Data drift happens when the statistical properties of a machine learning (ML) model’s input data change over time, eventually rendering its predictions less accurate. Cybersecurity professionals who rely on ML for tasks like malware detection and network threat analysis find that undetected data drift can create vulnerabilities. A model trained on old attack patterns may fail to see today’s sophisticated threats. Recognizing the early signs of data drift is the first step in maintaining reliable and efficient security systems.
Why data drift compromises security models
ML models are trained on a snapshot of historical data. When live data no longer resembles this snapshot, the model’s performance dwindles, creating a critical cybersecurity risk. A threat detection model may generate more false negatives by missing real breaches or create more false positives, leading to alert fatigue for security teams.
Adversaries actively exploit this weakness. In 2024,attackers used echo-spoofing techniques to bypass email protection services. By exploiting misconfigurations in the system, they sent millions of spoofed emails that evaded the vendor’s ML classifiers. This incident demonstrates how threat actors can manipulate input data to exploit blind spots. When a security model fails to adapt to shifting tactics, it becomes a liability.
5 indicators of data drift
Security professionals can recognize the presence of drift (or its potential) in several ways.
Advertisement
1. A sudden drop in model performance
Accuracy, precision, and recall are often the first casualties. A consistent decline in these key metrics is a red flag that the model is no longer in sync with the current threat landscape.
Consider Klarna’s success: Its AI assistant handled 2.3 million customer service conversations in its first month and performed work equivalent to 700 agents. This efficiency drove a25% decline in repeat inquiries and reduced resolution times to under two minutes.
Now imagine if those parameters suddenly reversed because of drift. In a security context, a similar drop in performance does not just mean unhappy clients — it also means successful intrusions and potential data exfiltration.
2. Shifts in statistical distributions
Security teams should monitor the core statistical properties of input features, such as the mean, median, and standard deviation. A significant change in these metrics from training data could indicate the underlying data has changed.
Advertisement
Monitoring for such shifts enables teams to catch drift before it causes a breach. For example, a phishing detection model might be trained on emails with an average attachment size of 2MB. If the average attachment size suddenly jumps to 10MB due to a new malware-delivery method, the model may fail to classify these emails correctly.
3. Changes in prediction behavior
Even if overall accuracy seems stable, distributions of predictions might change, a phenomenon often referred to as prediction drift.
For instance, if a fraud detection model historically flagged 1% of transactions as suspicious but suddenly starts flagging 5% or 0.1%, either something has shifted or the nature of the input data has changed. It might indicate a new type of attack that confuses the model or a change in legitimate user behavior that the model was not trained to identify.
4. An increase in model uncertainty
For models that provide a confidence score or probability with their predictions, a general decrease in confidence can be a subtle sign of drift.
Advertisement
Recent studies highlight thevalue of uncertainty quantification in detecting adversarial attacks. If the model becomes less sure about its forecasts across the board, it is likely facing data it was not trained on. In a cybersecurity setting, this uncertainty is an early sign of potential model failure, suggesting the model is operating in unfamiliar ground and that its decisions might no longer be reliable.
5. Changes in feature relationships
The correlation between different input features can also change over time. In a network intrusion model, traffic volume and packet size might be highly linked during normal operations. If that correlation disappears, it can signal a change in network behavior that the model may not understand. A sudden feature decoupling could indicate a new tunneling tactic or a stealthy exfiltration attempt.
Approaches to detecting and mitigating data drift
Common detection methods include the Kolmogorov-Smirnov (KS) and the population stability index (PSI). These compare the distributions of live and training data to identify deviations. The KS test determines if two datasets differ significantly, while the PSI measures how much a variable’s distribution has shifted over time.
The mitigation method of choice often depends on how the drift manifests, as distribution changes may occur suddenly. For example, customers’ buying behavior may change overnight with the launch of a new product or a promotion. In other cases, drift may occur gradually over a more extended period. That said, security teams must learn to adjust their monitoring cadence to capture both rapid spikes and slow burns. Mitigation will involve retraining the model on more recent data to reclaim its effectiveness.
Advertisement
Proactively manage drift for stronger security
Data drift is an inevitable reality, and cybersecurity teams can maintain a strong security posture by treating detection as a continuous and automated process. Proactive monitoring and model retraining are fundamental practices to ensure ML systems remain reliable allies against developing threats.
Our guest posting program is where technical experts share insights and provide neutral, non-vested deep dives on AI, data infrastructure, cybersecurity and other cutting-edge technologies shaping the future of enterprise.
