1010.cx

  • New React RSC Vulnerabilities Enable DoS and Source Code Exposure

    ·

    The React team has released fixes for two new types of flaws in React Server Components (RSC) that, if successfully exploited, could result in denial-of-service (DoS) or source code exposure. The team said the issues were found by the security community while attempting to exploit the patches released for CVE-2025-55182 (CVSS score: 10.0), a critical bug in RSC that has since been weaponized in

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • React2Shell Exploitation Escalates into Large-Scale Global Attacks, Forcing Emergency Mitigation

    ·

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urged federal agencies to patch the recent React2Shell vulnerability by December 12, 2025, amid reports of widespread exploitation. The critical vulnerability, tracked as CVE-2025-55182 (CVSS score: 10.0), affects the React Server Components (RSC) Flight protocol. The underlying cause of the issue is an unsafe deserialization

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • CISA Flags Actively Exploited GeoServer XXE Flaw in Updated KEV Catalog

    ·

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a high-severity security flaw impacting OSGeo GeoServer to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation in the wild. The vulnerability in question is CVE-2025-58360 (CVSS score: 8.2), an unauthenticated XML External Entity (XXE) flaw that affects all versions prior to

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • There’s a divide within the Space Force. Congress is forcing the service to address it

    ·

    A year ago, the leaders of the House Armed Services Committee put the Space Force on notice. The service, they said, was putting too much focus on its operators and not enough on its acquisitions corps—an imbalance that might ultimately harm the U.S. military's ability to preserve its edge in space.

    “We fear a divide that elevates operators at the detriment to other core functions of the Space Force will have negative impacts, potentially not immediately, but as we look to 2030 and beyond,” Chairman Rep. Mike Rogers and ranking member Rep. Adam Smith wrote in a December 2024 letter to the service. Later that day, Rogers told a think-tank audience that “for the Space Force, and the joint force to succeed, we must have guardians that are just as comfortable operating in space as they are breaking down a requirements document.”

    Since then, the divide has only gotten worse, according to lawmakers, guardians, and others in the defense, policy, and Congressional spheres. One military policy expert described the split between operators and acquisition officers as “an ongoing fight for the core culture of the Space Force.” 

    This week, the House passed the compromise 2026 National Defense Authorization Act, which contains a section requiring the Space Force to train and assign an equal number of operations and acquisition officers.

    “Things have not improved,” a source familiar with the committee process told Defense One. “A year later, this being in the NDAA indicates that there's still an issue.”

    A service divided

    It’s an issue that long predates the Space Force itself, which will celebrate its sixth birthday later this month.

    In 2001, the “Rumsfeld Report” suggested that merging at least some of the military’s far-flung space-related organizations would enable leaders to better set priorities and seize opportunities. The acquisitions-focused Space and Missile Systems Center was consequently removed from Air Force Materiel Command and placed under Air Force Space Command. That made AFSC the only one of the service’s nine major commands to house both operators and acquirers. 

    “You had a tension built into Air Force Space Command, right from the start, which was ‘what voice really matters?’,” said Paula Thornhill, a retired Air Force brigadier general-turned-professor at Johns Hopkins University. “This tension has always been there.”

    The tension was perceived as a danger to the military’s ability to maintain its edge in space.

    “There was this historical chip on the shoulder and the belief that ‘operators were supposed to be the kings and acquirers are supposed to be the servants’ and that is, unfortunately, not how space works,” one Space Force insider said.

    In 2019, Air Force Space Command became the Space Force, in large part to unite space-related acquisition and operations workforces under a service branch—and to merge the tribes.

    “When we were first standing up Space Force, a primary goal was to establish a culture without the tribalism often seen in the other services, while still developing the demanding technical skill sets needed to be an effective warfighting force,” said John Shaw, a retired Space Force lieutenant general and former deputy head of Space Command. 

    Initially, leaders had visions of “badgeless” officers who could handle both acquisitions and operations, but this never came to fruition, defense experts and service insiders said.

    Part of the problem was that the troops who made up the Space Force in its earliest months and years came not just from the Air Force but from space-related units all over the military. Another part was that several space-related functions remained in the Air Force proper or in the newly reconstituted U.S. Space Command, a combatant command. Both hindered the development of a single culture within the new service branch.

    “The establishment of the USSF, U.S. Space Command, and other changes in how DoD organizes for space…will continue to affect the development and fielding of space capabilities and forces, the execution of operations, and how services and combatant commands unite service components into a joint force,” RAND researchers wrote in 2024. "These major organizational changes are still unfolding and will have implications for the [Department of the Air Force]. DAF senior leaders will have to navigate and understand these changes to inform its approach to long-term air-space integration.”

    In September 2024, the Space Force opened a new Officer Training Course, a 12-month program for officers joining the service. Officials hailed it as a unifying experience where “officers learn to be a guardian first and specialist second.”

    But the course has an operational bent, with acquisition largely left for subsequent specialist training, insiders said. And the first assignment for OTC graduates is in operations; officers who want ultimately to pursue careers in acquisition must wait.

    "I know what I'd do if the [Department of the Air Force] paid for my shiny new engineering degree, then sent me to a year of non engineering training then a tour of non engineering work. I'd leave as soon as it's over," read one post on a Space Force subreddit.

    One defense expert said the tilt was widely perceived to reflect the priorities of the service’s top officer: Chief of Space Operations Gen. Chance Saltzman, a career operator who has served as an ICBM launch officer and a National Reconnaissance Office satellite controller. 

    In his December 2024 speech at CSIS, Rogers praised Saltzman and his predecessor, Gen. John Raymond—another longtime operator. But the HASC chairman pointedly warned that acquirers need a voice in leadership as well.

    “The Space Force has to be led by more than just operators,” Rogers said. “They must recognize the contributions of all career services if it is to be successful. A deep understanding and connection with technology is at the core of the Space Force. Operators, acquisition, intel, and cyber professionals must all be on equal footing. The future of the Space Force will depend on its ability to both nurture these unique specialties and tribes, while also creating a unified fighting force.”

    2025

    Saltzman has vigorously answered Defense Secretary Pete Hegseth’s calls to “restore a warfighting ethos” across the military. In public remarks, policy documents, and memos to the force dubbed “C-Notes,” the CSO has urged guardians to embrace an operational focus and warfighting identity. In June, he left his Space Operations Badge off for his official military portrait, a deliberate move intended to convey the idea that all Space Force troops are operators.

    “Contesting a physical domain is a complex endeavor—it takes a purpose-built service to do so effectively,” Saltzman wrote last month. “It also requires service members who have a deep understanding of military operations specific to their domain.”

    Thornhill, the Johns Hopkins professor, said those shifts are unsurprising, given Hegseth’s purges of top officers.

    “If that's what the Secretary's pushing, and you want to keep your job in an environment where you've seen a dozen flag officers fired, you better be talking about lethality and war fighting,” she said.

    In May, the acquisition corps lost a key voice atop the Space Force, seemingly bearing out Rogers’ warning. Vice Chief of Space Operations Gen. Michael Guetlein, an acquisition specialist, was transferred to a new Pentagon job: implementing the sprawling vision of the Golden Dome missile defense system.

    “There has been a growing animosity between the operators and the acquirers, and that friction kind of reached its apex between Saltzman and Guetlein,” one defense expert said.

    Guetlein’s replacement, Gen. Shawn Bratton, has an operations background: he has served as Space Command’s deputy director for operations and the first head of Space Training and Readiness Command. 

    “The problem is now you have two folks who were both heritage operators,” a Space Force insider said. “So, now you don't have anybody who represents the acquisition side of the service in the front office.”

    Guetlein departed just as the Space Force’s acquisition corps was beginning to reel from Hegseth’s hasty push to shed tens of thousands of Defense Department civilians in the name of efficiency. By May, the service had lost 14 percent of its civilian employees, many of whom worked closely with the uniformed acquisition specialists. In September, Saltzman estimated that Space Systems Command alone was likely to lose 10 percent of its workforce.

