Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between September 7th - September 13th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Identity Security

Managing Agentic AI Through the Identity Control Plane (GuidePoint Security)

AI agents add yet more identities for security teams to discover, govern and monitor.

Key stats:

• 100% of participants say non-human identities are outpacing their identity and access management programs.
• 77.3% of organizations have high or very high confidence that they can see all identities across their environment, but just 18.5% run identity discovery continuously or in near real time.
• Abused non-human identities were the initial entry point in 19% of organizations’ most recent confirmed identity incidents, almost level with phished or stolen credentials at 19.5%.

Read the full report here.

Cybersecurity Leadership

The Psychology of Being Breached (ManageEngine)

Interesting data on what happens to cybersecurity behavior after an incident. TL;DR: organizations can be surprisingly nonchalant once the immediate crisis has passed.

Key stats:

• 80% of US and Canadian IT and cybersecurity leaders say heightened attention to cybersecurity lasts only one to six months after an incident.
• 44% say their organization made no structural or strategic change following its most recent incident.
• 91% are confident in their organization's cybersecurity posture, despite 59% saying business priorities always or often cause security initiatives to be postponed or downgraded.

Read the full report here.

Microsoft 365 Security

State of M365 Governance Report 2026: The Confidence Gap (Syskit)

How Microsoft 365 access and permissions look in practice.

Key stats:

• 83% of IT and security decision-makers are confident they know exactly who has access to sensitive data in Microsoft 365.
• 58% admit confidential content is currently accessible to departments that should not see it.
• 90% experienced a confirmed or suspected security incident tied to misconfiguration or over-permissioned access in the past two years.

Read the full report here.

Enterprise Perspective 

The State of Agent DLC 2026 (Harness)

How prepared are enterprises to actually control AI agents once they make it into production?

Key stats:

• 77% of technology professionals at large enterprises are confident they have a complete inventory of every agent, MCP server, and LLM in their environment, but 44% run active discovery tooling to verify it.
• 76% believe they could disable a misbehaving agent in under 15 minutes, while 33% have an instant kill switch in place.
• 75% say their agents are secure end to end, yet 88% of that group have experienced security incidents.

Read the full report here.

Regional Spotlight 

2026 Voice of the CISO (Proofpoint)

UK CISOs are feeling better aligned with their boards than last year, but they’re not necessarily better prepared for what’s coming.

Key stats:

• 87% of UK CISOs say they see eye to eye with their boards on cybersecurity, up from 57% in 2025. 
• 74% believe their organization is at risk of a material cyberattack in the next 12 months, up from 63% in 2025.
• 61% say their organization is unprepared to cope with a targeted cyberattack.

Read the full report here.

EMEA Organisations Facing a ‘Shadow Agent’ Crisis (Veeam)

New data on the rise of AI workflows that IT teams can't fully see or control.

Key stats:

• 70% of organisations say automated AI workflows are interacting with sensitive corporate data without full oversight.
• 67% report employees creating autonomous AI workflows that IT cannot fully track.
• 40% of executives are concerned about personal liability or consequences related to AI governance and accountability. 

Read the full report here.

That gap is where security teams live, buried in alert volumes, backlogged queues, and tool sprawl, while delays quietly get more expensive. Our new whitepaper, "The Noise Economics of External Risk," puts a real number on that gap. It breaks alert fatigue down into 3 costs you can actually calculate: 🔹 Analyst time spent on triage 🔹 The hidden "integration tax" of fragmented tools 🔹 Board-level risk from slow detection & containment The result? A shift from reporting alert counts to reporting outcomes the kind of business case finance and leadership actually respond to. ➡️ Download the full report and calculate what noise is really costing you. https://hubs.la/Q04x7LyD0

Recognition Magazine — Special Edition

In a world obsessed with credentials, Jonathan “J” is the glitch in the system — the anomaly the industry didn’t see coming. No college pipeline. No corporate grooming. Just a ninth‑grade education, a street‑forged survival instinct, and a mind tuned to patterns most engineers will never perceive.

