← cyberarmor.ai/research  ·  Report PDF  ·  Second edition, revised August 4, 2026

Source Table — The Cost of Untrusted AI, August 2026 edition

Every load-bearing claim in the report, its source, URL, and verification status. Two statuses are used honestly and deliberately:

Anything that could not be placed in either category was cut from the report, or is listed in could-not-verify.md.

A. Measurements

# Claim in report Source URL Status
A1 Global average breach cost US$4.99M (2026); rose from US$4.44M (2025) IBM press release for Cost of a Data Breach 2026, July 29, 2026 (Ponemon-conducted, 602 orgs, Mar 2025–Feb 2026) https://www.prnewswire.com/news-releases/ibm-study-one-in-four-malicious-breaches-are-ai-enabled-costing-companies-6-million-on-average-302837049.html Re-verified 2026-07-29
A2 1 in 4 malicious breaches AI-enabled; +56% YoY; most common: deepfake impersonation and AI-enabled malware Same Same Re-verified 2026-07-29
A3 AI-enabled breaches average ≈US$6M (~US$1M above average) Same Same Re-verified 2026-07-29
A4 Security AI/automation users cut breach costs ≈US$2M on average; 1 in 4 orgs have not adopted Same Same Re-verified 2026-07-29
A5 >20% of orgs report breaches targeting AI models/apps; top causes compromised APIs/apps/plug-ins (27%) and cloud misconfigurations affecting AI workloads (27%) Same Same Re-verified 2026-07-29
A6 62% of AI-driven attacks target critical infrastructure; financial services US$6.3M; energy US$5.2M Same Same Re-verified 2026-07-29
A7 2025-edition figures used with explicit "2025 edition" label: US$4.44M global (first decline in 5 yrs); shadow-AI premium +US$670K; 63% no AI governance policy; 97% of AI-breached orgs lacked AI access controls; 13% breached own AI models/apps (2025) IBM Cost of a Data Breach 2025 (July 30, 2025); IBM's own AI-findings summary page https://www.ibm.com/reports/data-breach · https://www.ibm.com/think/insights/data-matters/cost-of-a-data-breach Re-verified 2026-07-29 (think page fetched; figures stated there)
A8 IC3 2025: US$20.877B total losses; 1,008,597 complaints; BEC US$3,046,598,558 FBI IC3, Internet Crime Report 2025 (released April 2026) https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf Re-verified 2026-07-29 (PDF fetched)
A9 IC3 AI section: 22,364 complaints referencing AI; US$893,346,472 losses; voice-clone "distress scams" >US$5M; section titled "Artificial Intelligence (AI) Used in Cybercrime" Same Same Re-verified 2026-07-29
A9a AI-section loss breakdown: investment fraud US$632,041,188 (dominant; AI-generated video/voices of celebrities, CEOs and trusted figures); AI-enabled BEC US$30,256,592; tech/customer-support scams US$19,457,078; confidence/romance US$19,041,653 Same (AI section, by-crime-type figures) Same Re-verified 2026-07-29 (second targeted fetch of the section)
A10 Deloitte projection: GenAI "could enable fraud losses to reach US$40B in the US by 2027, from US$12.3B in 2023" — labelled projection Deloitte Center for Financial Services, May 2024 https://www2.deloitte.com/us/en/insights/industry/financial-services/financial-services-industry-predictions/2024/deepfake-banking-fraud-risk-on-the-rise.html Carried (verified 2026-07)

