Mandiant

Exploits continue to be the most common initial infection vector (33%).

8% of threat groups were motivated by espionage.

55% of threat groups active in 2024 were financially motivated, showing a steady increase.

Global median dwell time was 5 days when adversaries notified (notably in ransomware cases).

High tech (10.6%) was the 3rd most targeted industry.

Healthcare (9.3%) was the 5th most targeted industry.

Financial (17.4%) was the #1 targeted industry.

Global median dwell time was 26 days when external entities notified.

Government (9.5%) was the 4th most targeted industry.

Business and professional services (11.1%) was the 2nd most targeted industry.

Global median dwell time was 10 days when organizations discovered malicious activity internally

The Global median dwell time rose to 11 days in 2024, up from 10 days in 2023.

Stolen credentials are the second highest initial infection vector, making up 16% of investigations. This rise means stolen credentials were the second most common initial infection vector for the first time in 2024.

Financial (17.4%) was the #1 targeted industry.

High tech (10.6%) was the 3rd most targeted industry.