Website security threats span compromised credentials, unpatched software, third-party exposure, ransomware and increasingly intense DDoS campaigns. The statistics below show how these risks appeared in Verizon’s October 2024–November 2025 reporting dataset, Cloudflare’s 2025 network observations and IBM’s 2025 breach-cost research. These are measured views from particular studies and networks, not a census of every website.
Table of contents
- How website breaches begin
- Vulnerabilities and third-party exposure
- Ransomware and AI-related security risk
- The volume and scale of DDoS attacks
- DDoS intensity and record campaigns
- Disruption, response time and breach costs
How website breaches begin
Software vulnerabilities and stolen or abused credentials remain central paths into organizations that operate websites and online services. In Verizon’s 2026 DBIR executive summary, software-vulnerability exploitation represented 31% of initial access in its reporting dataset covering October 2024 through November 2025. Credential abuse accounted for another 13% of initial access.
The same dataset shows that technical controls are only part of the problem. The human element appeared in 62% of breaches. Social engineering represented 16% of all breaches, while phishing alone remained at 16%. Pretexting accounted for 6%.
These figures describe Verizon’s reported incidents and retain the source’s definitions. They do not estimate the share of all websites that experienced a breach. They do, however, indicate why website security programs need both vulnerability management and safeguards around people, identities and access.
| Breach or access factor | Share in Verizon’s reporting dataset | Measurement period |
|---|---|---|
| Software-vulnerability exploitation as initial access | 31% | October 2024–November 2025 |
| Credential abuse as initial access | 13% | October 2024–November 2025 |
| Breaches involving the human element | 62% | October 2024–November 2025 |
| Social engineering | 16% | October 2024–November 2025 |
| Phishing | 16% | October 2024–November 2025 |
| Pretexting | 6% | October 2024–November 2025 |
Vulnerabilities and third-party exposure
The speed and completeness of remediation are major parts of website security. During Verizon’s 2025 measurement year, organizations fully remediated 26% of critical vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog. The median time for full resolution was 43 days.
The exposure burden also increased. In Verizon’s October 2024–November 2025 reporting dataset, the median organization had 50% more critical vulnerabilities to patch than in the previous dataset. This is a comparison with Verizon’s prior dataset, not an independently verified estimate of every organization’s patch backlog.
Third-party risk was prominent in the same reporting. Breaches involving third parties reached 48% of all breaches, a 60% increase from Verizon’s previous reporting dataset. The result matters for websites that depend on hosting, analytics, payment, marketing, identity, cloud or other external services: a site’s security exposure can extend beyond its own code and infrastructure.
The remediation figures for third-party cloud accounts show uneven progress. Only 23% of third-party organizations fully remediated missing or improperly secured multifactor authentication on cloud accounts. Half of third-party cloud MFA exposure findings were resolved within one month. By contrast, the median time to resolve half of third-party findings for weak passwords and permission misconfigurations was nearly eight months.
Taken together, these measurements point to a practical distinction between finding a weakness and closing it. MFA findings may move faster than password and permissions problems, while the overall critical-vulnerability workload can still grow. Website owners should therefore track remediation age and third-party dependencies, not just the number of alerts.
Ransomware and AI-related security risk
Ransomware was present in 48% of breaches in Verizon’s October 2024–November 2025 reporting dataset. Among ransomware victims in that dataset, 69% did not pay. The median ransom paid was $139,875.
The payment statistic is a median for the reported cases that paid, while the non-payment figure describes ransomware victims in Verizon’s dataset. Neither should be treated as a forecast for an individual organization. They do show that incident response, restoration and resilience remain important even when an organization does not pay.
Verizon’s 2025 measurements also describe the use of generative-AI assistance by threat actors. The median threat actor researched or used generative-AI assistance in 15 documented attack techniques. Some threat actors used it in as many as 40 or 50 documented attack techniques. The median number of known malware examples performing the same functions as AI-assisted malware was 55.
AI introduces internal governance risks as well. Among users accessing unauthorized AI services, 67% used non-corporate accounts on corporate devices. Regular AI users accounted for 45% of employees using corporate devices in 2025, up from 15% in the prior year. Shadow AI was the third most common non-malicious insider action in Verizon’s 2025 data-loss-prevention dataset and increased fourfold as a percentage from the prior year. Research and technical documentation represented 3.2% of data-loss-prevention policy violations involving unauthorized generative-AI systems.
These figures do not say that AI caused a particular website breach. They describe documented attack techniques, device usage and policy violations in the cited Verizon measurements. For website teams, the security implication is that access controls and data-loss-prevention rules need to cover both malicious activity and unsanctioned tools.
