A new study from critical infrastructure protection firm OPSWAT reveals that organisations face escalating risks from insider activity, legacy tools, and the growing complexity of AI.

Independently conducted by Ponemon Institute, the report found that in the past two years, 61% of organisations have suffered file-related breaches caused by negligent or malicious insiders, at an average cost of $2.7 million per incident.

Broadly speaking, the research highlights the overall fragile state of file security.

While many enterprises are turning to AI for faster detection and cost savings, adversaries are also exploiting generative AI models, e.g. embedding prompts in macros or exposing hidden data through AI parsers. Yet, despite this, fewer than half of organisations report confidence in protecting files at critical points such as uploads, transfers, and third-party sharing.

“As threats continue to accelerate and increase in cost, cyber resilience has shifted from being a technical priority to being a strategic, fiscal imperative,” said Dr. Larry Ponemon, Founder of the Ponemon Institute.

“Executives must take ownership by investing in technology that reduces risk and cost while enabling organisations to keep pace with an ever-evolving AI landscape.”

The findings further reveal a sharp shift away from legacy point solutions toward unified, multi-layered platforms that incorporate technologies such as multiscanning, Content Disarm & Reconstruction (CDR), and adaptive sandboxing. By 2026, two-thirds of enterprises expect to be using these advanced technologies.

Recommended reading

• API and Bot Attacks Cost Businesses £141 Billion A Year 
• NCSC Issues Advisory to Combat China-linked Cyber Threat
• NCSC Releases Cyber Incident Response Guidance for CEOs

“A multi-layered defense that combines zero-trust file handling with advanced prevention tools is no longer optional but is the standard for organisations looking to build resilient, scalable security in the AI era,” added George Prichici, VP of Products at OPSWAT.

“Leveraging a unified platform approach allows file security architectures to adapt to new threats and defend modern workflows and complex file ecosystems inside and outside the perimeter.”