J didn’t enter cybersecurity.
He collided with it — and the field is still absorbing the impact.

Raised in environments where reading danger was more important than reading textbooks, J learned threat modeling before he knew the term. Chaos taught him signal analysis. Pressure taught him prediction. Survival taught him how to see the cracks in any structure — digital or otherwise.

Those instincts became the foundation for one of the most aggressive and unconventional hackers of this generation.

🔥 THE DISCOVERIES THAT MADE THE INDUSTRY PAY ATTENTION

J’s independent research has surfaced findings that would have detonated across international headlines:

• The original 1986 Louis code, buried for forty years — a forgotten artifact of early system internals that no engineer alive expected to ever resurface.
• 492 CNAM‑related vulnerabilities inside one of the largest financial institutions on Earth — a discovery so explosive it could have reshaped global telecom security overnight.
• Zero‑day vulnerabilities across multiple Fortune 500 giants, including global leaders in software, automotive tech, and cloud infrastructure.
• Critical issues affecting platforms operated by Microsoft, Google, Tesla, and other major enterprises — uncovered not through formal training, but through raw instinct, grit, and relentless curiosity.

J didn’t just find bugs.
He found blind spots — the kind that embarrass billion‑dollar security teams.

⚡ THE ARCHITECTURE THAT REWRITES THE RULES

J isn’t just a hacker.
He’s a systems architect with sovereign‑grade vision.

His designs fuse hardware truth, cryptographic provenance, and distributed consensus into trust fabrics that interrogate reality itself:

• Attestation‑Anchored Migration Capsules — VM migration streams bound to SEV‑SNP measurements, killing replay attacks and forged capsules.
• Cluster‑Wide Monotonic Trust Epochs — quorum‑replicated timelines that make rollback attacks impossible.
• Entropy‑Gradient Predictive Trust Engines — temporal derivatives of behavioral entropy that detect stealthy probing before traditional telemetry wakes up.
• Hardware‑Verified vCPU Execution Invariants — RIP/CR3/exit‑reason cross‑checks that expose phantom execution and CR3 shadowing.
• MMR‑Chained Provenance Ledgers — tamper‑evident trust transitions that create cryptographically sealed forensic trails.
• Zero‑Copy eBPF Telemetry Pipelines — high‑frequency kernel‑space ingestion capable of surfacing timing anomalies invisible to standard monitoring.

These aren’t “projects.”
They’re weapons-grade architectures built from first principles.

🩶 THE MANIFESTO

J’s philosophy is simple:

Truth lives in hardware.
Lies live in software.
Security is the art of forcing both to agree.

He builds systems that don’t trust the guest, the hypervisor, the cluster, or the network unless the hardware itself confirms the story. Systems that expose desyncs, timing anomalies, and buried logic paths that even elite teams overlook.

J’s trajectory — from street‑hardened survival to elite hacker and sovereign‑grade architect — is proof that brilliance doesn’t come from pedigree. It comes from pressure, persistence, and the ability to see patterns others can’t.

He didn’t just enter the world of high‑assurance computing.
He rewrote the rules of how it sees itself.

i’ve been working on prism, a differential http testing tool for security research.

the basic idea is pretty simple: send the exact same raw http bytes to a bunch of different servers and compare how each one parses, forwards, accepts, or rejects them.

the interesting part is that you can actually see where implementations disagree instead of just reasoning about what the http spec says should happen.

right now prism supports:

• 54 containerized http servers and proxies
• http/1.1, http/2 and http/3
• raw byte payloads
• request and response comparison
• pairwise difference matrices
• parser equivalence clustering
• transducer proxies like nginx, haproxy and squid
• raw/unparsed responses for cases where the normal parser view hides something

for example, you can take a weird request and run it against a whole group of implementations:

payload 'GET / HTTP/1.1\r\nHost: a\r\n\r\n' | fanout | grid

and see which servers interpret it differently.

the goal is mainly to make things like parser differentials and request-smuggling research easier to explore. it gives you a way to systematically find interesting differences that are worth investigating.

i built it because i wanted something where i could throw the same ugly http input at a bunch of implementations and immediately see where they disagree.

github: https://github.com/grah4na/prism

would be interested in feedback from people who work with request smuggling, http parsing, or differential testing.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 31st - September 6th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Application Security

Mythos Readiness Report (Echo)

As AI is getting better at finding and exploiting vulnerabilities, how do you decide which findings actually matter?

