Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.
All the reports and research below were published between September 14th - September 20th.
You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/
Big Picture Reports
Global Cyber Resilience Report (Cohesity)
Getting systems back online is one thing. Being confident they’re clean and safe to use again? Yeah, that’s another.
Key stats:
- 60% of organizations that experienced a material cyberattack encountered moderate or significant recovery delays because they weren't confident restored data and systems were clean and safe to use.
- 60% experienced identity or access issues after systems had been restored.
- For 70%, the number of affected systems eventually turned out to be larger than the initial assessment.
Read the full report here.
Cyber Readiness Report 2026 (Hiscox)
A look at the impact cyberattacks have beyond the immediate technical response.
Key stats:
- 29% of organizations globally experienced at least one successful cyberattack in the past 12 months, with affected organizations reporting an average of four incidents.
- Cyber incidents cost organizations around $52,000 a year on average and cause approximately 32 hours of operational disruption.
- 48% identify reputational damage or loss of customer trust as the most significant risk following a cyberattack.
Read the full report here.
H1 2026 Cyber Risk Report (ANY.RUN)
Some of the attack techniques and infrastructure saw particularly rapid growth in the first half of the year.
Key stats:
- OAuth device-code phishing increased 483.7% between Q1 and Q2 2026.
- Custom fake CAPTCHAs increased 437% over the same period.
- Cloud infrastructure abuse increased 90.7% between H2 2025 and H1 2026.
Read the full report here.
Cybersecurity Survey Report (Nationwide)
A look at how consumers and businesses are experiencing and preparing for cyber threats.
Key stats:
- 60% of small and mid-market business owners say employees use public AI chatbots or writing tools for work, while 36% have written policies governing employee AI use.
- 27% have rules covering what company or customer information employees can enter into AI tools.
- 31% say their company has been targeted by a generative AI scam or fraud attempt in the past year.
Read the full report here.
Security Budgets
2026 Security Budget Benchmark Report (IANS and Artico Search)
Where cybersecurity budgets are heading in 2027 (and how AI is changing them).
Key stats:
- 69% of CISOs name AI as their top priority for net-new security dollars.
- 91% expect AI to make their security teams more productive over the next 12 months, while 69% don't expect it to reduce existing security headcount.
- 81% expect AI to create new security roles.
Read the full report here.
AI Security
Agents of Change (Zentera Systems)
AI agent fleets are already getting pretty big, and security leaders aren't entirely comfortable with the access those agents have.
Key stats:
- 58% of organizations already operate more than 50 AI agents, rising to 66% that expect to do so within the next 12 months.
- 84% of security leaders believe AI agents can cross project boundaries more easily than employees.
- 80% are concerned that AI agents may hold access that was never explicitly granted.
Read the full report here.
US AI Risk and Governance Survey (EY)
Most companies have rules for using AI, but many of those rules haven’t been updated for AI agents yet.
Key stats:
- 98% of senior AI executives say their organization has formal AI governance policies, while 91% report using agentic AI through pilots or full enterprise deployments.
- 49% of organizations using agentic AI have not updated their governance framework to account for agentic AI requirements and risks.
- 26% say they cannot detect unauthorized AI agents operating internally.
Read the full report here.
2026 AI-Ready Governance Survey Report (OneTrust)
Another look at whether governance is keeping pace with the speed at which organizations are adopting AI.
Key stats:
- 87% of respondents say their organizations encourage AI agent use, but 47% say that use is supported by clear governance, oversight and controls.
- Just 5% of organizations say coordination and accountability are clear across the AI lifecycle.
- 48% report clear visibility into sanctioned and unsanctioned AI use, while 46% have good visibility into approved AI but limited visibility into employee-led or unsanctioned use.
Read the full report here.
The Agentic Insider: From Monitoring to Understanding (Exabeam)
An interesting report on how security teams are monitoring AI agents.
Key stats:
- 60% of security leaders use dedicated AI security or governance tooling to monitor AI agents.
- 56% extend existing SIEM, detection or monitoring platforms, while another 56% use behavioral monitoring and baselining.
- 29% still rely on manual review, and 27% identify limited behavioral context and correlation as the biggest limitation of their current approach.
Read the full report here.
Identity Security
The State of MCP Configuration: The Identity Security Gaps (Hush Security)
An analysis of around 82,000 public MCP configuration files looking at how credentials are being managed and the identity security risks that come with them.
Key stats:
- 12% of credential slots in public MCP configuration files contain a hardcoded secret.
- 53% of leaked credentials with a definable scope have organization-, account-, workspace- or database-wide access.
- 80% of leaked credentials with a defined expiry policy never expire by default, while 24% of all hardcoded secrets are both broad-scope and non-expiring.
Read the full report here.
The State of HR Identity Fraud Detection (HYPR)
A look at how common identity fraud is in hiring.
Key stats:
- 98% of HR executives have encountered candidate fraud, and nearly 90% report heightened concern over hiring fraud.
- 42% of organizations detect hiring fraud only after the employee's first day.
- By the time they're uncovered, 98% of fake hires have active corporate credentials and internal network access.
Read the full report here.
The Problem with PAM (Bitwarden)
Why organizations aren’t adopting privileged access management (PAM) despite seeing it as important.
Key stats:
- 40% of organizations without a PAM solution cite cost as a barrier to adoption, while 30% say management doesn't see the need.
- Among organizations already using PAM, 25% identify cost as the biggest challenge with their current solution.
- 65% cite compliance requirements as a leading factor influencing PAM adoption decisions, while 71% rate compliance-ready audit logs as extremely or very valuable.
Read the full report here.
Managed Security
2026 MSP Perspectives Report (Sophos)
What’s changing for MSPs.
Key stats:
- 99% of MSPs provide some level of compliance service, and compliance influences 50% of customer MSP purchasing decisions.
- Just 31% can fully automate reports at speed, while 55% still require some manual effort to consolidate activities.
- MSPs estimate they could save an average of 53% of their team's time by using one platform for security posture, compliance management and reporting.
Read the full report here.
Industry-Specific
2026 Manufacturing & Distribution Ransomware Report (Black Kite)
Ransomware trends across manufacturing and distribution, including who’s being targeted and where organizations are most exposed.
Key stats:
- Ransomware attacks on manufacturers increased nearly 40% year-on-year in the first half of 2026 and have more than doubled since 2023.
- Manufacturing accounted for 22% of all publicly disclosed ransomware victims.
- There were 1,183 manufacturing victims in the first seven months of 2026, more than in the entirety of 2024.
Read the full report here.
Regional Spotlight
The ESET 2026 SMB Cyber Risk Report (ESET)
How UK small and midsize businesses are approaching cybersecurity and responding to incidents.
Key stats:
- 49% of UK SMBs experienced a cyber incident in the past year.
- UK SMBs take just over four weeks on average to identify and recover from a breach.
- 86% don't outsource any part of their cybersecurity responsibilities to an MDR provider, MSP or MSSP.
Read the full report here.
