the numbers
168 numbers, each with its source.
Statistics on access, apps, AI and attacks, checked against the original report. Every one names who measured it and when, so you can quote it to a board, an auditor or a sceptical colleague and say where it came from. Survey results are marked as self-reported where it matters.
identity & access.
- 38%of all accounts are dormantVeza, 2026
- 62%of breaches involved the human elementVerizon DBIR, 2026
- 96%report human users with excessive accessPalo Alto Networks Identity Security Landscape, 2026
- 17:1non-human to human identitiesVeza, 2026
- 109:1machine identities per human identity, up from 82:1Palo Alto Networks Identity Security Landscape, 2026
- 82%of detections were malware-freeCrowdStrike, 2026
- 82%of intrusions are malware-free; attackers simply log inCrowdStrike Global Threat Report, 2026
- 36%of breaches involved stolen credentialsVerizon DBIR, 2026
- 32%of breaches began with an exploited vulnerability, now the top vectorVerizon DBIR, 2026
- 144:1machine identities to people in the cloudEntro Labs NHI & Secrets Risk Report, 2025
- 3.9Bcredentials surfaced from infostealer logs in 2024KELA State of Cybercrime 2025, 2025
- +84%yearly growth in emails carrying infostealersIBM X-Force Threat Intelligence Index, 2025
- 42%of machine identities have privileged accessCyberArk, 2025
- 82:1machine identities per human one, nearly half privilegedCyberArk Identity Security Landscape, 2025
- 82:1machine identities per humanCyberArk, 2025
- +44%year-over-year growth in non-human identities, H1 2025Entro Labs NHI & Secrets Risk Report (analysed 27M+ NHIs), 2025
- 44%of firms carry 1,000+ orphaned accountsVaronis / Orchid Security State of Identity Security, 2025
- 1B+people have activated a passkeyFIDO Alliance, 2025
- 600Midentity attacks against Microsoft every dayMicrosoft Digital Defense Report 2024, 2024
- 7,000password attacks blocked by Microsoft every secondMicrosoft Digital Defense Report 2024, 2024
- 39,000token theft incidents every dayMicrosoft Digital Defense Report, 2024
- 99.2%of account-compromise attacks are blocked by MFAMicrosoft, 2023
- 74%of leaders saw harm from a former employee's lingering accessBeyond Identity, 2022
- 83%of employees still have access to a previous employer's account (self-reported)Beyond Identity, 2022
SaaS.
- 305SaaS applications in the average organisationZylo SaaS Management Index, 2026
- 65%of manual offboarding misses SaaS applicationsReco, 2026
- 48%of breaches involve a third partyVerizon DBIR, 2026
- $21Maverage yearly waste on unused licenses at large organizationsZylo SaaS Management Index, 2026
- 3.4Mbusinesses run automations on Zapier alone (self-reported)Zapier, 2026
- 66%of companies have cloud data open to anonymous usersVaronis State of Data Security, 2025
- 87%of IT pros lost SaaS data in the past yearBackupify State of SaaS Backup and Recovery, 2025
- 256+app-to-app SaaS connections per orgAppOmni, 2025
- 256+app-to-app SaaS connections in the average enterpriseAppOmni State of SaaS Security, 2025
- 700+companies reached through one compromised OAuth integrationFINRA on the Salesloft/Drift breach, 2025
- 700+organizations reached via one OAuth integrationFINRA, 2025
- 1,000+believed under 10 apps vs 1,000+ actualAppOmni, 2024
- <10 vs 1,000+believed apps vs the measured average connected to M365AppOmni State of SaaS Security, 2024
- 16app-to-app OAuth grants per employee on averageNudge Security, 2024
- 16OAuth grants per employeeNudge Security, 2024
- ~350KDrive files open to anyone with the link, in one 6.5M-file scanMetomic Google Drive Risk Report, 2023
shadow IT.
- 14 vs 4-5AI tools in use on average, against the 4 to 5 IT knows aboutProductiv, 2026
- 64.5%of personal-account AI activity is business useHarmonic Security AI Usage Index (May 2026), 2026
- 45.6%of personal AI activity runs on employer-paid enterprise plansHarmonic Security AI Usage Index (May 2026), 2026
- 89%of AI usage is invisible to the organizationLayerX Enterprise GenAI Security Report, 2025
- 1,550+distinct GenAI SaaS apps tracked, up from 317Netskope Cloud & Threat Report, 2025
- 71%of GenAI connections use personal non-corporate accountsLayerX Enterprise GenAI Security Report, 2025
- 35%of breaches involved shadow data, hidden ~26% longerIBM Cost of a Data Breach, 2024
AI.
