Organizations with 5,001 to 10,000 employees carry the highest CRI of any size segment at 41.5, exceeding even the largest enterprises. This segment operates with network complexity comparable to organizations above 10,000 employees but typically without the security operations maturity or staffing depth of that scale. The largest enterprises recorded the biggest absolute improvement, falling 3.8 points from 2024 to 40.4, likely reflecting the scale benefits of centralized risk management programs. Organizations with 100 or fewer employees are the only size band to record a CRI increase year-over-year, rising to 32.4, consistent with growing attacker interest in small businesses as entry points into larger supply chains.

Web Reputation Settings tops the endpoint misconfiguration list for the second consecutive year. Anti-Malware Scanning, Predictive Machine Learning, Endpoint Sensors, Firewall, Application Control, and Behavior Monitoring settings are simultaneously unoptimized across thousands of environments. These are not independent gaps: each weakness compounds the others. In cloud environments, Application Control Settings, Firewall Settings, and Log Inspection Settings top the cloud misconfiguration list, pointing to a persistent gap between deployment and operationalization of cloud workload protection.

Possible Disabling of Antivirus Software tops the XDR model hits list in 2025, displacing Possible OS Credential Dumping from the position it held in 2024. The shift suggests adversaries have moved toward neutralizing endpoint defenses as a first-stage objective rather than attempting to evade them. Registry Run Key Creation in Temp Location, Backdoor File Detection, and Hacking Tool detections follow in the top 10, tracing a consistent attacker sequence: disable defenses, establish persistence, escalate privileges, move laterally.

All 10 of the most detected unpatched Common Vulnerabilities and Exposures (CVEs) are from 2025. Remote Code Execution (RCE) vulnerabilities—including CVE-2025-24035 (Windows Remote Desktop Services, 8.1 High) and CVE-2025-21376 (Windows Lightweight Directory Access Protocol, or LDAP, 8.1 High)—enable attackers to execute arbitrary code remotely. Elevation of Privilege (EoP) vulnerabilities—including CVE-2025-24044 (Windows Kernel-Mode Driver, 7.8 High) and CVE-2025-21420 (Windows system utilities, 7.8 High)—provide the escalation pathway from initial foothold to full system control. Unpatched RCE and EoP vulnerabilities in the same environment provide attackers with a complete compromise pathway.

Three of the top 10 CVEs carry medium severity scores: CVE-2025-24992 (5.5), CVE-2025-21247 (4.3), and CVE-2025-21377 (6.5). None are independently critical, but each may directly enable the high-severity exploits on the same list—enabling local information disclosure, bypassing content security, or disclosing NTLM hashes for lateral movement. Organizations that deprioritize these based on Common Vulnerability Scoring System (CVSS) score are leaving in place the conditions that make high-severity exploits more reliable.

TrendAI™ TippingPoint™ data suggests virtual patching can help bridge the gap: the average virtual patch lead time for 2025 vulnerabilities sits at 115 days from discovery, while attackers weaponize known vulnerabilities in an average of 39 days from public disclosure. Because discovery always precedes disclosure, virtual patching can provide a window of protection before a vulnerability becomes publicly known and actively targeted. The risk is treating virtual patching as a substitute for formal patching rather than a bridge to it.

This year's report introduces telemetry from the TrendAI Vision One™ Attack Path Prediction capability, which models the chained sequences adversaries follow from an initial foothold through to a high-value target. Where the Cyber Risk Index measures current exposure, Attack Path Prediction simulates how that exposure may be exploited. Because full-year 2025 data was not yet available, this section should be read as a directional view of emerging patterns rather than a complete annual measurement.

Unpatched vulnerabilities are the single largest source of active attack paths, appearing at the head of 2,317,503 predicted paths, about 15% more than the combined total of the next two categories. Password spraying (1,135,327 paths) and password guessing (880,527 paths) rank second and third, feeding directly on the identity hygiene failures documented throughout this report.

Public IP addresses are the most common entry point asset type, averaging 4,979 assets per day. Domain assets—Domain Name System (DNS) hostnames attached to those IP addresses—average 2,781 per day, together defining the perimeter exposure dimension of attack path initiation. At the other end of the chain, user accounts are the most common terminal target, averaging 32,964 targeted assets per day, nearly double the second-ranked asset type (devices, at 18,445). The identity risks that elevate CRI scores appear to be the same conditions that make user accounts the preferred destination for adversary attack chains.

Total confirmed ransomware breaches across the top 10 groups grew from 1,518 in 2024 to 5,096 in 2025. Five groups enter the top 10 for the first time: INC Ransom (558 breaches), SafePay (509), Lynx (279), DragonForce (264), and Sinobi (252). LockBit, ranked second in 2024, has dropped off the top 10 entirely following law enforcement disruption. RansomHub fell from first in 2024 to tenth in 2025 with 213 breaches.

Qilin (detected by TrendAI™ as Agenda) climbed from last place in 2024 to first in 2025 with 1,262 confirmed breaches, a 1,270% increase. It operates as a ransomware-as-a-service platform, meaning its growth reflects an expanding affiliate network. Akira grew from 106 to 857 breaches, a 708% increase, making it the second most active group. The rapid entry of multiple new groups at scale suggests that disrupting established ransomware operations redistributes rather than reduces the overall threat.

The consistent pattern across this report's findings is not a technology gap but an operationalization gap. Misconfigurations persist in solutions capable of enforcing optimal settings. Identity risks accumulate in platforms capable of automating account lifecycle management. Medium-severity CVEs are deprioritized despite their documented role in enabling high-severity exploits. The TrendAI Vision One™ Cyber Risk Exposure Management (CREM) solution provides continuous attack surface visibility, unified risk scoring, XDR-powered detection and response, and automated remediation. Organizations that made the most measurable progress in 2025 are those that moved from periodic security reviews to continuous, intelligence-led risk management.