Chainguard's 1,300-leader survey finds 66% at $1bn-plus firms knowingly leave high or critical flaws unpatched at least sometimes, versus 27% under $250m. The all-respondent rate is 54%, LeadDev reported, with testing and disruption the stated blockers.
Perspective Coverage
4 publishers
- Builder
- Builder 34%
- Operator
- Operator 62%
- Investor
- Investor 4%
Reality
- Evidence55
- Adoption50
- Hype gap+25
- Incentives65
- Confidence55
Flashpoint's 2026 report puts agentic AI in active defense use at one in four security teams
Flashpoint's 2026 report finds 25% of security teams actively use agentic AI in cyber defense. Respondents name wrong decisions, data leakage, auditability, regulation and cost as the obstacles to going further.
Reality
- Evidence40
- Adoption25
- Hype gap+8
- Incentives
- Not scored
- Confidence50
Socura's poll of 500 UK security leaders finds 22% have tried to avoid Patch Tuesday
Socura's survey of 500 UK security leaders found 22% said they have tried to avoid Patch Tuesday by calling in sick or booking holiday. Socura blames rising patch volume, but the figures reported cover hours and stress, and staff turnover is not among them.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+25
- Incentives70
- Confidence55
Leaked Luna Moth files show one operator on the phone while a second drives the remote session
Check Point's October 9 analysis of leaked Luna Moth files describes one operator calming the victim by phone while another runs the remote session. The files surfaced on an anonymous onion site and Check Point words its conclusion conditionally, so the call pattern is usable for training but unverified.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence45
Ten AI developers including OpenAI, Google and Meta have changed or pledged to change their UK data protection policies after ICO pressure. Because the regulator says it is tracking delivery, buyers can now ask those vendors how they meet its training-data tests.
Reality
- Evidence55
- Adoption30
- Hype gap+15
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher Attackers posing as a colleague took over ASOS's push-notification console with one employee's login
ASOS shares fell 10% after attackers used one employee's stolen login to push an extortion message through its app, a dev.to account says. That single credential was enough to reach third-party messaging tools, so those consoles need production-grade access controls.
Reality
- Evidence30
- Adoption
- Not scored
- Hype gap+25
- Incentives
- Not scored
- Confidence30
Barracuda finds phishing mail aimed at both the recipient and the AI that summarizes their inbox
Barracuda analyzed a phishing campaign pairing a password-protected attachment with hidden prompt injection aimed at the user's AI inbox summarizer. The filter that passes a message decides what the assistant reads, so the two need testing as one path.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
NCC Group counted 1,073 ransomware attacks in August, a second straight 2026 high and 12% above July. Industrial companies took 31% of them, up from 28% in July, so the hardest-hit sector drew a larger slice of a larger total.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+25
- Incentives60
- Confidence55
New ransomware crew n0n threatens to destroy the backups of victims who refuse to pay
n0n, a ransomware crew first seen September 18, listed over a dozen victims in four days and threatens to wipe the backups of those who refuse to pay. Whether it can depends on what its escalated admin accounts reach.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+25
- Incentives
- Not scored
- Confidence40
Fortra researchers say the extortion crew likely read Dynamics 365 data straight out of portals where a table was exposed to the Anonymous Users web role.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+5
- Incentives40
- Confidence55
Direct Send carried 29,785 spoofed internal emails past the mail gateway in two months
KnowBe4's Threat Lab logged the messages across July and August 2026. None of them needed a stolen password to look like mail from HR or accounting, and a single send addressed 900 recipients. The report landed September 10.
Reality
- Evidence57
- Adoption54
- Hype gap+14
- Incentives68
- Confidence56
The oversight ratio comes from one vendor's platform telemetry and should be read as such, but the capability data underneath it is checkable, and half of the 500 MCP servers sampled from npm can execute shell commands.
Reality
- Evidence54
- Adoption58
- Hype gap+28
- Incentives82
- Confidence57
NIST's multi-cloud tally: one resilience win against 23 new problems
The August 21 report says a second provider buys continuity at the price of policy consistency and verifiable authentication, and much of the fix sits on the provider's side of the boundary.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+12
- Incentives45
- Confidence52
Two Artifactory flaws poisoned metadata, not artifacts, and that was enough to break a shared cache
Oligo Security says a 32-bit cache key and a trusted .jfrog/ directory let low-privileged users serve other people a poisoned index. JFrog has patched both.
Reality
- Evidence58
- Adoption28
- Hype gap+12
- Incentives55
- Confidence60
KnowBe4 says a new build of the commodity infostealer uses Unicode emoji to break string signatures and keeps its final payload off disk. The lure is a spoofed bank thread aimed at finance teams.
Reality
- Evidence45
- Adoption20
- Hype gap+30
- Incentives70
- Confidence52
NCSC tells agent deployers: the model's built-in guardrails are not a control
The UK cyber authority's interim advice puts sandboxing, threat-modelling of agent tools and network paths, and a human stop button on the deployer rather than the vendor.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+8
- Incentives25
- Confidence55
Akrites switches on in September with 20-odd members and a one-to-10 engineer donation band
The Linux Foundation's coalition for AI-generated vulnerability reports starts taking automated submissions next month. Its membership terms set the ceiling on what it can absorb.
Reality
- Evidence38
- Adoption41
- Hype gap+28
- Incentives68
- Confidence45
Ransomware's price point is $10m to $1bn in revenue, and it is not moving
Black Kite's read of 13,336 disclosed incidents puts 73% of victims in the mid-market, a share that held while volume rose 44%. The upper band is the only one shrinking.
Reality
- Evidence58
- Adoption60
- Hype gap+20
- Incentives72
- Confidence57