42% of U.S. mid-market enterprise IT leaders reported a confirmed AI-related security incident or exposure in the past 12 months.

Around eight in ten businesses (81%) and charities (84%) said they informed directors or trustees following an incident, and 62% of businesses and 73% of charities said they kept an internal record of the incident.

24% of financial services organizations have not implemented incident reporting (a DORA requirement).