CyberSecStats #46 - AI maturity woes, shrinking time to exploit and most frequent attack techniques
CyberSecStats #46: time to exploit drops from 745 to 44 days, 63% of alerts go unaddressed, 22% meet AI readiness standards, 80% tradecraft shift to stealth.
This Week’s Cybersecurity Eye-Openers
Three takeaways from this week’s data.
1. Average time to exploit shrinks to 44 days (from 745 days)
Average time to exploit N-day vulnerabilities plummeted from 745 days in 2020 to just 44 days in 2025, with exploit weaponization now occurring in under 24 hours.
2. More than half of security alerts go unaddressed
Despite receiving an average of 2,992 security alerts per day, an average of 63% of alerts go unaddressed.
3. Barely anyone is as AI-mature as they think
40% of organizations self-assess as mature in AI practices, yet only 22% meet objective standards for AI readiness.
Big Picture Reports
2026 State of Threat Detection and Response Report (Vectra AI)
Why growing security investment and AI adoption still are not translating into stronger detection confidence.
The defender’s dilemma:
- Organizations receive an average of 2,992 security alerts per day, down from 3,832 the year prior.
- 63% of security alerts go unaddressed.
- 71% of defenders set aside important security tasks at least two days per week.
2026 State of Cybersecurity Report (Ivanti)
The widening gap between threats and readiness, contrasted with rising confidence about AI’s potential.
The cybersecurity divide:
- 77% of organizations have been targeted by deepfake attacks.
- 87% of security professionals say integrating agentic AI is a priority for their teams.
- Only 30% are confident their CEOs could reliably identify a deepfake.
Threat Landscape
Red Report 2026 (Picus Security)
The most frequently seen attack techniques of last year.
The stealth pivot:
- Adversaries shifted 80% of their tradecraft toward stealth, evasion, and persistence in 2025.
- Process injection accounted for 30% of attacker techniques and is the top technique for the third consecutive year.
- One in four attacks involves stealing saved passwords from browsers to authenticate as valid users.
Ransomware
2025 State of Ransomware Report (BlackFog)
The vast majority of ransomware attacks are never reported.
The ransomware surge:
- Publicly disclosed ransomware increased by 49% year over year, reaching 1,174 incidents.
- Approximately 86% of ransomware attacks are never publicly reported.
- The Qilin ransomware group claimed 1,115 victims, making it the most active group.
Vulnerabilities and Exploits
N-Day Vulnerability Trends (Flashpoint)
Over the past six years, the time between disclosure and exploitation has collapsed.
The exploitation timeline:
- Average time to exploit declined year by year: 745 days in 2020, 518 in 2021, 405 in 2022, 296 in 2023, 115 in 2024, and 44 in 2025.
- N-day vulnerabilities represent over 80% of all Known Exploited Vulnerabilities tracked over the past four years.
- In 2025, 37 N-day vulnerabilities and 52 zero-day vulnerabilities specifically targeted security and perimeter software.
AI
The Dual Disconnect: Why Your AI Maturity Fails to Scale (JumpCloud)
The gap between perceived AI maturity and infrastructure readiness to scale AI securely.
The maturity gap:
- 40% of organizations self-assess as mature in their AI practices, yet only 22% meet objective standards for leading AI readiness.
- 61% report use of unsanctioned AI tools, creating visibility and governance gaps.
- A fragmented IT infrastructure leaves 60% of professionals unable to protect against rapidly evolving threats.
The State of Agentic AI in 2026 (CrewAI)
The growing gap between security teams’ ability to detect risks and their capacity to remediate at scale.
The agentic surge:
- 100% of enterprises plan to expand agentic AI adoption in 2026.
- 81% have fully adopted or are actively scaling agentic AI across teams.
- Organizations expect a 33% average expansion in agentic AI adoption in 2026.
CIO Perspectives
7 Career-Making AI Decisions for CIOs (Dataiku)
Global CIO survey on the growing pressure to prove measurable AI outcomes.
The CIO pressure cooker:
- 74% regret at least one major AI vendor or platform selection made in the past 18 months.
- 85% expect their compensation to be directly tied to measurable AI outcomes.
- 82% say employees are creating AI agents and applications faster than IT can govern them.
Identity
The State of Identity Governance 2026 (Omada)
How rapidly scaling identity environments are outpacing governance models and executive visibility.
The identity explosion:
- 85% of organizations are already using or piloting agentic AI.
- 76% strongly agree that identity security is core to cybersecurity strategy.
- Over 60% cite automating identity lifecycle processes and scaling identity operations as their primary GenAI use cases.
GRC and Compliance
2026 IT Risk and Compliance Benchmark Report (Hyperproof)
How AI adoption, reactive risk management, and scaling compliance programs are shaping breach rates and GRC outcomes.
The automation advantage:
- Organizations using an integrated, automated approach to risk management report a 27% breach rate in 2025.
- Organizations that manage risk ad hoc or only after a negative event report a 50% breach rate.
- 97% of IT, security, risk, and compliance professionals report using AI to streamline their work.
Consumer Security
Consumer Data Security and Privacy (Clutch)
The widening gap between how much people value data privacy and their confidence in protecting it.
The consumer disconnect:
- 90% of consumers say safeguarding their privacy is important.
- 88% would stop using a company if their data was not secure.
- Only 55% feel confident protecting their data online.
- 57% say their personal information has been compromised at least once.
Enterprise Perspective
The Great Virtualization Reset (HPE)
How AI readiness and operational complexity are driving a rethink of virtualization strategies.
The readiness gap:
- More than two-thirds of enterprises plan material changes to their virtualization strategy within the next two years.
- Only 5% of enterprises are fully ready to implement planned virtualization changes.
- Budget constraints (28%), technical complexity (24%), migration risk (21%), and skills gaps (20%) are cited as top barriers.
AI Adoption in Practice (Nudge Security)
How widespread AI adoption is creating new governance challenges.
The adoption picture:
- OpenAI is present in 96.0% of organizations. Anthropic is present in 77.8%.
- 17% of prompts include copy/paste and/or file upload activity.
- Detected sensitive-data events are led by secrets and credentials (47.9%), followed by financial information (36.3%) and health-related data (15.8%).
Industry-Specific
State of AI in the Public Sector (Euna Solutions)
How public sector agencies are adopting AI, with early value in procurement, budgeting, and grants.
The public sector lag:
- 57% of public sector agencies are actively exploring and learning about AI.
- 16% are piloting small AI projects.
- Only 1.6% report broad AI deployment across departments.
CYBER360: Defending the Digital Battlespace (Everfox)
The growing tension between sharing sensitive data at mission speed and the risks of outdated infrastructure.
The national security threat:
- National security organizations faced an average of 137 attempted or successful cyberattacks per week in 2025, up from 127 in 2024.
- 53% of government IT security leaders rely on manual data transfer processes.
- 78% cite outdated infrastructure as a primary source of cyber vulnerability.