B. Regulation and statute

# Claim in report Source URL Status
B1 EU AI Act penalties: Art. 99(3) €35M/7%; 99(4) €15M/3%; 99(5) €7.5M/1%; 99(6) SME lower-of Regulation (EU) 2024/1689, Art. 99 https://eur-lex.europa.eu/eli/reg/2024/1689/oj (text mirror re-read at https://artificialintelligenceact.eu/article/99/) Re-verified 2026-07-29
B2 Art. 50 transparency duties (AI-interaction disclosure; machine-readable marking of synthetic content; deployer deepfake disclosure) apply from Aug 2, 2026; prohibitions since Feb 2, 2025; GPAI obligations since Aug 2, 2025; enforcement begins Aug 2, 2026 Regulation (EU) 2024/1689 Arts. 50/113; European Commission AI Act Service Desk implementation timeline https://ai-act-service-desk.ec.europa.eu/en/ai-act/timeline/timeline-implementation-eu-ai-act Re-verified 2026-07-29
B3 Digital Omnibus on AI = Regulation (EU) 2026/1744; OJ publication July 24, 2026; entry into force July 27, 2026 EUR-Lex record (document dated 2026-07-08; in-force date 2026-07-27 in EUR-Lex metadata) https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng Re-verified 2026-07-29 (metadata; see caveat C-2 in could-not-verify.md)
B4 Omnibus deferrals: Annex III stand-alone high-risk → Dec 2, 2027; Art. 6(1)/Annex I embedded → Aug 2, 2028; new Art. 5 prohibition (NCII/CSAM) applying Dec 2, 2026; synthetic-content marking transition to Dec 2, 2026 for systems on market before Aug 2, 2026 Gibson Dunn client alert; Hunton Andrews Kurth analysis (two independent firms), consistent with EUR-Lex metadata https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/ · https://www.hunton.com/privacy-and-cybersecurity-law-blog/eu-digital-omnibus-on-ai-enters-into-force Re-verified 2026-07-29 (secondary-corroborated; see caveat C-2)
B5 GDPR Art. 83(5) €20M/4%; 83(4) €10M/2% Regulation (EU) 2016/679 https://eur-lex.europa.eu/eli/reg/2016/679/oj Carried (verified 2026-07)
B6 SEC FY2026 exam priorities: accuracy of AI representations; P&Ps to monitor/supervise AI use (fraud prevention, AML, back-office, trading); AI + polymorphic-malware risk controls and training SEC Division of Examinations, FY2026 Examination Priorities https://www.sec.gov/files/2026-exam-priorities.pdf Re-verified 2026-07-29 (PDF fetched — resolves the 403 flag in decision record 0001)
B7 FINRA 2026: GenAI in supervisory systems — "integrity, reliability and accuracy of the AI model" under Rule 3110; RN 24-09; third-party GenAI diligence incl. contract language against sensitive-data ingestion; deepfakes from social-media images circumventing security checks; added verification on anomalies, likeness checks, MFA FINRA 2026 Annual Regulatory Oversight Report (Dec 2025) https://www.finra.org/sites/default/files/2025-12/2026-annual-regulatory-oversight-report.pdf Re-verified 2026-07-29 (PDF fetched; quotes verbatim)
B8 NYDFS Part 500 final phase-in Nov 1, 2025 NYDFS cybersecurity resource center https://www.dfs.ny.gov/industry_guidance/cybersecurity Re-verified 2026-07-29
B9 NYDFS Oct 16, 2024 AI letter: deepfakes to authorize fraudulent transfers and defeat biometric verification; AI in risk assessments; deepfake-resistant MFA factors (avoid SMS/voice/video); training on "procedures for what to do when personnel receive unusual requests such as … an urgent money transfer," verification protocols, human review NYDFS Industry Letter, Oct 16, 2024 https://www.dfs.ny.gov/industry-guidance/industry-letters/il20241016-cyber-risks-ai-and-strategies-combat-related-risks Re-verified 2026-07-29 (letter fetched; quotes verbatim)
B10 NYDFS May 21, 2026 frontier-AI letter: accelerated vulnerability remediation; dependency maps with critical third parties; restrict/validate inputs before scripts or processes run; human oversight of AI-generated code; monitoring and updated risk assessments NYDFS Industry Letter, May 21, 2026 https://www.dfs.ny.gov/industry-guidance/industry-letters/20260521-heightened-cybersecurity-risks-assoc-with-frontier-ai-models Re-verified 2026-07-29 (letter fetched)
B11 FinCEN deepfake alert: GenAI-altered identity documents; GenAI social engineering in BEC/spear-phishing/elder exploitation; mitigations MFA incl. phishing-resistant + live identity-verification checks; enumerated red flags (third-party webcam plugin, changing communication methods, declining MFA) FinCEN Alert FIN-2024-Alert004, Nov 13, 2024 https://www.fincen.gov/sites/default/files/shared/FinCEN-Alert-DeepFakes-Alert508FINAL.pdf Re-verified 2026-07-29 (PDF fetched)
B12 HIPAA CMPs effective Jan 28, 2026: US$145–$73,011 per violation by tier; annual cap US$2,190,294 per provision Federal Register doc. 2026-01688 (HHS annual civil-penalty inflation adjustment) https://www.federalregister.gov/d/2026-01688 Carried (verified 2026-07); corroborated 2026-07-29 via trade coverage of the same FR doc — see caveat C-3
B13 Texas TRAIGA (HB 149): effective Jan 1, 2026; exclusive AG enforcement; penalties US$10–12K curable / US$80–200K uncurable / US$2–40K per day continuing; prohibited practices incl. non-consensual deepfakes; no private right of action Texas Attorney General, Consumer AI Rights page https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-ai-rights Re-verified 2026-07-29 (page fetched)

