In 2025, attacker dwell time rose, voice phishing topped email phishing, and threat actors increasingly targeted backup and identity systems, according to Mandiant’s latest incident response data.

CSO Online offers insights into cybersecurity, risk management, and IT leadership, providing articles, reports, and expert analysis to help security professionals navigate the evolving threat landscape and protect their organizations from cyber attacks. By exploring CSO Online's curated content, CISOs, security managers, and IT executives can learn about threat intelligence, security frameworks, and incident response strategies for building resilient cybersecurity programs. Whether you're defending against ransomware, phishing attacks, or insider threats, CSO Online offers resources to strengthen your security posture and safeguard your digital assets.

CSO Online

Mandiant's M-Trends 2026 report reveals significant shifts in the 2025 threat landscape. Attacker hand-off times between initial access brokers and ransomware groups collapsed from 8 hours in 2022 to just 22 seconds. Median dwell time rose to 14 days overall, with externally-notified incidents averaging 25 days. Voice phishing surpassed email phishing as the second most common initial infection vector (11% vs 6%), while exploits led at 32%. Ransomware operators are now systematically targeting backup infrastructure, identity services, and virtualization platforms in a 'recovery denial' strategy, forcing victims to pay even when backups exist. AI is accelerating early-stage attack efficiency but not fundamentally changing breach causes. CISOs are advised to rethink alert triage, treat identity and backup systems as Tier-0 assets, adopt behavioral detection, and extend log retention.

Faster attacks and ‘recovery denial’ ransomware reshape threat landscape