Missing multi-factor authentication and stale passwords: the Snowflake-related incidents showed attackers using exposed credentials, including some available on the dark web for years. |
| Varonis | 2024 | Threat Intelligence Vendor |
| 780 | The Identity Security Reckoning 2026 | Bottom Line Up Front (BLUF) SpyCloud’s central warning is that identity misuse remains the core cyber risk heading into 2026, driven by exposed credentials, stolen session cookies, infostealer malware, non-human identities, and third-party access. For SMBs and insurance teams, this means traditional controls like passwords, MFA, antivirus, and basic vendor reviews are not enough on their own; attackers are increasingly using stolen identity data to bypass defenses and reach business systems. Top 3-5 Most Notable Statistics •Corporate users have, on average, 12 times more exposed identity data than previous tracking methods reported, totaling 146 exposed records tied to a digital identity. •56% of organizations experienced an insider threat incident in the past year. •SpyCloud observed about 900,000 stolen credential records obtained from enterprise AI tools. •66% of malware infections in SpyCloud’s recaptured database bypassed endpoint detection and response or antivirus solutions. •Third-party involvement was observed in 30% of breaches in 2025, according to the report’s cited Verizon research. Top 3-5 Exploitable Technology Risks •Infostealer malware and phishing-as-a-service kits that collect credentials, session cookies, and other identity data for account takeover, session hijacking, ransomware, and fraud. •MFA bypass methods, including stolen session cookies, adversary-in-the-middle phishing, mass MFA notification spam, residential proxies, and antidetect browsers. •Non-human identities such as API tokens, OAuth keys, GitHub personal access tokens, and service accounts that may have privileged access without the same protections as human users. |
| SpyCloud | 2026 | Threat Intelligence Vendor |
| 781 | The Industrialization of Cybercrime: Identities Are Under Attack 2026 | Bottom Line Up Front (BLUF) eSentire’s central finding is that cybercrime has industrialized around identity theft: attackers increasingly prefer to “log in” with stolen credentials rather than break in through traditional exploits. For SMBs and insurance teams, this matters because account compromise, phishing-as-a-service, browser-based social engineering, and trusted third-party access can move from initial access to business impact in minutes. Top 3-5 Most Notable Statistics •Account compromise represented 50%+ of observed threats and increased 389% year over year. •Email-initiated account compromises rose from 36.9% in 2024 to 54.8% in 2025. •Phishing-as-a-Service platforms accounted for 63% of account compromise incidents. •In 100 Tycoon2FA incidents, attackers began exploitation an average of 14 minutes after initial compromise. •ClickFix increased from 7.8% to 30.7% of malware cases, a nearly 300% year-over-year surge. Top 3-5 Exploitable Technology Risks •Phishing-as-a-Service platforms that bypass traditional MFA by intercepting credentials and session tokens in real time. •Microsoft 365 and cloud identity environments where one compromised account can expose email, data, and business workflows. •Microsoft 365 Exchange Online Direct Send abuse, which can allow spoofed emails appearing to come from the victim’s own domain, especially where DMARC is set to monitoring only. |
| eSentire | 2026 | MSP / MSSP / SOC Provider |
| 782 | The Insider AI Threat Report Summer 2025 | Bottom Line Up Front (BLUF) CalypsoAI’s report shows that insider AI misuse is becoming a practical security and governance risk: employees are using AI tools even when policies are unclear or prohibit it. For SMBs and insurance teams, the key issue is not only malicious activity, but everyday staff behavior that can expose sensitive data, proprietary information, and regulated records. Top 3-5 Most Notable Statistics •52% of employees said they are willing to use AI to make their job easier, even if it violates company policy. •28% of employees said they have used AI to access sensitive data or documents. •25% of employees said they submitted proprietary company information so AI could complete a task. •67% of C-level office workers said they are willing to use AI if it makes their job easier, even if it goes against policy. •60% of financial services and banking employees said they use AI tools even if it violates company policy. Top 3-5 Exploitable Technology Risks •Employee use of AI tools to access sensitive data or documents, creating a pathway for data exposure. •Submission of proprietary company information into AI tools to complete work tasks. •AI use without checking whether it is allowed under company policy. |
| CalypsoAI | 2025 | AI Security Vendor |
| 783 | The MSP Customer Insight Report 2025 | Bottom Line Up Front (BLUF) SMBs are increasingly relying on managed service providers because cybersecurity has become too complex to handle with limited internal staff, especially as security tools, AI, cloud, and network needs expand. For insurance and risk teams, the report highlights that weak provider capability, poor tool integration, and inadequate 24/7 support can directly affect breach response, recovery confidence, and customer retention. Top 3-5 Most Notable Statistics •73% of surveyed organizations already outsource security services to an MSP. •52% turn to MSPs when the number of security tools becomes unmanageable. •48% turn to MSPs for 24-hour security support. •39% expect to need MSP support with AI and machine learning tools and applications in the next two years. •45% would switch MSPs if they cannot see evidence of skills, expertise, and the ability to support 24/7 security. Top 3-5 Exploitable Technology Risks •Security tool sprawl and poor integration, which the report says can increase security risk and exposure and make detection and mitigation harder. •Lack of 24/7 monitoring and response capability, leaving organizations less able to respond to threats and security alerts around the clock. •AI and machine learning tools and applications, identified as a growing area of business focus, security vulnerability, and technical complexity. |
| Barracuda | 2025 | Email Security Vendor |
| 784 | The organizational structure of ransomware groups is evolving rapidly | Bottom Line Up Front (BLUF) Ransomware is not disappearing, but its operating model is changing quickly: large Ransomware-as-a-Service groups are fragmenting while lone extortionists, newer brands, and some state-linked actors fill the space. For SMBs and insurance teams, the key takeaway is that smaller organizations remain heavily exposed, especially where unpatched edge systems, weak backup resilience, and limited monitoring allow attackers to create business interruption and data theft leverage. Top 3-5 Most Notable Statistics •Average ransom payment in Q1 2025 was $552,777, nearly unchanged from Q4 2024. •Median ransom payment rose to $200,000, an 80% increase from Q4 2024. •Ransom payment rates have stayed between 25-35% for the trailing six quarters. •Data exfiltration appeared in 71% of cases, while lateral movement appeared in 67%. •The median victim organization had 228 employees, and companies with 11-100 employees represented 35.6% of attacks. Top 3-5 Exploitable Technology Risks •Unpatched edge and remote access systems, including Ivanti Connect Secure VPN, SonicWall SMA1000, Mitel MiCollab, and Palo Alto Networks PAN-OS, were highlighted as actively exploited paths into victim environments. •VMware ESXi environments were targeted for direct ransomware deployment at the hypervisor level, including administrator lockout through password tampering. •Internal remote access tools and protocols, including RDP, PsExec, SSH, OpenSSH, and PuTTY, were used for lateral movement across environments. |
| Coveware | 2025 | Consulting / Analyst Firm |
| 785 | The Q3 2025 Threat Landscape | Bottom Line Up Front (BLUF) Rapid7’s Q3 2025 report shows attackers moving quickly against exposed business-critical systems, especially remote access, SaaS, file transfer, firewall, VPN, and collaboration platforms. For SMBs and insurance teams, the main takeaway is that ransomware, credential compromise, and fast exploitation of newly disclosed or even old vulnerabilities remain practical drivers of downtime, data theft, extortion, and claims. Top 3-5 Most Notable Statistics •88 ransomware groups actively posted to leak sites in Q3, up from 65 in Q2 and 76 in Q1. •28 of the active ransomware groups in Q3 were new additions. •Business services accounted for 18% of ransomware leak posts, followed by manufacturing at 15% and healthcare at 13%. •The United States represented 67% of ransomware regional targeting, followed by Germany at 6%, and the UK and Canada at 5% each. •Rapid7 tracked 53 vulnerabilities first reported as exploited in the wild in Q3, including 10 that had been disclosed more than a year earlier. Top 3-5 Exploitable Technology Risks •Remote access services, including SonicWall SSLVPN, Cisco ASA VPN, FortiGate firewall VPN, and RDP, were repeatedly abused, especially where MFA was missing. •Microsoft SharePoint servers were exploited through a zero-day campaign described as one of the most significant and impactful Q3 incidents due to broad deployment. •Managed file transfer products, including CrushFTP and GoAnywhere MFT, were exploited as zero days and are highlighted as attractive targets for data theft and extortion. |
| Rapid7 | 2025 | Threat Intelligence Vendor |
| 786 | The Ransomware Insights Report 2025 | Bottom Line Up Front (BLUF) Ransomware remains a common and damaging threat for organizations in the SMB size range, with more than half of surveyed organizations reporting a successful attack in the last 12 months. For SMB owners and insurance teams, the key takeaway is that ransomware is no longer just an encryption event: it can involve data theft, backup destruction, added malware, business disruption, reputational damage, and customer loss. Top 3-5 Most Notable Statistics •57% of surveyed organizations experienced a successful ransomware attack in the last 12 months. •31% of ransomware victims were affected twice or more. •32% of ransomware victims paid a ransom to recover or restore data, and 41% of those who paid did not get all or any of their data back. •71% of organizations that experienced an email breach were also hit with ransomware. •25% of ransomware victims lost existing customers, and 25% lost new business opportunities. Top 3-5 Exploitable Technology Risks •Email compromise and social engineering: the report highlights a strong link between email breaches and ransomware, with attackers using phishing and credential theft to gain access. •Security tool sprawl and poor integration: organizations hit multiple times were more likely to report too many security tools and tools that could not integrate, creating gaps in detection and response. •Weak coverage in email, network, endpoint security, and security awareness training: ransomware victims were less likely than non-victims to have these protections in place. |
| Barracuda | 2025 | Email Security Vendor |
| 787 | The Secure Sign-in Trends Report 2024 | Bottom Line Up Front (BLUF) Okta’s 2024 report shows that MFA adoption is improving, but not fast enough given continued phishing, social engineering, password reuse, and brute-force threats. For SMBs and insurance teams, the key takeaway is that basic MFA is no longer the strongest target state: phishing-resistant, passwordless authentication can improve both security and user experience. Top 3-5 Most Notable Statistics •66% of Okta workforce users signed in using MFA as of January 2024. •91% of Okta administrators used MFA, up 1% from the prior year. •MFA adoption increased only 2 percentage points year over year, after growing about 6% per year from 2020 to 2023. •Passwordless usage grew from less than 2% in January 2023 to almost 5% in January 2024. •Okta FastPass adoption increased from 2% to 6%, while FIDO2 WebAuthn increased from 2% to 3%. Top 3-5 Exploitable Technology Risks •Password-only access remains a major risk because MFA is intended to defend against password spraying, compromised password reuse, and some phishing attacks. •Accounts without MFA are a clear target; Okta observed threat actors targeting human and machine accounts that did not have MFA enabled. •Traditional MFA methods such as SMS, email, soft tokens, voice, and security questions are less protective than phishing-resistant authenticators. |
| Okta | 2024 | Threat Intelligence Vendor |
| 788 | The Secure Sign-in Trends Report 2025 | Bottom Line Up Front (BLUF) Okta’s 2025 report shows that MFA is becoming a baseline security control, but many users still lack it and weaker methods such as passwords and SMS remain common. For SMBs and insurance teams, the key takeaway is that phishing-resistant authentication is both more secure and more usable, making it a practical loss-prevention priority rather than a productivity tradeoff. Top 3-5 Most Notable Statistics •Workforce MFA adoption reached 70% of users as of January 2025, meaning nearly one-third still lacked MFA. •Adoption of phishing-resistant authenticators increased 63% in one year, rising from 8.6% to 14.0% of users. •Okta FastPass adoption almost doubled, increasing from 6.7% to 13.3%. •SMS usage fell from 17.5% to 15.3%, while password usage decreased from 95.1% to 93.0%. •Technology led industry MFA adoption at 87%, while retail had the largest year-over-year increase, rising from 43% to 52%. Top 3-5 Exploitable Technology Risks •Lack of MFA: nearly one-third of workforce users still do not have MFA, leaving accounts more exposed to unauthorized access. •Continued password reliance: passwords remain the most widely adopted authentication method, and the report identifies passwords as a vulnerable traditional method. •SMS authentication: the report describes SMS as a low-assurance method and recommends eliminating it from sign-on policies. |
| Okta | 2025 | Threat Intelligence Vendor |
| 789 | The Sophos Annual Threat Report: Cybercrime on Main Street 2025 | Bottom Line Up Front (BLUF) Ransomware remains the most serious cyber threat to small and midsized businesses, but Sophos emphasizes that attackers are increasingly getting in through preventable weaknesses: exposed edge devices, weak or bypassed authentication, unmanaged systems, and social engineering. For SMB owners and insurance teams, the key takeaway is that loss prevention depends heavily on basic lifecycle management, stronger identity protection, and visibility across all assets. Top 3-5 Most Notable Statistics •Ransomware accounted for 70 percent of Sophos Incident Response cases for small business customers in 2024. •Ransomware accounted for over 90 percent of Sophos Incident Response cases for midsized organizations. •Ransomware and data theft attempts accounted for nearly 30 percent of Sophos MDR-tracked incidents for small and midsized businesses. •Published vulnerabilities played a role in 14.53 percent of Sophos MDR and Incident Response intrusion incidents. •Remote ransomware increased 50 percent in 2024 over the prior year and 141 percent since 2022. Top 3-5 Exploitable Technology Risks •Internet-facing edge devices, including VPN appliances, firewalls, remote-access appliances, routers, and gateways, are frequently exploited when misconfigured, weakly protected, unpatched, or obsolete. •Known vulnerabilities in products such as ConnectWise ScreenConnect, Citrix NetScaler, Veeam Backup & Replication, Palo Alto Networks PAN-OS, VMware ESXi, Fortinet products, JetBrains TeamCity, and Microsoft Exchange were observed in intrusion cases. •Microsoft 365 and other software-as-a-service platforms are being abused through email bombing, fake Teams support calls, credential theft, and attempts to move into cloud-hosted data. |
| Sophos | 2025 | Endpoint / MDR / XDR Vendor |
| 790 | The State of Attacks on GenAI 2025 | Bottom Line Up Front (BLUF) Pillar’s analysis shows that GenAI applications are already being attacked successfully in real-world use, with data exposure as the dominant outcome. For SMBs and insurance teams, the key issue is not only whether a business uses AI, but whether its AI tools can leak sensitive data, reveal internal prompts, generate harmful content, or be manipulated through repeated prompt-based attacks. Top 3-5 Most Notable Statistics •90% of successful attacks resulted in leakage of sensitive data. •20% of jailbreak attack attempts successfully bypassed GenAI application guardrails. •Attackers needed an average of only 5 interactions with an LLM to complete an attack. •The average attack took 42 seconds, with the shortest observed attempt lasting 4 seconds. •Customer support applications made up 25% of all observed attacks. Top 3-5 Exploitable Technology Risks •Prompt injection and jailbreaking can bypass both model-level and prompt-level protections, causing systems to ignore instructions or disclose protected content. •“Ignore previous instructions” attacks can override intended system behavior and lead to harmful outputs or unauthorized actions. •Strong Arm attacks use authoritative commands such as “ADMIN OVERRIDE” to pressure the model into revealing internal prompts or restricted information. |
| Pillar | 2025 | Threat Intelligence Vendor |
| 791 | The State of AWS Security 2026 | Bottom Line Up Front (BLUF) AWS security risk in 2026 is driven less by exotic exploits and more by customer-side configuration failures: weak identity controls, exposed credentials, insufficient logging, insecure S3 practices, and new autonomous AI agent risks. For SMBs and insurance teams, the key takeaway is that cloud losses can escalate quickly when attackers use valid credentials or trusted AWS services against the business. Top 3-5 Most Notable Statistics •80% of organizations reported at least one severe cloud security incident, according to a cited 2022 Snyk survey. •Significant cloud incidents increased 154% year over year, from 24% in 2023 to 61% in 2024, according to the cited Check Point / Cybersecurity Insiders report. •IBM’s cited 2025 breach report placed the global average breach cost at $4.44 million, with an average lifecycle of 241 days to identify and contain. •Verizon’s cited 2025 DBIR found compromised credentials were the initial access vector in 22% of breaches. •Shadow AI was a factor in 20% of breaches and added $670,000 to average costs, according to the report. Top 3-5 Exploitable Technology Risks •Long-lived AWS access keys that never expire and often appear in environment variables, repositories, CI/CD systems, or leaked files. •Overly permissive IAM roles and default service roles, including roles with broad S3 access that exceed what workloads need. •S3 exposure and weak recovery controls, including public bucket access, missing CloudTrail data events, and attacks that abuse encryption and lifecycle deletion. |
| Toc Consulting | 2026 | Consulting / Analyst Firm |
| 792 | The State of DevSecOps 2025 | Bottom Line Up Front (BLUF) The report’s core message is that DevSecOps improves software delivery by integrating security, automation, continuous monitoring, and shared responsibility throughout the software life cycle. For SMBs and insurance teams, the practical takeaway is that software risk is better managed continuously, not through one-time reviews or security checks performed late in development. Top 3-5 Most Notable Statistics •DoD reports more than 50 software factories using DevSecOps to deliver code into production. •The study interviewed more than 75 leaders and practitioners across DoD. •Interviewees represented 19 different software organizations and test organizations covering cyber, developmental test, and operational test. •The Air Force completed an initial inventory and assessment of about 30 software activities. •A NAVSEA team delivered 13 updates to an application in one production cloud over 9 months, with some features and bug fixes delivered in 24-48 hours. Top 3-5 Exploitable Technology Risks •Unpatched software vulnerabilities: the report identifies Mean Time to Patch Vulnerabilities as an important cyber hygiene metric, especially for vulnerabilities with high to moderate mission or application impact. •Weak or incomplete continuous monitoring: the report states that traditional point-in-time authorization does not address continuous cybersecurity risk management. •Software supply chain risk: the report identifies secure software supply chain requirements as necessary for continuous authorization. |