    Industry has taken notice of the strain. 

    “You can tell that they’re stressed,” Kay Sears, a Boeing Space vice president, said at a think-tank event last month. “You can tell that they’re overworked.”

    But the Space Force insider said Saltzman has some reason to be frustrated with his service’s acquisition performance. 

    “Certainly the acquirers in the Space Force haven't done a great job of doing well by him either,” the insider said. “They can't deliver anything on time, which is a whole different problem.”

    The Space Force’s next-generation Overhead Persistent Infrared missile warning satellite, first announced in 2018, has slipped its initial 2023 launch date estimate to March 2026. The decades-long and multi-billion dollar Next Generation Operational Control System program for GPS has been highly scrutinized as a “poster child for broken space acquisition programs.” The Space Development Agency’s missile warning and tracking satellites have experienced repeated delays. 

    Efforts to fix the divide

    The Space Force has made several changes to increase cooperation and make peace between the acquisitions and operations camps. 

    In August, it created Systems Delta, a new command structure meant to increase communications between program offices and operations-focused mission deltas.

    In September, Saltzman announced that graduates of the Officer Training Course who choose a career in acquisition can attend a 10-week “first of its kind” Acquisition Initial Qualification Training course. 

    The CSO also took pains to tout his acquisition corps.

    “The Space Force, by percentage, has by far the largest acquisitions workforce of any service.  Uniformed guardians in acquisitions roles make up over 49% of our officer corps,” he said in his speech at the Air & Space Force Association conference. “Space acquisitions is one of the most intricate professions on – or off – the planet, and it can take years to master.  At the pace the Joint Force is demanding our capabilities, we will need an expert workforce to deliver.”

    Last month, nine operations officers from intelligence, cyber, and space backgrounds graduated from the first AIQT course, a service spokesperson said. Those officers will be assigned to program and engineering technical management roles.

    And more acquisition coursework is being added to the one-year OTC course, which currently spends two weeks on the topic, Maj. Kaitlin D. Holmes, an Air Force spokesperson, confirmed to Defense One.

    “The Space Force continues to iterate the OTC curriculum to increase the acquisitions segment and better integrate all segments, as opposed to teaching all segments separately in silos,” Holmes wrote.

    What comes next

    On Thursday, the House passed the NDAA with the section requiring the Space Force to train and assign an equal number of operations and acquisition officers. The bill now awaits passage by the Senate and signature by President Trump.

    Once that happens, the Air Force secretary will have two months to submit a report giving the number and percentage of the service’s officers in both career fields and detailing “any identified shortfalls or imbalances in acquisition manning relative to operational manning in the Space Force; and actions taken or planned to achieve and sustain comparable manning levels for billets in acquisition and operations,” the NDAA reads. New versions of the report will be due each Oct. 31 through 2030.

    The bill also requires quarterly briefings by the secretary to the HASC and its Senate counterpart on these topics and on “the development of the curriculum” to balance acquisition and operations focus.

    Shaw, the former deputy head of Space Command, applauded the changes to OTC and called for more efforts to give equal attention to operations and acquisitions.

    “The challenge will be developing effective career paths for officers and enlisted that continue to grow needed expertise in space operations, intelligence, cyber, and acquisition, while avoiding tribalism,” he said.

    All this will not be quick or easy, but it must remain top of mind for service leaders, the Space Force insider said.

    “Until we fix this, we are going to continue to fall behind,” the insider said. “This is not a problem we're going to fix easily. This is something we have to focus on over the years in order to go ahead and correct.”

    Air Force and Space Force spokespeople did not respond when asked about the NDAA language or the implications of a divide between the service’s operators and acquirers.

    A Space Force officer told Defense One that the space force has talented service members, and hopes that prioritizing a like-minded mission will create unity, no matter what background or experience a guardian comes from.

    “We can do both [missions] even better than we are today, but we do both well, and that cultural aspect of building space-minded guardians who think about these things from the beginning of their career is going to pay long-term dividends,” the officer said. “We need to grow people that think about the domain differently, and we can do that both in acquisitions, engineering and operations under the Space Force.”

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ‘Enemy from within’? NORTHCOM commander says he hasn’t seen it

    ·

    The military commander overseeing National Guard deployments in Los Angeles, Portland, and Chicago told lawmakers Thursday that he had no intelligence to suggest the military is facing an “enemy within,” in contrast to statements the president made during a September speech at Marine Corps Base Quantico.

    Members of the Senate Armed Services Committee questioned Air Force Gen. Gregory Guillot, head of U.S. Northern Command, as well as a top Pentagon lawyer and the Defense Department’s deputy assistant secretary for homeland security and Americas security affairs during a hearing on the recent deployment of National Guard troops to U.S. cities. Several of those deployments have been deemed illegal in federal court.

    In September, Trump told an auditorium full of the nation’s top military officers, “We should use some of these dangerous cities as training grounds for our military National Guard.” He added that “this is going to be a big thing for the people in this room, because it's the enemy from within, and we have to handle it before it gets out of control.”

    But Guillot said he has not been tasked with any domestic military operations against an “enemy from within,” and he doesn’t “have any indication of an enemy within.”

    Mark Ditlevson, the Pentagon’s homeland defense official, described the deployments as a “modest burden” on the National Guard, while committee Chairman Sen. Roger Wicker, R-Ala., said concerns about cost and readiness “are both manufactured and misguided.”

    “In my judgment, mobilizing the Guard is an excellent opportunity for units to enhance cohesion, complete mission-essential tasks and ensure training is complete,” he added.

    Democratic lawmakers argued that the true cost is less time spent training for military missions, particularly among the troops deployed to Washington, D.C., who have been tasked with “beautification.”

    “The National Guard has been performing missions that don't help with their military training, like spreading mulch and picking up trash,” Army veteran Tammy Duckworth, D-Ill., said, “but that as we have sadly seen, nonetheless, carry risk for our service members,” referring to two West Virginia Guardsmen who were shot, one of whom died, while standing guard outside a Metro station late last month.

    Duckworth went on to question the administration’s assertions that the deployments are about restoring “law and order” in cities run by Democrats.

    “If this administration cared about law and order, it would not be ignoring the growing number of judges, including those appointed by Trump himself, who've deemed these deployments illegal,’ she said. “In Illinois, a judge from the Northern District found that the [Homeland Security Department] account of the situation on the ground, and I quote, ‘was simply unreliable.’"

    Judges in California, Oregon, Illinois, and D.C. have all ruled the deployments illegal, but the administration has sought appeals that have allowed troops to stay in place. 

    “I fear the day when Americans stop thanking our troops for their service because they're afraid of our troops,” Duckworth said. “We know that this administration is trying to borrow the respected image of the military. Across the country, the DHS agents are dressing in camouflage and wielding military-style weapons. They're making it hard for Americans to tell the difference between abusive federal agents and professional troops.”

    Sen. Angus King, I-Maine, questioned whether the emergencies Trump has declared to justify sending in troops are truly occurring.

    “We have a president who has a very low bar as to what constitutes an emergency,” he said. “I live in Maine, on the border of Canada—there is no emergency with Canada, and yet this president declared an emergency in order to impose tariffs on Canada, which is wrecking their economy.”

    Though lawmakers have differing views of the deployments along party lines, there was bipartisan agreement on one thing.

    “By the way, Counselor, the organization that you work for is the Department of Defense,” King told Charles Young, the deputy Pentagon counsel, responding to the official’s repeated use of the term War Department, an alternative Trump administration name that hasn’t been approved by Congress.

    The most recent version of the National Defense Authorization Act, the traditional venue for any changes to Pentagon policy, does not include a name-change provision.

    "Thank you for repeatedly making that point, Senator,” Wicker said. 

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The D Brief: US seizes tanker; House passes $901B NDAA; US pushes business-centered ‘peace plan’; Chipping away at US AI edge; And a bit more.

