Report by IBM
2026 X-Force Threat Intelligence Index
Key Findings
Active ransomware and extortion groups increased by 49% year over year.
Vulnerability exploitation accounted for 40% of incidents observed by IBM X‑Force in 2025.
Manufacturing accounted for 27.7% of incidents observed by IBM X‑Force.
North America accounted for 29% of total cases observed by IBM X‑Force.
Manufacturing is the top targeted sector for the fifth consecutive year.
North America became the most-attacked region for the first time in 6 years.
Publicly disclosed victim counts increased by roughly 12%.
North America's share of total cases increased from 24% in 2024 to 29%.
Attacks that begin with exploitation of public-facing applications increased by 44%, largely driven by missing authentication controls and AI-enabled vulnerability discovery.
Infostealer malware led to the exposure of over 300,000 ChatGPT credentials in 2025.
Large supply chain and third-party compromises have nearly quadrupled since 2020.