In Q4 2025, callback phishing increased from 3% to 18% of all phishing incidents, a 500% spike.

In Q4 2025, Business Email Compromise accounted for 51% of all email fraud cases.

Diversion tactics (fraudulent invoices, fake payroll requests) accounted for 18% of BEC incidents in Q4 2025.

In Q4 2025, CEOs and senior executives accounted for 50% of impersonation-based BEC emails and 41% of total BEC incidents.

14.4% of AI agent configuration files grant arbitrary code execution permissions for Node.js.

In MCP registries, for every server provided by a verified technology vendor there are up to 15 lookalike servers from untrusted sources.

One in five developers grant AI agents permission for unrestricted file deletion, risking recursive wiping of a project or system.

Almost 20% of developers let AI automatically save changes to the project's main code repository without human review.

Use of risk-ranking methods to determine where LLM-generated code is safe to deploy increased by 12%.

Teams using attack intelligence to track emerging AI vulnerabilities increased by 10%.

Automated verification of infrastructure security surged by more than 50%.

Organizations delivering expertise through open collaboration channels increased by 29%.

Nearly 30% more organizations now produce SBOMs to meet transparency requirements.

Threats on the DNSFilter network grew by 30% between October 2024 and September 2025.

The DNSFilter network processed over 6 billion AI-related queries between October 2024 and September 2025.

DNSFilter blocked 44% more CSAM content in 2025 than in the previous year.

GenAI traffic experienced a 102.13% month-over-month spike in September 2025.

The Internet Watch Foundation detected 26,362% more AI videos of CSAM in 2025 compared to 2024.

The average internet user encounters 66 threats per day, up from 29 threats per day.

At least 700 million people use leading AI systems weekly.