C. Frameworks

# Claim in report Source URL Status
C1 OWASP LLM Top 10 2025 IDs (LLM01–LLM10 as used); OWASP Agentic Top 10 2026 IDs (ASI01–ASI10 as used) OWASP GenAI Security Project https://genai.owasp.org/llm-top-10/ · https://genai.owasp.org/ Carried (verified 2026-07 against the official lists)
C2 MITRE ATLAS IDs: AML.T0010.002/.003/.005; AML.T0011; AML.T0016.002; AML.T0018.002; AML.T0024; AML.T0025; AML.T0048.000; AML.T0051.000/.001; AML.T0052.001; AML.T0073; AML.T0088 MITRE ATLAS data release 2026.06 https://github.com/mitre-atlas/atlas-data Carried (verified 2026-07 against the published dataset; atlas.mitre.org renders client-side)
C3 MITRE ATT&CK v19 IDs: T1683.002; T1684.001; T1566 / T1566.004; T1588.007; T1656 revoked in v19 (superseded by T1684.001) MITRE ATT&CK Enterprise v19.1 STIX distribution and release notes https://github.com/mitre-attack/attack-stix-data · https://attack.mitre.org Carried (verified 2026-07)

D. Incident record (36 entries)

Primary sources as carried in the incident entries; all verified in the July 2026 edition's pass unless marked re-verified.

