# CyberSecStats #46 - AI maturity woes, shrinking time to exploit and most frequent attack techniques

> CyberSecStats #46: time to exploit drops from 745 to 44 days, 63% of alerts go unaddressed, 22% meet AI readiness standards, 80% tradecraft shift to stealth.

Source: https://fmcybersecurity.com/en/insights/strategy/cybersecstats-46/
Locale: English
Other locale: https://fmcybersecurity.com/insights/strategy/cybersecstats-46/

## Metadata

- Date: 2026-05-18
- Author: fredrik-standahl
- Topic: strategy
- Format: news
- Scope: international

## This Week's Cybersecurity Eye-Openers

Three takeaways from this week's data.

**1. Average time to exploit shrinks to 44 days (from 745 days)**

Average time to exploit N-day vulnerabilities plummeted from 745 days in 2020 to just 44 days in 2025, with exploit weaponization now occurring in under 24 hours.

**2. More than half of security alerts go unaddressed**

Despite receiving an average of 2,992 security alerts per day, an average of 63% of alerts go unaddressed.

**3. Barely anyone is as AI-mature as they think**

40% of organizations self-assess as mature in AI practices, yet only 22% meet objective standards for AI readiness.

## Big Picture Reports

### 2026 State of Threat Detection and Response Report (Vectra AI)

Why growing security investment and AI adoption still are not translating into stronger detection confidence.

**The defender's dilemma:**

- Organizations receive an average of 2,992 security alerts per day, down from 3,832 the year prior.
- 63% of security alerts go unaddressed.
- 71% of defenders set aside important security tasks at least two days per week.

[Read the full report here.](https://www.vectra.ai/resources/2026-state-of-threat-detection?ref=cybersecstats.com)

### 2026 State of Cybersecurity Report (Ivanti)

The widening gap between threats and readiness, contrasted with rising confidence about AI's potential.

**The cybersecurity divide:**

- 77% of organizations have been targeted by deepfake attacks.
- 87% of security professionals say integrating agentic AI is a priority for their teams.
- Only 30% are confident their CEOs could reliably identify a deepfake.

[Read the full report here.](https://www.ivanti.com/resources/research-reports/state-of-cybersecurity-report?ref=cybersecstats.com)

## Threat Landscape

### Red Report 2026 (Picus Security)

The most frequently seen attack techniques of last year.

**The stealth pivot:**

- Adversaries shifted 80% of their tradecraft toward stealth, evasion, and persistence in 2025.
- Process injection accounted for 30% of attacker techniques and is the top technique for the third consecutive year.
- One in four attacks involves stealing saved passwords from browsers to authenticate as valid users.

[Read the full report here.](https://www.picussecurity.com/red-report?ref=cybersecstats.com)

## Ransomware

### 2025 State of Ransomware Report (BlackFog)

The vast majority of ransomware attacks are never reported.

**The ransomware surge:**

- Publicly disclosed ransomware increased by 49% year over year, reaching 1,174 incidents.
- Approximately 86% of ransomware attacks are never publicly reported.
- The Qilin ransomware group claimed 1,115 victims, making it the most active group.

[Read the full report here.](https://www.blackfog.com/register-for-2025-state-of-ransomware-annual-report/?ref=cybersecstats.com)

## Vulnerabilities and Exploits

### N-Day Vulnerability Trends (Flashpoint)

Over the past six years, the time between disclosure and exploitation has collapsed.

**The exploitation timeline:**

- Average time to exploit declined year by year: 745 days in 2020, 518 in 2021, 405 in 2022, 296 in 2023, 115 in 2024, and 44 in 2025.
- N-day vulnerabilities represent over 80% of all Known Exploited Vulnerabilities tracked over the past four years.
- In 2025, 37 N-day vulnerabilities and 52 zero-day vulnerabilities specifically targeted security and perimeter software.

[Read the full breakdown here.](https://flashpoint.io/blog/n-day-vulnerability-trends-turn-key-exploitation/?ref=cybersecstats.com)

## AI

### The Dual Disconnect: Why Your AI Maturity Fails to Scale (JumpCloud)

The gap between perceived AI maturity and infrastructure readiness to scale AI securely.

**The maturity gap:**

- 40% of organizations self-assess as mature in their AI practices, yet only 22% meet objective standards for leading AI readiness.
- 61% report use of unsanctioned AI tools, creating visibility and governance gaps.
- A fragmented IT infrastructure leaves 60% of professionals unable to protect against rapidly evolving threats.

[Read the full report here.](https://jumpcloud.com/resources/q1-2026-it-trends-report?ref=cybersecstats.com)

### The State of Agentic AI in 2026 (CrewAI)

The growing gap between security teams' ability to detect risks and their capacity to remediate at scale.