- ~75%plan agentic AI within two yearsDeloitte, 2026
- 47%of security leaders saw AI agents act outside intentSaviynt / Cybersecurity Insiders CISO AI Risk Report, 2026
- 47%of deployed AI agents are actively monitored or securedGravitee State of Agentic AI, 2026
- 87%call AI the fastest-growing cyber riskWEF, 2026
- 87%of organizations call AI vulnerabilities the fastest-growing riskWorld Economic Forum Global Cybersecurity Outlook, 2026
- 78%of execs doubt they'd pass an AI-governance audit within 90 daysGrant Thornton AI Impact Survey, 2026
- 67%of employees use AI at workSalesforce Workforce AI Survey, 2026
- 13vendors made Gartner's first AI Governance Platforms Magic QuadrantGartner Magic Quadrant (16 Jun 2026), 2026
- 18%of orgs have formal AI security policiesSalesforce Workforce AI Survey, 2026
- 30%name genAI data leaks their top AI concernWorld Economic Forum Global Cybersecurity Outlook, 2026
- 21%have a mature agent-governance modelDeloitte, 2026
- 56%of professionals don't know how long halting an AI system takesISACA, 2026
- 66%used unsanctioned AIPagerDuty, 2026
- 79%of organizations run or test AI agents in productionPwC, 2025
- 97%of AI-breached orgs lacked AI access controlsIBM, 2025
- 97%of orgs with an AI incident lacked AI access controlsIBM Cost of a Data Breach, 2025
- 233AI incidents recorded in 2024Stanford HAI, 2025
- 3Msensitive records touched by CopilotConcentric AI, 2025
- ~3Msensitive records per org touched by Copilot in six monthsConcentric AI Data Risk Report, 2025
- 40%of AI data breaches expected to come from cross-border GenAI misuse by 2027Gartner press release, 17 February 2025, 2025
- 77%of employees paste data into GenAI promptsLayerX Enterprise AI and SaaS Data Security Report 2025, 2025
- 62%hit by a deepfake attackGartner, 2025
- 62%of organisations were hit by a deepfake attack (self-reported)Gartner press release, 22 September 2025, 2025
- 80%of enterprise AI tools run unmanagedZluri, 2025
- 20%of EU enterprises used AI in 2025, up from 13.5%Eurostat, 2025
- 20%of EU enterprises used AI in 2025Eurostat, 2025
- 31%report a formal AI policyISACA, 2025
- 47%of workplace genAI use runs on personal accountsNetskope Cloud and Threat Report: Generative AI, 2025
- 27%of organisations review all generative AI output before use (self-reported)McKinsey, The State of AI 2025, 2025
- 51%report a negative AI incidentMcKinsey, 2025
- 51%of organisations had a negative AI incident in the past year (self-reported)McKinsey, The State of AI 2025, 2025
- 63%of organizations have no AI governance policyIBM Cost of a Data Breach, 2025
- 88%of organizations use AI in at least one functionMcKinsey State of AI, 2025
- 77%of employees paste data into GenAILayerX, 2025
- 233AI incidents recorded in 2024, up 56%Stanford HAI AI Index Report 2025, 2025
- 99%of organizations had sensitive data exposed to AI toolsVaronis State of Data Security, 2025
- $670Khigher breach cost with high shadow AIIBM, 2025
- 80%of enterprise AI tools run unmanagedZluri, The State of AI in the Workplace 2025 Report, 2025
- $25Mlost to a deepfake video-call scamCNN, 2024
- 49%of businesses faced audio and video deepfakes in 2024 (self-reported)Regula deepfake survey, 2024
- 75%of knowledge workers use AI at workMicrosoft & LinkedIn Work Trend Index, 2024
- 8%of orgs maintain a comprehensive AI-governance frameworkEconomist Impact
- 64/40/57of IT leaders say Copilot governance consumed significant timeGartner
- 40-60%of ungoverned Copilot pilots are abandoned within 90 daysEPC Group
ransomware.
- 22 secondsfor initial access to be handed off to a ransomware crewMandiant M-Trends 2026, 2026
- 48%of breaches are found by someone outside the companyMandiant M-Trends 2026, 2026
- 50%of ransomware victims had credentials leak in the prior 95 daysVerizon DBIR, 2026
- 70%of ransomware insurance claims used dual extortionCoalition Cyber Claims Report, 2026
- 29 minuteson average for attackers to spread across a networkCrowdStrike 2026 Global Threat Report, 2026
- 14 daysmedian attacker dwell timeMandiant M-Trends 2026, 2026
- 67%of ransomware victims tie the incident to an identity attackSophos State of Identity Security, 2026
- $300,750median ransom payment in early 2026Coveware, 2026
- 30%of ransomware attacks start from prior access, the top way inMandiant M-Trends 2026, 2026
- 23%payment rate in ransomware cases, near an all-time lowCoveware, 2026
- $269Kaverage loss in a ransomware insurance claimCoalition Cyber Claims Report, 2026
- 48%of breaches involved ransomwareVerizon DBIR, 2026
- 96%of ransomware victims are small and mid-sized businessesVerizon DBIR, 2026
- 69%of ransomware victims refused to payVerizon DBIR, 2026
- 54%of victims restored encrypted data from backups, a six-year lowSophos State of Ransomware, 2025
- 94%of extortion cases involved confirmed data theftCoveware, 2025
- $1.53Mmean ransomware recovery cost, excluding any ransomSophos State of Ransomware, 2025
- 200 employeesemployees at the median ransomware victimCoveware, 2025
- 24 daysaverage downtime after ransomwareSophos State of Ransomware, 2025
- 81%of analyzed EU cybercrime incidents were ransomwareENISA Threat Landscape, 2025
- $1.53Maverage ransomware recovery cost, before any ransomSophos State of Ransomware (survey of 3,400 IT/security leaders), 2025
- 32/23/19/18the root-cause split: vulnerabilities, credentials, email, phishingSophos State of Ransomware, 2025
- 53%of ransomware victims fully recovered within a weekSophos State of Ransomware, 2025
- 49%of victims with encrypted data paid the ransomSophos State of Ransomware, 2025
- 94%of ransomware attacks went after the backupsSophos, 2024
breaches and attacks.
