Research

Where our numbers come from

Every industry trend in our security reports and on our website is backed by at least five trusted public sources that agree. Specific rules and events cite the original source.

Where sources disagree, we say so and use only what they share. Last checked October 21, 2026.

AI makes phishing messages more convincing

Criminals now use AI tools to write phishing messages that read well and look real, so the old advice to look for spelling mistakes no longer keeps you safe.

Mandiant M Trends 2026 notes most successful break ins still come from basic gaps, not AI. AI makes phishing better; it is not yet the main cause of breaches.

Some phishing kits get past ordinary two step sign in

Some phishing kits sit between you and the real sign in page and steal your logged in session, so a stolen login can work even with normal two step sign in. Security agencies say passkeys or security keys are the strongest protection. Normal two step sign in is still far better than none.

Microsoft, Proofpoint and the UK NCSC describe the session theft; CISA, CISA and FBI, and FinCEN recommend phishing resistant sign in.

Fake IT help desk calls

Attackers call or message staff pretending to be the IT help desk and talk them into allowing remote access. Staff should hang up and call IT back on a number they already know.

Mandiant found voice phishing became the second most common way in during 2025. The FBI says the Silent Ransom Group has targeted U.S. law firms since 2023.

Cloned voices

Criminals can now copy a real person's voice with AI and use it in calls and voice messages to push urgent requests. Always check by calling back on a number you already trust.

Unpatched software is a top way in

Breaking in through unpatched software is now one of the top ways breaches start, about 3 in 10 in two major studies, and the gap between a flaw becoming public and attackers using it has shrunk to days.

Verizon (31% of breaches) and Mandiant (32% of intrusions) agree on about 3 in 10. Sophos's 2026 incident data shows 16%, from a different sample of mostly small organizations, so we say 'one of the top ways', not 'the top way'.

Vendors are part of your security

More and more breaches start with, or involve, a vendor or outside company a business depends on, so a weakness at your vendor can put your own data at risk.

Shares differ by method: Verizon 48% (any third party involvement), SecurityScorecard 35.5% (2024 breaches), IBM 17% (supply chain as the starting point, Middle East sample). All agree it is large and growing, so we use no single number.

Data theft without the lockout

Many attackers now steal data and threaten to post it, and some never lock your files at all, so good backups help you recover but do not stop the threat to leak the data.

Encryption has not gone away; Sophos still sees most attacks encrypt data. The point is that backups alone do not solve a leak threat.

Staff are already using AI

Many employees use AI tools at work, often tools or personal accounts their employer has not approved, and pasting client or company information into them can expose private data.

Verizon: 67% of AI users on work devices use personal accounts. Microsoft: 78% of AI users bring their own tools. Cisco: 48% admit entering non public company information. Different questions, same direction. Pew finds lower overall use, so we say 'many', not 'most'.

Weak email settings let others send as you

If your email domain has weak or missing SPF and DMARC settings, attackers can send phishing and fake invoice emails that look like they came from you. Setting DMARC to reject is the step government and security experts recommend.

Google and Yahoo require DMARC for bulk senders but accept p=none. The reject recommendation comes from CISA, NSA, FBI, NCSC, FTC and Microsoft.

Fake court filing notices

Federal courts across the country warned lawyers in late 2024 about fake electronic filing notices that look like they come from the court but are really phishing emails.

All notices date from November 2024, so we describe it as a past campaign.

Closing payment fraud

Criminals often send fake wiring instructions just before a real estate closing. The FBI, FinCEN, the CFPB and the real estate and title industries all warn buyers and law firms to confirm payment details by phone using a number they already trust.

The FBI's 2025 report lists about $275 million in real estate fraud losses, a broad category that includes rental and timeshare fraud. The reports name the FBI when using it.

Scammers posing as immigration lawyers

Scammers pretend to be immigration lawyers and law firms, often on social media, and ask for money to help with paperwork or appointments.

Only New York's Department of State mentions scammers using real law firms' logos, so we credit New York State for that detail.

Older adults lose the most to online fraud

The FBI says people age 60 and older report bigger online fraud losses than any other age group, and the FTC reports their losses have grown sharply since 2020.

FBI: about $7.7 billion reported by people 60 and older in 2025. FTC data is a different dataset (about $3 billion), so we never add the two together.

Healthcare is among the most attacked

Healthcare and behavioral health organizations are among the most attacked, and hacking and ransomware are a leading cause of large health data breaches.

Counts differ by source and year, so we use no number.

Nonprofits are targeted

Nonprofits and charities are targeted by cyberattacks and fraud, including fake donation scams and fake payment requests, and many have small budgets and little or no dedicated IT staff.

UK surveys find about 3 in 10 charities report a breach or attack each year; US figures are not comparable, so we use no number.

Rules, alerts and specific events

These are single facts, so we cite the original source.