**The agentic surge:**

- 100% of enterprises plan to expand agentic AI adoption in 2026.
- 81% have fully adopted or are actively scaling agentic AI across teams.
- Organizations expect a 33% average expansion in agentic AI adoption in 2026.

[Read the full report here.](https://crewai.com/blog/the-state-of-agentic-ai-in-2026?ref=cybersecstats.com)

## CIO Perspectives

### 7 Career-Making AI Decisions for CIOs (Dataiku)

Global CIO survey on the growing pressure to prove measurable AI outcomes.

**The CIO pressure cooker:**

- 74% regret at least one major AI vendor or platform selection made in the past 18 months.
- 85% expect their compensation to be directly tied to measurable AI outcomes.
- 82% say employees are creating AI agents and applications faster than IT can govern them.

[Read the full report here.](https://pages.dataiku.com/cio-ai-decisions?ref=cybersecstats.com)

## Identity

### The State of Identity Governance 2026 (Omada)

How rapidly scaling identity environments are outpacing governance models and executive visibility.

**The identity explosion:**

- 85% of organizations are already using or piloting agentic AI.
- 76% strongly agree that identity security is core to cybersecurity strategy.
- Over 60% cite automating identity lifecycle processes and scaling identity operations as their primary GenAI use cases.

[Read the full report here.](https://omadaidentity.com/resources/analyst-reports/state-of-iga/?ref=cybersecstats.com)

## GRC and Compliance

### 2026 IT Risk and Compliance Benchmark Report (Hyperproof)

How AI adoption, reactive risk management, and scaling compliance programs are shaping breach rates and GRC outcomes.

**The automation advantage:**

- Organizations using an integrated, automated approach to risk management report a 27% breach rate in 2025.
- Organizations that manage risk ad hoc or only after a negative event report a 50% breach rate.
- 97% of IT, security, risk, and compliance professionals report using AI to streamline their work.

[Read the full report here.](https://hyperproof.io/it-compliance-benchmarks/?ref=cybersecstats.com)

## Consumer Security

### Consumer Data Security and Privacy (Clutch)

The widening gap between how much people value data privacy and their confidence in protecting it.

**The consumer disconnect:**

- 90% of consumers say safeguarding their privacy is important.
- 88% would stop using a company if their data was not secure.
- Only 55% feel confident protecting their data online.
- 57% say their personal information has been compromised at least once.

[Read the full report here.](https://clutch.co/resources/consumer-data-security-privacy?ref=cybersecstats.com)

## Enterprise Perspective

### The Great Virtualization Reset (HPE)

How AI readiness and operational complexity are driving a rethink of virtualization strategies.

**The readiness gap:**

- More than two-thirds of enterprises plan material changes to their virtualization strategy within the next two years.
- Only 5% of enterprises are fully ready to implement planned virtualization changes.
- Budget constraints (28%), technical complexity (24%), migration risk (21%), and skills gaps (20%) are cited as top barriers.

[Read the full report here.](https://www.hpe.com/us/en/solutions/cloud.html?slug=a00155927enw&x=MHm9Z2&pf_route=uccldfav&ref=cybersecstats.com)

### AI Adoption in Practice (Nudge Security)

How widespread AI adoption is creating new governance challenges.

**The adoption picture:**

- OpenAI is present in 96.0% of organizations. Anthropic is present in 77.8%.
- 17% of prompts include copy/paste and/or file upload activity.
- Detected sensitive-data events are led by secrets and credentials (47.9%), followed by financial information (36.3%) and health-related data (15.8%).

[Read the full report here.](https://www.nudgesecurity.com/content/ai-adoption-in-practice?ref=cybersecstats.com)

## Industry-Specific

### State of AI in the Public Sector (Euna Solutions)

How public sector agencies are adopting AI, with early value in procurement, budgeting, and grants.

**The public sector lag:**

- 57% of public sector agencies are actively exploring and learning about AI.
- 16% are piloting small AI projects.
- Only 1.6% report broad AI deployment across departments.

[Read the full report here.](https://eunasolutions.com/resources/state-of-ai-in-the-public-sector/?ref=cybersecstats.com)

### CYBER360: Defending the Digital Battlespace (Everfox)

The growing tension between sharing sensitive data at mission speed and the risks of outdated infrastructure.

**The national security threat:**

- National security organizations faced an average of 137 attempted or successful cyberattacks per week in 2025, up from 127 in 2024.
- 53% of government IT security leaders rely on manual data transfer processes.
- 78% cite outdated infrastructure as a primary source of cyber vulnerability.

[Read the full report here.](https://info.everfox.com/cyber360-defending-the-digital-battlespace?ref=cybersecstats.com)

---

For the full documentation index, see https://fmcybersecurity.com/llms.txt
For the complete corpus as a single document, see https://fmcybersecurity.com/llms-full.txt