Mandiant

Highly interactive voice phishing accounted for 11% of intrusions, making it the second-most common initial infection vector.

The high tech sector accounted for 17% of incidents.

Prior compromise accounted for 10% of initial infection vectors globally, ranking third-most common.

Stolen credentials are the second highest initial infection vector, making up 16% of investigations. This rise means stolen credentials were the second most common initial infection vector for the first time in 2024.

Exploits continue to be the most common initial infection vector (33%).

8% of threat groups were motivated by espionage.

Exploits remained the most common initial infection vector for the sixth consecutive year, accounting for 32% of intrusions.

Email phishing accounted for 6% of intrusions in 2025.

Mean time to exploit vulnerabilities was -7 days, indicating exploitation routinely occurs before patches are released.

Organizations first detected evidence of malicious activity internally 52% of the time in 2025, up from 43% in 2024.

Median dwell time for cyber espionage incidents and North Korean IT worker incidents was 122 days.

Global median dwell time was 14 days, up from 11 days.

Prior compromise was the top initial infection vector in ransomware operations at 30%, up from 15% in 2024.

Median time between initial access and hand-off to a secondary threat group was 22 seconds in 2025, down from more than 8 hours in 2022.

BRICKSTORM achieved dwell times of nearly 400 days.

The financial sector accounted for 14.6% of incidents.

55% of threat groups active in 2024 were financially motivated, showing a steady increase.

Global median dwell time was 5 days when adversaries notified (notably in ransomware cases).

High tech (10.6%) was the 3rd most targeted industry.

Healthcare (9.3%) was the 5th most targeted industry.

Financial (17.4%) was the #1 targeted industry.

Global median dwell time was 26 days when external entities notified.

Government (9.5%) was the 4th most targeted industry.

Business and professional services (11.1%) was the 2nd most targeted industry.

Global median dwell time was 10 days when organizations discovered malicious activity internally

The Global median dwell time rose to 11 days in 2024, up from 10 days in 2023.

Financial (17.4%) was the #1 targeted industry.

High tech (10.6%) was the 3rd most targeted industry.