Cybersecurity Statistics

In Q4 2025, callback phishing increased from 3% to 18% of all phishing incidents, a 500% spike.

In Q4 2025, Business Email Compromise accounted for 51% of all email fraud cases.

Diversion tactics (fraudulent invoices, fake payroll requests) accounted for 18% of BEC incidents in Q4 2025.

In Q4 2025, CEOs and senior executives accounted for 50% of impersonation-based BEC emails and 41% of total BEC incidents.

14.4% of AI agent configuration files grant arbitrary code execution permissions for Node.js.

In MCP registries, for every server provided by a verified technology vendor there are up to 15 lookalike servers from untrusted sources.

One in five developers grant AI agents permission for unrestricted file deletion, risking recursive wiping of a project or system.

Almost 20% of developers let AI automatically save changes to the project's main code repository without human review.

Use of risk-ranking methods to determine where LLM-generated code is safe to deploy increased by 12%.

Teams using attack intelligence to track emerging AI vulnerabilities increased by 10%.