| U.S. Department of Defense | 2025 | Threat Intelligence Vendor |
| 793 | The State of Embedded Software Quality and Safety 2025 | Bottom Line Up Front (BLUF) Black Duck’s 2025 survey shows embedded software teams are rapidly adopting AI and open source components, but governance, testing, and supply chain transparency are not keeping pace. For SMBs and insurance teams, the key issue is unmanaged software risk: defects, vulnerable AI-generated code, license exposure, and incomplete visibility into what is inside shipped products. Top 3-5 Most Notable Statistics •89.3% of companies are already using AI-powered coding assistants. •96.1% of companies are using open source AI models in the software they build. •21.1% of organizations are not confident they can prevent AI-generated code from introducing vulnerabilities or other issues. •70.8% of companies are required to produce a Software Bill of Materials. •39.4% produce SBOMs because of customer or partner requirements, more than the 31.5% driven by industry regulation. Top 3-5 Exploitable Technology Risks •AI-generated code that may introduce security vulnerabilities if not reviewed, tested, and scanned before release. •“Shadow AI,” where developers use AI tools against company policy, creating unmanaged security, license, and intellectual property risk. •Open source AI models embedded directly into products without sufficient visibility into vulnerabilities or license obligations. |
| Black Duck | 2025 | Application / API Security Vendor |
| 794 | The State of File Security 2025 | Bottom Line Up Front (BLUF) File security failures are frequent, costly, and often tied to everyday business activities such as sharing, uploading, transferring, and storing files. For SMBs and insurance teams, the key takeaway is that sensitive files can create material financial, operational, and compliance exposure when access is poorly controlled or malicious content is not detected quickly. Top 3-5 Most Notable Statistics •61% of surveyed organizations had a data breach or security incident due to unauthorized access to sensitive and confidential data in files in the past two years. •Organizations that experienced incidents reported an average of 8.425 incidents over the past two years. •54% said these breaches and incidents had financial consequences, with an average cost of $2.7 million over two years. •Only 40% said they can detect and respond to file-based threats within a day or within a week. •Only 25% reported having a formal Generative AI policy, while 29% said GenAI is banned. Top 3-5 Exploitable Technology Risks •Data leakage from negligent or malicious insiders, identified by 45% as the top file security risk. •Weak file access visibility and control, identified by 39%, which can allow unauthorized access to sensitive files. •Third-party file transfers, where only 39% reported high confidence in security. |
| OPSWAT | 2025 | Threat Intelligence Vendor |
| 795 | The State of Human Risk 2026 | Bottom Line Up Front (BLUF) Human risk has become the central cybersecurity challenge, with attackers increasingly exploiting employee behavior, credentials, collaboration tools, and AI-enhanced social engineering rather than only technical flaws. For SMBs and insurance teams, the key issue is not awareness but execution: many organizations know the risks but have not connected training, monitoring, governance, and response into a coordinated program. Top 3-5 Most Notable Statistics •91% of organizations face obstacles ensuring employee compliance, and 96% acknowledge incomplete protection. •Only 28% combine regular security awareness training with continuous monitoring for policy violations. •71% expect collaboration tool attacks to cause negative business impact in 2026. •69% say AI-driven attacks are inevitable within 12 months, but only 40% report being fully prepared. •Respondents estimate an average $13.1M cost for a single insider-driven data exposure, loss, leak, or theft event. Top 3-5 Exploitable Technology Risks •Email phishing, malicious links, attachments, and business email compromise remain major attack vectors, with attackers using more believable and automated conversation chains. •Collaboration platforms such as Microsoft Teams, Slack, Zoom, SharePoint, and DocuSign are being exploited as trusted communication channels, especially where organizations rely on native controls alone. •Credential misuse and account compromise remain high-risk paths, including attacks that bypass traditional authentication methods or exploit systems lacking multi-factor authentication. |
| Mimecast | 2026 | Email Security Vendor |
| 796 | The State of Identity and Access Management (IAM) Maturity | Bottom Line Up Front (BLUF) GuidePoint Security’s 2025 IAM maturity study shows that many organizations remain exposed to identity-based incidents because IAM programs are underfunded, manually operated, and not consistently integrated across users, privileged accounts, and non-human identities. For SMBs and insurance teams, the key takeaway is that weak identity controls can directly translate into business interruption, productivity loss, data exposure, legal costs, and regulatory consequences. Top 3-5 Most Notable Statistics •50% of organizations experienced an identity-based security incident in the past 12 months. •34% of identity-based incidents were caused by leaked, compromised, or stolen credentials. •Only 44% of organizations expressed high confidence in their ability to prevent identity-based security incidents. •38% of impacted organizations reported loss of workforce productivity, such as employees being unable to access systems. •28% of organizations have not implemented multifactor authentication. Top 3-5 Exploitable Technology Risks •Leaked, compromised, or stolen credentials remain the leading cause of identity-based incidents, creating a direct path for unauthorized access. •Phishing, social engineering, and identity theft are common attack paths that can bypass weak or inconsistent identity controls. •Manual deprovisioning of user and non-human identities can leave unnecessary access active after accounts, service accounts, APIs, or devices are no longer needed. |
| GuidePoint Security | 2025 | Consulting / Analyst Firm |
| 797 | The State of Network Security in Transportation & Logistics: Key Findings on Operational Visibility, Cloud Readiness, and GenAI Impact | Bottom Line Up Front (BLUF) Transportation and logistics organizations are struggling to balance network modernization, cloud migration, and security with limited IT resources. For SMBs and insurance teams, the main takeaway is that distributed operations, hybrid applications, remote access, and ransomware concerns create practical risk areas that should be assessed before they become downtime, claims, or coverage issues. Top 3-5 Most Notable Statistics •81% cite staying on top of network security threats as a top networking challenge. •77% identify malware and ransomware attacks as a top network security concern. •74% rely on a hybrid mix of private data centers and cloud environments for critical applications. •70% say simplifying and reducing the cost of network operations is a top priority. •56% are either still evaluating GenAI risks or are not prepared for GenAI-related network and security issues. Top 3-5 Exploitable Technology Risks •Malware and ransomware attacks are the top stated security concern, creating direct risk of operational disruption. •Inconsistent network security policy definition and enforcement can leave gaps across distributed sites and users. •Remote access control is a major concern, especially for organizations supporting mobile and distributed workforces. |
| Gatepoint Research | 2025 | Industrial / Manufacturing Vendor |
| 798 | The State of Passwordless Identity Assurance 2025 | Bottom Line Up Front (BLUF) Identity is the central breach risk highlighted in this report: attackers are increasingly “logging in” by abusing credentials, phishing users, bypassing MFA, and exploiting weak identity verification processes. For SMBs and insurance teams, the key takeaway is that password-based and traditional MFA controls may no longer be enough to prevent costly identity-related incidents, especially as GenAI and deepfakes make impersonation easier. Top 3-5 Most Notable Statistics •49% of surveyed firms reported a breach in the past year. •87% of those breaches were related to identity vulnerabilities. •The average cost of an identity-related breach was US$2.5 million. •Nearly 40% of respondents experienced a GenAI-related security incident in the last 12 months. •95% of organizations that had a GenAI-related incident experienced some form of deepfake incident. Top 3-5 Exploitable Technology Risks •Credential misuse: The report identifies stolen or misused credentials as the top identity vulnerability, creating a direct path for attackers to access systems as legitimate users. •Phishing, pharming, and smishing: These were the most common attack types reported and remain a major concern because they target users and authentication processes. •MFA bypass and weak “standard” MFA: One-time passwords, SMS codes, and push notifications can be intercepted or abused, making them weaker than phishing-resistant methods. |
| HYPR | 2025 | Identity Security Vendor |
| 799 | The State of Passwordless Identity Assurance 2026 | Bottom Line Up Front (BLUF) HYPR’s 2026 survey shows that identity attacks are being accelerated by AI while many organizations still rely heavily on passwords and fragmented identity controls. For SMBs and insurance teams, the key takeaway is that identity risk is no longer just a login problem; attackers are exploiting phishing, deepfakes, stolen credentials, account recovery, hiring, and help desk workflows. Top 3-5 Most Notable Statistics •Generative AI and agentic AI are now the top identity security concerns, cited by 53% and 45% of respondents. •Nearly 40% of organizations reported a GenAI-related security incident in the past 12 months. •Among organizations impacted by AI-based attacks, 65% encountered personalized phishing emails, and 87% experienced some form of audio or video deepfake. •Usernames and passwords remain the dominant authentication method for 76% of respondents, while passwordless authentication is deployed by 43%. •Cost and budget constraints were the top barrier to passwordless adoption at 40%, followed by inability to support legacy applications at 32%. Top 3-5 Exploitable Technology Risks •AI-generated phishing that imitates executives or trusted employees, making credential theft and fraud harder to spot. •Deepfake audio, prerecorded video, live video manipulation, and voice cloning used for impersonation, especially against help desks and call centers. •Continued dependence on usernames and passwords, which preserves exposure to stolen, shared, or compromised credentials. |
| HYPR | 2026 | Identity Security Vendor |
| 800 | The State of Secrets Sprawl 2025 | Bottom Line Up Front (BLUF) GitGuardian’s 2025 report shows that leaked credentials are growing rapidly across code, containers, and collaboration tools, giving attackers an easy path to initial access and lateral movement. For SMBs and insurance teams, the main concern is not just accidental exposure, but that exposed secrets often remain valid long enough to become breach entry points. Top 3-5 Most Notable Statistics •23,770,171 new hardcoded secrets were added to public GitHub repositories in 2024, a 25% increase from the prior year. •58% of detected secrets were generic secrets, up from 49% in 2023. •4.6% of public repositories and 35% of private repositories contained secrets. •Private repositories were 8 times more likely to contain secrets than public repositories. •GitGuardian found approximately 100,000 valid secrets exposed on Docker Hub. Top 3-5 Exploitable Technology Risks •Generic secrets such as hardcoded passwords, database connection strings, custom tokens, and plaintext encryption keys can bypass pattern-based protections. •Docker image layers can retain secrets even after files are deleted in later build stages, leaving credentials accessible in image history. •Collaboration and project management tools such as Slack, Jira, and Confluence are leaking secrets outside traditional source code controls. |
| GitGuardian | 2025 | Application / API Security Vendor |
| 801 | The State of Secure Identity Report 2023 | Bottom Line Up Front (BLUF) Okta’s report shows that customer login systems are a major target for identity attacks, including fraudulent signups, credential stuffing, and MFA bypass attempts. For SMBs and insurance teams, the key takeaway is that any business with a customer-facing portal can face account takeover, fraud costs, customer disruption, and privacy exposure unless identity controls are layered and continuously tuned. Top 3-5 Most Notable Statistics •13.9% of attempted account registrations from January 1 through June 30, 2023 met Okta Customer Identity Cloud criteria for signup attacks. •24.3% of login attempts overall met the criteria for credential stuffing. •12.7% of MFA attempts met the criteria for malicious MFA bypass. •Small businesses experienced the highest MFA bypass rate by organization size at 20.3%. •On the busiest observed day for credential stuffing, Okta identified more than 27 million credential stuffing events. Top 3-5 Exploitable Technology Risks •Credential stuffing driven by password reuse, where attackers use stolen credentials from one service to attempt access to another. •Fraudulent account registration, including abuse of signup incentives and creation of fake accounts. •MFA bypass, especially where older or weaker MFA factors are used. |
| Okta | 2023 | Threat Intelligence Vendor |
| 802 | The State of the Application Security Workflow 2025 | Bottom Line Up Front (BLUF) Kodem’s 2025 survey shows that application security teams are struggling less with finding vulnerabilities and more with fixing the right ones fast enough. For SMBs and insurance teams, the key risk is an extended exposure window: fragmented tools, manual triage, weak prioritization, and limited runtime visibility can leave exploitable issues open while attackers have time to act. Top 3-5 Most Notable Statistics •78% of respondents use more than five application security tools, creating fragmented visibility and inefficiency. •Critical vulnerabilities take an average of 22 days to remediate, and 89% of respondents are dissatisfied with that service level. •8% of respondents reported a compromise attempt during the critical vulnerability remediation window. •87% of respondents are overwhelmed by the volume of security alerts, while 58% question their vulnerability scanners’ prioritization accuracy. •52% encountered API-specific threats in the last 12 months, and 33% said runtime tools significantly helped mitigate those threats. Top 3-5 Exploitable Technology Risks •API-specific threats: APIs are described as central to modern applications and frequent attacker targets. •Unfixed critical vulnerabilities in production: slow remediation creates an open attack window, especially when prioritization is unclear. •Cloud-native and hybrid environments: respondents report workflows are poorly suited to cloud-native demands, and hybrid environments had 2.3x more security incidents than fully cloud-native setups. |
| Kodem | 2025 | Security Research Vendor |
| 803 | The State of Threat Exposure Management 2023 | Bottom Line Up Front (BLUF) Picus Security’s 2023 report shows that many organizations are only partially protected against real-world attacks: they prevent just over half of simulated attacks and detect far fewer. For SMBs and insurance teams, the key takeaway is that having security tools in place does not mean those tools are effectively blocking, logging, or alerting on attacks that can lead to ransomware, data loss, downtime, and claims. Top 3-5 Most Notable Statistics •Organizations prevented only 59% of simulated attacks using existing controls such as IPS, next-generation firewalls, or web application firewalls. •Only 37% of successful attacks were logged after entering environments. •Less than 1 in 6 attacks, or 16%, triggered alerts. •Organizations had only 18% prevention effectiveness against data exfiltration. •The ten least-prevented vulnerability exploits were prevented only 11-16% of the time. Top 3-5 Exploitable Technology Risks •Data exfiltration controls: Organizations showed very weak prevention against unauthorized export of sensitive data, creating direct exposure to data breach impacts. •Web application attacks: Prevention effectiveness was only moderate at 55%, important because many businesses rely on web platforms for core operations. •Multi-stage attack scenarios: Complex attacks had a prevention effectiveness score of only 46%, showing gaps when attackers combine multiple techniques. |
| Picus Security | 2023 | Cybersecurity Services / Consultancy |
| 804 | The State of Threat Exposure Management 2024 | Bottom Line Up Front (BLUF) Picus Security’s 2024 report shows that many organizations are improving prevention, but still struggle to turn security logs into actionable alerts and to stop attackers from reaching high-privilege access. For SMBs and insurance teams, the key takeaway is that having security tools is not enough; controls must be continuously tested, tuned, and validated against realistic attacks. Top 3-5 Most Notable Statistics •40% of tested environments had at least one path that led to domain administrator access. •Average prevention effectiveness improved from 59% in 2023 to 69% in 2024. •Average log score improved from 37% to 54%, but alert score declined from 16% to 12%. •SIEM detection rule issues were most often tied to log collection (38%) and performance (33%). •In 25% of environments, attackers could crack at least one dumped password hash into a cleartext password. Top 3-5 Exploitable Technology Risks •Domain administrator attack paths: Attackers can combine credential theft, privilege escalation, and lateral movement to gain broad network control. •Weak detection and alerting: More attacks are being logged, but too few are generating alerts, delaying response. •SIEM log source problems: Improper consolidation, unavailable log sources, and broken log sources can make detection rules ineffective. |
| Picus Security | 2024 | Cybersecurity Services / Consultancy |
| 805 | The State of Threat Exposure Management 2025 | Bottom Line Up Front (BLUF) Picus Security’s 2025 findings show that many organizations have security tools in place, but those tools often fail to block, log, or alert on real-world attack behaviors unless they are continuously validated and tuned. For SMBs and insurance teams, the most important takeaway is that data theft, credential abuse, and weak detection pipelines remain major loss drivers even when traditional security products are deployed. Top 3-5 Most Notable Statistics •Picus analyzed more than 160 million attack simulations from January to June 2025. •Average prevention effectiveness declined from 69% in 2024 to 62% in 2025. •Data exfiltration prevention dropped to just 3%, down from 9% in 2024. •Password cracking succeeded in 46% of tested environments, up from 25% the prior year. •Alert effectiveness improved only slightly to 14%, while the log score remained 54%. Top 3-5 Exploitable Technology Risks •Data exfiltration controls: Outbound data theft was the least prevented attack vector, creating exposure to ransomware extortion and silent data loss. •Password and credential weaknesses: Cracked password hashes and successful use of valid accounts show that attackers can still move through environments using legitimate credentials. •Detection pipeline failures: Logging gaps, improper log source coalescing, unavailable sources, and weak alert logic prevent security teams from seeing and escalating attacker behavior. |
| Picus Security | 2025 | Cybersecurity Services / Consultancy |