Advertisement
Read more from our guest post program — and check out our guidelines if you’re interested in contributing an article of your own!
Microsoft’s April 2026 update lets users and administrators fully uninstall the Copilot app from Windows 11. The move follows poor adoption numbers, with only 3.3 per cent of eligible users paying for Copilot, and persistent criticism that Microsoft forced AI features on users without adequate control.
Microsoft has added the ability to fully remove the Copilot app from Windows 11. The change arrived in the April 2026 update and applies to both enterprise administrators using Group Policy and regular users who can now uninstall it through Settings like any other app.
Advertisement
For IT administrators, the new policy is called “Remove Microsoft Copilot app.” It sits under User Configuration, Administrative Templates, Windows Components, Windows AI in the Group Policy Editor. Administrators can also apply it through the Windows Registry. The policy will uninstall Copilot only if specific conditions are met: both Microsoft 365 Copilot and the standalone Microsoft Copilot must be installed, the user must not have manually installed the Copilot app, and the app must not have been launched in the past 28 days.
For home and Pro users, the path is simpler. Go to Settings, then Apps, then Installed Apps, search for Copilot, and select Uninstall. The app can be reinstalled later from the Microsoft Store if needed.
The 💜 of EU tech
The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!
Advertisement
The move is a concession. Since integrating Copilot across Windows 11 and the Microsoft 365 suite in 2023, Microsoft has positioned the tool as its centrepiece AI product. It embedded Copilot into the taskbar, Edge, Notepad, Office apps, and Outlook, all running in the background and enabled by default. Users who wanted it gone had to resort to PowerShell scripts, third-party debloating tools, or registry hacks. The new policy makes removal an official, supported option for the first time.
The timing reflects a broader problem with Copilot adoption. Only 3.3 per cent of Microsoft 365 users who have access to Copilot Chat actually pay for it. Of roughly 450 million Microsoft 365 seats, 15 million are paid Copilot subscribers. That is a conversion rate that suggests most users either do not find the tool useful enough to pay for or actively prefer to avoid it. Microsoft’s own terms of service describe Copilot as being “for entertainment purposes only,” a disclaimer that sits uncomfortably alongside a product marketed as a productivity tool priced at $30 per user per month.
The uninstall option is part of a wider Windows 11 cleanup effort. Microsoft has been removing legacy features and reducing pre-installed software in recent updates. WordPad was deprecated in 2024. The Tips app was removed. Cortana was discontinued. Letting users remove Copilot follows the same logic: if a feature is not being used, forcing it on people generates resentment rather than adoption.
Enterprise customers have been particularly vocal. IT administrators managing thousands of devices objected to Copilot being pushed to managed environments without adequate controls. Microsoft has been rethinking its AI strategy more broadly, launching its own MAI model family to reduce dependence on OpenAI and cutting internal Claude Code licences after the costs proved difficult to justify.
Advertisement
The 28-day inactivity condition on the Group Policy removal is worth noting. If a user has opened Copilot even once in the past four weeks, the policy will not uninstall it. Microsoft is clearly trying to preserve the app for anyone who has shown even minimal engagement while giving administrators a way to clear it from machines where it sits untouched.
The change does not affect Copilot features embedded elsewhere in Windows, such as AI suggestions in the Start menu search, AI-powered features in Paint and Photos, or Copilot integration in Edge. Removing the standalone Copilot app removes the dedicated AI chat interface but does not strip AI from the operating system entirely.
For Microsoft, the calculation is straightforward. A product that users actively resent and administrators work around is doing more harm to Windows sentiment than any AI feature is worth. Letting people remove it is cheaper than the support burden, community backlash, and enterprise friction that forcing it creates.
The broader pattern across the tech industry is similar. GitHub froze new Copilot sign-ups after agentic AI usage broke the economics of its pricing model. Google has faced pushback over AI Overviews in Search. Apple settled an AI exaggeration lawsuit for $250 million. The lesson is consistent: users will adopt AI tools that demonstrably improve their work, but they will push back hard against AI that is imposed on them without clear value.
Advertisement
Microsoft is learning that lesson in real time. The Copilot uninstall button is small, but the signal it sends is not. When a company that invested $13 billion in OpenAI admits that its flagship AI product should be optional, that is an acknowledgement that the current version has not yet earned its place on every desktop.
