Why this report exists


Every vendor with an MCP security product has an opinion about MCP risk. What the industry does not have is a shared snapshot of the ecosystem: what got hit, what the attackers did, which controls would have caught which attack, and where the gaps sit in April 2026.

This report is the snapshot. It covers public incidents...