More than half (55.2%) of respondents who experienced a security incident or breach in the past 12 months stated they were told to keep it confidential despite believing it should have been reported to authorities. While slightly down from 57.6% in 2025, the figure remains dramatically higher than the 42% reported in 2023, pointing to a deeply entrenched culture of breach suppression globally. The U.S. led all regions at 68.6%, followed by Germany and U.K. both at 57.2%, and the pattern holds across organizational levels with managers (56.8%) and practitioners (53.5%) reporting similar pressure to stay silent.

Cloud infrastructure or application breaches topped the list of security incidents experienced in the past 12 months at 41.8%, followed by BEC resulting in financial or data loss at 35.9%, and ransomware at 25.6%. U.S. organizations stood out sharply, with 54.7% reporting BEC incidents, nearly 19 percentage points above the overall average. Adding to the picture, 59.2% of all respondents confirmed experiencing AI-driven social engineering attacks in the past 12 months, a strong signal that the use of AI in cybercrime has moved from industry hype to reality.

The top barriers to reducing the attack surface are high overhead in maintaining hardening rules and exceptions (38%), fear of operational disruption (35.4%), and resource constraints (34.6%), suggesting organizations understand the need to reduce exposure but struggle to act without impacting operations. Difficulty securing legacy systems (34.5%) and visibility gaps, defined as uncertainty about which legitimate tools are essential for each user (33.8%), deepen the challenge, with 48.8% of U.S. organizations reporting marked gaps in visibility compared to the overall average of 33.8%.

Over three-quarters (76.1%) of respondents say they would likely switch cybersecurity vendors due to concerns about data sovereignty, jurisdiction, or foreign government access to their data. The U.S. led all regions at 87%, followed by the U.K. at 85% and Germany (77%). Managers expressed even greater urgency than practitioners, at 79.4% versus 72.8% respectively. As regulations such as NIS2, DORA, and evolving U.S.-EU data frameworks continue to expand compliance obligations, organizations are increasingly prioritizing vendors that offer transparent data-processing models and clear answers on where their data lives and who can access it.

Organizations rate a broad spectrum of AI-driven scenarios as serious threats, with attackers using AI to generate self-mutating malware topping the list at 55.9%, followed by employees leaking sensitive data into public LLMs (53.5%), AI-driven evasion techniques bypassing traditional endpoint detection and response (EDR) signatures (52.5%), and deepfakes or voice cloning used in fraud or BEC (51.9%). Notably, while self-mutating malware ranks as the top concern, current threat intelligence suggests adversaries are using AI to accelerate and refine attacks rather than create fundamentally new malware. Concern extends beyond these scenarios, with agentic AI expanding the attack surface emerging as a regional flashpoint, particularly in Singapore (64%) and the U.S. (61.6%).

Download the report.