U.S. businesses are facing an increasing number of data breaches, according to Apricorn’s 2025 annual research. The survey reveals that 76 percent of organizations have self-reported a breach or potential breach to the authorities over the past year, up from 72 percent in 2024. However, self-reporting doesn’t necessarily mean that breaches are under control.
Apricorn’s research highlights significant concerns about data security, particularly with remote and mobile workers. Two-thirds (66 percent) of surveyed organizations admit that their remote employees knowingly put corporate data at risk in the last year. Additionally, 69 percent of businesses believe their mobile workforce could lead to a future breach. This suggests ongoing challenges with user behavior and endpoint management, especially in hybrid and decentralized work environments.
Phishing and employee mistakes are the leading causes of data breaches, each accounting for 32 percent of incidents. While external threats remain a concern, human error, negligence, and malicious intent continue to be the biggest vulnerabilities in most organizations.
Despite these concerns, most companies (96 percent) have security policies in place for remote and mobile work, and they believe their employees understand and follow these policies. However, a significant gap exists in terms of capability—73 percent of respondents report that employees lack the necessary technology or skills to secure data properly, even if they are willing to comply. This is nearly unchanged from 72 percent last year, emphasizing that awareness alone is not enough.
The issue is compounded by the widespread use of employee-owned devices. In both 2025 and 2024, 62 percent of companies allow staff to use personal devices for accessing corporate systems. While many organizations implement software to control access, these solutions often lack the visibility and enforcement provided by company-issued devices. Only 12 percent of companies mandate the use of company-provisioned equipment with endpoint controls, a slight decrease from 13 percent in 2024, highlighting the need for better control over the remote attack surface.
Kurt Markley, Managing Director of Apricorn, warned that businesses must focus on more than just creating policies. “IT decision makers must go beyond policy creation and focus on equipping remote and mobile workers with the right tools and training to secure sensitive data,” he said. “Until organizations take control of endpoints and eliminate reliance on unsecured personal devices, their breach exposure will only grow.”
The survey also reveals technical and operational challenges. Almost 40 percent of organizations are unsure whether their data is properly secured or have lost visibility over where corporate data is stored. Additionally, 19 percent report that their current technology cannot support secure mobile or remote work, and 7 percent are unclear about which datasets need to be encrypted, indicating a lack of basic data classification and risk assessment.
The complexity of managing remote technologies is another growing issue. Nearly half (49 percent) of businesses say managing the technology needed for remote work is too complex. Unsurprisingly, 82 percent of respondents feel that office-based staff are more security-conscious than remote employees.
Markley concluded: “Self-reporting is a step in the right direction, but it also reveals how often breaches still occur. Policies mean little without execution. Organizations must equip remote teams with secure tools like hardware-encrypted drives, control how data moves, and build security into everyday habits. With many employees still working outside the office, raising their security know-how is not optional, it’s essential.”