Here is my problem with The Boys finale. After five seasons of buildup, watching Homelander laser people in half for looking at him wrong and Butcher destroying himself for one shot at revenge – I wanted a bloodbath. And somehow, the memes that came out of the finale were more satisfying than the episode itself.
The Boys season 5 finale, titled “Blood and Bone,” is not the worst finale ever made, but it is one of the most frustrating ones to sit through. The show threw out every method the Boys had spent seasons chasing to kill Homelander, botched the execution of what remained, and delivered an ending that felt like the writers suddenly remembered they had a show to wrap up.
The Boys finale traded chaos for commentary and lost the plot doing it
Amazon MGM Studios
The writers wanted Homelander’s final moments to mirror the fall of every real-world tyrant who spent years terrifying people, only to crumble into a sniveling, pathetic mess. He is stripped of everything he thought made him God, and dies as a depowered man with a crowbar in his skull.
People watching this show have spent years watching real leaders abuse power with zero consequences. The symbolism of a tyrant losing everything and begging for his life in the end is not lost on me. I understand why a lot of viewers found it satisfying on that level, but when you spend five seasons building a monster and then quietly defang him to make the ending work, the symbolism stops feeling earned.
Let’s talk about the scorched earth promise that Homelander and Butcher made back in The Boys season 3. The pact was to raise the stakes until one of them was left standing in the rubble of everything they burned down together. The posters leaned into it hard, showing Homelander lording over a burning Earth. Key visuals had Butcher walking over the ruins of Vought Tower. I was ready for absolute apocalyptic chaos.
Advertisement
When the hyped showdown finally arrived, it took place entirely inside the Oval Office, a far cry from the scorched earth apocalypse we were promised. Showrunner Eric Kripke has since confirmed that a post-apocalyptic wasteland was never going to happen and that he always wanted something more intimate and character-driven. While that is a valid creative choice, you cannot spend seasons building up the hype and then hand fans a crowbar fight in a government office.
The show forgot its own rules
There is also the sheer logic collapse of how Butcher and his team even got there. The show spent episodes establishing that Vought Tower was impenetrable due to its heavy security and supe presence. Yet somehow, walking into the actual Oval Office with a sitting president-god on the premises was apparently no problem at all.
Homelander knew they were coming and assigned what felt like a handful of Secret Service agents to hold them off. Where was his supe army? Where was the manic, overwhelming response you would expect from a man who had literally just declared himself god on live television?
The wasted characters hurt more than the weak fight did
Amazon MGM Studios
Starlight was the face of the entire resistance against Homelander, but nothing says “final battle” like benching your most powerful resistance symbol on a beach to fight a fish man while the actual showdown happens without her. Deep had already been rejected by the ocean itself, but Starlight had no way of knowing that. So why would she fly him to a beach where she is surrounded by water, which is his element, and far from any electricity source that fuels her own powers? It made no tactical sense either.
Prime Video
Speaking of people who deserved more, Sister Sage had real potential because of her superintelligence. I thought the show was setting her up as the real puppet master, a villain smarter than Homelander in every way that actually mattered, pulling strings nobody else could even see. Instead, she spirals into depression, gets depowered by Kimiko, and ends up going to Harry Potter World in Florida, completely at peace with herself. What a waste of a perfectly good character!
Amazon Studios
Gen V getting cancelled before its third season, and then having its surviving characters shoved to the sidelines in the very season that needed them most, is a separate tragedy. Marie Moreau is described in the show’s own logic as Homelander-level powerful. She had blood-bending abilities that could have changed everything about that final fight. Instead, she got a few lines and a bus out of town. So I don’t understand why the writers built a trump card and refused to play it.
And then there is Soldier Boy. Why would an arrogant, deeply resentful man who does not even like Homelander hand over a vial of V1 to him, just because it is apparently “what Clara would have wanted”? However, the show never explains it. Maybe Vought Rising, the upcoming Boys prequel, will give us more context on the Clara Vought angle. Nevertheless, that scene has already spawned a flood of memes online, and I will be honest, I enjoyed those memes considerably more than I enjoyed the finale itself.
Advertisement
Mother’s Milk got the rawest deal of all when it comes to unresolved arcs. For context, MM’s entire reason for being on this team can be traced back to Soldier Boy. As a child, he watched Soldier Boy hurl a car into his family home, killing his grandfather and other family members. So when Soldier Boy ends up frozen back in Vought Tower at the end of all this, still very much alive, you would expect MM to do something about it. The revenge arc was right there, but the writers ghosted it completely. On top of that, MM takes in Ryan despite the two barely interacting this season.
