Each new edition of Cyentia’s Information Risk Insights Study (IRIS) presents an opportunity to reorient our understanding of the cybersecurity landscape, not just in the present, but across time. IRIS 2025 is no different, except perhaps in its explicit focus on time itself. After 15 years of longitudinal data, we can finally test many of the assumptions that have shaped boardroom briefings, insurance policies, and cyber risk models. Some of them hold up. Some do not. Either way, it’s about time we took a harder look.
