In 2025, 57% of CISOs reported that their organizations took more than 4.5 days on average for full remediation and recovery after a cyber incident.

In 2025, not a single Chief Information Security Officer (CISO) reported being able to recover from a cyber incident within a day.

65% of CISOs agreed that their organization prioritizes Cyber Resilience over traditional prevention, detection, and response.

In 2025, 98% of organizations reported spending between $1 and $5 million to recover from cyber incidents, with the average recovery cost per incident being $2.5 million.

66% of U.S. organizations say traditional privileged access reviews delay projects.

In 2025, 55% of Chief Information Security Officers (CISOs) in the US and UK reported that their organization experienced a cyberattack, ransomware infection, compromise, or data breach that rendered mobile, remote, or hybrid endpoint devices inoperable.

In 2025, 61% of CISOs indicated that their organization’s board and C-suite expect the cybersecurity group to guarantee zero breaches and ransomware incidents.

63% of U.S. organizations admit employees bypass controls to move faster.

In 2025, 19% of CISOs indicated that recovery efforts from cyber incidents extended as long as two weeks.

91% of U.S. organizations report that at least half of their privileged access is always-on, providing unrestricted access to sensitive systems.

48% of New Yorkers stated they have been the victim of a cyberattack at least once.

53% of New Yorkers try to follow best practices like using two-factor authentication when using public WiFi, while 15% report using no security measures at all.

In one-third (33%) of cases, the SMB business owner personally handles alerts and incident resolution.

38% of leaders at U.S. organizations see AI-powered attacks as a major challenge in the next two to three years.

16% of SMBs allocate less than $50 per user on security annually.

99% of security leaders at U.S. organizations with at least $1 billion in revenue plan to increase their cybersecurity budgets over the next two to three years.

In December 2025, Japan had 18%, the UK had 16%, and the US had 12% of organizations classified as 'Exceptional' in AppSec maturity.

43% of SMBs report they experienced a cyberattack in the past 5 years.

38% of New Yorkers reported they have already stopped using a service because they did not trust it to protect their data.

44% of New Yorkers use unique passwords for all of their accounts, while 56% reported reusing passwords across multiple accounts.