- 13dedicated security tools on average; 99.4% still had an incidentVorlon, 2026
- 31%of breaches start with an exploited vulnerability, now the top way inVerizon DBIR 2026, 2026
- 4.8Munfilled cybersecurity roles worldwideISC2 Cybersecurity Workforce Study, 2025
- 22,000+EU financial entities covered by DORAPwC / EU DORA scope analysis, 2025
- 30%of credential attacks in 2024 used phishing-as-a-serviceBarracuda Networks Threat Spotlight, 2025
- 16%of breaches started with phishing, the top entry point globallyIBM Cost of a Data Breach Report 2025, 2025
- 76%of CISOs name tool sprawl and alert fatigue a top challengeProofpoint Voice of the CISO, 2025
- +442%growth in voice phishing in the second half of 2024CrowdStrike 2025 Global Threat Report, 2025
- $2.77Blost to business email compromise in 2024FBI IC3 2024 Internet Crime Report, 2024
- $55.49Bexposed to business email compromise worldwide since 2013FBI IC3 Public Service Announcement I-091124-PSA, 2024
- $40Bin generative AI fraud expected by 2027Deloitte Center for Financial Services, 2024
- 160,000+EU entities in scope of NIS2ENISA NIS investments / EU scope estimates, 2024
- 5 daysmedian time for a new vulnerability to be weaponisedGoogle Threat Intelligence Group (Mandiant), 2024
- 31%of cloud breaches are caused by misconfiguration and human error (self-reported)Thales 2024 Cloud Security Study, 2024
compliance.
- 3%of Nordic orgs feel fully AI-Act-readyTieto Nordic AI Survey (Feb 2026), 2026
- 48%of breaches involve a third partyVerizon DBIR, 2026
- +55%year-over-year growth in breaches through vulnerability exploitationVerizon DBIR 2026, 2026
- 31%of European organisations have a formal AI policy (self-reported)ISACA 2025 AI Pulse Poll, 2025
- 36%unsure whether NIS2 appliesESET/DAGMA, 2025
- €15Mor 3% of turnover: the AI Act fine cap for other breachesEU AI Act, Regulation (EU) 2024/1689, Article 99(4), 2024
- €35Mor 7% of global turnover: the AI Act fine cap for banned practicesEU AI Act, Regulation (EU) 2024/1689, Article 99(3), 2024
- 6.5%of DORA dry-run registers passed all ESA data-quality checksEuropean Supervisory Authorities dry-run (Dec 2024), 2024
- 60Mpeople exposed across 1,000 organisations by one file-transfer flawSecurityWeek / Emsisoft tracking, 2023
cost.
- €7.1Bin GDPR fines since 2018CMS GDPR Enforcement Tracker, 2026
- 16%of breaches involved attackers using AIIBM Cost of a Data Breach, 2025
- $4.44Maverage cost of a data breach worldwideIBM Cost of a Data Breach, 2025
- $10.22Maverage cost of a US data breachIBM Cost of a Data Breach, 2025
- 241 daysdays to identify and contain the average breachIBM Cost of a Data Breach, 2025
- 53%of breaches took customer personal dataIBM Cost of a Data Breach, 2025
- $10.5Ta year: the forecast global cost of cybercrime in 2025Cybersecurity Ventures, 2025
- $7.42Maverage healthcare breach cost, the highest of any industryIBM Cost of a Data Breach, 2025
- 60%of EU intrusions began with phishingENISA Threat Landscape, 2025
- 88%of small-business breaches involve ransomwareVerizon Data Breach Investigations Report (DBIR), 2025
- $375Maverage cost of a 50-million-record breachIBM Cost of a Data Breach 2024, 2024
Poland.
- ~42,000entities in scope of Poland's amended KSC Act, up from ~400Amended KSC Act (in force 3 Apr 2026), 2026
- 38%of Polish firms use MFA; only 12% use PAMESET / DAGMA Cyberportret polskiego biznesu, 2025
- 36%of Polish IT experts are unsure if NIS2 covers their firmESET / DAGMA Cyberportret polskiego biznesu, 2025
- 55%of Polish employees reuse one password across work accountsESET / DAGMA Cyberportret polskiego biznesu, 2025
- 19%of Polish employees pasted sensitive data into AI toolsESET / DAGMA Cyberportret polskiego biznesu, 2025
- 30%of Polish employees were trained on safe AI useESET / DAGMA Cyberportret polskiego biznesu, 2025
- +25%growth of the Polish cybersecurity market in 2025PMR via trade.gov, 2025