2026 Global Incident Response Report

Encryption-based extortion declined by 15% compared to the previous year.

Many organizations run 50 or more security products.

Nearly 48% of incidents include browser-based activity.

In the fastest cases, attackers moved from initial access to data exfiltration in 72 minutes, four times faster than the previous year.

Identity weaknesses play a material role in nearly 90% of investigated incidents.

Attackers leverage third-party SaaS applications in 23% of incidents.

Misconfigurations or gaps in security coverage materially enable attacks in over 90% of incidents.

87% of intrusions involve activity across multiple attack surfaces.