The Boys deserved a better send-off than this
The Boys was never just a gory superhero show. It was supposed to be a cultural mirror that made people uncomfortable in the best possible way. Instead of going out as that show, the finale fumbled so badly it became the joke rather than the one telling it.
Fans are not quoting the finale’s emotional beats or its political symbolism online. They are making memes and comparing the finale to Game of Thrones and Stranger Things in the same breath, and not as a compliment. It is truly disappointing that after five seasons of holding a mirror up to the world, the finale could not even hold itself together.
Glass-based substrates are slowly beginning to push out organic substrates commonly used in PCBs due to often superior material properties. One area where glass substrates have however struggled is with through-hole vias and providing the conductive copper path through them. A 2024 article by [Keith Best] gives a good overview of the topic, with recent news showing how much companies like Intel are pushing for glass substrates, specifically for the packaging of dies.
One major advantage with vias in glass substrates is that they can be much smaller, enabling smaller than 0.1 mm diameter holes with far finer pitch. The challenge here is to make perfect holes with a laser that are defect-free, as well as have the intended diameter.
After that this through-glass via (TGV) has to be coated or filled with copper, much like their organic equivalent. Said TGV can be fully filled with copper, or use plating and add dielectric filler. Detecting flaws in such a finished TGV is important.
In a 2025 review article of glass substrate technologies by [Pratik Nimbalkar] et al. published in Chips the state of the art at the time was covered. The need for ever higher-density integration options with ASICs is highlight here, especially now that many chips today consist of multiple interconnected dies inside a single package.
The complications of creating TGVs with femtosecond laser pulses in Borofloat 33 glass are highlighted by [Daniel Franz] et al. in a 2025 research article, with microcracks and backside ablation observed without proper precautions, something which previously was often resolved by an etching step following said laser drilling. The main issue here is the post-drilling residual stress from the thermal shock, which the authors demonstrate can be largely prevented with careful tweaking of the laser drilling parameters.
Advertisement
As pointed out in a 2024 review article by [Chen Yu] et al. glass substrates are useful for far more than just high-density chip packaging. Glass substrates are also chemically resistant, have a higher heat resistance, are largely transparent to RF and can be hermetically sealed against outside influences. This makes them great for various advanced sensors and communication devices.
Meanwhile, if you wanted to do some metal-depositing on glass at home, we covered this recently.
The PlayStation Portable, or the PSP, was discontinued over a decade ago, but its cultural presence never fully faded. Most recently, the fast-fashion brand Zara gave it a second life in the most unexpected form: the company has dropped a crossbody bag modelled after the PSP 1000.
The Zara PSP Crossbody Bag is exactly as delightful and absurd as the name sounds. The shadow drop came without an announcements or media campaigns, but the retro gaming community has already taken notice of it.
Zara
What does the bag actually look like?
It is actually a relatively small crossbody bag whose front face is a silicone recreation of the PSP 1000, in convincing detail. The bag comes with embossed buttons, logos (on the front and the back), an analogue nub, and a vinyl panel standing in for the iconic 4.3-inch widescreen display.
The adjustable shoulder strap also carries a PSP branding, along with the classic triangle, circle, cross, and square shapes. Clearly, Zara doesn’t want the product to look like a cheap knockoff, and the result shows.
The bag measures 4.3 x 7.9 x 2 inches, has a main zipper compartment, and is made from polyurethane thermoplastic on the front face with a silicone overlay and a polyester shell and lining.
For now, the Zara PSP Crossbody Bag is available at $35.90 in the United States and £19.99 in the United Kingdom, available directly via the company’s official website and in stores. The bag is only available in one color, black.
I also see the trademark symbol on the website, implying that this is some sort of licensed deal between Zara and Sony, rather than an unofficial product, even though neither company has confirmed the arrangement.
At $35.90, it could be among the most affordable pieces of PSP memorabilia you might ever own, but only if the PSP mattered to you.
