26.4% of all file uploads to generative AI tools contained sensitive data between July and September 2025, an increase from 22% in Q2 2025.

57% of sensitive data uploaded to generative AI tools is classified as business or legal data, with 35% of that involving contract or policy drafting.

15% of all sensitive data uploaded to generative AI tools involves personal or employee data, including identifiers such as names and addresses.

89% of organizations have fully or partially incorporated AI agents into their identity infrastructure, with an additional 10% planning to do so

82% is the ratio of non-human identities (NHIs) to human users, indicating NHIs now outnumber human users by 82 to 1

25% of all sensitive data disclosures involve technical data, with 65% of that consisting of proprietary source code copied into generative AI tools.

12% of all sensitive data exposures originate from personal accounts, including free versions of generative AI tools.

90% of global leaders identified identity attacks as their top concern in 2025

89% of organizations plan to hire professionals within the next 12 months to manage or improve identity management, infrastructure, and security

51% of firms identified data discovery as a top priority for improving audit readiness and control visibility.

66% of organizations faced a security incident in the past year.

73% of organizations take longer than 24 hours to apply critical patches.

92% of organizations that experienced a security incident in the past year believe stronger cyber hygiene could have prevented it.

74% of organizations expect their focus on AI security to increase significantly over the next two years.

67% of retail executives who reported high-profile breaches indicated that cybersecurity has become a higher priority on the C-suite agenda in 2025.

60% of retail executives indicated that their cybersecurity team is integrated with lines of business.

66% of retailers plan to invest significantly in application security to prepare for evolving threats.

5% of identity theft victims reported experiencing suicidal feelings following their incident in 2025.

48% of consumers do not use a third-party security solution on their phone, despite 53% conducting sensitive transactions such as bill payments or online shopping in 2025.

54% of firms in the financial services industry still rely on spreadsheets or in-house systems to track security controls.