| 806 | The State of Trust Report: Third Edition | Bottom Line Up Front (BLUF) Vanta’s report shows that security risk, AI adoption, and third-party exposure are rising faster than many organizations’ budgets, governance, and compliance processes can handle. For SMBs and insurance teams, the key takeaway is that trust is now a business requirement: customers, partners, and regulators increasingly expect verified proof of security, while attackers and vendor incidents create more operational and financial risk. Top 3-5 Most Notable Statistics •72% of security decision-makers say overall risk has never been higher, up from 55% in 2024. •56% of organizations encounter threat activity at least once a week, and 79% encounter it at least once a month. •59% say AI-related security threats outpace their expertise. •56% report a vendor experienced a data breach in the past 6-12 months. •82% believe improving security and compliance directly boosts customer trust. Top 3-5 Exploitable Technology Risks •AI-generated phishing, which the report says is harder to distinguish from legitimate email and can be launched faster than traditional phishing campaigns. •AI-powered malware that can change during execution to avoid detection. •AI-driven identity theft or fraud, where fraudulent identities can be created, tested, and deployed at high speed. |
| Vanta | 2025 | Threat Intelligence Vendor |
| 807 | The State of Vulnerability Management 2023 | Bottom Line Up Front (BLUF) Vulnerability exploitation has become a leading path into organizations, and traditional manual patching cannot keep up with the volume and speed of newly disclosed flaws. For SMBs and insurance teams, the key takeaway is that unmanaged or slowly remediated vulnerabilities can materially increase breach likelihood, response time, and loss costs. Top 3-5 Most Notable Statistics •37% of incidents start with vulnerability exploitation, making it the leading initial access vector cited in the report. •More than 24,000 new vulnerabilities were discovered globally in 2022. •An average of 72% of vulnerabilities remain unpatched within 30 days. •Firms are able to fix only 5%-20% of known vulnerabilities per month. •Organizations that contained breaches in under 200 days saw average savings of $1.12 million. Top 3-5 Exploitable Technology Risks •Internet-facing applications: the report highlights exploitation of vulnerabilities in Internet-facing applications as a major initial intrusion path. •Known vulnerabilities, or CVEs: 78% of identified attack paths use known vulnerabilities as an initial attack vector. •Newly disclosed flaws: attackers scan for vulnerable systems within minutes after a CVE is announced. |
| Nucleus | 2023 | Threat Intelligence Vendor |
| 808 | The State of Zero Trust 2025 | Bottom Line Up Front (BLUF) Zero Trust is widely accepted in principle, but the report shows most organizations are still operating with fragmented tools, legacy VPNs, manual access processes, and inconsistent identity controls. For SMBs and insurance teams, the core issue is practical risk: weak access management creates opportunities for credential misuse, lingering former-employee access, unmanaged devices, and user workarounds that can undermine security controls. Top 3-5 Most Notable Statistics •99% of companies want to redesign their access and connectivity approach. •83% of respondents have bypassed security processes; among developers, the figure is 87%. •68% of respondents report retaining some level of access to former employers’ privileged systems after leaving. •90% report one or more issues with their current VPN, and 40% cite VPN security risks. •42% say their current security and access model will be outdated within two years. Top 3-5 Exploitable Technology Risks •Legacy VPNs that grant broad internal access after connection, increasing the potential impact of stolen credentials or compromised devices. •Manual network access controls and static IP-based permissions, which create complexity, delays, and security gaps. •Poor offboarding and identity lifecycle management, allowing former employees to retain access after departure. |
| Tailscale | 2025 | Network Security Vendor |
| 809 | The Supply Chain Threat 2025 | Bottom Line Up Front (BLUF) Supply chain attacks are a high-impact risk because a single compromised software or service provider can expose many downstream customers at once. For SMBs and insurance teams, this means a business can suffer data theft, operational disruption, or credential compromise even when the initial breach happens at a trusted vendor rather than inside the business itself. Top 3-5 Most Notable Statistics •3CX had 600,000 business customers worldwide when trojanized software was distributed through trusted channels. •Zellis processes payroll for five million employees every month and is used by 42% of the FTSE100. •The Cl0p MOVEit mass-exploitation campaign affected more than 300 organizations, including Zellis. •Dropbox reported that 130 GitHub code repositories were stolen after a phishing compromise. •Under NIS2, incident notification may be required within 24 hours, with enforcement of up to 2% of annual turnover or €10 million, whichever is higher. Top 3-5 Exploitable Technology Risks •Trusted software updates and downloads can be trojanized, as shown by the 3CX incident, allowing attackers to reach many customers through legitimate software channels. •Managed file-transfer software can expose sensitive customer data when vulnerable, as shown by MOVEit and the Zellis downstream impact. •Public and private software dependencies can hide risk, including deeply embedded libraries such as Log4j that organizations may not know they use. |
| WithSecure | 2025 | Threat Intelligence Vendor |
| 810 | The Total Economic Impact of Bugcrowd Managed Bug Bounty | Bottom Line Up Front (BLUF) Forrester’s study concludes that a managed bug bounty program can materially improve vulnerability discovery, remediation efficiency, and financial outcomes compared with relying mainly on traditional penetration testing. For SMBs and insurance teams, the key takeaway is that continuous, researcher-driven testing may reduce breach exposure, lower operating burden, and support a stronger cyber insurance risk profile. Top 3-5 Most Notable Statistics •268% return on investment over three years for the composite organization. •$1.43 million net present value and less than 6 months payback period. •60% avoided traditional penetration test costs by Year 3. •Up to 30% reduced likelihood of a material breach. •9% reduction in cybersecurity insurance premium costs for the composite organization. Top 3-5 Exploitable Technology Risks •Customer-facing application vulnerabilities that may be missed by internal teams, scanners, or periodic penetration tests. •Application-layer weaknesses that can lead to data leakage or undesired disclosure of information. •Vulnerabilities left exposed longer because of slow triage, delayed remediation guidance, or limited retesting. |
| Forrester | 2024 | Consulting / Analyst Firm |
| 811 | Third Party Breach Report 2022 | Bottom Line Up Front (BLUF) Third-party cyber risk is a major business exposure because attackers increasingly reach organizations through vendors, especially software publishers and service providers. For SMBs and insurance teams, the key takeaway is that vendor risk cannot be treated as a one-time checklist exercise; ransomware, weak access controls, unsecured databases, and delayed breach disclosure can create costly ripple effects across many connected businesses. Top 3-5 Most Notable Statistics •Third-party data breaches increased 17% in 2021. •Ransomware caused 27% of third-party breaches analyzed, making it the most common attack method. •Software publishers accounted for 23% of third-party breach incidents and were the top breached vendor type for the third consecutive year. •Healthcare accounted for 33% of third-party breach incidents, making it the most impacted industry. •The average time between an attack and disclosure was 75 days. Top 3-5 Exploitable Technology Risks •Ransomware: Attackers used ransomware as the leading method because it allows stolen or locked data to be monetized quickly. •Unauthorized network access: The report links this to weak passwords and vulnerabilities in access control. •Unsecured servers and databases: Externally facing databases and servers were a top root cause, especially when third parties manage sensitive data. |
| Black Kite | 2022 | Security Research Vendor |
| 812 | Third-Party Breach Report 2025 | Bottom Line Up Front (BLUF) Third-party breaches are now a major entry point for attackers, with more than one in three breaches in the report tied to vendors, suppliers, partners, software providers, subsidiaries, or other connected organizations. For SMBs and insurance teams, the key issue is that a company can be breached through a trusted business relationship even when its own perimeter controls appear sound. Top 3-5 Most Notable Statistics •35.5% of all breaches in 2024 were third-party related, up from 29% the prior year. •4.5% of all breaches extended to fourth parties, showing how one supplier compromise can cascade across multiple organizations. •41.4% of ransomware and extortion incidents had a third-party breach component. •Technology products and services enabled 46.75% of third-party breach relationships, while non-technology sources accounted for 53.25%. •File transfer software was the top individual breach enabler, involved in 14% of third-party breach relationships. Top 3-5 Exploitable Technology Risks •File transfer software vulnerabilities, including Cleo vulnerabilities CVE-2024-50623 and CVE-2024-55956, were heavily exploited and enabled large-scale third-party attacks. •Cloud products and services were the second most common third-party attack vector, with Snowflake-related compromises linked to accounts lacking multi-factor authentication. •VPN software and Ivanti Connect Secure vulnerabilities were exploited in notable breaches, including CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893. |
| SecurityScorecard | 2025 | Security Research Vendor |
| 813 | Threat Hunting Report 2021 | Bottom Line Up Front (BLUF) CrowdStrike’s report shows that hands-on intrusions increased sharply, moved quickly, and often avoided malware by using valid credentials and built-in tools. For SMBs and insurance teams, the key takeaway is that prevention alone is not enough: organizations need broad visibility, fast response, strong identity controls, and disciplined patching to stop intrusions before they become business-impacting breaches. Top 3-5 Most Notable Statistics •OverWatch observed a near 60% year-over-year increase in interactive intrusion campaigns. •OverWatch threat hunters identified more than 65,000 potential intrusions, averaging 1 potential intrusion every 8 minutes. •68% of detections from the last three months were not malware-based. •Financially motivated eCrime accounted for 75% of interactive intrusion activity. •The average eCrime breakout time was 1 hour 32 minutes, and in 36% of cases adversaries moved laterally in less than 30 minutes. Top 3-5 Exploitable Technology Risks •Valid accounts and legitimate credentials, which adversaries use because they are difficult to distinguish from normal user activity. •Public-facing applications and servers, including vulnerable Oracle WebLogic servers and Microsoft Exchange exploitation. •Remote access pathways such as RDP, SMB, TeamViewer, AnyDesk, Ammyy Admin, and VNC, especially when exposed or poorly monitored. |
| CrowdStrike | 2021 | Endpoint / MDR / XDR Vendor |
| 814 | Threat Hunting Report 2022 | Bottom Line Up Front (BLUF) CrowdStrike’s 2022 Threat Hunting Report shows a sharp rise in hands-on, human-driven intrusions, with adversaries increasingly using valid accounts, remote access, newly disclosed vulnerabilities, phishing, and cloud access paths rather than relying only on malware. For SMBs and insurance teams, the key takeaway is that loss prevention must focus on early detection of attacker behavior, identity security, remote access controls, and rapid response before ransomware or data theft occurs. Top 3-5 Most Notable Statistics •77,000+ potential intrusions were directly identified by Falcon OverWatch during the reporting period. •OverWatch uncovered a potential intrusion every 7 minutes on average. •Interactive intrusion campaigns increased by nearly 50% year over year. •Malware-free activity accounted for 71% of detections indexed by CrowdStrike Threat Graph. •For eCrime intrusions where breakout time could be measured, adversaries moved laterally in an average of 1 hour and 24 minutes, with 30% moving to additional hosts in under 30 minutes. Top 3-5 Exploitable Technology Risks •Valid account abuse, including domain, local, and default accounts, which attackers used for access, persistence, privilege escalation, and lateral movement. •Remote access services and RDP, especially where attackers could use valid credentials, modify registry settings, or move between critical systems such as domain controllers and backup servers. •Public-facing applications and newly disclosed vulnerabilities, including web service compromise, web shell deployment, and exploit chaining against internet-facing systems. |
| CrowdStrike | 2022 | Endpoint / MDR / XDR Vendor |
| 815 | Threat Hunting Report 2023 | Bottom Line Up Front (BLUF) CrowdStrike’s 2023 Threat Hunting Report shows that attackers are increasingly using identity abuse, exposed applications, legitimate remote tools, and cloud credentials to conduct hands-on-keyboard intrusions while avoiding traditional detection. For SMBs and insurance teams, the key takeaway is that risk is no longer limited to malware: valid accounts, unpatched internet-facing systems, and unmanaged cloud or Linux/macOS assets can create fast paths to data theft, ransomware, and business disruption. Top 3-5 Most Notable Statistics •Interactive intrusion volume increased 40% year over year. •71% of intrusions tracked by CrowdStrike were malware-free. •80% of breaches used compromised identities. •62% of interactive intrusions used valid accounts; 26% involved credential dumping attempts and 11% targeted unsecured credentials. •Exploitation of public-facing applications was observed in over 20% of interactive intrusions. Top 3-5 Exploitable Technology Risks •Valid account abuse and stolen identity material, including usernames, passwords, Kerberos tickets, API keys, session tokens, certificates, and cloud credentials. •Unpatched public-facing applications, including productivity applications and Oracle WebLogic Server activity involving CVE-2023-21839. •Remote monitoring and management tools, which adversaries used to blend into normal enterprise activity and avoid detection. |
| CrowdStrike | 2023 | Endpoint / MDR / XDR Vendor |
| 816 | Threat Hunting Report 2024 | Bottom Line Up Front (BLUF) CrowdStrike’s 2024 Threat Hunting Report shows that human-operated intrusions are rising quickly, with attackers increasingly using valid identities, cloud access, and legitimate remote management tools to stay hidden. For SMBs and insurance teams, the key takeaway is that many serious intrusions may look like normal employee, administrator, or IT support activity unless identity, endpoint, and cloud activity are monitored together. Top 3-5 Most Notable Statistics •Interactive intrusions increased by 55% year-over-year. •86% of all interactive intrusions were attributed to eCrime activity. •eCrime-related interactive intrusions against healthcare increased 75%. •Interactive intrusions impacting the technology sector increased 60%, making it the most frequently targeted industry for the seventh consecutive year. •Adversary use of remote monitoring and management tools increased 70%, and 27% of all interactive intrusions leveraged these tools. Top 3-5 Exploitable Technology Risks •Valid account abuse and stolen credentials, including use of compromised identities to access networks, cloud consoles, VPNs, and unmanaged internet-facing systems. •Poorly configured or over-privileged cloud environments, where attackers can use credentials to access cloud control planes, find privileged roles, and pivot into hosted virtual machines. •Remote monitoring and management tools, including ScreenConnect, AnyDesk, RustDesk, Atera, Level.io, SimpleHelp, Tactical RMM, Action1, TinyPilot, VS Code Dev Tunnels, and Google Chrome Remote Desktop, which can be used for persistence or initial access. |
| CrowdStrike | 2024 | Endpoint / MDR / XDR Vendor |
| 817 | Threat Hunting Report 2025 | Bottom Line Up Front (BLUF) CrowdStrike’s 2025 Threat Hunting Report shows adversaries moving faster and operating across identity, endpoint, cloud, SaaS, and unmanaged network devices to avoid traditional defenses. For SMBs and insurance teams, the key takeaway is that ransomware, data theft, and account takeover risk increasingly depend on weak identity processes, cloud exposure, and visibility gaps rather than malware alone. Top 3-5 Most Notable Statistics •81% of interactive intrusions were malware-free. •Interactive, hands-on-keyboard intrusions increased 27% year-over-year. •eCrime represented 73% of total interactive intrusions. •Cloud intrusions increased 136% in the first half of 2025 compared to all of 2024. •FAMOUS CHOLLIMA insiders infiltrated over 320 companies in the last 12 months, a 220% year-over-year increase. Top 3-5 Exploitable Technology Risks •Help desk social engineering and MFA reset abuse, especially against Microsoft Entra ID, SSO, virtual desktop infrastructure, IT/security staff, and executive accounts. •Cloud environments exposed through stolen credentials, misconfigurations, trusted relationships, service principals, and cloud management tools. •Unmanaged or under-monitored network devices, including VPN appliances, routers, switches, firewalls, and Cisco IOS/IOS XE devices, which can sit outside traditional endpoint detection. |
| CrowdStrike | 2025 | Endpoint / MDR / XDR Vendor |
| 818 | Threat Intel Report 2024 | Bottom Line Up Front (BLUF) Flashpoint’s 2024 report shows a threat environment where data breaches, exploitable vulnerabilities, and ransomware all increased sharply, creating practical risk for SMBs and the insurers that cover them. The most important takeaway is that attackers are using unauthorized access, public exploits, third-party compromise, and extortion pressure to turn security gaps into business disruption and data loss. Top 3-5 Most Notable Statistics •6,077 publicly reported data breaches were recorded in 2023, a 34.5% increase compared to 2022. •More than 17 billion personal records were leaked in 2023. •Ransomware attacks rose to 5,028 in 2023, an 84% year-over-year increase. •33,137 vulnerabilities were disclosed in 2023, and 35% had known public exploits. •From January 1 to February 29, 2024, threat actors compromised 1.897 billion personal records and credentials, a 429% increase compared to the same period last year. Top 3-5 Exploitable Technology Risks •MOVEit Transfer vulnerability CVE-2023-34362, exploited by Cl0p, contributed to 19.3% of reported 2023 data breaches, including third-party impacts. •Remotely exploitable vulnerabilities with known public exploits and known solution details are highlighted as high-priority risks because they are actionable for attackers and defenders. •Non-CVE vulnerabilities create visibility gaps; Flashpoint reports over 100,000 vulnerabilities not covered by CVE, including some exploited in the wild. |
| Flashpoint | 2024 | Threat Intelligence Vendor |
| 819 | Threat Intelligence Report 2025 | Bottom Line Up Front (BLUF) Nokia’s 2025 report shows a shift from opportunistic cyberattacks to coordinated, persistent campaigns against telecom infrastructure, including core systems, signaling, subscriber databases, and lawful-interception environments. For SMBs and insurance teams, the key takeaway is that business interruption, data exposure, credential misuse, and third-party dependency risk are increasingly tied to the resilience of communications providers and connected digital services. Top 3-5 Most Notable Statistics •63% of surveyed operators faced at least one “living off the land” attack last year, and 32% saw four or more. •78% of DDoS attacks were completed within five minutes, with 37% ending within two minutes. •59% of the most impactful incidents stemmed from human error or insider activity. •76% of vulnerabilities identified in assessments stemmed from missing security patches. •63% of major incidents took more than a week to fully recover, while 83% of malware or ransomware incidents cost over $500,000. Top 3-5 Exploitable Technology Risks •Missing security patches and end-of-life systems, which remain a primary source of exploitable vulnerabilities. •“Living off the land” techniques, where attackers use legitimate tools and credentials to evade detection. •DDoS attacks using residential proxy botnets and compromised IoT devices, enabling fast, multi-vector disruption. |
