AI security statistics 2026: sourced figures with sample sizes

Last updated 9 November 2026. These AI security statistics cover application and agent security: how many organizations ship AI features, what testers find in them, how often attacks succeed and what the standards bodies say is still unsolved. Each figure has its source, sample size and date. We left out breach-cost and shadow-AI statistics that give no sample.

Key figures at a glance#

Seven figures answer most questions about AI application security. All come from the sources named in the table, checked on 9 November 2026. Vendor surveys are labeled as vendor surveys.

How did we choose these sources?#

We picked primary reports and kept only figures we could read in the original. A figure from a blog post that cites a report gets traced to the report or dropped. Each row has a named source, a sample or population, and a date.

Three rules decide what goes in. First, a vendor survey is marked as one, because the vendor sets the questions. Second, a percentage without a base (the HackerOne 540%) carries a warning. Third, a benchmark score is tied to the models in the paper, not to current models. We checked each source on 9 November 2026. We excluded figures we could only find in secondary reports, such as ISO/IEC 42001 certificate counts.

What do the statistics say about AI adoption and testing?#

Most surveyed organizations already ship AI features, and most say they assess them. In Cobalt's 2025 survey (450 validated responses, security staff at firms with 500 to 9,999 employees), 98% said they were integrating generative AI into their products and services. About 80% said they were increasing efforts to secure AI, and 66% were conducting regular security assessments, including pentests, of their AI solutions.

SaaS Capital found a lower figure in a different population. Its annual survey of private B2B SaaS companies draws more than a thousand responses, and over 76% of respondents used at least some AI in their existing products and 69% used AI in day-to-day operations. Respondents were typically CEOs, CFOs or other executives.

The two surveys use different populations, so do not average them. Cobalt's 98% is for mid-size and large firms that answer a security vendor's survey. SaaS Capital's 76% covers private SaaS companies of all sizes.

What do pentests find in AI and LLM applications?#

Testers rate a higher share of AI and LLM findings as serious than for other test types, and those findings are fixed less often. Cobalt's 2025 report states that about one-third (32%) of findings in its AI and LLM pentests were rated serious, against about 13% of all findings. Only 21.1% of serious AI and LLM findings were resolved, the lowest of the test types shown. Internal network tests resolved 49.6% and desktop tests 36.4%.

The 2026 edition, as summarized in Cobalt's own blog post, gives 32% serious AI and LLM findings against 12% for the whole dataset, and a resolution rate of 38% for AI and LLM high-risk findings, again the lowest of any category. We quote the shares and not the ratio Cobalt prints, because Cobalt's pages disagree on the ratio. We have not opened the 2026 PDF itself, so check the 2026 figures there before you rely on them.

The 2026 blog lists the causes of those incidents that respondents named: shadow AI (44%), improper output handling (41%), data and model poisoning (41%), supply chain issues (35%) and prompt injection (34%). Read the share of serious findings with care. It does not say how many flaws a typical AI application has. It says how testers rated the findings they reported in Cobalt's engagements.

How often does prompt injection succeed?#

Defenders report falling but non-zero attack success rates, and no source claims the problem is solved. Anthropic published a figure for its browser agent on 24 November 2025: a 1% attack success rate, which it says still represents meaningful risk. It states that no browser agent is immune to prompt injection. The figure comes from Anthropic's own test setup, so it does not transfer to your application.

HackerOne reported on 18 March 2026 that validated prompt injection vulnerabilities on its platform rose 540% year over year. The release does not state the starting count. A 540% rise from a small base is a small absolute number, so use it as a direction, not a size.

How well do AI agents find vulnerabilities?#

AI agents find real vulnerabilities in controlled benchmarks and competitions, at a cost and rate that depend on the task. DARPA's AI Cyber Challenge final (results dated 8 August 2025) is the largest public test. The seven finalist teams worked across 54 million lines of code, in 63 challenges.

The official DARPA text says 63 challenges. Some news sites print 70. CyberGym's roughly 20% success rate applies to the models in the 2025 paper, not to current models. The paper also reports 34 zero-day vulnerabilities and 18 historically incomplete patches found along the way.

These benchmarks test memory-safety bugs and CTF puzzles. They do not test authorization flaws or business logic in your own application. That gap matters for AI red teaming tools and for how you read vendor claims.

What do the standards bodies say is still unsolved?#

Standards and government bodies say prompt injection has no complete fix and that mitigations reduce likelihood and impact. These statements are not statistics, but they bound how to read the figures above.

Microsoft's AI Red Team paper on more than 100 generative AI products (arXiv:2501.07238, January 2025) makes the same point from practice. One of its stated lessons is that "the work of securing AI systems will never be complete."

A statistic cannot show that a system is secure after testing. A test shows which flaws existed on the test date. See the OWASP Top 10 for LLM applications for the risk list testers work through.

How do I cite these statistics, and when was this page updated?#

Cite the original source named in the table, not this page. Name the publisher, the report, the year, the sample and the figure, and say whether it is a vendor survey. Example: "Cobalt, State of Pentesting Report 2025 (vendor survey, 450 respondents): 98% are integrating generative AI into products and services."

This page was last updated on 9 November 2026. Several figures change each year. Cobalt already has a 2026 edition, and AI benchmark scores change with each model release. Re-check the source before you reuse a number in a document you will keep.