ID Incident Primary source(s) URL(s) Status
D-1 Arup deepfake video-conference fraud, HK$200M (≈US$25.6M) HK police briefing (HKFP); HK gov't LCQ9 record; victim confirmation (SCMP; Fortune) https://www.info.gov.hk/gia/general/202406/26/P2024062600192.htm · https://hongkongfp.com/2024/02/05/multinational-loses-hk200-million-to-deepfake-video-conference-scam-hong-kong-police-say/ · https://www.scmp.com/news/hong-kong/law-and-crime/article/3263151/uk-multinational-arup-confirmed-victim-hk200-million-deepfake-scam-used-digital-version-cfo-dupe · https://fortune.com/europe/2024/05/17/arup-deepfake-fraud-scam-victim-hong-kong-25-million-cfo Carried (verified 2026-07)
D-2 US$35M voice-clone fraud (2020; historical exception) Dubai Public Prosecution filing in US federal court, via Forbes; Commsrisk reading of the filing https://www.forbes.com/sites/thomasbrewster/2021/10/14/huge-bank-fraud-uses-deep-fake-voice-tech-to-steal-millions/ · https://commsrisk.com/cloned-voice-of-company-director-used-for-35mn-bank-theft-says-uae-police/ Carried (verified 2026-07)
D-3 HK$4M deepfake CFO video call (May 2024) SCMP; HK gov't LCQ9 https://www.scmp.com/news/hong-kong/law-and-crime/article/3264684/hong-kong-employee-tricked-paying-out-hk4-million-after-video-call-deepfake-chief-financial-officer · https://www.info.gov.hk/gia/general/202406/26/P2024062600192.htm Carried (verified 2026-07)
D-4 Executive-deepfake attempt wave: Ferrari, WPP, LastPass, Wiz (all defeated) Bloomberg via Spokesman-Review; Fortune; The Guardian; LastPass blog (first-party); TechCrunch https://www.spokesman.com/stories/2024/jul/26/ferrari-narrowly-dodges-deepfake-scam-simulating-d/ · https://fortune.com/2024/07/27/ferrari-deepfake-attempt-scammer-security-question-ceo-benedetto-vigna-cybersecurity-ai · https://www.theguardian.com/technology/article/2024/may/10/ceo-wpp-deepfake-scam · https://blog.lastpass.com/posts/attempted-audio-deepfake-call-targets-lastpass-employee · https://techcrunch.com/2024/10/28/wiz-ceo-says-company-was-targeted-with-deepfake-attack-that-used-his-voice/ Carried (verified 2026-07)
D-5 United States v. Smith — US$8,091,843.64 forfeited (plea Mar 19, 2026) DOJ SDNY indictment release (Sep 4, 2024); DOJ guilty-plea release (Mar 19, 2026) https://www.justice.gov/usao-sdny/pr/north-carolina-musician-charged-music-streaming-fraud-aided-artificial-intelligence Carried (verified 2026-07). Sentencing was scheduled for July 29, 2026 — check outcome before print (caveat C-4)
D-6 Singapore deepfake-PM Zoom fraud, S$4.9M (US$3.8M), individual victim Singapore Police Force statement via SCMP / The Star https://www.scmp.com/news/asia/southeast-asia/article/3353868/how-victim-lost-us38-million-singapore-deepfake-zoom-scam-impersonating-pm-wong · https://www.thestar.com.my/aseanplus/aseanplus-news/2026/05/14/victim-loses-at-least-s49mil-in-scam-involving-deepfakes-of-singapore-pm-wong-government-officials · https://www.police.gov.sg/media-room Carried (verified 2026-07)
D-7 HK deepfake romance-fraud syndicate, ≈HK$360M (US$46M) aggregate HK police via SCMP https://www.scmp.com/news/hong-kong/law-and-crime/article/3282345/hong-kong-fraudsters-use-deepfake-tech-swindle-love-struck-men-out-hk360-million Carried (verified 2026-07)
A-1 EchoLeak, CVE-2025-32711 (M365 Copilot, zero-click) Microsoft MSRC; NVD; Aim Labs via Cato/coverage https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711 · https://nvd.nist.gov/vuln/detail/CVE-2025-32711 · https://www.catonetworks.com/blog/breaking-down-echoleak/ Carried (verified 2026-07)
A-2 Slack AI indirect-injection exfiltration path PromptArmor; Slack security update (first-party); Simon Willison analysis https://www.promptarmor.com/resources/data-exfiltration-from-slack-ai-via-indirect-prompt-injection · https://slack.com/blog/news/slack-security-update-082124 · https://simonwillison.net/2024/Aug/20/data-exfiltration-from-slack-ai/ Carried (verified 2026-07)
A-3 CurXecute, CVE-2025-54135 (Cursor, injection→RCE via MCP auto-write) Aim Labs/Cato; NVD https://www.catonetworks.com/blog/curxecute-rce/ · https://nvd.nist.gov/vuln/detail/CVE-2025-54135 Carried (verified 2026-07)
A-4 CamoLeak (GitHub Copilot Chat; no CVE assigned) Legit Security disclosure https://www.legitsecurity.com/blog/camoleak-critical-github-copilot-vulnerability-leaks-private-source-code Carried (verified 2026-07)
A-5 GitLab Duo remote prompt injection Legit Security https://www.legitsecurity.com/blog/remote-prompt-injection-in-gitlab-duo Carried (verified 2026-07)
A-6 Perplexity Comet agentic-browser injection Brave disclosure https://brave.com/blog/comet-prompt-injection/ Carried (verified 2026-07)
A-7 ~100 malicious models on Hugging Face JFrog research https://jfrog.com/blog/data-scientists-targeted-by-malicious-hugging-face-ml-models-with-silent-backdoor/ Carried (verified 2026-07)
A-8 PyTorch torchtriton dependency-confusion compromise PyTorch advisory (first-party) https://pytorch.org/blog/compromised-nightly-dependency/ Carried (verified 2026-07)
A-9 Hugging Face production breach via malicious dataset; autonomous-agent intruder; OpenAI attribution Hugging Face disclosure (Jul 16, 2026); OpenAI statement (Jul 21, 2026) https://huggingface.co/blog/security-incident-july-2026 · https://openai.com/index/hugging-face-model-evaluation-security-incident/ Re-verified 2026-07-29 (HF post fetched; quotes confirmed)
A-10 MCPoison, CVE-2025-54136 (post-approval MCP swap) Check Point Research; NVD https://research.checkpoint.com/2025/cursor-vulnerability-mcpoison/ · https://nvd.nist.gov/vuln/detail/CVE-2025-54136 Carried (verified 2026-07)