| Nokia | 2025 | Threat Intelligence Vendor |
| 820 | Threat Intelligence Report 2025 | Bottom Line Up Front (BLUF) Truesec’s central message for SMBs is clear: cybercriminals are increasingly opportunistic and are shifting ransomware activity toward smaller organizations with weaker defenses. For insurers and risk managers, the most important takeaway is that many successful ransomware incidents are tied to preventable control gaps: exposed systems, weak identity protection, and poor vulnerability management. Top 3-5 Most Notable Statistics •More than 40% of ransomware incidents began with exploitation of vulnerabilities in external-facing security applications such as VPNs and firewalls. •Over 90% of ransomware incidents Truesec handled in 2024 could have been avoided through blocking password guessing, strictly enforcing MFA, and active vulnerability management. •99% of companies in the Nordics are considered SMBs. •SMBs generate approximately 51.4% of the value added to Swedish GDP. •Cyber insurance rates for SMBs dropped about 30% in the last 12 months, according to the report’s insurance commentary. Top 3-5 Exploitable Technology Risks •Exposed VPNs, firewalls, and other external-facing security applications with vulnerabilities that allow remote code execution. •Weak identity controls, including stolen credentials, brute-force password guessing, and remote access without enforced MFA. •Phishing that steals credentials, session cookies, or tokens, especially in business email compromise cases. |
| Truesec | 2025 | Threat Intelligence Vendor |
| 821 | Threat Intelligence Report 2025 | Bottom Line Up Front (BLUF) Anthropic’s report shows that cybercriminals are using AI not just for advice, but as an active operator across intrusions, malware development, extortion, fraud, and fake employment schemes. For SMBs and insurance teams, the key takeaway is that AI can let lower-skilled actors perform higher-impact attacks faster, increasing exposure to data theft, ransomware, business interruption, and fraud. Top 3-5 Most Notable Statistics •A data extortion operation potentially affected at least 17 organizations in one month across government, healthcare, emergency services, and religious institutions. •AI-generated ransom demands ranged from $75,000 to $500,000 in Bitcoin. •North Korean remote worker activity was concentrated in frontend development (61%), programming/scripting (26%), interview preparation (10%), and backend development (3%). •Anthropic observed that about 80% of Claude usage in the North Korean remote worker case was consistent with active employment. •A Chinese threat actor used Claude across 12 of 14 MITRE ATT&CK tactics during a 9-month campaign. Top 3-5 Exploitable Technology Risks •Internet-facing VPN endpoints and devices: Attackers used scanning and open-source intelligence to identify potential entry points at scale. •Credential harvesting and enterprise directory abuse: Claude-assisted activity included extracting credentials, accessing Active Directory systems, and supporting lateral movement. •Ransomware and malware with evasion features: AI-assisted malware used encryption, anti-debugging, direct syscall techniques, string obfuscation, and disguises as legitimate tools. |
| Anthropic | 2025 | Research Organization |
| 822 | Threat Intelligence Report 2026 | Bottom Line Up Front (BLUF) Truesec’s central message is that cybercrime remains the most common threat to most organizations, but better detection and response are reducing the worst ransomware outcomes. For SMBs and insurance teams, the risk is shifting toward faster attacks, credential abuse, social engineering, data extortion, and attacks against commonly trusted tools and software supply chains. Top 3-5 Most Notable Statistics •More than a third of ransomware incidents handled by Truesec in 2025 began with attackers using valid usernames and passwords to access exposed VPN gateways or terminal servers. •Almost 14 percent of valid credentials used in ransomware attacks handled by Truesec CSIRT in 2025 were obtained through password spraying. •Truesec observed that the number of significant ransomware incidents decreased by more than a third compared with earlier periods. •The “Shai-Hulud” software supply chain incident compromised more than 500 npm packages. •In 2024, over 1,000 cybercriminals and fraudsters were arrested in a joint INTERPOL and AFRIPOL operation. Top 3-5 Exploitable Technology Risks •Exposed VPN gateways and terminal servers accessed with valid credentials, including reused, stolen, or sprayed passwords. •Internet-facing applications such as VPNs, firewalls, and security products that can be exploited as ransomware entry points. •Commercial remote management and monitoring tools, including TeamViewer and AnyDesk, used by attackers to maintain persistence while blending in with legitimate administration. |
| Truesec | 2026 | Threat Intelligence Vendor |
| 823 | Threat Landscape Report 2025 | Bottom Line Up Front (BLUF) Cyberint’s report shows that travel and tour operations are being targeted through practical, high-impact attacks: DDoS disruptions, ransomware, exposed cloud storage, phishing-driven credential theft, and third-party compromise. For SMBs and insurance teams, the key takeaway is that smaller travel businesses with limited security budgets and reliance on online booking, cloud storage, and vendors may face downtime, data exposure, extortion, and customer trust impacts. Top 3-5 Most Notable Statistics •112,000 customer records and 26.8GB of data were exposed in an Australian travel agency breach caused by a publicly accessible AWS storage bucket. •More than 13,000 customer spreadsheets were leaked in the same incident, including names, emails, trip costs, and destinations. •Transport for London had data on 5,000 people accessed and reset 30,000 employee passwords in person after a credential access and privilege escalation attack. •A major U.S. airport ransomware incident involved personal information from 90,000 individuals. •A major U.S. resort attack allegedly involved 6TB of customer information exfiltrated from systems supporting reservations, digital room keys, websites, and other operations. Top 3-5 Exploitable Technology Risks •Publicly exposed cloud storage, especially misconfigured AWS S3 buckets, allowing attackers to find and extract sensitive files using automated scanning tools. •DDoS attacks against booking and ticketing systems, which can disrupt real-time customer-facing services during high-traffic periods. •Phishing, impersonation, and credential theft targeting employees and help desks, enabling access to Okta, Azure, VPNs, and internal systems. |
| Cyberint | 2025 | Threat Intelligence Vendor |
| 824 | Threat Landscape Report: Cybercrime in the Crypto Era | Bottom Line Up Front (BLUF) Kroll’s 2025 report shows that cybercriminals are increasingly targeting cryptocurrency users, exchanges, and businesses as crypto becomes more mainstream. For SMBs and insurance teams, the key takeaway is that crypto exposure can amplify familiar risks—phishing, credential theft, malware, compliance failures, and even physical security threats—into high-value loss events. Top 3-5 Most Notable Statistics •Nearly $1.93 billion was stolen in crypto-related crimes in the first half of 2025, surpassing the total for 2024. •Phishing attacks targeting cryptocurrency users increased by 40%, primarily through fake exchange sites. •The Bybit breach involved theft of more than $1.46 billion in cryptocurrency from a cold wallet. •The Bybit theft was described as the largest cryptocurrency hack ever, almost doubling the $620 million stolen from Sky Mavis in March 2022. •Under DORA, in-scope EU financial entities must perform Threat-Led Penetration Tests at least every three years. Top 3-5 Exploitable Technology Risks •Phishing and fake exchange sites remain a major initial access risk, especially for users handling cryptocurrency accounts or wallets. •CLEARFAKE uses fake CAPTCHA pop-ups on compromised websites, commonly WordPress sites, to deliver malicious browser-based activity. •EtherHiding allows malicious logic to be stored on blockchain infrastructure, making payload hosting difficult to remove or take down. |
| Kroll | 2025 | Consulting / Analyst Firm |
| 825 | Threat Landscape Retrospective 2021 | Bottom Line Up Front (BLUF) Tenable’s 2021 retrospective shows that attackers continued to succeed through known, preventable weaknesses: unpatched legacy vulnerabilities, exposed perimeter systems, cloud misconfigurations, and exploitable trust relationships. For SMBs and insurance teams, the key takeaway is that many high-impact ransomware and breach events were tied to weaknesses that can be identified, prioritized, and reduced before they become claims. Top 3-5 Most Notable Statistics •21,957 new CVEs were assigned in 2021, a 19.6% increase over 2020 and a 241% increase over 2016. •105 zero-day vulnerabilities were reported in 2021. •83% of zero-day vulnerabilities disclosed in 2021 were exploited in attacks, with web browser zero-days accounting for over 30%. •Tenable analyzed 1,825 breach events from November 2020 through October 2021. •More than 40 billion records were exposed across analyzed breach disclosures, while 87% of breach disclosures did not state the number of exposed records. Top 3-5 Exploitable Technology Risks •Microsoft Exchange vulnerabilities, including ProxyLogon and ProxyShell, were heavily exploited because Exchange is widely used, internet-accessible, and can be chained with other flaws. •SSL VPN vulnerabilities in products from Fortinet, Pulse Secure, Citrix, SonicWall, and others remained major entry points for espionage, data theft, and ransomware. •Windows Print Spooler vulnerabilities created significant risk because the service is common in Windows environments and several flaws were disclosed in a short period. |
| Tenable | 2021 | Threat Intelligence Vendor |
| 826 | Threat Monitor Report 2022 | Bottom Line Up Front (BLUF) NCC Group’s 2022 Threat Monitor shows that ransomware, business email compromise, phishing, exploited public-facing systems, and vulnerable remote access remained the most practical routes into organizations. For SMBs and insurance teams, the key takeaway is that common, preventable weaknesses continued to drive material incidents, including encryption, fraud, data theft, and operational disruption. Top 3-5 Most Notable Statistics •Spearphishing accounted for 43% of initial access techniques in NCC Group incident response cases, followed by exploitation of public-facing applications at 33%. •Organized crime groups conducted 81% of attacks seen by NCC Group’s incident response team. •Ransomware represented 40% of incident response impact cases, while business email compromise represented 33%. •NCC Group’s SOC recorded 2,559 true positive incidents in 2022, a 116% increase from 1,183 in 2021 across its client base. •LockBit was responsible for 846 of 2,531 ransomware attacks observed in 2022, representing 33% of the total. Top 3-5 Exploitable Technology Risks •Spearphishing using malicious links or attachments, which remained the most common initial access method in NCC Group incident response cases. •Exploitation of vulnerable public-facing applications, including widely used platforms such as Atlassian Confluence and Spring Framework where critical vulnerabilities were highlighted. •Unsecure external remote services such as RDP and VPNs, which were identified as a recurring route into victim networks. |
| NCC Group | 2022 | Threat Intelligence Vendor |
| 827 | Threat Monitor Report 2023 | Bottom Line Up Front (BLUF) NCC Group’s 2023 Threat Monitor shows ransomware reaching the highest victim volume the firm has recorded, with attackers increasingly using supply-chain compromise, file-transfer vulnerabilities, and extortion pressure to affect many organizations at once. For SMBs and insurance teams, the key takeaway is that cyber risk is no longer limited to direct targeting: vendors, managed service providers, and widely used software platforms can create serious disruption, data exposure, and claims impact. Top 3-5 Most Notable Statistics •Ransomware cases increased by 84% from 2022 to 2023, rising from 2,531 to 4,667 incidents. •The mean number of monthly ransomware attacks rose to 389 in 2023, compared with 211 in 2022. •Industrials was the most targeted ransomware sector, with 1,484 attacks, representing 32% of 2023 activity. •LockBit 3.0 was the most active ransomware group, with 1,039 attacks in 2023. •NIST recorded 29,065 vulnerabilities disclosed in 2023, an increase of 3,982 compared with 2022. Top 3-5 Exploitable Technology Risks •Managed file transfer platforms, including GoAnywhere MFT and MOVEit, were exploited through zero-day vulnerabilities to steal data and support ransomware extortion. •Public-facing and remote services remained key entry points, with the report highlighting exploitation of remote services, public-facing applications, and privilege escalation as top techniques. •PaperCut NG and PaperCut MF remote code execution vulnerabilities were highlighted as exploitable without authentication. |
| NCC Group | 2023 | Threat Intelligence Vendor |
| 828 | Threat Predictions 2026 | Bottom Line Up Front (BLUF) Fortinet’s main prediction for 2026 is that cybercrime will become faster, more automated, and more industrialized, with attackers using AI, shared infrastructure, and specialized services to move from compromise to extortion much more quickly. For SMBs and insurance teams, the key issue is speed: losses may depend on whether an organization can detect, contain, and respond before automated attacks spread or stolen data is monetized. Top 3-5 Most Notable Statistics •A ransomware affiliate may launch 10 attacks in the time it once took to coordinate one. •AI models may parse terabytes of stolen data in minutes to identify which victims or records to extort first. •Attackers who once needed days to monetize access may now do so in hours by automating reconnaissance, data analysis, and extortion. •A compromised cloud workload may trigger AI-driven privilege escalation within seconds. •The average annual cost of cybercrime is expected to increase to more than $23 trillion by 2027, according to the report’s cited World Economic Forum reference. Top 3-5 Exploitable Technology Risks •AI-enabled cybercrime agents designed for credential theft, phishing, lateral movement, and other attack-chain tasks with limited or no human oversight. •Cloud workloads and cloud identities, where automated privilege escalation and rapid lateral movement can occur quickly after compromise. •Human and non-human identities, including automation agents, scripts, CI/CD identities, AI-powered processes, and machine-to-machine workflows that require strong authentication and auditing. |
| Fortinet | 2026 | Network Security Vendor |
| 829 | Threat Report 2021 | Bottom Line Up Front (BLUF) Email remained a major attack path in 2020, even as overall spam volume declined. For SMBs and insurance teams, the key issue is not just how much email arrives, but how attackers use familiar tools like Microsoft Office, cloud services, and business email workflows to deliver malware, steal credentials, and redirect payments. Top 3-5 Most Notable Statistics •Spam volume declined by 43 percent compared to 2019 and was only 16 percent of the 2014 level. •Malware represented 0.44 percent of total spam, up from 0.22 percent in 2019. •Excel attachments represented 39 percent of malicious attachments, up from 7 percent in 2019. •43 percent of malicious Excel attachments used Excel 4.0 macros. •Trustwave intercepted around 40 BEC messages per day on average for MailMarshal Cloud customers, and 58.61 percent of BEC messages used a Gmail address in the From field. Top 3-5 Exploitable Technology Risks •Malicious Microsoft Office attachments, especially Excel files using macros, which attackers use to download additional malware. •Password-protected Microsoft documents and archives, which can make malware harder for email scanners to inspect. •Older Microsoft Office and Adobe vulnerabilities, including commonly observed exploits for Equation Editor and Office memory corruption issues. |
| Trustwave | 2021 | MSP / MSSP / SOC Provider |
| 830 | Threat Report 2022 | Bottom Line Up Front (BLUF) Sophos’ 2022 report shows ransomware remains the dominant business threat, increasingly delivered through ransomware-as-a-service, stolen access, commercial attack tools, and exposed infrastructure. For SMBs and insurance teams, the key takeaway is that even a small foothold—such as a weak remote access login, malware alert, or unpatched server—can lead to data theft, extortion, downtime, and a costly claim. Top 3-5 Most Notable Statistics •Ransomware accounted for 79% of Sophos Rapid Response incident response engagements in 2020-2021. •Cobalt Strike accounted for 6% of Sophos Rapid Response engagements and was described as present in most ransomware cases Sophos saw over the last year. •Sophos tracked detections of more than 180 different attack tools, including mimikatz, Metasploit, Cobalt Strike, and Sharp-Suite. •Sophos warned that credential theft happens millions of times a day globally and feeds initial access brokers. •The Kaseya attack was reported to have infected hundreds of Kaseya customers, including managed service providers, with REvil ransomware. Top 3-5 Exploitable Technology Risks •Exposed or poorly protected RDP, especially where access depends only on passwords, remains a major ransomware entry point. •Microsoft Exchange vulnerabilities such as ProxyLogon and ProxyShell enabled attackers to install web shells, Cobalt Strike Beacons, cryptominers, ransomware, and other malware. •Cobalt Strike Beacons are widely used as backdoors for command execution, lateral movement, payload delivery, and ransomware deployment. |
| Sophos | 2022 | Endpoint / MDR / XDR Vendor |
| 831 | Threat Report 2024 | Bottom Line Up Front (BLUF) Sophos identifies ransomware as the biggest existential cyber threat to small businesses, but the broader risk is data theft: more than 90% of reported attacks involved data or credential theft in some form. For SMBs and insurance teams, the key takeaway is that smaller organizations are frequent, practical targets because attackers expect weaker defenses, limited security staffing, and slower response. Top 3-5 Most Notable Statistics •More than 90% of attacks reported by Sophos customers involved data or credential theft in some way. •Over 75% of Sophos X-Ops Incident Response cases in 2023 were for small businesses. •43.26% of malware detections were stealers, spyware, or keyloggers. •70% of ransomware attacks targeted small businesses, according to the Ransomware Task Force finding cited in the report. •51% of malware delivery framework detections were AgentTesla. Top 3-5 Exploitable Technology Risks •Unmanaged devices, unprotected servers, personal devices, and network appliances used for remote ransomware attacks against Windows-based networks. •Credential theft through phishing, malware, stolen browser cookies, and information stealers enabling business email compromise, cloud access, fraud, and resale of access. •Public-facing and vulnerable systems, including MOVEit Transfer, GoAnywhere, PaperCut, Barracuda Email Security Gateway appliances, older firewalls, and unsupported web server software. |
| Sophos | 2024 | Endpoint / MDR / XDR Vendor |
| 832 | Threat Report H1 2025 | Bottom Line Up Front (BLUF) ESET’s H1 2025 report shows attackers rapidly adopting practical, low-friction methods that trick users into helping compromise their own devices, especially through ClickFix social engineering, infostealers, Android ad fraud, NFC scams, and ransomware tooling. For SMBs and insurance teams, the key takeaway is that user-driven compromise, credential theft, mobile fraud, and ransomware-enabling tools remain central loss drivers and should be treated as underwriting and loss-prevention priorities. Top 3-5 Most Notable Statistics •ClickFix detections grew by 517% from H2 2024 to H1 2025 and became the second most common attack vector after phishing. •Android adware and clicker detections surged by 160%, compared with a 50% increase across all Android detections. •NFC-related scams increased by more than 35-fold in H1 2025 compared with H2 2024. •Ransomware attacks grew by 15%, while the number of ransomware gangs increased by 43%, based on summarized 2024 ecrime.ch data. •SnakeStealer accounted for almost one fifth of all infostealer detections in ESET telemetry during H1 2025. Top 3-5 Exploitable Technology Risks •ClickFix attacks that use fake errors, fake CAPTCHA checks, fake browser updates, or fake verification pages to make users paste and run malicious commands, often through PowerShell. •Infostealers such as SnakeStealer, Lumma Stealer, and Danabot, which can steal credentials, log keystrokes, capture screens, grab files, and deliver additional malware. •Android third-party app store downloads, including Kaleidoscope “evil twin” apps that impersonate legitimate apps and generate intrusive ads. |