    ·

    Dozens of U.S. troops seized a tanker ship allegedly transiting oil to Iran from Venezuela, President Trump announced Wednesday. “We've just seized a tanker on the coast of Venezuela, large tanker, very large, largest one ever, actually, and other things are happening,” the president said. Asked what will happen next, he replied, “We keep it, I guess.”

    Attorney General Pam Bondi later shared a video of the seizure on social media. “For multiple years, the oil tanker has been sanctioned by the United States due to its involvement in an illicit oil shipping network supporting foreign terrorist organizations,” Bondi said. 

    Venezuelan officials called it “an act of international piracy” and “blatant theft,” while Iranian officials called it a “grave violation of international laws and norms,” Reuters reports. The vessel—reportedly known as “Skipper”—was falsely flying a flag from Guyana, that country’s maritime officials said afterward. 

    Analyst reax: “Seizing this tanker further inflames…supply concerns but also doesn't immediately change the situation fundamentally because these barrels were already going to be floating around for a while,” Rory Johnston of Commodity Context said, according to Reuters. 

    Context: U.S. forces in the region have amassed their largest troop and naval buildup since the Cuban missile crisis as the Trump administration attacks alleged drug-trafficking boats off the Latin American coast—and White House officials apply pressure on Venezuelan dictator Nicholas Maduro to step down. The boat strikes have so far killed more than 80 people in a naval campaign that eschews due process, causing critics to warn at least some of the attacks could constitute war crimes.  

    Additional reading: 

    Welcome to this Thursday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson and Bradley Peniston. It’s more important than ever to stay informed, so thank you for reading. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1972, Apollo 17 became the sixth and last time humans landed on the Moon.

    On the Hill

    Update: House passes $901 billion NDAA, 312-112. “Fiscal hawks were also not happy that the bill had a top line of about $8 billion more than the $892.6 billion that President Trump requested in May,” but the bill still advanced through the lower chamber on Wednesday, The Hill reports. The Senate is expected to pass the bill sometime next week. 

    Second opinion: While the bill contains provisions for “military construction projects that will improve quality-of-life infrastructure—barracks, housing, and Child Development Centers, including one at Travis Air Force Base,” the NDAA “does not do enough to reinforce Congress’s role as a co-equal branch responsible for matters of war and peace,” Rep. John Garamendi, D-Calif., and member of the House Armed Services Readiness Subcommittee, said in a statement. However, “this Administration is dangerously close to dragging us into a disastrous and unauthorized war” in Venezuela, “eroding our military’s readiness while advancing their authoritarian ambitions,” he warned. 

    “Meanwhile, Congress hasn’t held a public hearing since July and most Americans haven’t seen the videotape of the double-tap strike in Venezuela. And when we have demanded oversight, the Republican majority and Trump’s Pentagon have delayed and obstructed it,” he continued. “Congress can fix this. Sadly, this bill does not rise to the moment.” 

    And: Trump officials allegedly took more than $2 billion earmarked for the U.S. military and diverted it to immigration-related actions. These include flights to Guantanamo Bay and Djibouti, as well as National Guard deployments to Illinois and Oregon that judges later deemed illegal, 13 Democratic lawmakers said in a new report (PDF).  

    Those costs could rise, the lawmakers warn. “The exact cost of these operations remains unclear, including the actual cost of mobilizing and deploying National Guard troops to American cities, the total cost of deporting and transporting noncitizen detainees on military aircrafts, the cost of detaining individuals on U.S. military installations, and more,” according to the report, which notes “the vast majority of these funds have not been reimbursed by the Department of Homeland Security.” 

    “The diversion of DoD resources is adversely impacting military readiness and servicemembers’ quality of life, while simultaneously diminishing the National Guard’s capacity to respond to disasters and other emergencies in their home states,” including funds diverted from “training programs, barracks repairs, and even repairs for elementary schools.” Read more, here. 

    Troops in US cities

    NORTHCOM’s Gen. Gregory Guillot is testifying on Trump’s deployment of National Guard troops in multiple U.S. cities. Guillot is joined by Defense Department counsel Charles Young and Principal Deputy Assistant Secretary of Defense for Homeland Defense and Americas Security Affairs Mark Ditlevson. 

    All three witnesses appear to have submitted the same joint statement (PDF) for their pre-hearing witness testimony. “Unfortunately, the President and his Administration inherited a troubling state of lawlessness at home and are fully committed to ensuring the American people are safe and secure,” the three men say in that document. 

    “Confronted with an intolerable risk of harm to Federal agents and coordinated, violent opposition to the enforcement of Federal law” when the administration launched its immigration crackdowns across the country—starting in Los Angeles—last spring, “the President invoked power delegated to his office by Congress to utilize the National Guard to safeguard Federal personnel, property, and functions on June 7, 2025,” Guillot, Young and Ditlevson write. “Since that time, the National Guard has been mobilized in California, Illinois, and Oregon under title 10 authorities.” 

    They also note troops have been sent to Washington, D.C., which a judge deemed illegal but an appeals court stayed temporarily last week, as well as Memphis, Portland, and Chicago. Last month, a state judge in Tennessee temporarily blocked that deployment, which triggered an appeal by state officials. Guard deployments to Portland and Chicago were also deemed unconstitutional by district judges after state officials objected, describing the troops’ presence as unnecessary. Administration officials are also eyeing Guard deployments to New Orleans, though troops have not yet been sent there. 

    And this week, a district judge ordered an end to the Guard deployment inside LA, excoriating the White House for what he described as an attempt to wield “unchecked power to control state troops [that] would wholly upend the federalism that is at the heart of our system of government.” 

    “The founders designed our government to be a system of checks and balances. Defendants, however, make clear that the only check they want is a blank one,” the judge wrote in his Wednesday ruling, which he put on hold until Monday as the White House is expected to appeal. 

    Stay tuned for later reporting out of today’s Guard hearing before the Senate Armed Services Committee. 

    Additional reading: 

    Europe

    The U.S. is pitching plans to boost investment in Russia. Europe isn’t having it. Late last month, the Wall Street Journal revealed how a Putin envoy pitched a Ukraine peace plan to Trump envoy Stephen Witkoff and son-in-law Jared Kushner: end the war with Russian gains, then invest in projects in Russia. 

    Now the Trump administration has handed European counterparts “a series of documents, each a single page,” proposing to end the war and touch off a broad re-opening of Russia to foreign business. “The clash at the negotiating table is now not just about borders but increasingly about business—and in a twist, pits not just Russia against Ukraine but the U.S. against its traditional allies in Europe.” the WSJ reported on Wednesday. 

    European officials say this could give Russia the reprieve it needs “to rev up its economy and make itself militarily stronger. A new assessment by a Western intelligence agency, reviewed by the Journal, said that Russia has technically been in recession for six months and that the challenges of running its war economy while trying to control prices are presenting a systemic risk to its banking sector.” Read on, here.

    Video explainer: “Why Russia Won’t Agree to Peace Without Ukraine’s ‘Fortress Belt’,” from the WSJ.

    Danish intelligence report: U.S. is our closest ally…and possibly a threat. “If you’ve been following what has happened over the past few months, you can see why the Danes feel they have to recognize that something is changing,” said Elisabeth Braw, a senior fellow at the Atlantic Council, told the New York Times. Read on, here. 

    NATO official pushes back on NSS. Countries looking to join NATO are still welcome to apply, a top alliance official said Wednesday in tacit repudiation of the Trump administration’s recent declaration that the group must not be a “perpetually expanding alliance.”’ Defense One’s Meghann Myers reports, here.

    Trump 2.0

    U.S. greenlights sale of advanced chips to China, neutralizing a key advantage in AI development. NYT on Tuesday: “President Trump’s decision to allow Nvidia to sell its chips to China has raised questions about whether he is prioritizing short-term economic gain over long-term American security interests.”

