HP Wolf Security
Reports
All Statistics
In Q2 2025, 13% of malicious emails (phishing, malware, etc.) were not blocked by the email gateway security system. This is 1 percentage point higher than in Q1 2025.
In Q2 2025, 40% of all detected cyber threats (malware, phishing payloads, etc.) were sent inside archive files (like .zip, .rar, .7z). This share is 2 percentage points higher than in Q1 2025.
Email remained the top vector for delivering malware, accounting for 61% of threats caught by HP Sure Click in Q2 2025. This was a 1 percentage point drop compared to Q1 2025.
60% of IT and security decision-makers warn that a lack of collaboration between procurement, IT, and security puts their organization at risk.
36% of IT and security decision-makers apply firmware updates promptly during the Ongoing Management stage.
86% of IT and security decision-makers say data security is a barrier to printer reuse, resale, or recycling.
In Q4 2024, HP threat researchers saw a growth in social engineering campaigns that rely on fake CAPTCHA challenges to infect users with malware
In Q4 2024, archives were the second most popular malware delivery file type with 32% of threats
11% of email threats evaded gateway security in Q4 2024
Archive files were the second most popular file type for malware delivery in Q3 2024, accounting for 34% of threats. The top five archive file formats used were ZIP, RAR, LZH, 7Z, and GZ3.
Malicious spreadsheets (e.g. XLS, XLSX) totaled 7% of threats detected in Q3 2024.
Email was the primary method for delivering malware to endpoints, accounting for 52% of threats in Q3 2024. This represents a 9% decrease compared to Q2 2024.
Malicious spreadsheets (e.g., XLS, XLSX) totaled 4% of threats in Q2 2025, showing a 2 percentage point drop from Q1 2025.
PDF files were responsible for 8% of threats in Q2 2025, a 2 percentage point fall compared to Q1 2025.
Documents, such as Microsoft Word formats (e.g., DOC, DOCX), accounted for 9% of threats in Q2 2025, growing by 1 percentage point over the previous quarter.
Threats delivered by other vectors, such as removable media, slightly grew by 1 percentage point in Q2 2025 compared to the previous quarter, reaching 16% of threats.
Executables and scripts were the second most popular delivery type, making up 35% of threats in Q2 2025, a 1 percentage point growth from Q1 2025.
Malicious web browser downloads made up 23% of threats in Q2 2025, with no change compared to Q1 2025.
More than half (51%) of IT and security decision-makers cannot confirm if a printer has been tampered with in the factory or in transit once it arrives.
1-in-10 (10%) of IT and security decision-makers insist on destroying both the device and its storage drives to ensure data security.
42% of IT and security decision-makers fail to involve IT/security teams in vendor presentations.
On average, IT and security decision-makers report having approximately 80 printers that are redundant or are in the process of being decommissioned within their organizations.
Only 32% of IT and security decision-makers can detect security events linked to hardware-level attacks.
35% of IT and security decision-makers are uncertain whether printers can be fully and safely wiped using current sanitisation solutions.
IT teams spend 3.5 hours per printer per month managing hardware and firmware security issues.
1-in-4 (25%) of IT and security decision-makers believe it’s necessary to physically destroy printer storage drives.
54% of IT and security decision-makers fail to request technical documentation to validate security claims.
Only 38% of IT and security decision-makers say procurement, IT, and security collaborate to define printer security standards during the Supplier Selection & Onboarding stage.
Only 35% of IT and security decision-makers are able to identify vulnerable printers based on newly published hardware or firmware vulnerabilities.
70% of IT and security decision-makers are increasingly worried about offline threats, such as employees printing and mishandling sensitive company information.
55% of IT and security decision-makers fail to submit vendor responses to security teams for review.
Only 34% of IT and security decision-makers can track unauthorized hardware changes made by users or support teams.
The popularity of executables and scripts as a malware delivery type saw a 3% point rise over Q3 2024
Malicious PDF documents were the third most popular threat file type isolated by HP Sure Click in Q4 2024
More than half (53%) of threats targeting endpoints were delivered by email in Q4 2024
Threats delivered in PDF documents accounted for 10% in Q4 2024
In Q4 2024, executables and scripts retained first place as the most popular malware delivery type with 43% of threats caught by HP Sure Click
8% of threats relied on documents such as Microsoft Word formats (e.g. DOC, DOCX) in Q4 2024
Malicious spreadsheets (e.g. XLS, XLSX) totalled 3% of threats in Q4 2024
10% of threats were PDF files in Q4 2024
Executables and scripts were the most popular type of malware delivery file, making up 40% of threats in Q3 2024. This is a 5% point increase compared to Q2 2024.
8% of detected threats in Q3 2024 relied on documents such as Microsoft Word formats (e.g. DOC, DOCX).
PDF files were responsible for 9% of threats detected in Q3 2024, showing a 2% point rise compared to Q2 2024.
Of detected email threats, 11% were able to bypass email gateway scanners in Q3 2024, a 1% decrease compared to Q2 2024.
Web browser downloads were the second most common malware delivery method to endpoints, responsible for 28% of threats in Q3 2024. This is a 10% increase compared to Q2 2024.
Threats delivered by other vectors (such as removable media) to endpoints accounted for 20% of threats in Q3 2024, a 1% decrease compared to the previous quarter.