Last month saw a world first, reports Electrek. Wind and solar generated more power globally than gas:
According to new analysis from independent energy think tank Ember, wind and solar produced 22% of the world’s electricity in April 2026, compared to 20% from gas. Together, the two renewable sources generated a record 531 terawatt-hours (TWh) of electricity during the month, 54 TWh more than gas plants generated globally, at 477 TWh…
Five years ago, in April 2021, gas generation was almost identical to today’s level at 476 TWh. But back then, wind and solar combined generated just 245 TWh — less than half of what they produced this April…
Wind and solar generation increased across nearly every major market reporting April data… April tends to be the strongest month for this kind of milestone because spring weather in the Northern Hemisphere usually brings a combination of strong wind generation, rising solar output, and lower electricity demand between heating and cooling seasons. Still, the broader trend is clear. Ember’s recent Global Electricity Review found that wind and solar met all global electricity demand growth in 2025. “Governments around the world are also ramping up renewable energy targets to reduce dependence on volatile fossil fuel imports…”
When you think of Memorial Day sales, you probably think of mattresses and other home goods. And while those items are definitely discounted, now is also a good time to purchase tech. Personally, I’m not buying anything right now unless it’s discounted—and fortunately many of our top picks are. Whether you’re shopping for a power bank, a new pair of headphones, or some other gadget, I’ve rounded up the best Memorial Day deals for your perusal. Most of these deals end at the end of the day.
Updated Monday, May 25: We’ve checked prices, removed expired deals, added 6 new deals, and ensured accuracy throughout.
WIRED Featured Deals:
Advertisement
Sony WH-1000XM5 for $248 ($152 off)
The Sony WH-1000XM5 have a very frustrating name, but they’re the predecessor to our favorite wireless headphones, and they’re still an excellent pick if you don’t want to shell out for the new WH-1000XM6. They go on sale frequently, but rarely drop this low in price, which comes within $5 of their all-time low. If you’re in the market for over-ear headphones, they’re hard to beat. They’re comfortable, portable, lightweight, and stylish, and they’ll make your music sound great no matter what you like to listen to.
[B]ox office analysts are mixed on the results. On one hand, it’s significant for any film to debut above $100 million in post-pandemic times. On the other, “Star Wars” is one of Hollywood’s preeminent film properties, so there’s an expectation of a certain level of box office. And this start is the worst for “Star Wars” since Disney bought the franchise in 2012.
CNBC cites reports 41% of tickets were sold for more expensive large-format screenings like IMAX and DolbyCinema.
So how’s the movie? Rotten Tomatoesshows an 89% positive rating from moviegoers on its “popcornmeter” and a 62% average score from professional movie critics. And Ars Technica writes that “The plot is predictable, the fight scenes are meh, but you can’t beat the charm of that little green Grogu.” So while there’s “a paint-by-numbers plot,” they add that “the little green puppet pretty much carries the entire film.”
Advertisement
The new film is … fine. It’s an average Star Wars outing, and it will give families a solid Memorial Day Weekend entertainment option. It’s just not the spectacular home run that might have helped launch the flagging franchise into an exciting new era, and diehard Star Wars fans hoping for more are probably going to be disappointed. Of course, not everyone agrees. “How many nails can we realistically drive into Star Wars’s coffin before it’s time to give up hope of resuscitation?” writes Clarisse Loughrey for The Independent, calling it “the dullest and most inconsequential ‘Star Wars’ ever made.” (She argues that the movie “stitches together what is clearly three episodes of the previously planned fourth season of The Mandalorian and calls it a day. There’s not a whiff of effort here.”)
And a reviewer at RogerEbert.com gave it one-and-a-half stars, complaining that “There’s no reason for anything in this movie except the wish to make even more money….”
I’m on record as despising the word “content,” which was pushed by early tech moguls to devalue art as interchangeable goo in a virtual pipeline, but this washed-out, video-game-looking movie, with its murky night scenes and lack of visual depth, deserves the word. You’ve seen everything in it before, from the equipment, spacecraft, armor, and tactical maneuvers to the species and various types of terrain (earthlike, but cartoony)…
Even Grogu taxes our patience. Some of his cute bits could’ve ended with him facing the camera and doing jazz hands.
Just one year after reaching $800 million in its unrelenting funding spree, Star Citizen has now crossed yet another significant milestone. The overly ambitious space trading and combat simulator, developed by Cloud Imperium Games, has officially raised more than $1 billion from enthusiasts and early backers. Game director Chris Roberts,… Read Entire Article Source link
Diotima received €500,000 under Enterprise Ireland’s Commercialisation Fund last year.
AI edtech start-up Diotima, founded by former secondary school teacher Siobhan Ryan, has spun out from Trinity College Dublin (TCD).
The platform aims to enable educators to use AI to create assessments and individualised feedback to improve learning outcomes and lighten burdens on teachers.
The spin-out will be led by edtech commercialisation specialist Jonathan Dempsey as CEO, with Ryan, also a biochemist and environmental scientist, becoming chief product officer and learning lead.