    Additional reading:

    • “Trump's Nvidia move could help China win the AI war, analysts say,” reports Quartz, adding: “Policy experts say Trump’s Nvidia plan weakens America’s only clear advantage in AI compute.”
    • ICYMI: A year ago, Peter Singer and analysts from BluePath Labs explained why China remains dependent on Western chips for AI—and how that gives the United States leverage.

    Back in the States: Elon Musk says DOGE was only “somewhat successful.” Would he do it again? “I don’t think so,” the world’s richest man told an interviewer. “Instead of doing DOGE, I would have, basically, built … worked on my companies.” AP reports, here.

    Related: OPM says 92% of fed departures this year were voluntary. Those who left disagree. That’s the headline from GovExec, reporting on reactions to a social-media thread from Office of Personnel Management Director Scott Kupor. One former worker: “I ‘voluntarily’ chose to leave the most amazing job I could ever have as a scientist because of the toxic environment the administration made for us federal employees.” Read on, here.

    ICYMI: DOD has said 60K civilians have left, but refused to give more details. Review that, here.

    And introducing: The Defense Business Brief

    The defense industry is booming, and Defense One has a new weekly newsletter to tell you what’s happening and what’s next. Learn something new each Wednesday with the Defense Business Brief. 

    Produced by Business Editor Lauren C. Williams, DBB explores the makers, buyers, and sellers of defense technology, the money behind it and why it all matters. Read the first edition, here.

    ]]>

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • 2025 Cybersecurity Almanac: 100 Facts, Figures, Predictions And Statistics

    ·

    The past, present, and future of cybercrime. Brought to you by Evolution Equity Partners

    – Steve Morgan, Editor-In-Chief

    Sausalito, Calif. – Dec. 11, 2025

    If it were measured as a country, then cybercrime — which is predicted to inflict damages totaling $10.5 trillion USD globally in 2025, according to Cybersecurity Ventures — would be the world’s third-largest economy after the U.S. and China, surpassing the wealth of entire nations.

    Cybersecurity Ventures is excited to release this special fifth annual edition of the Cybersecurity Almanac, a handbook containing the most pertinent statistics and information for understanding cybercrime and the cybersecurity market.

    We have something for everyone, including students, parents, academia, government, law enforcement, small-to-midsized businesses, Fortune 500 and Global 2000 companies, IT workers, cybersecurity experts, chief security officers, the boardroom, and C-suite executives.

    The latest edition of the Cybersecurity Almanac provides an enlightening journey into noteworthy security incidents and the hackers behind them, as well as a comprehensive overview of critical historical dates, insightful statistical information, the cyberdefense landscape, cybersecurity investment trends, and more.

    CYBERCRIME DAMAGE

    • Cybersecurity Ventures expects global cybercrime costs to grow by 15 percent per year over the next two years, reaching $10.5 trillion USD globally this year and $12 trillion USD annually by 2031, up from $3 trillion USD in 2015. This represents the greatest transfer of economic wealth in history, risks the incentives for innovation and investment, is exponentially larger than the damage inflicted from natural disasters in a year, and will be more profitable than the global trade of all major illegal drugs combined.
    • The average global costs of a data breach, according to an IBM report, dropped to $4.44 million USD—down 9 percent from the year prior. The catalyst is faster breach containment driven by AI-powered defenses. Organizations were able to identify and contain a breach within a mean time of 241 days, the lowest it’s been in nine years. Yet this progress comes with a caveat: the very speed of AI and automation deployment that’s helping organizations defend better is also creating new risks. The 2025 cost is still up from $3.86 million USD in 2020.
    • Following three years of intensive research, an international team of researchers have compiled the first ever ‘World Cybercrime Index’, which identifies the globe’s key cybercrime hotspots by ranking the most significant sources of cybercrime at a national level. The Index, published in Apr. 2024, shows that a relatively small number of countries house the greatest cybercriminal threat. Russia tops the list, followed by Ukraine, China, the U.S., Nigeria, and Romania. The U.K. comes in at number eight.
    • Reporting practices concerning illegal cyber activity have improved, but in 2025, we are still faced with a situation where Cybersecurity Ventures predicts that less than 25 percent of cybercrimes committed globally are reported to law enforcement, up from less than one in seven cybercrimes that were reported in 2018, according to the U.S. Department of Justice.
    • “Across the country we’re seeing increasingly sophisticated cybercrime being conducted by people who are younger and younger and younger,” said William McKeen, a supervisory special agent with the FBI’s Cyber Division, at a security conference in San Francisco last year. “It is terrifying.” He said the average age of anyone arrested for a crime in the U.S. is 37, while the average age of someone arrested for cybercrime is 19.

    WHAT’S AT RISK

    • Cybersecurity Ventures estimates that around half of all cyberattacks globally strike small businesses, and it’s been reported in various media outlets over the past decade that 60 percent of small companies go out of business within six months of falling victim to a data breach or cyberattack.
    • A survey conducted in Oct. 2025 for Mastercard by the Harris Poll of 13,077 adults across 13 countries revealed that younger people are more likely to fall for online fraud, that people would feel too ashamed to report the crime, and, perhaps most worryingly, that nearly 60 percent say that fraud is so pervasive that being scammed is simply inevitable. Seven of 10 respondents said that it’s harder to secure their information on digital platforms than it is to secure their own home.
    • Roughly one million more people join the internet every day. There were around 6 billion people connected to the internet interacting with data in 2022, up from 5 billion in 2020 — and we predict there will be more than 7.5 billion internet users in 2030. If street crime grows in relation to population growth, so will cybercrime.
    • Total global data storage is projected to exceed 200 zettabytes by 2025. This includes data stored on private and public IT infrastructures, on utility infrastructures, on private and public cloud data centers, on personal computing devices — PCs, laptops, tablets, and smartphones — and on IoT (Internet-of-Things) devices. Cybersecurity Ventures predicts that the total amount of data stored in the cloud — which includes public clouds operated by vendors and social media companies (think Apple, Facebook, Google, Microsoft, X, etc.), government-owned clouds that are accessible to citizens and businesses, private clouds owned by mid-to-large-sized corporations, and cloud storage providers — will reach 100 zettabytes by 2025, or 50 percent of the world’s data at that time, up from approximately 25 percent stored in the cloud in 2015.

    RANSOMWARE

    • The global cost of ransomware was predicted to reach $20 billion USD in 2021, up from $325 million USD in 2015. Cybersecurity Ventures expects ransomware damage costs to exceed $265 billion USD annually by 2031.
    • Cybersecurity Ventures predicted that a business fell victim to a ransomware attack every 11 seconds in 2021, up from every 14 seconds in 2019. The frequency of ransomware attacks on governments, businesses, consumers, and devices will continue to rise over the next seven years and hit every two seconds by 2031.
    • CNA Financial made the biggest ransomware payout on record. The Chicago-based company paid $40 million USD to the Phoenix cybercriminal group, believed to come from Russia.
    • Verizon’s 2025 Data Breach Investigation Report (DBIR) found that 44 percent of all breaches analyzed showed ransomware was present, marking a notable rise from last year’s report. Ransomware is also disproportionally affecting small organizations. In larger organizations, Ransomware is a component of 39 percent of breaches, while SMBs experienced Ransomware-related breaches to the tune of 88 percent overall.
    • Ransomware complaints to the FBI’s Internet Crime Complaint Center (IC3) increased 9 percent year over year with 3,156 being posted in 2024 up from 2,825 and was called the most pervasive threat to critical infrastructure. For the year, the top five most active ransomware groups were Akira, LockBit, RansomHub, FOG, and PLAY, the report noted.