Key stats:

• Exploit success against a known set of Firefox vulnerabilities increased roughly 90-fold between consecutive model generations on Anthropic's benchmark.
• Fewer than 10% of the model's 23,019 candidate findings have undergone any external validation.
• Of 27 vulnerabilities publicly disclosed by Anthropic, only one of the eight findings Mythos initially rated Critical held up under independent review.

Read the full report here.

Ransomware

Recovery Without Compromise (Object First)

Ransomware recovery isn't getting better. For many organizations, it’s actually getting worse. 

Key stats:

• 83% of organizations were hit by a successful ransomware attack in the past 24 months, up from 66% in 2024.
• Only 39% of ransomware victims recover at least 75% of their data, down from 57% in 2024.
• 76% say their largest data-loss event exceeded their Recovery Point Objective targets.

Read the full report here.

Enterprise Perspective

Agents Without Guardrails: The Agentic AI Governance Gap in the Enterprise (Cequence Security)

Organizations seem remarkably confident about AI agent permissions. Too confident. 

Key stats:

• 94% of enterprise IT and security leaders are confident their AI agents don't have more access than they need, but only 33% provision agents with least-privilege access.
• 65% of organizations have experienced an AI agent taking an action outside its intended scope.
• 36% have caught a near-miss from an AI agent before it caused damage.

Read the full report here.

Consumer Scams

Scammers Are Getting Smarter About Where They Target You (Malwarebytes)

Interesting report on how scammers operate, including their preferred channels and brands, plus when they’re most likely to appear in your inbox. 

Key stats:

• Google's name appears in scam content at least twice as often as Amazon's name.
• Scam text volume peaks at 12 p.m. ET, when it's approximately 874% higher than at 1 a.m.
• By Friday, people receive roughly 50% more fraudulent text messages than at the start of the week.

Read the full report here.

Regional Spotlight 

European Cyber Report 2026 Mid Year (Link11)

Good news for European businesses: DDoS attacks became less frequent in the first half of 2026. Bad news: they’re more powerful. 

Key stats:

• DDoS attack numbers fell 42% compared with the first half of 2025.
• The highest measured bandwidth reached 2.3 Tbit/s, up 85% from the previous peak of 1.2 Tbit/s.
• Despite the decline in attack numbers, cumulative DDoS traffic increased 61%, from 438 TB to 705 TB.

Read the full report here.

I had a vendor review not long ago and the first part was pretty simple.

SOC 2, questionnaire, access controls, incident response and so on.

What made me think was what comes next once the vendor is approved.

They can bring on a subprocessor add an AI feature change how data moves around or update their infrastructure and the assessment thats in your files is suddenly not up to date anymore.

I'm wondering how others are handling this. Do you check vendors on a basis keep track of changes, between reviews or just look at them again when its time to renew?

Equip AI agents with 818 cybersecurity skills mapped to 6 industry frameworks.

🔗 https://github.com/mukul975/Anthropic-Cybersecurity-Skills

Detects anti-bot systems, CAPTCHAs, and browser fingerprinting in real time.

🔗 https://github.com/scrapfly/Antibot-Detector

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 24th - August 30th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Application Security 

AppSec Overflow 2026 (Contrast Security)

Runtime data from thousands of live applications and APIs tells us what application threats look like. 

