Sign in Subscribe
7 min read

CyberSecStats #22 - Encryption adoption, internet-exposed assets, and the latest SaaS trends

Hello,

Have you fully integrated AI tools into your security workflow?

If so, you're apparently still in the (large) minority. 

According to a recent ICS2 survey, 30% of cybersecurity professionals are currently using AI tools, while 42% are planning or evaluating AI tools with plans to integrate them soon. 

Other AI-related data we highlight this week includes the latest statistics on employee usage of Chinese AI tools and the percentage of all applications that now incorporate an AI element (25%, according to an F5 report).

Quiz: How long does IT spend each month managing hardware and firmware security issues for every printer in their estate?

a) 3.5 hours

b) 35 minutes

c) 3 minutes

(Answer at the end of the newsletter). 

BTW, if you have information your company would like to share with our growing audience of over 300 cybersecurity practitioners, researchers, founders, and marketers, please contact us now to avoid a backlog.

General cybersecurity trend reports 

Encryption adoption at 96%, but inconsistent application continues to put sensitive data at risk (Apricorn)

Research into encryption adoption based on a sample of 200 IT security decision makers across the US.

Key stats:

  • 96% of organizations have a defined data encryption policy for removable media.
  • 29% of organizations cited remote/hybrid working as a primary reason for implementing encryption. This is an increase from 19% in 2024.
  • 23% cited a lack of encryption as the main reason for a data breach within their organization

Read the full report here.

What Over 2 Million Assets Reveal About Industry Vulnerability (CyCognito)

Findings from a statistical sample of over 2 million internet-exposed assets, across on-prem, cloud, APIs, and web apps.

Key stats:

  • 13.6% of all analyzed cloud assets are vulnerable.
  • 20.8% of all APIs analyzed are vulnerable.
  • 19.6% of all analyzed web apps are vulnerable.

Read the full report here.

40% of Enterprises Could Be at Risk of an Outage Due to SSL Expiration (CSC)

Results of CSC’s analysis of over 100,000 global SSL certificate records. 

Key stats:

  • 40% of enterprises are at risk of unexpected service outages due to out-of-date Secure Sockets Layer (SSL) certificates.
  • 17% of companies surveyed are unaware of their current Domain Control Validation (DCV) method.

Read the full report here. 

2025 H1 Data Breach Report (Identity Theft Resource Center)

A look at what happened in the first six months of 2025 when it comes to U.S. data compromises.

Key stats:

  • 1,732 data compromises were reported in the first half of 2025. This is about 5% ahead of H1 2024 in terms of compromises. 
  • About 0.5% of all security breaches in the first half of 2025 were supply‑chain incidents, but these incidents generated nearly half of all breach notifications, affecting almost 700 companies.
  • 69% of 2025's breach notices did not include an attack vector. This is an increase from 65% for the full year 2024.

Read the full report here.

Securing the Print Estate: A Proactive Lifecycle Approach to Cyber Resilience (HP Wolf Security)

A report highlighting the challenges of securing printer hardware and firmware, and the implications of these failures across every stage of the printer’s lifecycle. 

Key stats:

  • Only 32% of IT and security decision-makers can detect security events linked to hardware-level attacks.
  • 70% of IT and security decision-makers are increasingly worried about offline threats, such as employees printing and mishandling sensitive company information.

Read the full report here.

Ransomware

The State of Ransomware 2025 (BlackFog)

Findings from the analysis of ransomware activity from April to June 2025 across publicly disclosed and non-disclosed attacks.

Key stats:

  • There was a 63% increase in publicly disclosed ransomware attack volumes in Q2 2025 compared to Q2 2024.
  • June 2025 saw a 113% increase in publicly disclosed ransomware attacks year-on-year, with a total of 96 attacks.
  • 80.9% of all ransomware attacks go unreported.

Read the full report here.

AI

2025 State of AI Application Strategy Report: AI Readiness (F5)

The state of AI readiness for enterprises today and their ability to adapt at sufficient speeds to keep pace with new innovations. 

Key stats:

  • Only 2% of global organizations are highly ready to scale AI securely across operations.
  • On average, 25% of apps use AI, with "highly ready for AI" organizations typically using AI in a much higher percentage.

Read the full report here. 

2025 AI Adoption Pulse Survey (ISC2)

A report measuring the adoption of AI security tools across cybersecurity teams. 

Key stats:

  • 30% of cybersecurity professionals are using integrated AI tools.
  • 44% report no impact on hiring from current or expected adoption of AI security tools.
  • The top five areas where AI security tools are expected to have the most positive impact on operations in the shortest amount of time, by improving efficiencies and automating time-consuming tasks, are: Network monitoring and intrusion detection (60%), endpoint protection and response (56%), vulnerability management (50%), threat modeling (45%), and security testing (43%).

Read the full report here.

Code Red: Analyzing China-Based App Use (Harmonic Security)

Research into the use of Chinese-developed generative AI (GenAI) applications within the workplace. 

Key stats:

  • 1 in 12 employees, or 7.95%, used at least one Chinese GenAI tool at work.
  • Among the 1,059 users who engaged with Chinese GenAI tools, there were 535 incidents of sensitive data exposure.
  • The majority of sensitive data exposure (roughly 85%) due to the use of Chinese GenAI tools occurred via DeepSeek, followed by Moonshot Kimi, Qwen, Baidu Chat and Manus.