| ESET | 2025 | Endpoint / MDR / XDR Vendor |
| 833 | Threat Report H1 2025 | Bottom Line Up Front (BLUF) SISA’s H1 2025 threat report shows that financial, insurance, retail, and payment-facing organizations are being hit through a mix of ransomware, data extortion, credential theft, payment fraud, and fast exploitation of known vulnerabilities. For SMBs and insurance teams, the main takeaway is that attackers are not relying on one path in; they are combining unpatched systems, weak identity controls, third-party access, and social engineering to cause data loss, downtime, fraud, and claims exposure. Top 3-5 Most Notable Statistics •83% of phishing emails targeting BFSI from September 2024 to February 2025 were AI-generated, a 54% year-over-year increase. •Business Email Compromise exposure was estimated at approximately $51 billion globally. •Ransomware payments reached approximately $813.55 million in 2024, down 35% from $1.25 billion in 2023, while the median ransom payment rose to $1.5 million by June 2024. •The Marks & Spencer, Co-op, and Harrods ransomware incidents caused over £800 million in combined operating losses. •The Cork Protocol exploit resulted in an $11 million loss. Top 3-5 Exploitable Technology Risks •Unpatched managed file transfer systems, including Cleo, MOVEit, Accellion, and GoAnywhere, which attackers use to steal sensitive files at scale. •Identity and helpdesk weaknesses, including social engineering, password resets, rogue MFA token registration, and abuse of support accounts. •Known exploited vulnerabilities affecting VPN gateways, browser sandboxes, SAP NetWeaver deserialization, and archive handling. |
| SISA | 2025 | Threat Intelligence Vendor |
| 834 | Threat Report H2 2025 | Bottom Line Up Front (BLUF) ESET’s H2 2025 report shows attackers rapidly improving the tools they use to steal data, deploy ransomware, bypass defenses, and deceive users. For SMBs and insurance teams, the most important takeaway is that common entry points such as phishing emails, malicious attachments, Android banking fraud, exposed services, and ransomware evasion remain highly exploitable and can lead to costly downtime, data theft, and claims activity. Top 3-5 Most Notable Statistics •Ransomware victims listed on dedicated leak sites reached 6,937 in 2025, already surpassing the 2024 total, with ESET projecting a 40% year-over-year increase. •CloudEyE attack attempts rose almost thirtyfold in H2 2025, reaching more than 100,000 detections. •NFC-abusing Android malware detections grew by 87% between H1 and H2 2025. •Lumma Stealer detections fell by 86% in H2 2025, while HTML/FakeCaptcha detections dropped from more than 1.6 million to less than 60,000. •Nomani scam detections grew 62% year over year, with more than 64,000 unique URLs blocked during 2025. Top 3-5 Exploitable Technology Risks •Phishing emails delivering CloudEyE through archives, scripts, NSIS executables, and PowerShell-based downloaders, which can lead to ransomware or infostealer infections. •Ransomware operators using EDR killers, including bring-your-own-vulnerable-driver techniques and EDR-Freeze, to disable endpoint defenses. •Android NFC fraud combining relay attacks, remote access, Accessibility service abuse, automated transfers, and biometric bypass attempts. |
| ESET | 2025 | Endpoint / MDR / XDR Vendor |
| 835 | Threat Research Report 2022 | Bottom Line Up Front (BLUF) Trellix identifies Log4j and ransomware as the most important threats from late 2021, with Log4j described as the biggest vulnerability of the year and ransomware continuing to disrupt major organizations and supply chains. For SMBs and insurance teams, the key takeaway is that attackers are exploiting both exposed software flaws and normal administrative tools, which can turn a small weakness into business interruption, data exposure, or ransom-related loss. Top 3-5 Most Notable Statistics •Sodinokibi was the most prevalent ransomware family detected in Q3 2021 at 41%, followed by DarkSide at 14% and Egregor at 13%. •APT41 accounted for 24% and APT29 for 22% of monitored APT activity in Q3 2021. •Cobalt Strike appeared in 34% of APT tool detections, followed by Mimikatz at 27%, Net.exe at 26%, and PsExec at 20%. •Banking/Financial represented 22% of ransomware customer detections and 37% of APT customer detections in Q3 2021. •Publicly reported Distributed Denial of Service incidents increased 112% from Q2 to Q3 2021, while targeted attacks increased 55%. Top 3-5 Exploitable Technology Risks •Log4j vulnerabilities, especially CVE-2021-44228, which Trellix described as easy to execute and actively exploited across malicious actors. •Remotely exploitable, unauthenticated bugs in edge-facing tools, including Apache webserver CVE-2021-41773 and Palo Alto GlobalProtect VPN CVE-2021-3064. •Living-off-the-land techniques using legitimate tools such as PowerShell, Windows Command Shell, Rundll32, WMIC, Schtasks, Regsvr32, and Reg.exe to execute commands, maintain persistence, or evade controls. |
| Trellix | 2022 | Endpoint / MDR / XDR Vendor |
| 836 | Threat Research Report 2024 | Bottom Line Up Front (BLUF) Trellix reports a fast-shifting threat environment where ransomware, nation-state activity, phishing, GenAI-enabled crime, and tools that disable endpoint detection are all active concerns. For SMBs and insurance teams, the most important takeaway is that attackers are increasingly trying to blind defenses before causing disruption, theft, or extortion. Top 3-5 Most Notable Statistics •China-aligned threat actor groups generated more than 21 million detections from October 2023 through March 2024. •The United States accounted for 47.2% of ransomware detections, followed by Turkey at 21.4%. •Transportation and shipping generated 53% of global ransomware detections in Q4 2023 and 45% in Q1 2024. •Spyboy’s EDR Terminator campaign targeted telecom in 79.71% of observed detections, with government at 15.94% and utilities at 4.35%. •Trellix processes 2 billion email samples and 93 million email attachments per day, highlighting the continued scale of email-based attack activity. Top 3-5 Exploitable Technology Risks •EDR killer and evasion tools that attempt to shut down endpoint detection and response, leaving organizations blind to attacker activity. •Abuse of legitimate Windows and administrative tools, including Netsh, Ldifde, NTDSUtil, PowerShell, PsExec, Reg, and related tools, to perform malicious activity while blending into normal operations. •Ransomware leak-site and extortion activity, including LockBit-related disruption and impersonation after law enforcement action. |
| Trellix | 2024 | Endpoint / MDR / XDR Vendor |
| 837 | Threat Review 2024 | Bottom Line Up Front (BLUF) Forescout’s 2024 threat review shows attackers are increasingly exploiting perimeter technologies such as VPNs, routers, firewalls, and other network infrastructure to gain initial access. For SMBs and insurance teams, the key takeaway is that internet-facing and unmanaged devices can create outsized loss exposure, especially when combined with rising ransomware activity and fragmented threat groups. Top 3-5 Most Notable Statistics •Published vulnerabilities increased 43% in the first half of 2024 compared with the same period in 2023. •Forescout observed 23,668 vulnerabilities in 2024H1, averaging 111 new CVEs per day. •Ransomware attacks increased 6%, with 3,085 attacks observed in 2024H1. •Active ransomware groups increased from 53 to 82, a 55% rise. •Nearly one in every five new CISA Known Exploited Vulnerabilities targeted network infrastructure or security appliances. Top 3-5 Exploitable Technology Risks •VPN and perimeter device vulnerabilities, including widely used products such as Ivanti Connect Secure, Cisco ASA, Cisco Firepower Threat Defense, and FortiOS SSL VPN, were heavily targeted for initial access. •Network infrastructure and security appliances from vendors including Ivanti, Citrix, Fortinet, Cisco, Palo Alto Networks, Check Point, and D-Link accounted for a significant share of newly exploited vulnerabilities. •End-of-life products, including Internet Explorer, D-Link routers, and network attached storage products, were affected by vulnerabilities for which no patches are available. |
| Forescout | 2024 | Network Security Vendor |
| 838 | ThreatLabz 2024 AI Security Report | Bottom Line Up Front (BLUF) AI adoption is accelerating quickly, but the same tools that improve productivity also create new data leakage, privacy, phishing, impersonation, and ransomware risks. For SMBs and insurance teams, the key issue is not whether AI is being used, but whether its use is visible, approved, controlled, and protected against AI-enabled attacks. Top 3-5 Most Notable Statistics •AI/ML tool usage increased by 594.82%, rising from 521 million transactions in April 2023 to 3.1 billion monthly transactions by January 2024. •Enterprises exchanged 569 TB of data with AI/ML applications between September 2023 and January 2024. •Enterprises are blocking 18.5% of all AI/ML transactions, a 577% increase in blocked transactions over nine months. •ChatGPT usage grew by 634.1% and was also the most-blocked AI application. •Manufacturing generated 20.9% of AI/ML transactions, followed by Finance and Insurance at 19.9% and Services at 16.8%. Top 3-5 Exploitable Technology Risks •Generative AI tools can expose sensitive, confidential, proprietary, or customer data through user prompts, training data exposure, or accidental disclosure. •Prompt injection can manipulate AI systems into revealing training data or other sensitive information. •Misconfigured or abused access controls, including role-based access control, can allow inappropriate access to AI-generated responses or historical user inputs. |
| ThreatLabz | 2024 | Research Organization |
| 839 | ThreatLabz 2024 Ransomware Report | Bottom Line Up Front (BLUF) Ransomware activity is rising, extortion is becoming more aggressive, and SMBs are explicitly within scope of attacker campaigns. For SMB owners and insurance teams, the key takeaway is that ransomware risk now includes not only system encryption, but also data theft, business interruption, recovery costs, regulatory pressure, and ransom demands that may not resolve the incident even if paid. Top 3-5 Most Notable Statistics •Ransomware attacks blocked by the Zscaler cloud increased by 17.8% year over year. •Companies listed on ransomware data leak sites increased by 57.8% year over year. •ThreatLabz identified a record ransomware payment of US$75 million, the largest payment by one company described in the report. •The United States accounted for 49.95% of overall ransomware attacks. •Manufacturing was the most targeted industry with 653 attacks, while healthcare had 312 and technology had 265. Top 3-5 Exploitable Technology Risks •Unpatched vulnerabilities remain a common ransomware attack vector, making timely patching and unified vulnerability management critical. •Public-facing applications can be exploited by ransomware actors, especially where internal applications are exposed to the internet. •Stolen or weak credentials are used for access, including through brute-force attacks against RDP or VPN credentials and credential purchases from initial access brokers. |
| ThreatLabz | 2024 | Research Organization |
| 840 | ThreatLabz 2025 AI Security Report | Bottom Line Up Front (BLUF) AI adoption is accelerating fast, but the biggest near-term risk is uncontrolled employee use of AI tools that can expose sensitive data and help attackers scale phishing, malware, ransomware, and fraud. For SMBs and insurance teams, the practical issue is not whether AI is useful, but whether the business can control what data enters AI systems and detect AI-enabled deception before it causes loss. Top 3-5 Most Notable Statistics •Zscaler analyzed 536.5 billion AI/ML transactions from February through December 2024. •AI/ML tool usage increased by 3,464.6% year over year across more than 800 AI/ML applications. •Enterprises blocked 59.9% of all AI/ML transactions, totaling more than 321.9 billion blocked transactions. •AI/ML applications transferred 3624 TB of data. •ChatGPT accounted for 45.2% of transactions among known AI/ML applications and was also the most-blocked AI application. Top 3-5 Exploitable Technology Risks •Shadow AI and unsanctioned AI use can expose sensitive company data when employees paste confidential information into tools without proper governance. •Data loss through AI applications is a clear risk, with DLP violations involving PII, financial data, source code, and medical data in tools such as ChatGPT and Microsoft Copilot. •AI-powered phishing, voice phishing, video phishing, and deepfakes make social engineering more convincing and harder for employees to identify. |
| Zscaler | 2025 | Cloud Security Vendor |
| 841 | ThreatLabz 2025 Ransomware Report | Bottom Line Up Front (BLUF) Ransomware is increasingly becoming a data theft and extortion problem, not just an encryption problem. For SMBs and insurance teams, this means loss scenarios may involve stolen sensitive data, regulatory exposure, reputation damage, business interruption, and ransom pressure even when systems are not fully encrypted. Top 3-5 Most Notable Statistics •Zscaler blocked more than 10.8 million ransomware attempts from April 2024 to April 2025, a 145.9% year-over-year increase. •Public extortion cases listed on ransomware leak sites rose 70.1%. •Data exfiltration across 10 major ransomware families increased 92.7%, reaching 238.5 TB stolen. •Manufacturing, Technology, and Healthcare were the top targeted industries; Oil & Gas saw a 935.3% increase in attacks. •The United States remained the top global target, accounting for 50.8% of overall attacks. Top 3-5 Exploitable Technology Risks •Internet-exposed file transfer applications: Clop exploited vulnerabilities in file transfer platforms to steal data from large numbers of organizations. •Remote monitoring and management tools: Vulnerable RMM tools, including SimpleHelp RMM vulnerabilities, enabled ransomware actors to gain access to corporate environments. •Publicly exposed applications: Groups such as Dark Angels used exposed vulnerable applications, including CVE-2023-22069, to infiltrate corporate networks. |
| Zscaler | 2025 | Cloud Security Vendor |
| 842 | ThreatLabz 2025 VPN Risk Report | Bottom Line Up Front (BLUF) Zscaler’s report argues that VPNs have become a high-risk access method because they expose organizations to ransomware, credential theft, lateral movement, and operational disruption. For SMBs and insurance teams, the key takeaway is that VPN-dependent remote access can increase both the likelihood and severity of cyber incidents, while zero trust access models are presented as the preferred replacement. Top 3-5 Most Notable Statistics •56% of organizations reported attacks due to VPN vulnerabilities in the past year. •92% of respondents are concerned that unpatched VPN vulnerabilities will lead to ransomware attacks. •93% are concerned that third-party VPN access can serve as a backdoor into their networks. •71% identify lateral movement through VPN access as a top concern. •65% of organizations are replacing or planning to replace VPN services within the next year, while 81% plan to adopt zero trust within the year. Top 3-5 Exploitable Technology Risks •Unpatched VPN vulnerabilities, including zero-days, can be scanned from the public internet and exploited before patches are applied. •Remote code execution vulnerabilities in VPN products allow attackers to run arbitrary commands and potentially compromise systems. •Broad VPN network access enables attackers who gain initial access to move laterally, escalate privileges, and reach sensitive systems. |
| Zscaler | 2025 | Cloud Security Vendor |
| 843 | Top 5 Data Discovery and Classification Vendors (2025) | Bottom Line Up Front (BLUF) This report’s main message is that data discovery and classification are foundational to knowing where sensitive, regulated, and business-critical data resides and applying the right protections. For SMBs and insurance teams, the practical value is improved visibility into personal, financial, health, and other sensitive data so organizations can better manage compliance, access controls, data risk, and storage decisions. Top 3-5 Most Notable Statistics No strong statistics identified in the report. Top 3-5 Exploitable Technology Risks No specific exploitable technology risks identified in the report. Key Business Impact for SMBs The report emphasizes that organizations often store data across multiple environments, including on-premises, cloud, and hybrid systems. Without clear discovery and classification, an SMB may not know what sensitive data it holds, where that data is stored, who has access to it, or whether it is being handled in line with internal and regulatory requirements. For SMBs that hold personally identifiable information, financial data, health information, intellectual property, or other regulated data, this lack of visibility can create security, privacy, and compliance challenges. The report highlights that discovery tools scan and map data assets, while classification labels data by sensitivity, risk, or business value, such as confidential, public, restricted, or regulated. This helps businesses apply stronger controls to higher-sensitivity information. The report also notes a business efficiency benefit: once organizations understand what data they have and how it is classified, they can make better decisions about storage, retention, and usage. Low-sensitivity or redundant data may be archived or deleted, which can reduce storage needs and infrastructure costs. Insurance & Risk Management Implications For insurance and risk management teams, the report points to data visibility as a core control area. Underwriters and risk managers should pay attention to whether an organization can identify sensitive and regulated data, classify it appropriately, enforce access controls, and produce compliance-related reporting. |
| BigID | 2025 | Compliance / GRC Vendor |
| 844 | Top 50 Cybersecurity Threats 2026 | Bottom Line Up Front (BLUF) Splunk’s report shows that many serious cyber incidents now begin with ordinary-looking access: stolen credentials, exposed cloud assets, weak authentication, or trusted tools used maliciously. For SMBs and insurance teams, the key takeaway is that loss prevention must focus on identity controls, cloud configuration hygiene, and visibility into abnormal behavior before attacks become data theft, ransomware, or business disruption. Top 3-5 Most Notable Statistics •More than 40 million APT-related threats were blocked in a single month in 2024. •Cryptomining activity was found in 69% of surveyed organizations. •Only 33% of security leaders are confident their identity provider can prevent identity-based attacks. •More than 51% of organizations have suffered financial losses from identity-related breaches. •Ransomware is linked to roughly 75% of system-intrusion breaches. Top 3-5 Exploitable Technology Risks •Cloud misconfiguration, including exposed storage, weak IAM roles, outdated services, and publicly reachable APIs that attackers can scan for and exploit. •SaaS authentication weaknesses, including credential theft, session hijacking, MFA bypass, orphaned accounts, and overly permissive identity policies. •Password spraying and credential reuse against VPNs, SSH, web portals, and cloud authentication services. |
| Splunk | 2026 | SIEM / Security Analytics Vendor |