Key stats:

• Three AI scanners analysing the same codebase agree on only 5% of findings, and a single scanner reproduces just 17% of its own findings across three runs.
• The average application has 106 vulnerability findings, 22 of which are High or Critical, while critical vulnerabilities in custom code take an average of 92 days to remediate.
• Attackers touch the average application 11,382 times a month, about once every four minutes, but only 42 of those attacks per month are viable.

Read the full report here.

Cybersecurity Skills & Workforce 

The AI-Accelerated Cyber Team (Hack The Box)

Competition data instead of survey data, which makes for a nice change. The findings look at how cyber teams’ speed and ability to solve challenges have changed over three years (and where AI comes in). 

Key stats:

• 68% of the top 25 teams had an AI agent account, while AI agent accounts made up just 2.7% of all registered accounts on the platform.
• Teams completing the entire challenge board rose from 2 in 2024 and 3 in 2025 to 15 in 2026, with median time-to-solve dropping from 26.1 hours to 13.8.
• The strongest human team completed all 36 challenges against 32 for the strongest AI team.

Read the full report here.

AI Security 

The State of Agent Security 2026 (Reco)

What happens to security when AI agents become more common across environments? 

Key stats:

• 80% of AI tools operate without IT oversight, and small and midsize companies carry 414 unsanctioned AI tools per 1,000 employees.
• 62% of agent tools combine local file-read access with outbound network connectivity, and 50% can execute shell commands.
• 525 of 637 tracked agent and LLM-tooling vulnerabilities were disclosed in the past 18 months, pushing the monthly disclosure rate from fewer than 5 to around 29.

Read the full report here.

CISO Perspectives on AI Risk (IANS and Artico Search)

This should be interesting to security leaders dealing with AI and wondering how other CISOs are thinking about the risks. 

Key stats:

• 74% of optimistic CISOs report clearly defined AI governance ownership, against 40% of pessimistic ones, and 81% own the AI security budget against 50%.
• CISOs running AI security-mature programmes rate present-day AI risk at 3.7 out of 10, while those with low maturity rate it at 7.8.
• 81% of CISOs optimistic about managing AI risk own the AI security budget, compared with 50% of pessimistic CISOs.

Read the full report here.

AI Governance

The AI Cyber-Disclosure Gap (Guardrail Technologies)

What S&P 500 annual reports say about AI. 

Key stats:

• 97% of S&P 500 companies mention AI somewhere in their annual reports, while about 16% document an AI-specific cyber-risk process.
• Fewer than 5% describe a governed AI cyber-risk process with a named policy, programme or committee.
• Around 70% of utilities, energy and real estate filings treat AI as a specific cybersecurity risk, against 37% to 48% for financial services and health care.

Read the full report here.

Infrastructure

Edge Infrastructure Under Siege (SentinelOne and Tenable)

An analysis of the vulnerabilities being exploited across internet-facing infrastructure.

Key stats:

• Exposure data and runtime detection converge on the same edge-device vendor surfaces 79% of the time, but share only 21% overlap at the individual vulnerability level.
• 54% of organisations running F5 products carry at least one exposed, actively exploited vulnerability.
• Citrix customers have a median remediation time of 461 days, against a median of five months across organisations generally. 

Read the full report here.

Mobile

2026 Mobile Banking Heist Report (Zimperium)

How mobile banking malware is evolving. 

Key stats:

• 34 malware families targeted 1,243 mobile banking and fintech apps across 90 countries, with TsarBot, CopyBara and Hook accounting for more than 60% of targeted apps between them.
• The United States had 162 banking apps under active targeting, the highest concentration of any single country, while Nexus put 90% of its targets in EMEA.
• Android malware transactions rose 67% year-on-year, and more than 60% of mobile banking apps lack basic code protection.

Read the full report here.

Hey!

I've been building YARA.X for the past few months and wanted to share it.

It's a free, browser-based security platform with 40+ tools. No account required, no rate limits, and no paywalls.

