Hi guys,

Based on feedback from a few weeks ago from this community, I'm sharing statistics and trends that I'm hoping are more actionable.

If you want to get a longer version of this in your inbox every week, you can subscribe here: https://www.cybersecstats.com/cybersecstatsnewsletter/

Threat actor behavior

• Attacker activity precedes the public disclosure of a new vulnerability in edge devices in 80% of cases, sometimes up to six weeks before CVE release. (Source)
• Non-Business Email Compromise (BEC) incidents rose by 214%. (Source)
• The average breakout time for attackers is under 60 minutes, sometimes less than 15. (Source)
• Fake CAPTCHA social engineering attacks (ClickFix campaigns) jumped 1,450% from 2H-2024 to 1H-2025. (Source)
• The theft of credentials via info-stealing malware has skyrocketed by 800% since the start of 2025. (Source)
• Over 1.8 billion credentials were stolen in 1H-2025. (Source)
• Publicly-available exploits rose by 179% since the start of 2025. (Source)
• 32.1% of vulnerabilities (Known Exploited Vulnerabilities - KEVs) had exploitation evidence on or before the day of their CVE disclosure, often indicating zero-day exploitation. This marks an 8.5% increase in the percentage of KEVs exploited on or before disclosure compared to 23.6% in 2024.(Source)
• Top KEV categories in 1H-2025: CMS (esp. WordPress plug-ins), Network Edge Devices, Server Software, OSS, and Operating Systems. (Source)
• Vendors with highest KEVs: Microsoft (Windows), Cisco, Apple OS, Totolink, VMware. (Source)
• Countries with the largest number of active threat actor groups: China (20), Russia (11), North Korea (9), Iran (6). (Source)

Ransomware and extortion tactics

• 40% of ransomware attacks involved physical threats against executives; 46% in the US. (Source)
• 47% of attacked companies reported regulatory blackmail (hackers threatening to file regulatory complaints). (Source)
• In Singapore, extortion threats surged to 66%, the highest rate among surveyed countries. (Source)
• A new quadruple extortion tactic: adds DDoS + harassment of third parties to double extortion. (Source)
• Nearly 20% of companies that paid a ransom still had their data published or received corrupt decryption keys. (Source)

AI and emerging threats

• 70% of real-world AI security incidents involved GenAI; 35% caused by simple prompts. (Source)
• Agentic AI caused the most dangerous failures - crypto thefts, API abuses, and legal disasters, and Supply chain attacks. (Source)
• AI security incidents doubled since 2024. (Source)
• 22% of files and 4.37% of prompts submitted to GenAI tools contained sensitive data. (Source)
• 7.95% of employees used Chinese GenAI tools; exposures included source code, credentials, M&A docs, and IP. (Source)

Let me know if the above is useful.