| 845 | Top Cloud and AI Infrastructure Trends and Private Companies 2026 | Bottom Line Up Front (BLUF) Futuriom’s main takeaway is that AI is rapidly reshaping cloud infrastructure, making environments more distributed, data-heavy, automated, and harder to secure. For SMBs and insurance teams, the key risk is not AI alone, but the added complexity around cloud access, data movement, identity, observability, and ransomware resilience. Top 3-5 Most Notable Statistics •Aggregate AI capital spending is estimated at about $1 trillion per year. •The four top hyperscalers budgeted more than $600 billion in combined capital spending. •Futuriom 50 private companies have raised more than $33 billion in funding. •Google’s planned acquisition of Wiz is valued at $32 billion, highlighting the importance of cloud security platforms. •Elisity states that microsegmentation can potentially reduce lateral movement risk by up to 85%. Top 3-5 Exploitable Technology Risks •Identity and access weaknesses: the report states that identity breaches are often the first step in an attack, especially as AI and machine-generated traffic increase. •Fragmented cloud and security tools: attackers exploit integrated environments while many organizations still operate separate tools across network, endpoint, and cloud security. •Poor data management for AI workflows: unclear, error-prone, or poorly governed data can disrupt AI workflows and create operational and compliance problems. |
| Futuriom | 2026 | Media / Independent Research |
| 846 | Torq AI SOC Leadership Report 2026 | Bottom Line Up Front (BLUF) Torq’s report shows that AI is now widely used in security operations, but many teams are struggling with fragmented tools, limited transparency, and uncertainty about when AI should act on its own. For SMBs and insurance teams, the key takeaway is that AI can reduce workload and response time, but only when it is governed, explainable, and integrated into existing security operations. Top 3-5 Most Notable Statistics •450+ CISOs, security leaders, and senior security decision-makers were surveyed across four countries. •Security teams run an average of 7 AI solutions in the SOC. •80% rely on multiple point-specific tools, and 85% would prefer a unified platform. •92% of security leaders cite at least one factor that reduces trust in AI within the SOC. •Analysts spend 8.6 hours per week overseeing AI-powered outputs. Top 3-5 Exploitable Technology Risks •Fragmented AI and security tools create operational complexity, forcing analysts to manually stitch together partial context from multiple systems. •Manual vulnerability management remains a risk because exploitation is increasingly automated while patching remains manual, creating a window of exposure. •False negatives and missed threats reduce confidence in AI and may allow real incidents to go undetected. |
| Torq | 2026 | Endpoint / MDR / XDR Vendor |
| 847 | Trellix SecondSight Threat Report February 2026 | Bottom Line Up Front (BLUF) Trellix highlights five high-impact 2025 campaigns showing that attackers are increasingly abusing trusted systems, legitimate software, cloud services, and human trust rather than relying only on obvious malware. For SMBs and insurance teams, the key takeaway is that losses can begin from normal-looking activity: a SharePoint server spawning PowerShell, an employee opening a hiring document, or a user approving an OAuth login flow. Top 3-5 Most Notable Statistics •5 critical campaigns were highlighted from Trellix SecondSight observations. •The report focuses primarily on activity observed between July 1, 2025 and December 31, 2025. •A SharePoint exploitation campaign affected organizations in healthcare, financial services, and life sciences, with activity observed between July 18 and July 23, 2025. •In the Kimsuky campaign, the attacker waited 10 days between an initial benign HR email and a malicious follow-up. •The Kimsuky malware attempted to create a scheduled task running every 30 minutes. Top 3-5 Exploitable Technology Risks •Microsoft SharePoint vulnerability CVE-2025-53770, used to execute encoded PowerShell, deploy web shells, create rogue admin accounts, stage data, and support persistence. •Spear-phishing attachments and links using PDFs, ZIP files, LNK files, and fake software updates to trigger user execution. •DLL side-loading through legitimate software, including MagTek and Canon utilities, allowing malicious code to run through trusted applications. |
| Trellix | 2026 | Endpoint / MDR / XDR Vendor |
| 848 | Trend Micro Security Predictions for 2026: The AI-Fication of Cyberthreats | Bottom Line Up Front (BLUF) Trend Micro’s central warning is that AI is industrializing cybercrime: attacks that once required skilled teams can now be automated, personalized, and scaled with less human effort. For SMBs and insurance teams, this means more convincing fraud, faster ransomware, more abuse of cloud and software supply chains, and less time to detect or respond before business disruption occurs. Top 3-5 Most Notable Statistics •Vercel saw a 57% increase in vibe-coded web apps hosted on its platform from January to September 2025. •Lovable saw a 660% increase in vibe-coded web apps hosted on its platform from January to September 2025. •AI-assisted “vibe coding” was found to generate unsecure code 45% of the time. •Approximately 47% of organizations struggle to maintain full visibility of their cloud assets. •Around three quarters of organizations have faced a serious cloud security incident stemming from misconfiguration. Top 3-5 Exploitable Technology Risks •Agentic AI systems that can make decisions, call tools, access data, and execute tasks with limited human oversight, making compromised agents potential attack vectors. •AI-generated code and hallucinated software libraries, which can introduce insecure code or enable software supply chain attacks. •Cloud misconfigurations, overprivileged credentials, exposed APIs, insecure containers, and exposed artifact repositories that can lead to data theft or lateral movement. |
| Trend Micro | 2026 | Threat Intelligence Vendor |
| 849 | Trends in Identity Security 2024 | Bottom Line Up Front (BLUF) Identity-related incidents are increasing in impact, with phishing, stolen credentials, identity sprawl, and incomplete security controls driving business disruption. For SMBs and insurance teams, the key takeaway is that identity security is not just an IT issue; it directly affects incident response activity, recovery costs, reputation, and insurability. Top 3-5 Most Notable Statistics •84% of identity stakeholders said identity-related incidents directly impacted their business, up from 68% in 2023. •69% identified phishing as the most significant reason behind increased identity-related incidents, up from 62% in 2023. •91% of organizations invoked their incident response plans, with 48% invoking them more than once and 3% still having no plan. •93% said stronger security outcomes could have lessened the business impact of identity-related incidents. •99% of businesses plan to further invest in identity security outcomes in the next 12 months. Top 3-5 Exploitable Technology Risks •Phishing attacks targeting user identities, identified as the leading driver of increased identity-related incidents. •Stolen credentials, which the report identifies as the second most significant contributor to identity-related incidents. •Employees using corporate credentials for social media, creating concern among identity stakeholders about credential exposure and misuse. |
| IDSA | 2024 | Threat Intelligence Vendor |
| 850 | Trustwave Risk Radar Report 2025: Manufacturing Sector | Bottom Line Up Front (BLUF) Manufacturers face elevated cyber risk because connected IT and OT environments, legacy systems, phishing, exposed vulnerabilities, and ransomware can disrupt production and create safety impacts. For SMBs and insurance teams, the key takeaway is that cyber events in manufacturing are not only data-loss events; they can stop operations, affect supply chains, damage equipment, and increase recovery costs. Top 3-5 Most Notable Statistics •87% of initial access techniques used against manufacturers originated from phishing. •86% of credential access techniques were brute-force attempts. •73% of OT devices are unmanaged, meaning they are not regularly monitored or updated by IT departments. •The average cost of a manufacturing data breach is $5.6 million, up from $4.7 million and above the overall industry average of $4.8 million. •54% of ransomware attacks in the dataset targeted US-based manufacturers, and Play accounted for 19% of ransomware attacks against the sector. Top 3-5 Exploitable Technology Risks •Phishing and malicious attachments or links, including observed malicious spreadsheet attachments with macros, remain the dominant entry point. •Public-facing applications and known vulnerabilities, including Log4j, ZeroLogon, Microsoft Exchange Server vulnerabilities, Apache HTTP Server issues, PHP flaws, SMBGhost, and other CISA Known Exploited Vulnerabilities, create exploitable internet-facing exposure. •Legacy OT and industrial systems often lack modern security features and may be difficult or impossible to patch, leaving known weaknesses available to attackers. |
| Trustwave | 2025 | MSP / MSSP / SOC Provider |
| 851 | Trustwave SpiderLabs Hospitality Sector Threat Landscape 2023 | Bottom Line Up Front (BLUF) Trustwave’s report shows that hospitality businesses remain attractive targets because they hold valuable payment and personal data while operating complex, guest-facing, third-party-heavy environments. For SMBs and insurance teams, the main takeaway is that common attack paths—phishing, stolen credentials, vulnerable systems, and vendor exposure—can quickly lead to ransomware, data theft, operational disruption, and reputational harm. Top 3-5 Most Notable Statistics •31% of hospitality organizations have reported a data breach in their company’s history. •Of those breached organizations, 89% were affected more than once in a year. •The average hospitality breach cost cited in the report is $3.4 million, compared with a cross-industry average of $4.4 million. •26% of reported incidents in Trustwave’s hospitality client base were attributed to credential access, particularly brute forcing. •LockBit was responsible for around 27% of ransomware attacks directly targeting hospitality businesses from the beginning of 2022 to July 2023. Top 3-5 Exploitable Technology Risks •Phishing and BEC, including HTML attachments, fake orders, extortion scams, credential theft, payroll diversion, and email-borne malware such as Emotet and Qakbot. •Weak, reused, old, or default credentials, especially where attackers can brute force passwords, buy access on underground forums, or abuse valid accounts. •Known vulnerability exploitation, including Apache Log4J, Spring Core RCE, MOVEit RCE, SQL injection, directory traversal, and other exposed services. |
| Trustwave | 2023 | MSP / MSSP / SOC Provider |
| 852 | UK 2025 Threat Landscape: Rampant Cyber Crime | Bottom Line Up Front (BLUF) Intel471 describes the UK cyber threat environment as one where cyber crime, especially ransomware, data extortion, credential theft, and third-party compromise, is becoming a board-level business risk. For SMBs and insurance teams, the key takeaway is that attackers are actively exploiting exposed remote access, stolen credentials, unpatched systems, SaaS dependencies, and supplier weaknesses, making proactive monitoring and faster risk prioritisation essential. Top 3-5 Most Notable Statistics •205 claimed UK ransomware victim entities were observed between May 2024 and May 2025, involving 43 threat actor groups across 44 industries. •254 alleged UK victims were offered by initial access brokers between May 2024 and May 2025, making the UK the second most impacted nation in Intel471’s observations. •Initial access brokers offered access to 4,771 victims across 132 countries during the same period. •One actor, “sandocan,” offered alleged access to 96 identifiable UK victim organisations. •Intel471’s malware collection was dominated by information stealers at 49% and loader malware at 44%; in Q1 2025, 34 malware cases were linked to 18 publicly disclosed vulnerabilities. Top 3-5 Exploitable Technology Risks •Corporate remote access technologies, especially VPN-based solutions and RDP-based services, are being targeted by initial access brokers. •Compromised credentials and information-stealer malware create risk for SaaS and cloud-based data platforms. •Unpatched vulnerabilities and misconfigurations affecting on-premises IT and cloud assets are routinely exploited by ransomware groups, initial access brokers, and nation-state actors. |
| Intel 471 | 2025 | Threat Intelligence Vendor |
| 853 | UK Cyber Security Sectoral Analysis 2025 | Bottom Line Up Front (BLUF) The UK cyber security sector is growing strongly, but the report highlights that many small and medium-sized enterprises still under-adopt cyber security despite rising digital dependence and more advanced threats. For SMBs and insurance teams, the main takeaway is that cyber risk management is increasingly tied to access controls, software security, AI security, managed security services, and practical adoption of recognised guidance and standards. Top 3-5 Most Notable Statistics •2,165 firms are active in the UK providing cyber security products and services. •The sector generated £13.2 billion in annual revenue, a nominal increase of 12% since the previous study. •Cyber security employment reached approximately 67,300 full-time equivalent roles, up by around 6,600 jobs, or 11%, in 12 months. •Sector gross value added reached approximately £7.8 billion, an increase of 21% since the previous study. •In 2024, dedicated cyber security firms raised £206 million across 59 investment deals. Top 3-5 Exploitable Technology Risks •AI systems and applications: the report identifies demand for securing AI systems, including large language model security, model protection, and advisory support for AI system security. •Software and application security: highlighted areas include application security testing, secure development lifecycle solutions, vulnerability assessment, DevSecOps, code and API security, containers, and software supply chain security. •Identity, authentication, and access controls: the report identifies products and services that control user access through passwords, biometrics, or multi-factor authentication. |
| UK Cyber | 2025 | Threat Intelligence Vendor |
| 854 | UltraDDoS Protect: 2025 Biannual DDoS Analysis Report | Bottom Line Up Front (BLUF) DigiCert observed far fewer DDoS attacks in the first half of 2025, but the risk has not disappeared: attackers are shifting toward shorter, more targeted disruption attempts. For SMBs and insurance teams, the key takeaway is that even low-bandwidth attacks can affect availability, while rare large attacks still have the potential to overwhelm organizations without dedicated mitigation. Top 3-5 Most Notable Statistics •DigiCert detected 15,260 DDoS attacks from January through June 2025, an 84.37% decrease from the same period in 2024. •Approximately 73% of attacks were between 0.0 and 0.5 Gbps, showing continued use of low-volume disruption. •The largest observed attack reached 813.39 Gbps and 357.08 Mpps. •DigiCert reported approximately 7,504 downtime hours avoided through mitigation. •Financial Services accounted for 47.18% of observed DDoS attacks, followed by IT/Technical Services at 19.56% and Communication Service Providers at 14.59%. Top 3-5 Exploitable Technology Risks •Low-volume flood attacks: Most attacks were small in bandwidth, which may still disrupt services or test defenses while drawing less attention than very large events. •Total Traffic flood vector: This was the most common vector, representing 42.94% of observed activity and covering flood attacks aimed at a victim host. •UDP and TCP ACK attacks: UDP accounted for 18.74% and TCP ACK for 14.29%, showing continued attacker use of common network protocols for disruption. |
| DigiCert | 2025 | Identity Security Vendor |
| 855 | Unit 42 Attack Surface Threat Report 2023 | Bottom Line Up Front (BLUF) Unit 42’s key finding is that internet-facing attack surfaces are changing faster than many organizations can secure them, especially in cloud environments. For SMBs and insurance teams, this means exposed remote access, misconfigured cloud services, and delayed patching can quickly become ransomware, data breach, downtime, and financial-loss events. Top 3-5 Most Notable Statistics •80% of medium, high, or critical exposures were observed on cloud-hosted assets. •An average of 20% of an organization’s cloud attack surface changes each month. •Over 85% of analyzed organizations had internet-accessible RDP for at least part of the month. •Web framework takeover exposures made up 22% of observed exposures, while remote access services accounted for 20%. •Unit 42 found that 3 of 30 analyzed vulnerabilities were exploited within hours of public disclosure, and 19 of 30 were exploited within 12 weeks. Top 3-5 Exploitable Technology Risks •Remote access services such as RDP, SSH, and VNC, because attackers can use them for unauthorized access, brute-force login attempts, and ransomware entry. •Vulnerable web frameworks, including insecure versions of Apache web servers, PHP, and jQuery, because attackers actively seek common website software weaknesses. •Internet-accessible IT and networking infrastructure, including router, firewall, VPN, and administrative login pages, because compromise can give attackers control over core systems. |
| Palo Alto Networks Unit 42 | 2023 | Network Security Vendor |
| 856 | Unit 42 Ransomware and Extortion Report 2023 | Bottom Line Up Front (BLUF) Ransomware has shifted into broader extortion: attackers increasingly steal data, threaten leaks, and harass employees or executives even when backups work. For SMBs and insurance teams, this means recovery planning must address business disruption, sensitive data exposure, reputational harm, legal issues, and ransom decision-making—not just file restoration. Top 3-5 Most Notable Statistics •Data theft appeared in about 70% of Unit 42 ransomware cases by late 2022, up from about 40% in mid-2021. •Harassment was a factor in about 20% of ransomware cases by late 2022, up from less than 1% in mid-2021. •About 10% of extortion incidents Unit 42 responded to did not involve encryption. •In 2022, 2,679 victims were posted on dark web leak sites, about 4% higher than in 2021. •Manufacturing had 447 compromised organizations publicly exposed on leak sites in 2022, and U.S.-based organizations accounted for 42% of observed leaks. Top 3-5 Exploitable Technology Risks •Internet-exposed assets with expired certificates, deprecated server operating systems, and end-of-life email platforms, which give attackers a direct path of least resistance. •Out-of-date software that is not regularly or easily patched, especially in environments with low tolerance for downtime. •Weak visibility across endpoints, networks, and cloud environments, limiting the ability to detect ransomware activity and stop lateral movement. |
| Palo Alto Networks Unit 42 | 2023 | Network Security Vendor |
| 857 | US Cyber Industry Exposure Database 2025 | Bottom Line Up Front (BLUF) Guy Carpenter and Guidewire Cyence model the 2025 US cyber insurance market as higher risk than 2024, driven by regulatory change, reduced federal cyber resources, geopolitical tension, ransomware, BEC, cloud reliance, and software concentration. For SMBs and insurance teams, the key issue is accumulation: many small businesses can be affected at once through shared software, cloud, SaaS/PaaS providers, or mass ransomware events. Top 3-5 Most Notable Statistics •The report estimates 4.97 million US primary cyber policies, with 98.7% of those policies in the SME segment. •Projected US annual written cyber premium is $9.52B, with modeled expected insured loss of $5.05B and an expected industry loss ratio of 53.0%. •A modeled 1-in-100 annual aggregate loss is $16.53B, while the 1-in-100 per-occurrence loss is $9.94B. •At the 1-in-100 return period, the modeled US industry aggregate loss ratio is 174%, including 105 loss ratio points from a single catastrophe event. •For 1-in-50-and-worse tail events, modeled software vulnerability outage duration averages 36.84 days, compared with 9.79 days for cloud service provider events. Top 3-5 Exploitable Technology Risks •Mass ransomware deployment through widely used software and operating systems, especially Windows, Apache HTTP Server, Linux, and NGINX. •Windows operating system mass data breach events using zero-day vulnerabilities and bot-driven data exfiltration across many firms at once. •Malicious and non-malicious outages affecting major cloud providers such as AWS and Azure. |
