Explore M-Trends 2026 report for frontline data on the latest cyber threats, including ransomware recovery denial and extreme persistence.

Google Cloud Platform provides a suite of cloud computing services for building, deploying, and managing applications and infrastructure on Google's global network. Developers can learn about cloud-native development, machine learning, and big data analytics to leverage GCP's scalable and reliable cloud infrastructure for their projects.

Google Cloud

Mandiant's M-Trends 2026 report, based on over 500,000 hours of frontline incident investigations in 2025, reveals key shifts in the cyber threat landscape. Global median dwell time rose to 14 days, while the hand-off window between initial access brokers and ransomware operators collapsed from 8 hours to just 22 seconds. Voice phishing surged to become the second-most common initial infection vector at 11%, while ransomware groups evolved beyond encryption to actively destroy backup infrastructure and virtualization management planes. Espionage groups are targeting edge devices lacking EDR telemetry, deploying persistent in-memory malware like BRICKSTORM with dwell times approaching 400 days. Mean time to exploit vulnerabilities dropped to -7 days, meaning exploitation routinely precedes patch release. AI is being integrated into attack tooling but is not yet the primary driver of breaches. Key defensive recommendations include treating low-impact alerts as critical indicators, isolating control planes, extending log retention beyond 90 days, and shifting to behavioral anomaly detection.

M-Trends 2026: Data, Insights, and Strategies From the Frontlines

Voice Phishing and the SaaS Identity Crisis

Edge Devices, Zero-Days, and Extreme Persistence