    CRYPTOCRIME

    • Cryptocrime, including exit scams, rug pulls, and theft is predicted to cost the world $30 billion USD in 2025, Cybersecurity Ventures predicts, rising at a rate of around 15 percent annually. This is more than twice the record-setting (at the time) $14 billion USD lost in 2021, according to a report from blockchain research firm Chainalysis.
    • Major media outlets globally reported on Feb. 21, 2025 that a $1.5 billion (USD) hack of the Bybit cryptocurrency exchange was a record-setting cyberattack. The attack has been linked to North Korea’s Lazarus group, a state-sponsored hacking collective. Prior to that, the largest cryptocurrency hack to date was conducted in Mar. 2022 and targeted the network that supports the popular Axie Infinity blockchain gaming platform. Hackers breached the Ronin Network and made off with around $625 million worth of Ethereum and the USDC stablecoin. U.S. officials said that the Lazarus Group was linked to the theft.
    • Perhaps no entity better illustrates the professionalization of the cryptocrime ecosystem than the online marketplace Huione Guarantee, according to the Chainalysis 2025 Crypto Crime Report. Huione and all vendors operating on their platform have processed more than $70 billion in crypto transactions since 2021. This platform has provided infrastructure which facilitates the sale of scam technology and processed on-chain transactions for pig butchering and other fraud and scams, addresses reported as stolen funds, sanctioned entities such as the Russian exchange Garantex, fraud shops, child sexual abuse material, and Chinese-language gambling sites and casinos, among others.
    • At least $28 billion tied to illicit activity has flowed into crypto exchanges over the last two years, according to an examination by the International Consortium of Investigative Journalists, The New York Times and 36 other news organizations around the world. The money came from hackers, thieves and extortionists. These groups have moved money onto the world’s largest exchanges, which are online marketplaces where people can convert U.S. dollars or euros into Bitcoin, Ether and other digital coins.
    • In Jan. 2024, hackers stole around $112 million of the Ripple-focused cryptocurrency XRP from a crypto wallet, Ripple’s co-founder and executive chairman had disclosed. Ripple’s Chris Larsen said at the time that the stolen crypto was his, which would make it one of the largest hacks on an individual. He wrote on X that “there was unauthorized access to a few of my personal XRP accounts (not Ripple) — we were quickly able to catch the problem and notify exchanges to freeze the affected addresses. Law enforcement is already involved.”

    RECENT MAJOR HACKS

    • Roku said hackers gained unauthorized access to 576,000 accounts, the company’s second data-breach incident this year, prompting the streaming-hardware maker to institute additional security measures for users. In an Apr. 2024 blog post, Roku said the hackers likely gained access to the accounts by using usernames and passwords from other sites where customers may have used the same login credentials. This type of automated cyberattack is known as credential stuffing. San Jose, Calif.-based Roku has a user base of 80 million.
    • Major London hospitals had to cancel operations and blood transfusions after being hit by a cyberattack that led to them declaring it a “critical incident” in Jun. 2024. Seven hospitals suffered serious disruption to their services as a result of a ransomware attack targeting a private company that analyses blood tests for them. More than 800 planned operations and 700 outpatient appointments were rearranged in the first week after the attack. The cyber assualt also prompted an urgent call for blood donations.
    • In Jun. 2024, as many as 165 customers of cloud storage provider Snowflake have been compromised by a group that obtained login credentials through information-stealing malware, researchers from Mandiant, a Google-owned security firm said. Live Nation confirmed that data from its TicketMaster group stored on Snowflake had been stolen following a posting offering the sale of the full names, addresses, phone numbers, and partial credit card numbers for 560 million Ticketmaster customers. Mandiant said that all the compromises it has tracked so far were the result of login credentials for Snowflake accounts being stolen by infostealer malware and stored in vast logs, sometimes for years at a time.
    • Roughly 15,000 car dealerships across the U.S. and Canada went days in Jun. 2024 without software systems crucial to running their business, following multiple cyberattacks on CDK Global. The company is one of just a handful of dealer management system providers that underpin auto retailers’ ability to access customer records, schedule appointments, handle car-repair orders and complete transactions, among other tasks. CDK has confirmed that it’s been the subject of a cyber-ransom event, and Bloomberg reported that the company was planning to pay the tens of millions of dollars that the group behind the hacks had demanded in order to restore service.
    • A Dec. 2024 data breach involving PowerSchool affected an estimated 62 million students and 10 million teachers. The cloud-based software solution provides tools for enrollment, communication, attendance, staff management, learning systems, analytics, and finance at more than 6,000 K-12 schools and districts across the United States and Canada. The breach has left parents and educators grappling with concerns over privacy and data security, exposing sensitive information that hackers are attempting to exploit on the dark web. 
    • In 2025, a notorious predominantly English-speaking hacking group launched a website to extort its victims, threatening to release about a billion records stolen from companies who store their customers’ data in cloud databases hosted by Salesforce. The ShinyHunters gang allegedly hacked dozens of high-profile companies by breaking into their cloud-based databases hosted by Salesforce. Insurance giant Allianz Life, Google, fashion conglomerate Kering, the airline Qantas, carmaking giant Stellantis, credit bureau TransUnion, and the employee management platform Workday, among several others, have confirmed their data was stolen in these mass hacks.The hackers’ leak site lists several alleged victims, including FedEx, Hulu (owned by Disney), and Toyota Motors.
    • Google said in Oct. 2025 that there were likely to be more than 100 companies affected by an ambitious hacking campaign that targeted Oracle’s suite of business products, an early assessment that could portend wide-ranging damage. Google, said in a statement that “mass amounts of customer data” were stolen in an operation it said may have begun as early as three months ago. As of Dec. 2025, the number of companies and damages reported are still being tallied.

    BIGGEST HACKS EVER

    • In 2020, state-backed hackers exploited a ubiquitous SolarWinds software product in order to spy on government and business networks around the world, including in the U.S., U.K., Israel and Canada. The cyber spies lurked in email services, and posed as legitimate staffers to tap confidential information stored in the cloud. The bombshell revelations sent 18,000 exposed SolarWinds customers scrambling to assess whether outsiders did indeed enter their systems, what the damage was and how to fix it.The sprawling operation targeted some of the US government’s most sensitive data.
    • Global meat supplier JBS was hit by a massive attack during the 2021 Memorial Day weekend. This was one of the biggest hacks in history to affect a player in food production. This ransomware attack brought its beef and pork slaughterhouses in North America and Australia to a standstill. The company obliged the attackers’ demand and paid an $11 million USD ransom to resume its operations.
    • In May 2017, a massive ransomware attack known as WannaCry spread to over 200,000 computer systems across 150 countries. The attack encrypted files on infected systems and demanded ransom payments in Bitcoin to decrypt them. Total financial losses from the WannaCry attack were estimated to exceed $4 billion.
    • In Jun. 2017, organisations around the world were hit by another destructive ransomware attack known as NotPetya. It is considered one of the most damaging cyber attacks to date, causing over $10 billion in damages. Major multinational companies were severely impacted, including shipping company Maersk, pharmaceutical giant Merck, and the French construction company Saint-Gobain. The attack also crippled computer systems across Ukraine where it is believed to have originated.
    • The credit reporting agency Equifax announced in Sep. 2017 that the personal information of over 145 million Americans had been exposed in a massive data breach. The attackers exploited a security flaw to gain access to Equifax systems and stole sensitive customer information including Social Security numbers, birthdates, addresses, and some driver’s license numbers.
    • In Nov. 2014, a hacker group calling itself the “Guardians of Peace” carried out a devastating cyber attack against Sony Pictures in retaliation for the planned release of the comedy film The Interview. The hackers stole and released over 100 terabytes of confidential data including upcoming film scripts, employee salaries, financial records, and thousands of private emails. They also wiped over half of Sony Pictures’ global network.
    • In what is considered the largest data breach in history, all 3 billion Yahoo user accounts were compromised by a 2013 breach that went undetected for three years. The attackers, believed to be state-sponsored hackers from Russia, stole names, email addresses, phone numbers, birthdates, and encrypted passwords from Yahoo’s user database. A separate 2014 intrusion also allowed hackers to gain the account keys needed to access the private information of over 500 million accounts.
    • The 2013 Cryptlocker malware attacked upwards of 250,000 machines by encrypting their files. It displayed a red ransom note with a payment window accompanied. The virus’ creators used a worm called the Gameover Zeus botnet to make and send copies of the CryptoLocker virus. Although CryptoLocker itself was easily removed, the affected files remained encrypted in a way which researchers considered unfeasible to break. Many said that the ransom should not be paid, but did not offer any way to recover files; others said that paying the ransom was the only way to recover files that had not been backed up. Some victims claimed that paying the ransom did not always lead to the files being decrypted.
    • The Stuxnet worm, uncovered in 2010, was a sophisticated cyber weapon used to target and damage Iran’s nuclear enrichment facilities. Stuxnet temporarily crippled Iran’s capacity to develop nuclear material and caused about one-fifth of centrifuges to be destroyed. The virus is widely attributed as a joint effort by U.S. and Israeli intelligence agencies.
    • The credit card payment processor Heartland Payment Systems was compromised in 2008, and an estimated 130 Million customer accounts were accessed, making it one of the largest credit card hacks in history. Albert Gonzalez and two Russian hackers placed sniffer programs within the Heartland system. These sniffers intercepted credit card credentials in real time and relayed the data back to them.He was found guilty in 2010 and sentenced to an unprecedented 20 years in prison.