C-1 Bartz v. Anthropic — US$1.5B settlement, final approval Jul 20, 2026 (held out of security totals) N.D. Cal. final-approval order; contemporaneous coverage https://cdn.arstechnica.net/wp-content/uploads/2026/07/Bartz-v-Anthropic-Order-Approving-Settlement-7-20-26.pdf · https://techcrunch.com/2026/07/20/anthropics-landmark-1-5b-copyright-settlement-is-approved/ Re-verified 2026-07-29 (approval confirmed via multiple outlets; order PDF carried)
C-2 Fabricated-citation sanctions, 7 orders in 6 cases, US$3,000–$31,100 (Mata 2023 → Coomer 2026); Semrad figure is US$5,500 not "US$100K+" Court orders: Mata (S.D.N.Y.); Wadsworth (D. Wyo.); Lacey (C.D. Cal.); Johnson v. Dunn (N.D. Ala.); In re Martin/Semrad (govinfo); Coomer (D. Colo.) https://www.courtlistener.com/docket/63107798/mata-v-avianca-inc/ · https://caselaw.findlaw.com/court/us-dis-crt-d-wyo/117003959.html · https://www.law.berkeley.edu/wp-content/uploads/archive/2025/12/Johnson-v-Dunn.pdf · https://www.govinfo.gov/content/pkg/USCOURTS-ilnb-1_24-bk-13368/pdf/USCOURTS-ilnb-1_24-bk-13368-0.pdf · https://reason.com/volokh/2025/05/13/ai-hallucination-in-filings-involving-14th-largest-u-s-law-firm-lead-to-31k-in-sanctions/ · https://reason.com/volokh/2026/05/09/5k-sanctions-for-repeated-mis-citation-in-coomer-v-lindell-my-pillow-election-related-libel-suit/ Carried (verified 2026-07)
C-3 Samsung → ChatGPT egress (3 events, 2023) Contemporaneous reporting; Samsung ban coverage https://techcrunch.com/2023/05/02/samsung-bans-use-of-generative-ai-tools-like-chatgpt-after-april-internal-data-leak/ · https://www.ciodive.com/news/Samsung-Electronics-ChatGPT-leak-data-privacy/647137/ Carried (verified 2026-07)
C-4 Chevrolet "$1 Tahoe" chatbot Trade press with screenshots https://gmauthority.com/blog/2023/12/gm-dealer-chat-bot-agrees-to-sell-2024-chevy-tahoe-for-1/ · https://venturebeat.com/ai/a-chevy-for-1-car-dealer-chatbots-show-perils-of-ai-for-customer-service Carried (verified 2026-07)
C-5 DPD chatbot swears at company ITV; TIME https://www.itv.com/news/2024-01-19/dpd-disables-ai-chatbot-after-customer-service-bot-appears-to-go-rogue · https://time.com/6564726/ai-chatbot-dpd-curses-criticizes-company/ Carried (verified 2026-07)
C-6 NYC MyCity chatbot advises law-breaking The Markup; THE CITY https://themarkup.org/news/2024/03/29/nycs-ai-chatbot-tells-businesses-to-break-the-law · https://www.thecity.nyc/2024/04/02/malfunctioning-nyc-ai-chatbot-still-active-false-information/ Carried (verified 2026-07)
C-7 Moffatt v. Air Canada, CA$812.02 2024 BCCRT 149 (CanLII) https://www.canlii.org/en/bc/bccrt/doc/2024/2024bccrt149/2024bccrt149.html Carried (verified 2026-07)
B-1 Freysa, ≈US$47,000 on-chain The Block; Cointelegraph; on-chain record https://www.theblock.co/post/328747/human-player-outwits-freysa-ai-agent-in-47000-crypto-challenge · https://cointelegraph.com/news/crypto-user-convinced-ai-bot-transfer-47k Carried (verified 2026-07)
B-2 Replit production-database deletion during freeze CEO/company statements; Fast Company; The Register https://www.fastcompany.com/91372483/replit-ceo-what-really-happened-when-ai-agent-wiped-jason-lemkins-database-exclusive · https://www.theregister.com/2025/07/22/replit_saastr_response/ Carried (verified 2026-07)
B-3 U.S. v. Ding — conviction Jan 2026, AI/TPU trade secrets DOJ releases https://www.justice.gov/usao-ndca/pr/former-google-engineer-found-guilty-economic-espionage-and-theft-confidential-ai · https://www.justice.gov/opa/pr/superseding-indictment-charges-chinese-national-relation-alleged-plan-steal-proprietary-ai Carried (verified 2026-07)
B-4 Meta LLaMA weights leak (2023) Contemporaneous reporting https://www.vice.com/en/article/facebooks-powerful-large-language-model-leaks-online-4chan-llama/ Carried (verified 2026-07)
B-5 OpenAI Redis cross-user exposure (Mar 20, 2023); €15M Italian fine annulled → excluded OpenAI post-incident writeup (first-party); WSGR case note on annulment https://openai.com/index/march-20-chatgpt-outage/ · https://www.wsgr.com/en/insights/openai-prevails-in-landmark-italian-ai-and-gdpr-enforcement-case.html Carried (verified 2026-07)
B-6 Microsoft AI research 38TB SAS-token exposure Wiz Research https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers Carried (verified 2026-07)
B-7 OpenAI internal forum accessed (2023; disclosed 2024) NYT reporting, relayed https://www.techrepublic.com/article/openai-hacked-internal-communications/ Carried (verified 2026-07)
L-1 DeepSeek ClickHouse exposure Wiz Research https://www.wiz.io/blog/wiz-research-uncovers-exposed-deepseek-database-leak Carried (verified 2026-07)
L-2 McHire "123456" — data tied to ~64M applicant interactions Researcher disclosure; Krebs; BleepingComputer https://krebsonsecurity.com/2025/07/poor-passwords-tattle-on-ai-hiring-bot-maker-paradox-ai/ · https://www.bleepingcomputer.com/news/security/123456-password-exposed-chats-for-64-million-mcdonalds-job-chatbot-applications/ Carried (verified 2026-07)
L-3 Chattr.ai client-side credentials MrBruh disclosure; 404 Media https://mrbruh.com/chattr/ · https://www.404media.co/hackers-break-into-hiring-ai-chat-bot-chattr/ Carried (verified 2026-07)
L-4 Vyro AI open Elasticsearch (116 GB) Cybernews https://cybernews.com/security/ai-chatbots-vyro-data-leak/ Carried (verified 2026-07)
L-5 WotNot public bucket (346,381 files) Cybernews https://cybernews.com/security/wotnot-chatbot-data-leak/ Carried (verified 2026-07)

