What actually changed in cyber risk, every quarter
We read the quarter's published research across threat intelligence, incident response, OT and regulation, and we tell you what the combined evidence says that no single report does. The executive perspective is public. The full edition is a request away.
Adversarial AI finally arrived with a price tag, and the cost curve reversed.
AI-driven attacks rose 56% and add an average of USD 1 million per breach. The global average cost climbed 12% to nearly USD 5 million, undoing the first decline in five years. And 88% of observed exploitation now occurs within 48 hours of a public proof of concept.
- Published
- September 15, 2026
- Period covered
- July 1, 2026 – September 30, 2026
- +56%
- Increase in AI-driven attacks
- $5 M
- Global average cost of a data breach
- 88%
- Exploitation within 48 hours of a public proof of concept
Every edition
One per quarter, from the first in March 2025.
- Q2 2026
Third parties are in 48% of breaches
Ninety percent of leaders think they would be fine. Seventy-eight percent cover less than half their vendor ecosystem. The gap between measured exposure and stated confidence is this quarter's subject.
June 23, 2026 - Q1 2026
The response window closed
Twenty-nine minutes to lateral movement, four to exfiltration at the extreme. Detection is not the constraint any more; the distance between an alert and an authorised human is.
March 24, 2026 - Q4 2025
Two products, 63.5% of breaches
The year's real finding is concentration. Two file transfer exploits produced nearly two-thirds of vulnerability-based breaches, and no amount of supplier diligence would have changed it.
December 16, 2025 - Q3 2025
Every defensive number improved. Volume doubled.
The strangest quarter we have reported: costs down, encryption down, payments down, and attack volume, data theft and public extortion all sharply up. Both are the same finding.
September 23, 2025 - Q2 2025
Extortion is being repriced
More attacks, fewer payers, smaller cheques. Defence made extortion measurably less profitable per victim, and the market answered with volume rather than retreat.
June 24, 2025 - Q1 2025
Attacker capability became a commodity
The opening edition sets the baseline. Malware-as-a-service competition put enterprise-grade tradecraft into commodity toolkits, and the sophistication gap between large and small targets closed.
March 25, 2025