Data from CYE’s 2025 Cybersecurity Maturity Report reveals that despite an uptick in cybersecurity spending, organizations still struggle to keep up with the growing complexity of risks, tools, and compliance demands.
“Since the release of our first Cybersecurity Maturity Report in 2023, the threat landscape has continued to evolve at a relentless pace and we are unfortunately seeing the same mistakes being made year after year,” says Reuven Aronashvili, founder and CEO of CYE. “This report should serve as a wakeup call that we’re never done when it comes to cyber resilience. Resilience should be a continuous cycle with clear visibility of the organization’s specific attack surface in context of the imminent cyber threats and vulnerabilities that are most likely to be exploited by attackers within the entire organizational environment.”
Key takeaways:
● The top findings reveal that many organizations lack full awareness of their assets and exposures. For instance, according to Vanta, over 75% of companies admit to poor visibility into IT assets, and that directly translates into higher security risks.
● Countries like Japan and Norway yet again achieved higher cyber readiness than larger nations like the United States or UK, underscoring that well-coordinated national strategies and investments in planning cant yield better incident response outcomes than budget alone.
● Many of the most critical findings in this year’s report—weak password policies, unpatched systems, etc.—are foundational issues. In fact, CYE’s Cost of Breach dataset found an estimated 81% of corporate breaches are linked to stolen or weak passwords.
● In 2025, Verizon reported that third-party involvement in breaches doubled to 30%[YK1] . Yet, many companies still lack formal methods to identify and manage cyber risks posed by external vendors and suppliers, leaving a significant blind spot in their overall cybersecurity strategy.
● Half (50%) of businesses still do not have a documented business continuity plan in place and disaster recovery plans remain a weakness.