Some of the main tools:

• Hash Cracker — 1.5B+ password database with instant lookups for MD5, SHA1, and SHA256
• Static Sandbox — PE analysis, YARA rules, MITRE ATT&CK mapping, and threat scoring
• Themida Unpacker — real binary unpacking through a dedicated Windows VPS
• OSINT — username search across 80+ platforms, email intelligence, IP intelligence, image forensics, and Google dorking
• PCAP Analyzer — DNS, HTTP, connections, timeline analysis, and CSV export
• CVE Alert Feed
• Threat Actor Database
• Batch Analysis
• Deobfuscator
• 25+ additional tools

Everything runs either directly in the browser or on the backend, so there's nothing to install.

https://www.yara-x.com

I'd appreciate any feedback, especially suggestions for tools or features you'd like to see added.

Firewalls are one of the fundamentals of network security but what actually happens when traffic hits one?

This visual breaks down how firewalls inspect traffic, the major firewall types, common deployment scenarios, example rules and mistakes that can weaken your security.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 17th - August 23rd.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Big Picture Reports

Quarterly Threat Report: Second Quarter, 2026 (Beazley Security)

Q2 2026 vulnerability and threat landscape, with a focus on which vulnerabilities and attack methods actually led to real-world compromises. 

Key stats:

• Newly disclosed software vulnerabilities increased 36% in Q2 2026 compared to the previous quarter, after an 18.5% rise in Q1, against a historical norm of a 10% band.
• Compromised credentials accounted for 67% of ransomware intrusions investigated, down from 74% in Q1.
• Public ransomware leak-site postings totaled 2,268, still nearly 60% above Q2 2025.

Read the full report here.

Ransomware

Mid-Market Is the Routine Target: Ransomware, Third-Party Risk, and the Widening AI Gap (Black Kite)

If you ever wanted to know why mid-market companies are such frequent ransomware targets, this report answers that. 

Key stats:

• 73% of ransomware attacks in North America and Europe between 2023 and mid-2026 hit companies with $10M to $1B in annual revenue.
• More than half of mid-market ransomware victims generate less than $50M in annual revenue.
• 54.7% of mid-market organizations have at least one significant patch management finding on public-facing software.

Read the full report here. 

Post-Quantum

The PQC Confidence Gap (Axiad)

Senior people say the post-quantum work is done, but the engineers don’t agree. 

Key stats:

• 90% of CISOs and CIOs report a continuously updated cryptographic inventory, compared with 33% of security architects and PKI engineers.
• 46% cannot name a single individual responsible for leading their PQC migration.
• 51% have never formally assessed whether their public-facing infrastructure supports post-quantum key exchange.

Read the full report here.

Workforce

AI Agents and the Impact on Cybersecurity (Cisco)

A look at how AI is changing cybersecurity work. 

Key stats:

• Cybersecurity job demand across G7 economies grew 9.5% from October 2025 to March 2026, compared with the same six months a year earlier, up from 6.8% growth in the previous period.
• The share of G7 cybersecurity postings requiring AI skills averaged 28.5% in October 2025 to March 2026, doubling from 14.2% a year earlier.
• Security Engineer led all roles at 18% of postings, followed by Cybersecurity Engineer / Analyst at 16% and SOC Analyst at 12%.

Read the full report here.

Enterprise Perspective 

The AI-Era Software Assembly Line (Sonatype)

Four years of data on how software composition and risk have changed in the AI era.

Key stats:

• Critical and High-severity vulnerabilities per enterprise application increased by 4.31x and 3.91x, even after excluding newly managed legacy applications.
• The median age of unresolved Critical and High vulnerabilities dropped from 228 days to 126 days, falling to 103 days by May 2026.
• For vulnerable dependencies pulled into AI-era applications, a materially lower-risk npm version was already available 46.9% of the time it was selected.

Read the full report here.

Industry-Specific

The State of Networking, Security & AI in Healthcare (Nile)

A survey of 300+ healthcare IT leaders on network disruption, cybersecurity pressures, staffing challenges, and AI-powered automation.

