This “preparedness gap” — which represents the shortfall in organizational readiness to defend against a broad spectrum of cyberthreats — widened by an average of 10 points compared to 12 months ago. Across the industry, security professionals identified ransomware and phishing as the top perceived threats, with 63% and 60% respectively rating these attack types as “high” or “critical” risks.

What's more, despite guidance from organizations like the FBI to not pay if an organization is hit by ransomware, 54% of all organizations surveyed said they believed their company would or probably would pay if hit by a ransomware attack today.

For example, the perceived risk of ransomware is up 8 points in one year, while compromised credential attacks have risen by 7 points.

These findings align with broader industry research, which shows cyberattacks are on the rise. A study from the World Economic Forum found that nearly three in four organizations reported a rise in cybersecurity risks in 2025 compared to 12 months prior. That report shows that critical infrastructure and social services (e.g., water, energy, healthcare, biosecurity) are increasingly targeted. The World Economic Forum research also found that supply chains are a critical area of vulnerability: 54% of large organizations identified supply chain complexity and third-party risk as the greatest barriers to resilience.

Each year, Ivanti calculates the preparedness gap by comparing industry-wide threat levels for various attack types with the readiness of organizations to defend against those threats. The preparedness gap research highlights where threat levels outpace existing security measures.

— as well as a high level of buy-in for the cybersecurity mandate among organizational leaders.

For example:

• 94% say cybersecurity is discussed at the board level, a 5-point improvement in one year.
• 83% say budgets are increasing this year — up 10 points since last year.
• 66% say their leaders are “highly supportive,” up 7 points in 2 years.

Security pros say their companies are increasing investments across a wide range of tactics and use cases. The most common areas of increasing investment are cloud security (68%) and data security (67%). And a significant number of companies (60%) are investing in gen AI for security use cases — though the figure is lower than we would expect given the amount of press it’s received.

As the AI arms race intensifies, a key question remains:

Which side will operationalize AI faster and smarter?

Security professionals largely believe they use AI just as effectively or more effectively than threat actors — and they expect the gap to continue to widen.

Though security pros remain confident, it’s clear that adversaries, armed with AI, are accelerating their operations, making them faster, more adaptive and more difficult to defend against. And with purpose-built generative AI, attackers can orchestrate vishing (i.e., voice phishing) and identity-based intrusions at unprecedented volume and precision. A study by the Harvard Kennedy School found that phishing emails generated by large language models had a click-through rate of 54% — far higher than the 12% observed for likely human-written messages.

Security teams need to speed up their adoption of AI tools and techniques to help them keep up with threats that are getting smarter and harder to stop.

Current uptake rates of AI/automation for cybersecurity applications remain modest. More than half (53%) of security teams use it for cloud security policy enforcement, but other important functions are used less often. Fewer than half use it for incident response workflows (44%), threat intelligence correlation (43%) and vulnerability response and remediation (42%).

Yet significant barriers to deploying AI effectively remain, including cost and regulatory challenges. But data quality issues rank among organizations’ biggest challenges, and our research shows these problems are only getting worse. Currently, 46% of organizations identify poor data quality as a barrier — up 9 points from last year.

Raising the bar for AI literacy throughout the workforce, ensuring that every employee is equipped to understand and uphold responsible AI practices, is equally critical. When asked to give employees at their companies a grade for AI literacy, security professionals rated them a B (84% grade). But differences by industry are stark: Only the tech industry scored above 85%, while healthcare — a highly targeted industry for ransomware — scored a C+ (79%) for AI literacy.

Yet the data shows there’s still plenty of room for growth and improvement. Just 27% say their ability to assess risk exposure is “excellent.” And security pros struggle with a lack of available data (47%) and a lack of time (46%) when trying to correctly assess risk.

The research also highlights an ongoing divide between IT and security teams:

• 48% of security professionals say IT lacks urgency when responding to cybersecurity concerns.
• 40% believe IT doesn’t understand the organization’s risk tolerance.

This divide is especially consequential for exposure management, which requires a close partnership between security and IT professionals. Security teams identify risks and design mitigation plans, but IT is responsible for implementing those changes. Effective exposure management demands balancing security needs with potential operational disruptions, underscoring the need for strong collaboration between security and IT leadership.

What it takes to operationalize exposure management

Effective exposure management relies on strong frameworks, which clarify risk appetite and guide consistent action across teams.

What seems clear: When companies cannot access the right skills, it has a significant negative effect on security preparedness and business outcomes.

Lack of skilled talent is the number one barrier to cybersecurity excellence, according to survey respondents.

The use of AI in cybersecurity promises to help, but here again, skills and talent shortfalls make adoption extremely difficult. A study by TechTarget found that within the cybersecurity talent pool, skills related to “emerging technologies” represent the biggest, most pressing shortfall. Meaning: Even for those organizations that want to adopt AI to help ease a talent gap, their existing talent gap prevents them (or slows them) from doing so — a self-reinforcing problem.

The sum of all these best practices: Advanced organizations are simply more confident about their security preparedness and more resilient in the face of adversity. Sixty-nine percent of Level 4 organizations say their incident response plans would definitely work as intended in the face of a breach, and 77% say they’re very confident their team could prevent or stop a damaging security incident.