| Guy Carpenter | 2025 | Threat Intelligence Vendor |
| 858 | USDoD State of DevSecOps 2024 | Bottom Line Up Front (BLUF) The report’s central message is that secure software delivery requires security to be built into every step of development, deployment, operations, and monitoring—not added at the end. For SMBs and insurance teams, the practical takeaway is that weak software supply chains, manual deployment processes, poor monitoring, and late security testing can increase operational risk and make software-related incidents harder to prevent, detect, and remediate. Top 3-5 Most Notable Statistics •DevSecOps is organized around 10 lifecycle phases: Plan, Develop, Build, Test, Release, Deliver, Deploy, Operate, Monitor, and Feedback. •The report illustrates that if four software supply chain components are each 90% secure, the end-to-end ecosystem is only roughly 65% secure. •Improving each of those four components from 90% to 95% raises overall cyber survivability from 65% to 81%. •Cited DevOps research found teams with a generative culture delivered 30% higher organizational performance than teams without one. •Traditional authorizations are commonly issued for 1, 2, or 3 years based on residual risk. Top 3-5 Exploitable Technology Risks •Software supply chain weaknesses across development tools, code repositories, artifact repositories, build tools, testing suites, and deployment platforms can reduce the security of the final product. •CI/CD pipeline gaps can allow insecure code, broken builds, vulnerable artifacts, or unreviewed changes to move further toward production. •Manual infrastructure deployment and configuration can introduce skipped steps, mistyped commands, and unreviewed changes that weaken security. |
| U.S. Department of Defense | 2024 | Threat Intelligence Vendor |
| 859 | USTelecom Cybersecurity Culture Report 2023 | Bottom Line Up Front (BLUF) USTelecom’s 2023 report finds that cybersecurity culture is a major factor in how prepared small and medium-sized critical infrastructure enterprises feel when facing cyberattacks. For SMB owners, insurers, underwriters, and risk managers, the key takeaway is that stronger preparedness is not simply a function of revenue or IT budget; it is tied to repeatable practices, employee confidence, management engagement, training, and cross-department coordination. Top 3-5 Most Notable Statistics •The survey included 374 respondents from small and medium-sized critical infrastructure enterprises. •31% of surveyed enterprises fell into the Weak cybersecurity culture segment, the largest segment identified. •28% of surveyed enterprises were classified as having a Mature cybersecurity culture. •Among companies with 501-1,000 employees, 93% said their company was improving its cybersecurity culture, compared with 59% of companies with 1-50 employees. •The report cites that 82% of breaches involved the human element, including social attacks, errors, and misuse. Top 3-5 Exploitable Technology Risks •Human-element risk: the report highlights social attacks, errors, and misuse as major breach factors, making employee behavior a key exposure. •Weak cybersecurity culture: organizations in the Weak segment had lower scores across preparedness, company, management, employee, and training dimensions. •Limited training and education: weaker culture segments showed lower training scores, which can reduce employee readiness during a cyberattack. |
| USTelecom | 2023 | Network Security Vendor |
| 860 | VikingCloud 2026 SMB Threat Landscape Report | Bottom Line Up Front (BLUF) Cybersecurity is now the top operational risk for SMBs in VikingCloud’s 2026 survey, ahead of inflation, recession, and hiring pressures. For SMB owners and insurance teams, the key issue is that cyber incidents are no longer rare events: they can quickly create downtime, customer loss, and financial damage that many smaller businesses may not survive. Top 3-5 Most Notable Statistics •75% of SMB respondents said cyberattacks, data breaches, ransomware, and related incidents are the threats most likely to negatively impact operations in 2026. •40% of SMBs said a cyberattack costing $100,000 or less could put them out of business. •73% reported Wi-Fi or network disruptions in the past 12 months, while 58% experienced website downtime and 55% experienced third-party or vendor outages. •46% reported facing AI-generated phishing or advanced phishing-as-a-service schemes in the past year. •84% of business owners said they self-manage cybersecurity, and 28% of respondents said the person managing cybersecurity lacks sufficient training. Top 3-5 Exploitable Technology Risks •AI-generated phishing and advanced phishing-as-a-service, which can make scams more personalized, faster, and harder for employees to detect. •Third-party vendor dependencies, including payments, cloud services, software platforms, and customer engagement tools, with limited due diligence, monitoring, access restriction, or joint incident response planning. •Weak password practices, including password reuse or sharing across systems and use of easy-to-remember passwords based on names, pets, or numbers. |
| VikingCloud | 2026 | Threat Intelligence Vendor |
| 861 | VikingCloud Cyber Threat Landscape 2025 | Bottom Line Up Front (BLUF) VikingCloud’s 2025 report shows a sharper cyber risk environment where AI-enabled attacks, insider incidents, ransomware, and nation-state activity are increasing faster than many organizations can defend against. For SMBs and insurance teams, the most important takeaway is that financial impact, incident underreporting, and gaps in preparedness can materially affect resilience, claims visibility, and underwriting confidence. Top 3-5 Most Notable Statistics •71% of cybersecurity leaders report rising attack frequency, and 61% report increasing attack severity. •59% of companies were hit with at least one successful cyberattack in the past 12 months. •52% of attacked organizations lost more than 5% of total revenue as a result. •58% of organizations attacked in the past year suspected AI was used. •Nearly 80% of cybersecurity leaders are concerned or extremely concerned they could be targeted directly or indirectly by a nation-state cyberattack in the next 12 months. Top 3-5 Exploitable Technology Risks •AI-driven phishing and social engineering, including generative and agentic AI attacks that make scams faster, more convincing, and easier to scale. •Ransomware, including ransomware-as-a-service, which the report links to a growing preparedness gap. •Third-party software vulnerabilities, which the report identifies as a typical infiltration path for nation-state hackers. |
| VikingCloud | 2025 | Threat Intelligence Vendor |
| 862 | Visa Payment Ecosystem Risk and Control Biannual Threats Report Spring 2025 | Bottom Line Up Front (BLUF) Visa reports that payment fraud threats increased in scale and sophistication from July through December 2024, with attackers combining social engineering, malicious applications, payment credential testing, and exploitation of system weaknesses. For SMBs and insurance teams, the most important takeaway is that payment-related losses are not limited to large enterprises: merchants, cardholders, payment processors, and third-party providers can all be affected through fraud, scams, data theft, and ransomware. Top 3-5 Most Notable Statistics •Enumeration attacks resulted in around US$1.1B in follow-on fraud over a one-year period. •Suspected enumeration attack transactions increased by 22% compared with the prior six-month period. •Visa PERC tracked several thousand ransomware and data breach incidents, a 51% increase from the prior six-month period. •Visa implemented targeted blocks on 76% of identified incidents, resulting in over 134.3M declined presumed fraudulent transactions. •In the last twelve months, Visa PERC detected US$357M in fraud and over 20K merchants involved in scams. Top 3-5 Exploitable Technology Risks •Enumeration attacks against eCommerce transactions, where attackers automate testing of payment data elements to validate card numbers, CVV2, or expiration dates. •Digital skimming on merchant checkout pages, where malicious code harvests payment account data and personal information entered by customers. •Malicious mobile applications and point-of-sale weaknesses that can enable fraudulent provisioning and offline approvals for in-store purchases. |
| Visa | 2025 | Threat Intelligence Vendor |
| 863 | Voice Intelligence and Security Report 2025 | Bottom Line Up Front (BLUF) AI-driven voice fraud is accelerating, and legacy authentication methods such as knowledge-based questions and one-time passwords are increasingly vulnerable. For SMBs and insurance teams, the key risk is that fraudsters can use stolen data, caller ID spoofing, and synthetic voices to manipulate staff into approving account changes, refunds, transfers, policy loans, or withdrawals. Top 3-5 Most Notable Statistics •Deepfake attacks surged by more than 1,300%, rising from one every two days to seven per day. •Contact center fraud attempts increased by 26% in 2024, reaching one attempt every 599 calls. •45% of fraud calls involved phishing, while 39% were account takeover attempts. •Insurance fraud rose 19% year over year, with average fraud exposure described as 20 times higher than banking. •Pindrop forecasts deepfake-related fraud will grow 162% by the end of 2025. Top 3-5 Exploitable Technology Risks •Synthetic voice and deepfake tools: Attackers can create convincing voices to impersonate customers, bypass agents, or conduct automated reconnaissance. •Caller ID spoofing and metadata manipulation: Fraudsters can mask phone numbers, spoof carrier data, and bypass defenses that rely too heavily on caller metadata. •Knowledge-based authentication and OTPs: Stolen personal data and social engineering make these methods easier to defeat, especially when attackers can redirect or intercept authentication flows. |
| Pindrop | 2025 | Email Security Vendor |
| 864 | Voice of SecOps 6th Edition 2025: Cybersecurity & AI - Promises, Pitfalls, and Prevention Paradise | Bottom Line Up Front (BLUF) AI is now central to both cybersecurity defense and attacker activity, but many organizations are adopting it faster than they understand or govern it. For SMBs and insurance teams, the key takeaway is that AI-powered phishing, deepfakes, cloud storage attacks, and zero-day risks are creating practical loss scenarios that require prevention-focused controls, not just detection and response. Top 3-5 Most Notable Statistics •86% of organizations increased their use of AI in security operations over the past year. •38% of organizations suffered an AI-powered cyberattack in the past 12 months. •83% cited weaponized files uploaded to local or cloud storage as a top risk. •46% reported more targeted phishing attacks, and 43% reported more deepfake impersonations. •69% said AI and other emerging technologies are increasing SecOps burnout. Top 3-5 Exploitable Technology Risks •AI-powered cyberattacks: Attackers are using AI to breach defenses, with reported outcomes including theft of sensitive or proprietary information, reputational harm, and financial impact. •Weaponized files in storage environments: The report highlights files uploaded to local drives, NAS, hybrid environments, or public cloud storage as a major concern. •Targeted phishing: More organizations are seeing targeted phishing attacks, which remain one of the highest-ranked security risks. |
| Deep Instinct | 2025 | Endpoint / MDR / XDR Vendor |
| 865 | Voice of the CISO Report 2025 | Bottom Line Up Front (BLUF) Proofpoint’s 2025 survey shows security leaders expect material cyberattacks and data loss to remain highly likely, with people-driven risk, email fraud, ransomware, insider threats, cloud account compromise, and GenAI use all prominent concerns. For SMBs and insurance teams, the key takeaway is that losses are not only technical events; they often involve sensitive data exposure, recovery costs, regulatory sanctions, reputational damage, and credential theft. Top 3-5 Most Notable Statistics •76% of CISOs believe their company is at risk of a material cyberattack in the next 12 months, up from 70% in 2024. •66% of CISOs said their organization experienced a material loss of sensitive information in the past 12 months, up from 46% in 2024. •58% of global CISOs agree their organization is unprepared for a cyberattack in 2025, up from 43% last year. •66% of CISOs said their organization would likely pay a ransom to restore systems or prevent data release. •60% of global CISOs believe generative AI poses a security risk to their organization, up from 54% in 2024. Top 3-5 Exploitable Technology Risks •Email fraud and business email compromise: cited as a top concern and capable of leading to spoofed communications, credential theft, and data loss. •Insider threats: malicious, careless, and compromised insiders were the top root causes of data loss events, showing that employee actions remain directly exploitable. •Ransomware: organizations remain concerned about system restoration, data release, and ransom payment pressure. |
| Proofpoint | 2025 | Email Security Vendor |
| 866 | VulnCheck State of Exploitation 2026 | Bottom Line Up Front (BLUF) VulnCheck’s 2026 report shows that exploitation continues to move faster than many organizations can respond, with nearly one-third of newly identified exploited vulnerabilities showing exploitation on or before CVE publication. For SMBs and insurance teams, the key takeaway is that internet-facing and widely deployed technologies require fast, evidence-based vulnerability prioritization, not just routine patch cycles. Top 3-5 Most Notable Statistics •884 Known Exploited Vulnerabilities were identified with first-time exploitation evidence during 2025. •28.96% of KEVs showed evidence of exploitation on or before the day the CVE was published. •118 unique sources were first to publicly report exploitation activity. •VulnCheck identified KEVs across 518 vendors and 672 products, compared with CISA KEV additions across 99 vendors and 146 products. •The most-targeted technology categories were network edge devices with 191 KEVs, content management systems with 163, and open source software with 129. Top 3-5 Exploitable Technology Risks •Network edge devices, including firewalls, VPNs, and proxies, because they are internet-facing and can serve as a jumping-off point into an environment. •Content management systems, largely dominated by the WordPress ecosystem, because they are commonly exposed to the internet. •Open source software, which ranked third among targeted technology categories in 2025. |
| VulnCheck | 2026 | Threat Intelligence Vendor |
| 867 | Vulnerability Disclosure Policy Platform Annual Report 2022 | Bottom Line Up Front (BLUF) CISA’s 2022 VDP Platform report shows that a structured vulnerability disclosure process can materially improve how organizations find, validate, prioritize, and remediate security weaknesses before adversaries exploit them. For SMBs and insurance teams, the core takeaway is that clear reporting channels, triage, and remediation tracking reduce uncertainty and help turn outside security research into actionable risk reduction. Top 3-5 Most Notable Statistics •The VDP Platform onboarded 40 agency programs. •The platform reviewed 4,091 unique submissions and validated 1,330 unique disclosures. •Agencies remediated 1,119 validated vulnerabilities, equal to 84% remediated. •Agencies averaged 38 days to remediate findings. •In the Hack DHS bug bounty pilot, 726 researchers were invited, 235 vulnerabilities were identified, 40 critical vulnerabilities were identified, and $329,900 was awarded. Top 3-5 Exploitable Technology Risks •Known Exploited Vulnerabilities were found on federal systems through platform submissions, including some not identified by existing scanning tools. •Critical and severe vulnerabilities were identified across internet-accessible systems and services, creating potentially high-impact exposure. •The Log4j critical vulnerability was significant enough to trigger a dedicated bug bounty event within 36 hours. |
| CISA | 2022 | Government / Intelligence Agency |
| 868 | Vulnerability Statistics Report 2025 | Bottom Line Up Front (BLUF) Edgescan’s 2025 data shows that many organizations still carry exploitable, patchable vulnerabilities across applications, APIs, networks, hosts, and public-facing systems, with remediation often taking months. For SMBs and insurance teams, the key issue is not simply finding vulnerabilities, but maintaining visibility, validating which issues are real, and prioritizing fixes that could lead to compromise, downtime, compliance failure, or claims. Top 3-5 Most Notable Statistics •33%+ of full-stack vulnerabilities discovered were Critical or High severity. •32.2% of infrastructure, hosting, cloud, and network-layer vulnerabilities were Critical or High severity. •14.8% of web application and API vulnerabilities were Critical or High severity. •High/Critical application and API vulnerabilities had an average remediation time of 74.3 days, while High/Critical device and network vulnerabilities averaged 54.8 days. •For larger enterprises, 45.4% of vulnerabilities discovered in a 12-month period remained open; 17.4% of backlog vulnerabilities were High or Critical severity. Top 3-5 Exploitable Technology Risks •SQL injection: The report identifies SQL injection as the leading High and Critical web/API issue, representing 28.28% of those severe findings. •Malicious file upload: Highlighted as frequently overlooked by automation and capable of enabling ransomware, malware, or internal network pivoting. •API authentication and authorization weaknesses: API access without authentication, insecure direct object reference, and broken access control are repeatedly identified among serious application/API risks. |
| Edgescan | 2025 | Security Research Vendor |
| 869 | WatchGuard Threat Report 2024 | Bottom Line Up Front (BLUF) WatchGuard’s Q1 2024 threat data shows a shift from network-level malware volume toward endpoint exposure, encrypted malware delivery, IoT botnets, and persistent exploitation of known vulnerabilities. For SMBs and insurance teams, the key takeaway is that basic controls still matter, but they must be paired with patching, endpoint protection, DNS protection, network segmentation, and inspection of encrypted traffic. Top 3-5 Most Notable Statistics •Network-based malware detections dropped 49% quarter over quarter, while malware over encrypted connections increased. •Endpoint malware detections increased 75.71%, reaching almost 175,000 total malware threats. •Malware hiding behind encryption increased to 69% in Q1. •Zero-day malware represented 36% of all malware, but 64% of malware arriving over encrypted connections. •Network attacks increased 13% quarter over quarter, and the top 10 network attacks accounted for 57% of all detections. Top 3-5 Exploitable Technology Risks •Microsoft Exchange ProxyLogon remains a major exploited risk, holding the #2 position among top network attacks; the report describes it as a critical remote code execution vulnerability. •HAProxy, a Linux-based load balancer application, appeared among the top network attacks, showing that weaknesses in widely used infrastructure software can create broad exposure. •TP-Link Archer devices were targeted by a Mirai-related Miori botnet variant using CVE-2023-1389, highlighting router and IoT device risk. |
| WatchGuard | 2024 | Threat Intelligence Vendor |
| 870 | WatchGuard Threat Report 2025 | Bottom Line Up Front (BLUF) WatchGuard’s 2025 report shows a sharp rise in evasive malware, even as some traditional attack measures stayed flat or declined. For SMBs and insurance teams, the key takeaway is that attackers are increasingly using new, hard-to-detect malware and encrypted delivery methods, which can bypass legacy signature-based defenses. Top 3-5 Most Notable Statistics •Network-based malware detections increased 171% quarter-over-quarter per Firebox. •New unique endpoint malware detections increased about 712% quarter-over-quarter, despite total endpoint malware volume declining. •71% of malware evaded signature-based detection methods and required more proactive techniques to detect. •87% of malware detected over encrypted connections was zero-day malware. •Ransomware declined 85% from the previous quarter, while the report notes attackers are shifting toward data theft instead of encryption. Top 3-5 Exploitable Technology Risks •Encrypted connections used for malware delivery, especially where inspection or detection is limited. •Malware that evades signature-based tools, described by WatchGuard as zero-day malware requiring proactive detection methods. •Endpoint delivery through browsers and “other” vectors, suggesting a return to drive-by download tactics and delivery through piracy-related tools and remote software. |