    HISTORIC VIRUSES

    • For computer buffs visiting Pakistan’s historic city of Lahore, it seemed too good a bargain to pass up. A shop called Brain Computer Services was selling brand-name computer programs, such as Lotus 1-2-3 and WordStar, for as little as $1.50 each, according to TIME. From early 1986 to late 1987, scores of Americans — most of them students and backpackers — snapped up cut-rate disks for use on their computers back home. Hidden in nearly every disk was an extra program not supplied by any manufacturer: a snippet of computer code many considered to be the world’s most sophisticated computer virus. Every time an unsuspecting user lent his new disk to a friend or colleague, and every time the disk was run on a machine shared by other users, the code spread from one computer to another. The so-called Brain virus had found its way onto at least 100,000 floppy disks, sometimes with data-destroying impact. In each case the illicit program left behind a calling card for those savvy enough to find it: a message that began with the words WELCOME TO THE DUNGEON, and was signed by brothers Amjad Farooq Alvi, 26, and Basit Farooq Alvi, 19, the owners of Brain Computer Services.
    • At around 8:30pm EST on Nov. 2, 1988, a malicious program developed by 23-year-old Robert Morris was unleashed on the Internet from a computer at the Massachusetts Institute of Technology (MIT), according to the FBI. The Morris Worm was soon propagating at remarkable speed and grinding computers to a halt. Within 24 hours, an estimated 6,000 of the approximately 60,000 computers that were then connected to the Internet had been hit. The rogue program had infected systems at a number of the prestigious colleges and public and private research centers that made up the early national electronic network. This was a year before the invention of the World Wide Web. The Morris Worm inspired a new generation of hackers and a wave of Internet-driven assaults that continue to plague our digital systems to this day.
    • Neel Mehta of Google’s security team privately reported Heartbleed to the OpenSSL team on Apr. 1, 2014. Codenomicon discovered it independently at approximately the same time, and reported HeartBleed on Apr. 3, 2014. At the time of disclosure, some 17 percent (around half a million) of the Internet’s secure web servers certified by trusted authorities were believed to be vulnerable to the attack, allowing theft of the servers’ private keys and users’ session cookies and passwords. Journalists deemed the Heartbleed bug “catastrophic”.
    • The Zeus computer virus is an online theft tool that hit the web in 2007. A whitepaper by Unisys three years later estimated that it was behind 44 percent of all banking malware attacks. By then, it had breached 88 percent of all Fortune 500 companies, 2,500 organizations total, and 76,000 computers in 196 countries.The Zeus botnet was a group of programs that worked together to take over machines for a remote “bot master.” It originated in Eastern Europe and was used to transfer money to secret bank accounts. More than 100 members of the crime ring behind the virus, mostly in the U.S., were arrested in 2010.
    • The worst computer virus outbreak in history, according to HP, Mydoom caused estimated damage of $38 billion in 2004. Also known as Novarg, this malware is technically a “worm,” spread by mass emailing. At one point, the Mydoom virus was responsible for 25 percent of all emails sent. Though a $250,000 reward was offered, the developer of this dangerous computer worm was never caught. Mydoom scraped addresses from infected machines, then sent copies of itself to those addresses. It also roped those infected machines into a web of computers called a botnet that performed distributed denial of service (DDoS) attacks. These attacks were intended to shut down a target website or server.
    • The Sobig Worm was a computer worm that infected millions of Internet-connected, Microsoft Windows computers in Aug. 2003. As of 2018, Sobig is the second fastest computer worm to have ever entered the wild, being surpassed only by Mydoom. Sobig was not only a computer worm in the sense that it replicates by itself, but also a Trojan horse in that it masquerades as something other than malware.
    • 20 years ago, the internet came as close to a total meltdown as we’ve seen since its commercialization in the 1990s. A UDP network worm payload of just 376 bytes, targeting UDP destination port 1434, aggressively propagated to all vulnerable, internet-connected Microsoft SQL Server hosts worldwide within a matter of minutes. Popularly known as the SQL Slammer (though the name Sapphire was suggested within the academic community, it didn’t catch on) worm, it infected around 75,000 vulnerable servers worldwide. The significant disruption it caused made international news. It was enough to bring many networks to a screeching halt, and disrupted retail credit card point-of-sale systems and ATMs worldwide
    • With nearly $20 billion in estimated damages, The Klez Worm infected about 7.2 percent of all computers in 2001, or 7 million PCs. Klez sent fake emails, spoofed recognized senders and, among other things, attempted to deactivate other viruses. As with other viruses and worms, Klez was released in several variants. It infected files, copied itself, and spread throughout each victim’s network. It hung around for years, with each version more destructive than the last.
    • Code Red was a computer worm observed on the Internet on Jul. 15, 2001. It attacked computers running Microsoft’s IIS web server. It was the first large-scale, mixed-threat attack to successfully target enterprise networks. The Code Red computer virus was yet another worm that penetrated 975,000 hosts. It displayed the words “Hacked by Chinese!” across infected web pages, and it ran entirely in each machine’s memory. In most cases it left no trace in hard drives or other storage. Financial costs are pegged at $2.4 billion. The virus attacked websites of infected computers and delivered a distributed denial of service (DDoS) attack on the U.S. White House’s website.
    • ILOVEYOU, sometimes referred to as the Love Bug or Loveletter, was a computer worm that infected over ten million Windows personal computers on and after May 5, 2000. It started spreading as an email message with the subject line “ILOVEYOU” and the attachment “LOVE-LETTER-FOR-YOU.TXT.vbs.” Onel de Guzman, a then-24-year-old computer science student at AMA Computer College and resident of Manila, Philippines, created the malware.

    ARTIFICIAL INTELLIGENCE (AI)