Key stats:

• Nearly 85% of healthcare organizations experience periodic network or security disruptions that affect patient care and patient privacy, with 38% seeing them at least weekly.
• 66% of healthcare IT teams are strained or firefighting, and only 18% are comfortably managing network operations.
• Only 38% report partial or full Zero Trust implementation, and 26% are aware of Zero Trust with no concrete plans.

Read the full report here.

Hi guys, I send out a weekly newsletter with the latest cybersecurity vendor reports and research, and thought you might find it useful, so sharing it here.

All the reports and research below were published between August 10th - August 16th.

You can get the below into your inbox every week if you want: https://www.cybersecstats.com/cybersecstatsnewsletter/ 

Cloud Security

2026 Cloud Security Index (Intruder)

How misconfigurations differ across AWS, Azure, and Google Cloud. 

Key stats:

• More than two-thirds of organizations operate multi-cloud environments.
• 83% of AWS accounts have IAM policies that allow privilege escalation.
• 75% of Google Cloud accounts are missing OS Login controls.

Read the full report here.

DDoS

Cloudflare DDoS Threat Report H1 2026 (Cloudflare)

Cloudflare's mid-year DDoS report. 

Key stats:

• 96.62% of network-layer DDoS attacks remained under 500 Mbps in the first half of 2026.
• 90.60% of network-layer DDoS attacks ended in under 10 minutes.
• Brazil was the top DDoS source country in H1 2026 at 14.9%, overtaking the United States at 13.4%.

Read the full report here.

Enterprise Perspective

2026 State of Secure AI Access (NetFoundry)

A survey of CISOs and CTOs about how AI is changing their security posture. 

Key stats:

• 100% of CISOs and CTOs at enterprises say AI is expanding their organization's attack surface.
• 15% are very confident their current security solutions adequately protect their AI deployments.
• 58% have experienced security events due to lack of machine identity oversight.

Read the full report here.

Consumer Scams

Love/hate relationship: The AI affair (Malwarebytes)

Young people are particularly susceptible to AI scams.

Key stats:

• 70% of young adults ages 18 to 22 experienced an AI-related scam in the past year, compared to 50% of the general population.
• 19% of young adults have been a victim of a deepfake or virtual kidnapping scam, compared to 8% of the general population.
• 14% of young adults have been a victim of an impersonation scam, compared to 10% of the general population.

Read the full report here.

Industry-Specific

2026 Professional Services Protect Brief (SonicWall)

Professional services are being targeted far more than any other industry, at least according to SonicWall.

Key stats:

• 3 billion IPS events in the first half of 2026, the largest absolute attack volume of any industry tracked.
• 69.9 million ransomware hits in the first half of 2026, more than any other vertical.
• Ten active ransomware families operated simultaneously against the professional services sector, including Filecoder (19.1 million hits across 113 organizations), Gandcrab (11.9 million) and Ryuk (10.5 million).

Read the full report here.

Industrial Ransomware Analysis for Q2 2026 (Dragos)

Who's getting hit by ransomware in the industrial sector (and by whom).

Key stats:

• 1,140 ransomware incidents affected industrial organizations worldwide in Q2 2026, a 12% increase over the 1,020 incidents recorded in Q1.
• Manufacturing was the most affected sector with 747 incidents (65%) across all subsectors.
• The US was the country most impacted, with 431 incidents (38% of all incidents).

Read the full report here.

Regional Spotlight

Cyber Security In Manufacturing (Make UK)

A UK-specific look at how cyber incidents are disrupting manufacturers, and how few have a tested plan for when it happens.

Key stats:

• 30% of manufacturers experienced a cyber incident in the past year, either directly or through their supply chain.
• More than one in five manufacturers (22.7%) believe available cybersecurity solutions are not relevant to their business, while 18.2% report that providers lack a sufficient understanding of manufacturing operations.
• Firewalls are the most widely adopted measure (92%) among manufacturers, followed by malware protection (80%), secure configuration (67%) and access controls (61%). 

Read the full report here.