| WatchGuard | 2025 | Threat Intelligence Vendor |
| 871 | WhiteSource State of Open Source Vulnerabilities 2021 | Bottom Line Up Front (BLUF) Open source vulnerability volume rose sharply in 2020, and more than half of newly reported issues were rated high or critical. For SMBs and insurance teams, the key takeaway is that open source risk is not a niche software issue: it is a growing application security exposure that requires prioritization, not a “fix everything” approach. Top 3-5 Most Notable Statistics •Published open source software vulnerabilities rose by over 50% in 2020. •The WhiteSource database shows open source vulnerabilities increased from 6,111 in 2019 to 9,658 in 2020. •15% of open source vulnerabilities in 2020 were rated critical. •38% of open source vulnerabilities in 2020 were rated high. •Go vulnerabilities increased from 1% of vulnerabilities across programming languages in 2019 to 5% in 2020. Top 3-5 Exploitable Technology Risks •Cross-site scripting, or CWE-79, remained the top weakness and continued to dominate across many programming languages, especially those used for web development. •Out-of-bounds write, or CWE-787, entered the top five open source weaknesses in 2020 and was newly prominent, especially in C. •Out-of-bounds read, or CWE-125, was also a prominent weakness and is related to the broader buffer overflow category. |
| Mend | 2021 | Supply Chain Security Vendor |
| 872 | Will Law Enforcement success against ransomware continue in 2025 | Bottom Line Up Front (BLUF) Ransomware pressure remains high for SMBs, even as law enforcement actions and lower payment rates appear to be weakening parts of the ransomware economy. The most important business takeaway is that attackers are still heavily targeting small and mid-sized companies through phishing, remote access compromise, stolen credentials, vulnerable VPNs, and data theft, so resilience and recovery capability matter more than relying on ransom payment as an option. Top 3-5 Most Notable Statistics •The average ransom payment in Q4 2024 was $553,959, up 16% from Q3 2024. •The median ransom payment fell to $110,890, down 45% from Q3 2024. •The percentage of companies paying ransoms dropped to an all-time low of 25%. •Data exfiltration appeared in 87% of observed cases, up from 76%. •Companies with 101 to 1,000 employees represented 41.53% of reported incidents, while companies with 11 to 100 employees accounted for 29.66%. Top 3-5 Exploitable Technology Risks •Phishing, including AI-driven phishing, SEO poisoning, callback phishing, vishing, smishing, fraudulent social media contact, and Teams messages impersonating IT support. •VPN compromise through Ivanti and Fortinet vulnerabilities, stolen credentials from infostealers, and brute force attacks. •Zero-day and unpatched vulnerabilities, including flaws in the Cleo file transfer tool and Ivanti VPN weaknesses. |
| Coveware | 2025 | Consulting / Analyst Firm |
| 873 | WithSecure Ransomware Threat Report 2025 | Bottom Line Up Front (BLUF) Ransomware remains a significant but manageable threat, with attackers using both encryption and added pressure tactics such as data theft and public leaks. For SMBs and insurance teams, the key takeaway is that basic security weaknesses—unpatched systems, exposed remote access, weak passwords, and lack of multi-factor authentication—continue to create practical paths for ransomware incidents. Top 3-5 Most Notable Statistics •Ransomware accounted for nearly one-fifth of identified threats encountered by users in 2021, making it the most prevalent threat type that year. •Only about 1% of ransomware in WithSecure telemetry was attributed to a particular ransomware family; the remaining 99% was detected based on behavior such as file encryption. •Approximately two-thirds of ransomware attacks investigated by WithSecure incident response and detection teams were stopped before attackers could encrypt any data. •WannaCry accounted for over half of non-generic ransomware detections, more than the next four most prevalent families combined. •CryptoLocker was cited as extorting approximately $3 million from 500,000 victims between 2013 and 2014. Top 3-5 Exploitable Technology Risks •Malicious Office documents and downloads were the most commonly observed initial attack vectors in WithSecure ransomware response engagements. •Exploitation of vulnerabilities, especially in internet-facing infrastructure, was highlighted as a key way attackers compromise organizations. •Exposed Remote Desktop Protocol ports were identified as a common ransomware access route. |
| WithSecure | 2025 | Threat Intelligence Vendor |
| 874 | Wiz CISO Budget Survey Report 2026 | Bottom Line Up Front (BLUF) The main takeaway is that cybersecurity budgets are rising, but confidence is not rising with them. For SMB owners and insurance teams, the report reinforces that spending alone is not a reliable indicator of reduced risk; cloud complexity, tool sprawl, and AI-related threats can still create exploitable gaps. Top 3-5 Most Notable Statistics •85% of organizations reported increased cybersecurity spending since last year. •88% anticipate further cybersecurity budget increases next year. •85% are increasing cloud security budgets. •49% identified cloud complexity and resource sprawl as the top inhibitor to effective cloud security. •99% believe AI will transform the future of cloud security. Top 3-5 Exploitable Technology Risks •Cloud complexity and resource sprawl, which can overwhelm manual processes and create protection gaps. •Fragmented security toolsets, including organizations running many separate cybersecurity and cloud security tools, which can reduce visibility and slow response. •Decentralized responsibility for cloud applications and services, which can weaken ownership and control. |
| Wiz | 2026 | Threat Intelligence Vendor |
| 875 | X-Force Cloud Threat Landscape Report 2021 | Bottom Line Up Front (BLUF) IBM’s 2021 X-Force report shows that cloud environments are actively targeted through stolen access, weak identity controls, misconfigurations, exposed remote access, and unpatched vulnerabilities. For SMBs and insurance teams, the key takeaway is that many cloud breaches are preventable with stronger hardening, access control, monitoring, and cloud-specific incident response preparation. Top 3-5 Most Notable Statistics •100% of X-Force Red cloud penetration tests found issues with either passwords or policies. •Cloud-related vulnerabilities increased 150% over the last five years, totaling more than 2,500 tracked vulnerabilities. •Almost 30,000 cloud accounts were potentially for sale on dark web marketplaces during the reviewed period. •71% of cloud resources offered for sale on dark web markets involved Remote Desktop Protocol access. •Over 23% of incident response cases involved attackers pivoting from on-premises systems into cloud environments. Top 3-5 Exploitable Technology Risks •Misconfigured public APIs and exposed API keys, including keys exposed through public code repositories, enabling improper cloud access. •Exposed Remote Desktop Protocol access, allowing attackers direct access to cloud-hosted resources. •Weak password and policy controls, including password spraying and excessive user privileges after compromise. |
| IBM | 2021 | Consulting / Analyst Firm |
| 876 | X-Force Cloud Threat Landscape Report 2022 | Bottom Line Up Front (BLUF) IBM’s 2022 cloud threat findings show that attackers are actively exploiting cloud weaknesses through vulnerable applications, excessive privileges, misconfigurations, and stolen access. For SMBs and insurance teams, the key takeaway is that cloud risk is not theoretical: compromised cloud environments can be used for cryptomining, extortion, data theft, and lateral movement across business systems. Top 3-5 Most Notable Statistics •99% of cloud identities in X-Force Red penetration testing cases were found to be excessively privileged. •26% of successful cloud compromises in X-Force incident response engagements resulted from exploited vulnerable applications. •IBM tracked over 3,200 cloud-related vulnerabilities, a 540% increase over six years and a 28% increase in new vulnerabilities compared to the prior year. •X-Force observed over 100,000 cloud accounts advertised on the dark web, a more than 200% increase over the prior year. •76% of cloud account sales observed were for Remote Desktop Protocol access, while 19% involved compromised cloud credentials. Top 3-5 Exploitable Technology Risks •Excessive cloud identity privileges, which allow an attacker who gains access to pivot and move laterally to other cloud assets. •Vulnerable public-facing applications, including exploitation of Log4j and VMware Cloud Director vulnerabilities. •Misconfigured cloud environments, including weak multifactor authentication, weak password policies, and poor cloud API access policies. |
| IBM | 2022 | Consulting / Analyst Firm |
| 877 | X-Force Cloud Threat Landscape Report 2023 | Bottom Line Up Front (BLUF) IBM X-Force found that cloud attacks are most often enabled by valid credentials, exposed applications, and weak access controls. For SMBs and insurance teams, the key takeaway is that cloud losses may come not only from ransomware, but also from account abuse, cryptomining, phishing infrastructure, and unexpected cloud charges. Top 3-5 Most Notable Statistics •36% of cloud security incidents IBM X-Force responded to used valid credentials as the initial access vector. •Plaintext credentials were found on user endpoints in 33% of engagements involving cloud environments. •IBM tracked 632 new cloud-related CVEs during the reporting period, a 194% increase from the prior year. •Credentials made up nearly 90% of cloud assets for sale on the dark web, with an average price of USD 10.68. •IBM is tracking nearly 3,900 cloud-related vulnerabilities, a number that has doubled since 2019. Top 3-5 Exploitable Technology Risks •Valid cloud credentials, especially plaintext and overprivileged credentials stored on endpoints, can let attackers access cloud resources without immediately appearing suspicious. •Public-facing cloud applications remain a major entry point, including continued exploitation of Log4j in Linux systems. •Kubernetes custom resource definitions can create security concerns when built without security-inclusive development processes. |
| IBM | 2023 | Consulting / Analyst Firm |
| 878 | X-Force Cloud Threat Landscape Report 2024 | Bottom Line Up Front (BLUF) IBM X-Force’s 2024 cloud threat findings show that attackers are most often getting into cloud environments through phishing, valid credentials, and exposed applications, then using that access for business email compromise, cryptomining, and credential theft. For SMBs and insurance teams, the central risk is not only sophisticated cloud attacks, but everyday identity, email, patching, and configuration weaknesses that can lead to financial fraud, service disruption, data exposure, and recovery problems. Top 3-5 Most Notable Statistics •33% of cloud-related incidents X-Force responded to over the past two years used phishing as the initial access vector. •28% of cloud-related incidents involved legitimate credentials as the initial access vector. •39% of incident response engagements involved business email compromise as the top action on objective. •22% of cloud-related incidents involved exploitation of public-facing applications, and 22% involved cryptomining as an action on objective. •Cross-site scripting accounted for 27% of newly discovered CVE impacts during the reporting period. Top 3-5 Exploitable Technology Risks •Phishing and adversary-in-the-middle attacks that harvest usernames, passwords, and session tokens, including attempts to bypass multifactor authentication. •Valid but compromised credentials, especially where user or service accounts are overprivileged. •Public-facing application vulnerabilities, including cloud-hosted services that may be unpatched or unknown to the organization. |
| IBM | 2024 | Consulting / Analyst Firm |
| 879 | X-Force Threat Intelligence Index 2022 | Bottom Line Up Front (BLUF) IBM’s 2022 X-Force Threat Intelligence Index shows that ransomware, phishing, and vulnerability exploitation remained the most important cyber risks for organizations in 2021. For SMBs and insurance teams, the key takeaway is that attackers are still using common entry points—email, unpatched systems, stolen credentials, and exposed remote services—to create costly business interruption, data theft, and extortion events. Top 3-5 Most Notable Statistics •21% of attacks remediated by X-Force in 2021 were ransomware, making it the top attack type. •41% of incidents used phishing as the initial access method, making it the leading infection vector. •Vulnerability exploitation incidents increased by 33% from 2020 to 2021. •Targeted phishing campaigns that added phone calls were 3X more effective, with a 53.2% click rate compared with 17.8% for average targeted phishing. •Manufacturing represented 23.2% of attacks X-Force remediated, replacing financial services as the most attacked industry. Top 3-5 Exploitable Technology Risks •Phishing emails and phishing kits designed to steal credentials, credit card data, addresses, phone numbers, and other personal information. •Unpatched internet-facing systems, including Microsoft Exchange vulnerabilities and Log4j CVE-2021-44228. •Remote services such as Remote Desktop Protocol, which remained a common access vector for ransomware. |
| IBM | 2022 | Consulting / Analyst Firm |
| 880 | X-Force Threat Intelligence Index 2023 | Bottom Line Up Front (BLUF) IBM X-Force found that attackers in 2022 most often gained access through phishing and exposed public-facing applications, then moved quickly toward backdoors, ransomware, extortion, data theft, and credential harvesting. For SMBs and insurance teams, the key takeaway is that common, preventable weaknesses—email compromise, exposed systems, weak credentials, and poor visibility—remain central drivers of cyber incidents and potential claims. Top 3-5 Most Notable Statistics •Phishing was involved in 41% of incidents as the initial access method. •Exploitation of public-facing applications accounted for 26% of incidents. •Backdoors were deployed in 21% of reported incidents, making them the top action on objective. •Ransomware represented 17% of incidents, down from 21% in 2021. •Extortion was the top observed impact, occurring in 27% of incidents. Top 3-5 Exploitable Technology Risks •Phishing emails using spear phishing attachments, links, or services, especially where employees can be tricked into opening malicious files or entering credentials. •Public-facing applications with exploitable vulnerabilities, which attackers used as the second most common initial access path. •Valid account abuse, including local, domain, cloud, and default accounts, allowing attackers to enter using legitimate credentials. |
| IBM | 2023 | Consulting / Analyst Firm |
| 881 | X-Force Threat Intelligence Index 2024 | Bottom Line Up Front (BLUF) IBM’s 2024 X-Force report shows a major shift toward identity-based attacks: criminals are increasingly “logging in” with valid credentials instead of breaking in through traditional hacking. For SMBs and insurance teams, this means credential controls, account monitoring, and data theft prevention are now central to reducing both incident likelihood and claim severity. Top 3-5 Most Notable Statistics •Valid account abuse was identified in 30% of incidents X-Force responded to in 2023, tying phishing as the top initial access vector. •Attacks using valid credentials increased 71% year over year. •Data theft and leak became the top observed impact, appearing in 32% of incidents. •X-Force observed a 266% upsurge in infostealer use. •84% of critical infrastructure incidents had an initial access vector that could have been mitigated with security fundamentals such as asset and patch management, credential hardening, and least privilege. Top 3-5 Exploitable Technology Risks •Valid accounts and stolen credentials: Attackers used legitimate cloud, domain, or local accounts to gain access, making misuse harder to distinguish from normal activity. •Web application security misconfigurations: These represented 30% of penetration testing web application findings, including concurrent user sessions, verbose error messages, and excessive session timeouts. •Public-facing applications: Exploitation of internet-facing systems appeared in 29% of incidents, including widespread exploitation of managed file transfer tools such as MOVEit and GoAnywhere. |
| IBM | 2024 | Consulting / Analyst Firm |
| 882 | X-Force Threat Intelligence Index 2025 | Bottom Line Up Front (BLUF) IBM’s 2025 X-Force report shows attackers are increasingly “logging in” with stolen or harvested credentials and exploiting exposed applications, rather than relying only on traditional malware. For SMBs and insurance teams, this means identity controls, patching, phishing resilience, and incident response planning are now central to reducing business disruption and claim severity. Top 3-5 Most Notable Statistics •Identity-based attacks made up 30% of total intrusions observed by X-Force. •Exploitation of public-facing applications also accounted for 30% of incident response engagements. •Infostealers delivered via phishing emails increased by 84% year over year. •Ransomware made up 28% of malware cases, despite an overall decline in ransomware incidents observed by X-Force. •Manufacturing was the most targeted industry for the fourth consecutive year, representing 26% of incidents. Top 3-5 Exploitable Technology Risks •Valid account credentials: Attackers are using stolen credentials to access environments directly, making activity harder to distinguish from legitimate user behavior. •Public-facing applications: Exposed internet-accessible systems remain a leading entry point, especially where patch management is weak. •Cloud-hosted phishing and malware: Attackers abuse trusted cloud hosting services to make malicious links appear legitimate and harder to block. |
| IBM | 2025 | Consulting / Analyst Firm |
| 883 | X-Force Threat Intelligence Index 2026 | Bottom Line Up Front (BLUF) IBM X-Force’s 2026 report shows attackers are gaining access mainly through exposed applications, weak identity controls, software supply chain weaknesses, and stolen credentials. For SMBs and insurance teams, the most important takeaway is that many incidents are still enabled by basic security gaps—misconfigurations, weak authentication, missing patches, and limited visibility—rather than highly advanced techniques. Top 3-5 Most Notable Statistics •44% increase in exploitation of public-facing applications as an initial access vector in 2025. •56% of disclosed vulnerabilities tracked by X-Force did not require authentication to exploit. •More than 300,000 ChatGPT credentials were observed for sale on the dark web. •Nearly 4x increase in major supply chain or third-party compromises over five years. •109 active ransomware or extortion groups were identified in 2025, a 49% increase from 2024. Top 3-5 Exploitable Technology Risks •Public-facing applications with vulnerabilities or misconfigurations, which became the leading initial access vector. •Weak or stolen credentials, including credentials harvested through phishing, infostealer malware, and exposed SaaS or AI chatbot accounts. •Software supply chain and third-party platforms, including open-source registries, CI/CD tools, developer platforms, SaaS ecosystems, and cloud integrations. |
| IBM | 2026 | Consulting / Analyst Firm |
Back to PETRA
PETRA Reports
Explore Reports
A static, searchable snapshot of PETRA's public cyber report library. Last Updated: April 25, 2026.
883 Reports Represented34,300 Pages Parsed