Advertisement
Development engineer Daniel Fernandez and AI engineer Dr Long Mai, who have both worked on the Diotima project, will also join the inaugural team.
Dr Eoin Lane, an AI regulatory compliance expert who was formerly the global head of AI and data science at the Bank of New York Mellon, is a governance consultant to the Diotima project.
“This all started when I was working as a teacher and I had a vision for how AI could enhance teaching and learning even before any of the models like ChatGPT launched,” said Ryan.
“I then worked with Tom Pollock and Learnovate to develop this vision into a real-world project.”
Advertisement
Diotima began its partnership with Learnovate in February 2025 and received €500,000 in funding under Enterprise Ireland’s Commercialisation Fund, which supports third-level researchers in translating their research into commercially viable solutions.
The idea was to develop an AI-enabled edtech platform to help teachers and other educators create assessments, as well as provide feedback to learners, all in compliance with European and Irish legislation.
Specifically, the platform meets requirements under the EU AI Act, which has strict regulations around the usage of AI in high-risk sectors such as education.
“We aim to position Diotima as a leader in responsible AI for education,” Ryan said. Diotima will continue to engage with prospective customers and stakeholders for a go-to-market strategy while also seeking new investment.
Advertisement
“Using responsible AI, Diotima promises to develop into a revolutionary platform for learners in secondary schools and professional education organisations, delivering formative feedback and better outcomes overall,” said Pollock, Learnovate’s impact, licensing and commercialisation manager.
Learnovate launched its ‘Responsible AI for Learning’ initiative earlier this year to enable AI implementers and practitioners involved in teaching and learning to share knowledge, interpret guidelines and comply with AI regulations.
The initiative is made up of professionals from all four education domains – schools, higher education, vocational education and training, and professional education – as well as representatives from the Department of Education, teaching unions and other sectors.
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.
AI-powered hackers now exploit software flaws faster than companies can patch systems
Mobile phishing scams now outperform traditional email attacks across corporate environments worldwide
Unauthorized AI tools are quietly leaking sensitive company information across global workplaces
For the first time in nearly two decades, exploiting software vulnerabilities has overtaken stolen passwords as the primary way hackers breach corporate networks.
Stolen credentials, once the dominant entry point, have dropped to just 13% of reported incidents this year.
Latest Videos From
Advertisement
Vulnerability exploitation has become the number one threat
The report analyzed over 31,000 security incidents across 145 countries, revealing how the threat landscape has fundamentally shifted.
Attackers are leveraging artificial intelligence to accelerate the discovery and weaponization of known software flaws, which dramatically shrinks the window available for defenders to patch their systems, reducing response time from months to mere hours.
Despite this growing risk, the report found that only 26% of critical vulnerabilities were fully remediated throughout 2025.
The median time organizations took to apply patches jumped to 43 days, leaving networks exposed for weeks or even months.
Advertisement
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
“While the velocity of cyber threats driven by AI is increasing, the foundational principles of security remain the most effective defense,” said Daniel Lawson, SVP of Global Solutions at Verizon Business.
Ransomware was present in nearly half of all breaches, at 48%, up from 44% the previous year.
However, the report noted that ransom payments have declined, with 69% of victims refusing to pay.
Advertisement
Mobile devices have become a more dangerous attack vector than email, with phishing simulations showing that text messages and voice calls achieve 40% higher click rates than traditional email phishing.
The human element was still involved in 62% of all breaches, as attackers increasingly target mobile-centric communication channels where users are less suspicious.
Advertisement
Nearly half of all employees, or 45%, now use AI tools at work, representing a significant increase from just 15% the previous year.
But 67% of these workers access artificial intelligence platforms through unauthorized personal accounts rather than approved corporate channels.
Shadow AI has become the third most common cause of non-malicious data leakage, putting company secrets at significant risk of unintended exposure.
Supply chain attacks have also grown substantially, with third-party involvement in breaches increasing by 60% year-over-year.
Advertisement
The DBIR makes it clear that attackers have shifted their tactics, and most organizations have not kept pace with the speed of modern threat actors.
The fundamentals of security and the use of firewalls or malware removal tools still work, but they only work when organizations actually practice them consistently.
Organizations are advised to patch faster, monitor mobile channels, control AI usage, and assume that third parties will eventually be compromised.
The attackers are already acting on that assumption, and the DBIR numbers prove they are right more often than they are wrong.
You must be logged in to post a comment Login