F. Product capability statements (About page)

# Claim in report Source URL Status
F1 Every product capability named in the About page — including behavioural ransomware/mass-deletion detection, host-isolation and process-termination response actions, response-side policy evaluation on model outputs, and the 58 policy templates across 17 frameworks validated against the live policy engine CyberArmor.AI public capability status page, as re-verified against the live platform 2026-08-02 https://cyberarmor.ai/status Verified 2026-08-04 against the updated status page in the repository (every claim maps to a Production, Pilot-ready or Configurable row; no Roadmap row is claimed)

E. Derived figures (arithmetic on the record — no external source)

# Figure Derivation
E1 US$69,308,411.64 enterprise-loss aggregate; 99.85% in Surface 4; US$104,600 all other surfaces Sum of D-1 (US$25.6M source conversion) + D-2 (US$35M) + D-3 (US$511,968) + D-5 (US$8,091,843.64) = US$69,203,811.64; plus C-2 orders (US$57,600) + B-1 (≈US$47,000). CA$812.02 excluded per currency rule; D-6/D-7 held out (victim class); C-1 held out (IP). Reconstruction stated in Part 7 of the report.
E2 "12 percent rise" (US$4.44M → US$4.99M) Arithmetic on A1/A7 primary figures; also stated as 12% in contemporaneous coverage of the 2026 report.

© 2026 CyberArmor.AI — AI Security, Governance and Trust Infrastructure. This table may be shared freely in unmodified form.