    CYBERSECURITY MARKET

    • Cybersecurity Ventures predicts that global spending on cybersecurity products and services will hit $522 billion annually (USD) in 2026, up from $260 billion in 2021.This includes all countries globally, B2B and B2C, plus a portion of any markets that are converged with cybersecurity such as quantum security, physical security and surveillance, government information security and military cyber defense technology (all nations), space cyber defense, and also counts in cyberinsurance policies.
    • AI is expanding a $2 trillion total addressable market (TAM) for cybersecurity providers, according to a 2024/2025 study by McKinsey, a global management consulting firm and trusted advisor to leading businesses, governments, and institutions.
    • Today, nearly 15 percent of (corporate) cybersecurity spending comes from outside the chief information security office (CISO), and non-CISO cyber spending is expected to grow at a 24 percent CAGR over the next three years, according to the McKinsey study, which goes on to state that this has changed from a decade ago, when almost all cybersecurity spending came from the CISO organization.
    • The U.S. and Western Europe will account for more than 70% of global security spending in 2025, according to the latest forecast from the “Worldwide Security Spending Guide”, published by IDC. However, all geographic regions were expected to see consistent growth in security spending in 2025, with the highest increases in Latin America, Central and Eastern Europe, and the Middle East and Africa.
    • AI is reshaping nearly every industry – and cybersecurity is no exception. One research report estimates that the global market for AI-based cybersecurity products was about $15 billion in 2021 and will surge to roughly $135 billion by 2030.
    • A significant amount of corporate, government, and small-to-midsized (STM) spending in our space has gone to Microsoft, who in fiscal 2025 generated around $37 billion in cybersecurity revenue, representing about 14 percent of its total revenue, according to Investing.com, and its security business can reach $50 billion by 2030 if it grows at a mid-teens CAGR.
    • Global spending on security awareness training for employees (previously one of the most underspent cybersecurity budget items) is predicted to exceed $10 billion USD by 2027, according to Cybersecurity Ventures, up from around $5.6 billion USD in 2023.
    • According to Gartner, worldwide security services revenue exceeded $77 billion in 2024, and Big 4 consulting giant Deloitte had the largest market share with 16.6 percent. That puts Deloitte’s annual security services revenues at more than $12.7 billion. Deloitte has an army of more than 40,000 security services professionals.
    • The U.S. spends more than $25 billion on cybersecurity every year to defend federal systems against increasing threats from hackers, ransomware groups and state- sponsored actors, according to Palo Alto Networks. Deltek estimates the federal cybersecurity market at $18.8 billion in 2026, growing to $20.7 billion in 2028. The U.S. has the largest cybersecurity budget out of all nations for protecting its government against cyber threats.

    CYBERINSURANCE

    • The first cyberinsurance product in the U.S. emerged in 1996/1997 when AIG launched its Internet Security Liability (ISL) product. The ISL standard plan covered legal costs and settlement fees if customer credit cards were stolen from insured companies’ servers and the credit card company failed to protect them.
    • Cybersecurity Ventures predicts the cyberinsurance market will grow to $14.8 billion USD in 2025 and will exceed $34 billion USD by 2031, based on a compound annual growth rate (CAGR) of 15 percent calculated over an 11-year period (2020 to 2031).
    • One of the world’s largest cyber insurance firms is reportedly pulling back from the market. That company, Beazley, is dealing with increasing claims and falling prices, even as competitors double down on policies covering ransomware demands and other cyberattacks, the Financial Times (FT) reported in Nov. 2025. (Nov. 30). The company recently reported that cyber gross written premiums, a measure of top-line revenue, fell 8 percent in the nine months to Sept. 30 to $848 million. While Beazley has reduced its exposure, Chubb and AIG, two of its biggest rivals in the U.S. market, have maintained or grown their books, the report added. These diverging strategies underline volatility in the nascent sector.
    • Attackers are leveraging AI to automate and scale phishing, ransomware and deepfake attacks, making threats faster and harder to detect. Aon research found that a rise in AI-driven deepfake attacks resulted in a 53 percent increase in social-engineering incidents year-over-year, and social engineering and fraud claims increased by 233 percent.
    • While cyber insurance claims in the Resilience portfolio dropped by 53 percent in the first half of 2025—suggesting that organizations are getting better at preventing attacks—the financial damage from successful incidents has actually increased. The 2025 Midyear Cyber Risk Report reveals that when cybercriminals do break through Resilience client defenses, they’re hitting 17 percent harder than before, with ransomware attacks now averaging over $1.18 million in damages.
    • When deemed reasonable and necessary, 44 percent of Coalition cyberinsurance policyholders that experienced a ransomware incident over the past year opted to pay the ransom. Coalition Incident Response (CIR) was able to negotiate ransom payments down by an average of 60 percent.
    • The potential in Europe is clear: 41 percent of businesses with over €500 million in revenue intend to purchase cyberinsurance for the first time in the next five years, according to Howden’s 2025 Cyberinsurance Report. For a €500 million business, cyberinsurance can save approximately €16 million in attack-related costs over ten years. That means a 19 percent return on investment – a compelling value proposition. With rates continuing to fall in the low-double-digit range, current market conditions present a highly favourable entry point for new buyers in Europe.

    BIG TECH

    • In 2021, Google announced an investment of more than $10 billion through 2025 in cybersecurity. The effort will include helping to secure the supply chain and strengthening open-source security. Google also said they’re training 100,000 Americans for vital data privacy and security jobs. They are providing $15 million to create 15 new cybersecurity clinics at universities across the country, the company informed in Jun. 2024. The tech giant has also funded 2,000 students to earn a Career Certificate in Cybersecurity in Africa. Last year, Google started offering a Cybersecurity Professional Certificate training program for anyone, including those with no background in coding or computer science. The program, created by cybersecurity experts at Google, is designed to provide people with job-ready skills in under 6 months to jumpstart their career.
    • IBM has committed to providing 30 million people in more than 30 countries across the Americas, Asia Pacific, Europe, Middle East and Africa, with learning opportunities to plug skills gaps in the technology sector, cybersecurity included, by 2030. Partnerships extend to NGOs focusing on underserved youth, women, and military veterans.
    • In Jun. 2024, Cisco Investments, the global corporate venture investment arm of Cisco, launched a $1B AI investment fund to bolster the startup ecosystem and expand the development of secure, reliable, and trustworthy AI solutions. Cisco has already committed nearly $200M of the $1B investment fund to date.

    BOARDROOM

    • Cybersecurity Ventures predicts that by 2025, 35 percent of Fortune 500 companies will have board members with cybersecurity experience, and by 2031 that will climb to more than 50 percent. This is up from a Heidrick & Struggles estimate of 17 percent in 2021.
    • Liability for cyber-physical security incidents were expected to pierce the corporate veil to personal liability for 75 percent of CEOs by 2024, according to Gartner, Inc. Due to the nature of cyber-physical systems (CPSs), incidents can quickly lead to physical harm to people, destruction of property or environmental disasters. 
    • Lack of board access is the number one factor for CISO dissatisfaction, according to a Sep. 2025 CSO story citing research that states nearly 40 percent of CISOs at small and mid-market organizations have minimal or no access to full boards.
    • The CISO’s rise to the C-suite comes with more engagement with the boardroom, an audience with the CEO, and the power to make strategic decisions for the business, according to Splunk. 82 percent of surveyed CISOs report directly to the CEO in 2025, a significant increase from 47 percent in 2023. In addition, 83 percent of CISOs participate in board meetings somewhat often or most of the time. While 60 percent acknowledge that board members with cybersecurity backgrounds more heavily influence security decisions, only 29 percent of CISOs say their board includes at least one member with cybersecurity expertise.
    • Only 29 percent of CISOs said they receive the proper budget for cybersecurity initiatives and achieving their security goals, compared with 41 percent of board members who think cybersecurity budgets are just fine, according to a 2025 report from Oxford Economics, who surveyed 600 respondents, 500 of them CISOs, CSOs, or equivalent security leaders, and 100 board members.

    WOMEN IN CYBER

    CHIEF INFORMATION SECURITY OFFICERS

    • The world’s first CISO was anointed in 1994, when financial services giant Citigroup (then Citicorp) set up a specialized cybersecurity office after suffering a series of cyberattacks from Russian hackers.
    • Cybersecurity Ventures estimates there are now at least 32,000 CISOs employed worldwide. Zippia, established through a database of 30 million profiles and verified against Census Bureau data, estimates over 7,523 chief security officers (an interchangeable term with CISOs) are “currently employed” in the U.S.
    • According to Cybersecurity Ventures, 100 percent of Fortune 500 companies and the majority of Global 2000 organizations employ a CISO or an equivalent role in 2025, up from 70 percent in 2018.
    • While 67 percent of CISOs say their cybersecurity culture is strong, a striking 76 percent believe their organization is at risk of a material cyberattack in the next 12 months—up from 70 percent in 2024, according to Proofpoint’s 2025 Voice of the CISO Report. This paradox reflects a growing sentiment: breaches are increasingly viewed as inevitable rather than avoidable.The rise in concern isn’t without merit. Two-thirds (66 percent) of CISOs reported a material loss of sensitive information in the past year—up dramatically from 46 percent in 2024. Despite investments in security posture and awareness, more than half (58 percent) of CISOs still felt unprepared for a cyberattack in 2025.
    • Gartner estimates that by 2025, nearly half of cybersecurity leaders will change roles — and 25 percent for different roles entirely — due to stress, psychological pressure, and burnout, among other factors.
    • The gender gap remains a chasm when we consider the top roles in cybersecurity. For example, in 2025 women hold less than 20 percent of CISO roles at Fortune 500 companies, according to research from Cybersecurity Ventures.

