File security incidents hit 41.7% of organisations

OPSWAT has published research with Osterman Research on enterprise file security. The survey found that 41.7% of organisations reported file-related breaches or security incidents in the past two years.

Based on responses from 254 US-based IT and Security Leaders, the research found those incidents cost an average of USD $2.2 million. It also pointed to a gap between how organisations rate their file security and what their controls show in practice.

Most respondents expressed confidence in their existing posture, with 73.6% describing their organisation's file security as very or extremely mature.

Yet when Osterman Research assessed responses against what it called an evidence-based maturity framework, no organisation reached either of the top two maturity levels. The study found that 85.8% showed no more than somewhat mature readiness, while 94.5% rated themselves more highly than their answers supported.

Michael Sampson, Principal Analyst at Osterman Research, said the findings showed a marked difference between perception and operational reality.

"The takeaway from this research is the vast distance between perceived security and evidenced reality," Sampson said. "By comparing organizations' actual capabilities against their self-ratings, we found a gap that AI-driven threats will severely test organizations over the next 12 to 24 months. You cannot defend against what you incorrectly assume is already protected."

AI pressure

The report linked that gap to changing threat patterns around artificial intelligence. It found that 59% of organisations expect AI to make file security more time-consuming for IT and security teams.

Concern about AI-driven threats against files rose by an average of 78.9% when respondents compared levels from 12 months ago with what they expect over the next year. Fears tied to generative AI and Large Language Model threats recorded the steepest increase, rising by 105%.

Security leaders also said attackers are paying closer attention to file defences. According to the survey, 68.1% said cybercriminals are more focused on getting around file security protections than they were 12 months earlier.

Confidence also appeared uneven across threat types. Respondents reported average confidence of 60.6% in detecting and preventing new and emerging threats, compared with 56.6% for longer-established threats such as malware.

That confidence dropped further for polymorphic threats, which change to avoid signature-based tools. Only 12.2% of respondents said they were extremely confident in dealing with those threats.

Visibility gaps

The survey suggested incident figures may understate the scale of the issue. Among respondents who said they had not experienced file-related incidents, 83% also said they do not have full visibility into file lifecycles.

Only 16.9% said they had complete visibility into files entering, moving through and leaving their networks. That leaves many organisations without a full record of where files travel or what may happen to them in the process.

The findings also indicate a shift in thinking about how to address file-borne threats. The strongest agreement among the security posture statements tested, at 27.2%, was with the view that an urgent move away from a detection-first approach is needed.

George Prichici, Vice President of Products at OPSWAT, said the research reflects growing concern about the limits of existing methods.

"Detection-first is reaching its limits, and this latest research shows security leaders acknowledge it," Prichici said. "When AI-generated threats appear daily, a control that has to recognize a threat first will always be a step behind. Prevention-first changes the question from which threats you caught to which classes of risk you addressed."

Prevention tools

One method highlighted in the report is content disarm and reconstruction, or CDR, which removes potentially malicious elements from files before delivery. The survey found that 51.6% of organisations already use CDR, while a further 8.3% plan to deploy it within 12 months.

That made it one of the most widely adopted, or planned, file security measures in the study. The report presented that uptake as evidence that some organisations are moving towards prevention-led controls rather than relying mainly on detection after a threat has been identified.

Barriers to adoption were not led by cost. Respondents said the top two reasons for not deploying newer file security prevention methods were a lack of senior leadership support and a lack of knowledge about the methods.

Budget ranked third, suggesting board-level backing and understanding remain more immediate obstacles than direct spending constraints. The figures point to a file security challenge that extends beyond technical teams into executive oversight.

For companies already dealing with a growing volume of files across email, cloud services and internal systems, the research argues that weak visibility and overstated confidence can leave risks unaddressed. No organisation in the survey provided evidence of top-tier readiness.