Apricorn research finds outside reporting of data breaches quadruples as US organizations struggle with visibility

49% of breaches were reported by an outside party, while 86% of IT security leaders identify employees as their biggest cyber threat

 

POWAY, Calif., October 21, 2026 – Organizations may be losing visibility of data breaches within their own environments even as they increasingly recognize the security risks created by employees and other trusted users, according to new research from Apricorn, the leading global provider of quantum-resistant hardware-encrypted external storage solutions.

Apricorn's 2026 survey of 400 US and UK IT security decision-makers found that 49 percent of US respondents say their organization became involved in breach reporting because somebody else reported it, compared with just 12 percent in 2025. That now exceeds the 47 percent who say their own organization notified the necessary authorities of a breach or potential breach. At the same time, 86 percent identify their staff, whether remote or office-based, as their biggest cyber security threat.

"When another party identifies a breach before the organization involved, that points to a serious visibility problem,” said Kurt Markley, Managing Director at Apricorn. “Security teams cannot protect information effectively if they do not know where sensitive data resides, how it is being used or when it has left their control. The increase in outside reporting shows why organizations need stronger oversight across employees, devices, third parties and every environment in which corporate data moves."

The dramatic increase in third-party reporting suggests that breaches are increasingly being identified by customers, suppliers, business partners or other external stakeholders before organizations discover them internally. As supply chains become more interconnected and data is shared across multiple platforms and organizations, businesses have less opportunity to contain incidents before they become visible to others.

Concern about the risk of employees causing a cyber breach runs throughout the research. In addition to the 86 percent who view staff as their biggest cyber security threat, 35 percent of US respondents say their remote or mobile workers have knowingly put corporate data at risk of a breach during the past year, while 41 percent expect mobile/remote workers to expose the organization to the risk of a future data breach. Meanwhile, 36 percent believe mobile/remote employees are willing to comply with security policies but simply do not have the technology or skills needed to keep the data safe.

"Insider risk is not limited to a disgruntled employee deliberately taking information," Markley said. "Criminal groups may recruit insiders to steal data or provide privileged access, but routine behavior can create just as much exposure. An unauthorized USB drive, an unapproved cloud service or corporate data accessed on a personal device can all put sensitive information beyond the organization's control. Security measures have to account for malicious activity and ordinary mistakes."

The survey also found that 19 percent of US organizations surveyed identify employees with malicious intent as one of the leading causes of data breaches, while 26 percent cite employees unintentionally putting corporate data at risk as one of the biggest contributors.

The changing nature of breach causes may suggest organizations are becoming more effective at defending against traditional cyber threats. Phishing, cited by 32 percent of organizations as a leading cause of breaches in 2025, has fallen to 23 percent this year, while ransomware edged down to 19 percent from 21 percent last year. This may reflect continued investment in awareness training, email security and endpoint protection. Instead, third parties mishandling corporate information now rank as the leading cause of a breach, cited by 32 percent of respondents.

Despite these concerns, both US and UK organizations continue to invest in cyber security, with 100 percent now having an information security strategy or policy that covers employees' use of their own IT equipment for mobile or remote working. Nearly 100 percent (98%) have also increased the implementation of encryption during the past year. However, the research suggests organizations increasingly recognize that policies alone cannot prevent breaches. In fact, 34 percent of US respondents now say one of their biggest is that employees who understand the risks of a data breach will still lose data and expose the organization to a breach.

Markley concluded, "Organizations have made real progress on security policies, training and encryption, but the findings show that gaps in visibility and control remain. The next step is to make protection less dependent on people making the right decision every time. Organizations need controls that keep sensitive data secure wherever it travels and regardless of who is handling it, because mistakes and deliberate misuse both have to be anticipated."

 

###

Methodology

The research was conducted by Censuswide among a sample of 200 US and 200 UK IT security decision-makers. The data was collected between July 1 and July 6, 2026. The 2025 survey was conducted among a sample of 400 IT Security DMs across the UK and USA between 23.05.2025 - 29.05.2025. Censuswide abides by and employs members of the Market Research Society and follows the MRS code of conduct and ESOMAR principles. Censuswide is also a member of the British Polling Council.

About Apricorn

Apricorn develops and provides software-free, quantum-resistant 256-bit AES XTS hardware-encrypted storage platforms designed to protect data at rest and enable its secure portability. For more than four decades, Apricorn has maintained uncompromising quality standards, with a focus on delivering high-assurance, hardware-based security products for demanding environments. Headquartered in Poway (San Diego), California, its offerings are trusted worldwide in government, defense, aerospace, industrial, healthcare, finance, legal digital forensics, education and other security-sensitive industries. Apricorn holds numerous patents and is an AS9100-certified manufacturer. The company also supports government procurement requirements including TAA and CMMC.