The volume and scale of DDoS attacks
Cloudflare’s 2025 Q4 DDoS threat report recorded 47.1 million DDoS attacks worldwide during 2025. Cloudflare automatically mitigated an average of 5,376 DDoS attacks per hour. The figure is a Cloudflare network observation, not a census of attacks across the entire Internet.
Network-layer attacks averaged 3,925 mitigated attacks per hour, while HTTP DDoS attacks averaged 1,451 per hour. Cloudflare mitigated 34.4 million network-layer DDoS attacks in 2025.
An 18-day campaign in the first quarter of 2025 targeted Cloudflare-protected global Internet infrastructure with approximately 13.5 million network-layer attacks. Of those, 6.9 million targeted Magic Transit customers and 6.6 million were sent directly against Cloudflare infrastructure. These counts describe the campaign’s targets and Cloudflare’s vantage point.
Cloudflare also reported the Aisuru-Kimwolf campaign from December 19–31, 2025. It comprised 902 hyper-volumetric DDoS attacks, averaging 53 per day. The average attack reached 3 billion packets per second, 4 terabits per second and 54 million requests per second.
| DDoS measure | Cloudflare observation | Period |
|---|---|---|
| DDoS attacks observed | 47.1 million | 2025 |
| Average mitigated attacks per hour | 5,376 | 2025 |
| Average network-layer attacks per hour | 3,925 | 2025 |
| Average HTTP attacks per hour | 1,451 | 2025 |
| Network-layer attacks mitigated | 34.4 million | 2025 |
| Aisuru-Kimwolf campaign attacks | 902 | December 19–31, 2025 |
DDoS intensity and record campaigns
The largest attacks were exceptional in intensity. During the Aisuru-Kimwolf campaign, the maximum attack rate reached 9 billion packets per second, maximum bandwidth reached 24 terabits per second and the maximum HTTP rate reached 205 million requests per second.
Cloudflare recorded a 31.4-terabit-per-second DDoS attack lasting 35 seconds in 2025. Cloudflare reported that the sizes of its largest DDoS attacks grew by more than 700% compared with late 2024. These are record-scale observations in Cloudflare’s reporting, not typical website attack sizes.
Cloudflare’s 2025 Q1 DDoS threat report recorded 20.5 million DDoS attacks blocked in the first quarter of 2025. Network-layer attacks accounted for 16.8 million of them. Approximately 700 hyper-volumetric attacks exceeded 1 terabit per second or 1 billion packets per second. Approximately 4 out of every 100,000 network-layer DDoS attacks were hyper-volumetric in that quarter.
The largest follow-on campaign in the second half of April 2025 peaked at 4.8 billion packets per second and 6.5 terabits per second. Its largest follow-on attacks typically lasted between 35 and 45 seconds. Short duration does not make such an event harmless: a high-rate burst can still challenge automated defenses and upstream capacity.
Disruption, response time and breach costs
Most DDoS attacks in Cloudflare’s first-quarter 2025 measurements were smaller or shorter than the record campaigns. Ninety-four percent of HTTP DDoS attacks were at or below 1 million requests per second. Six percent exceeded 1 million requests per second. For duration, 89% of Layer 3/4 DDoS attacks ended within 10 minutes, compared with 75% of HTTP DDoS attacks.
The distinction between network-layer and HTTP attacks matters because the source uses separate definitions and measurements. The percentages should not be combined into one generalized DDoS duration or intensity figure. They are useful as operational context: a defense plan must account for both short, high-volume bursts and application-layer traffic that can persist longer.
The financial impact of broader data breaches was measured by IBM’s Cost of a Data Breach 2025. The global average cost of a data breach was $4.44 million in the 2025 report, down 9% from the prior year. Organizations identified and contained a breach in a mean of 241 days.
IBM also reported gaps in AI controls. Ninety-seven percent of organizations reporting an AI-related security incident lacked proper AI access controls, and 63% of surveyed organizations lacked AI governance policies covering AI use or shadow AI. These figures come from IBM’s surveyed-organization scope and should not be read as a universal estimate for all websites.
At the same time, extensive use of AI in security was associated with $1.9 million in breach-cost savings versus organizations that did not use those solutions. This is an association reported by IBM, not proof that deploying AI alone produces a fixed saving. The broader website-security lesson is measurable preparation: limit access, monitor third parties, patch exposed software, and ensure that response processes can operate before a breach or DDoS campaign becomes a prolonged business disruption.