    CYBERSECURITY JOBS

    • Global cybersecurity job vacancies grew by 350 percent, from one million openings in 2013 to 3.5 million in 2021, enough to fill 50 NFL stadiums, according to Cybersecurity Ventures.
    • The number of unfilled jobs leveled off in 2022, and remains at 3.5 million (or less) in 2025, with around a half-million of those positions in the U.S., according to CyberSeek. Industry efforts to source new talent and tackle burnout continues, but we predict that the disparity between demand and supply will remain for at least the next several years, especially with the emergence of AI in cybersecurity.
    • Employment of information security analysts is projected to grow 32 percent from 2022 to 2032, much faster than the average for all occupations, according to the U.S. Bureau of Labor Statistics (BLS). The median annual wage for information security analysts was nearly $125,000 as of May 2024.
    • India alone was expected to create one million new cybersecurity jobs by 2025, according to a NASSCOM estimate in 2016. The Indian cybersecurity market was projected to be close to a valuation of $500 billion USD by 2030.
    • The cybersecurity unemployment rate for the most experienced positions hovers at around zero percent, and will likely remain so for years to come. But these positions make up a small percentage of the overall number of jobs in our industry.
    • A few CISOs reported earning $5 million a year (including bonuses and annual equity grants), and the median CISO received $532,000 in total compensation, according to a May 2025 story in CSO. The data comes from a survey of U.S. enterprises with more than $1 billion in annual revenues.
    • The median Chief Information Security Officer salary in the U.S. in 2025 is $384,715, according to Salary.com. The top paying cities for CISOs are San Francisco, New York, and Boston.

    SOME HISTORY

    • The world’s first national data network was constructed in France during the 1790s. It was a mechanical telegraph system, consisting of chains of towers, each of which had a system of movable wooden arms on top. The French telegraph system was hacked in 1834 by a pair of thieves who stole financial market information — effectively conducting the world’s first cyberattack.
    • Before computer hacking, there was phreaking. The “ph-” was for phone, and the phreaks liked to reverse engineer the system of tones that telecommunications companies used for long-distance dialing. Recreating the tones for each number, at just the right pitch, could mean making a free call rather than running up expensive charges. In 1957, Joe Engressia (Joybubbles), a blind, 7-year-old boy with perfect pitch, hears a high-pitched tone on a phone line and begins whistling along to it at a frequency of 2600Hz, enabling him to communicate with phone lines and become the U.S.’s first phone hacker or “phone phreak.”
    • The modern definition of the word “hack” was first coined at MIT in April 1955, and the first known mention of computer hacking occurred in a 1963 issue of The Tech.
    • The first computer virus, Creeper, was named after a Scooby-Doo cartoon show character. Creeper was written in 1971 by BBN computer programmer Bob Thomas as an experiment in self-duplicating code.
    • The first notable ransomware incident was caused by the AIDS Trojan. Malicious floppy disks containing the Trojan were handed out to roughly 20,000 attendees of the World Health Organization’s AIDS conference by “the father of ransomware,” Joseph Popp. Victims were told to send $189 to PC Cyborg Corporation at a PO box in Panama. Although, as it was simple malware, decryption tools were made available quickly.

    – Steve Morgan is founder and Editor-in-Chief at Cybersecurity Ventures.

    About Evolution Equity

    The 2025 Cybersecurity Almanac is brought to you in partnership with Evolution Equity Partners, an international venture capital investor partnering with exceptional entrepreneurs to develop market-leading cyber-security and enterprise software companies.

    Based in New York City and Zurich, Switzerland, the firm is managed by investment and technology entrepreneurs who have built companies around the world and leverage their operating, technical and product development expertise to help entrepreneurs win.

    Evolution has interest in companies utilizing big-data, machine learning, artificial intelligence, SaaS, mobile and the convergence of consumer and enterprise software to build leading information technology companies.

    The post 2025 Cybersecurity Almanac: 100 Facts, Figures, Predictions And Statistics appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • The Odds Of Suffering A Data Breach

    ·

    This week in cybersecurity from the editors at Cybercrime Magazine

    Sausalito, Calif. – Dec. 11, 2025

    –Read the full story in KBI Media

    According to research from Cybersecurity Ventures, cybercrime is projected to cost the world $10.5 trillion annually by 2025, and attacks, especially ransomware, are now an everyday fact of life.

    78 percent of respondents in a CrowdStrike survey acknowledged they were hit by a ransomware attack in the past year.

    With the rise of AI-driven threats and an avalanche of enterprise data, it’s not just a matter of “if” but “when” a cyber disruption will strike.

    Sanjay Mirchandani, CEO at Commvault who’s lived through a breach as a former CIO, put it pretty simply. Recovery isn’t a nice to have… it’s essential to survival and to bounce back, quickly. “The odds of you being actually breached are higher than not being breached,” Mirchandani said.

    It’s a mindset shift that underpins Commvault’s latest release of Cloud Unity. The pitch for Unity isn’t just a basic backup and restore. The magic sauce is that sensitive data is automatically masked and protected, so AI models and analytics access data that’s both centralized and controlled.

    Read the Full Story

    Cybercrime Magazine is Page ONE for Cybersecurity. Go to any of our sections to read the latest:

    • SCAM. The latest schemes, frauds, and social engineering attacks being launched on consumers globally.
    • NEWS. Breaking coverage on cyberattacks and data breaches, and the most recent privacy and security stories.
    • HACK. Another organization gets hacked every day. We tell you who, what, where, when, and why.
    • VC. Cybersecurity venture capital deal flow with the latest investment activity from various sources around the world.
    • M&A. Cybersecurity mergers and acquisitions including big tech, pure cyber, product vendors and professional services.
    • BLOG. What’s happening at Cybercrime Magazine. Plus the stories that don’t make headlines (but maybe they should).
    • PRESS. Cybersecurity industry news and press releases in real time from the editors at Business Wire.
    • PODCAST. New episodes daily on the Cybercrime Magazine Podcast feature victims, law enforcement, vendors, and cybersecurity experts.
    • RADIO. Tune into WCYB Digital Radio at Cybercrime.Radio, the first and only round-the-clock internet radio station devoted to cybersecurity.

    Contact us to send story tips, feedback and suggestions, and for sponsorship opportunities and custom media productions.

    The post The Odds Of Suffering A Data Breach appeared first on Cybercrime Magazine.

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • ThreatsDay Bulletin: Spyware Alerts, Mirai Strikes, Docker Leaks, ValleyRAT Rootkit — and 20 More Stories

    ·

    This week’s cyber stories show how fast the online world can turn risky. Hackers are sneaking malware into movie downloads, browser add-ons, and even software updates people trust. Tech giants and governments are racing to plug new holes while arguing over privacy and control. And researchers keep uncovering just how much of our digital life is still wide open. The new Threatsday Bulletin

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

  • NANOREMOTE Malware Uses Google Drive API for Hidden Control on Windows Systems

    ·

    Cybersecurity researchers have disclosed details of a new fully-featured Windows backdoor called NANOREMOTE that uses the Google Drive API for command-and-control (C2) purposes. According to a report from Elastic Security Labs, the malware shares code similarities with another implant codenamed FINALDRAFT (aka Squidoor) that employs Microsoft Graph API for C2. FINALDRAFT is attributed to a

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶

    ¶¶¶¶¶