Read the full report here. 

Consumer/Identity Fraud 

2025 Online Identity Study (Jumio)

Study exploring consumer awareness around issues involving online identity, fraud risks, and current methods used to protect consumer data.

Key stats:

  • 69% of respondents globally believe AI-powered fraud now poses a greater threat to personal security than traditional forms of identity theft.
  • 80% of consumers globally were willing to spend more time on security for digital platforms supporting banking and financial services
  • 69% of consumers say AI-powered fraud now poses a greater threat to personal security than traditional forms of identity theft. 

Read the full report here. 

The Trust Ledger: Transaction & Identity Fraud Bulletin (Proof)

A comprehensive look at the state of identity fraud.

Key stats:

  • Nearly 30% of fraud leaders and enterprise customers surveyed reported having no reliable way to measure fraud across their systems.
  • There are nearly twice as many identity verification users aged 60–64 as there are aged 20–24, suggesting older adults are both highly targeted and proactive in self-protection.
  • Stolen identity "fullz" (comprehensive personal information) can be bought for as little as $3 on the dark web.

Read the full report here. 

Applications

Software Under Siege 2025 (Contrast Security)

Research into application security based on an analysis of 1.6 trillion runtime observations per day across real-world applications and APIs. 

Key stats:

  • On average, applications contain 30 serious vulnerabilities.
  • The average application is targeted by attackers once every 3 minutes.
  • The average application is exposed to 81 confirmed, viable attacks each month that evade other defences.

Read the full report here. 

Mobile

Report: Mobile Application Security Can’t Be an Afterthought (Guardsquare)

Research into organizations’ application security. 

Key stats:

  • 62% of organizations have experienced mobile app security incidents.
  • Organizations are reporting an average of nine mobile app security incidents per year.
  • The average cost of mobile app security breaches has reached $6.99 million in 2025.

Read the full report here. 

SaaS

The State of SaaS Security 2025 Report (AppOmni)

The third annual report looking at the latest SaaS trends and challenges security practitioners are facing.

Key stats:

  • 91% of organizations are confident in their SaaS security posture.
  • There has been a 33% increase in SaaS-related security incidents over 2024.
  • 61% of respondents expect artificial intelligence to dominate SaaS security discussions in the coming year.

Read the full report here. 

MSPs

The MSP Customer Insight Report 2025 (Barracuda Networks)

The findings of an international survey into organisations’ partnerships with Managed Service Providers (MSPs). 

Key stats:

  • 73% of organisations with up to 2,000 employees rely on MSPs to manage the security challenges of growth.
  • Customers are prepared to pay MSPs up to 25% more for the services and support they need.
  • 45% of customers would switch providers if their current MSP cannot demonstrate the skills and expertise required to deliver 24/7 security support

Read the full report here. 

Phishing

Q2 2025 Simulated Phishing Roundup Report (KnowBe4)

Insights into KnowBe4 phishing simulations with the highest click rates. 

Key stats:

  • Internal-themed topics accounted for 98.4% of the top 10 most-clicked email templates in the phishing simulations.
  • 71.9% of interactions with malicious landing pages involved branded content.
  • 80.6% of the top 20 clicked links originated from internally-themed simulations.

Read the full report here. 

Compliance

96% of EMEA Financial Services Organizations Believe They Need to Improve Their Resilience to Meet DORA Requirements (Veeam)

Research into whether financial services organizations are meeting requirements set out in the EU’s Digital Operational Resilience Act (DORA), six months after the law came into effect.

Key stats:

  • 96% of EMEA financial services organizations believe they need to improve their resilience to meet DORA requirements.
  • 40% of organizations call DORA a current "top digital resilience priority".
  • 20% of financial services organizations have yet to secure the necessary budget to meet DORA requirements.

Read the full report here. 

Industry-specific

Rural Healthcare left vulnerable to cyber attacks (Paubox)

Research into rural healthcare organizations’ cybersecurity. 

Key stats:

  • 73% of rural healthcare organisations struggle to maintain HIPAA compliance due to staffing and funding gaps.
  • Rural healthcare organisations trail urban ones by 22% in adopting AI-based threat detection.
  • 50% of rural healthcare organisations say budget limitations are a top barrier to upgrading security tools, which is nearly double the rate of urban peers.

Read the full report here.

Geography-specific

Cybersecurity in Moldova’s SMEs: findings from a national survey (e-Governance Academy)

Research into how Moldovan SMEs perceive and address cybersecurity risks. 

Key stats:

  • Around 85% of Moldovan SMEs recognise that cybersecurity is important for their business.
  • Over 40% of Moldovan companies say they have discussed cybersecurity in strategic planning or business meetings.
  • About 45% of Moldovan SMEs have no formal cybersecurity policy and no plans to develop one.

Read the full report here.

Thanks for reading this week’s CyberSecStats.

The answer to the quiz in the intro is... a) 3.5 hours. According to Securing the Print Estate: A Proactive Lifecycle Approach to Cyber Resilience by HP Wolf Security, IT teams spend 3.5 hours per printer per month managing hardware and firmware security issues.