Red Report 2026

Virtualization/sandbox evasion is the 4th most prevalent attacker technique.

Adversaries shifted 80% of their tradecraft toward stealth, evasion, and persistence in 2025.

Use of data encryption for impact (ransomware encryption) dropped by 38%.

Process injection accounted for 30% of attacker techniques and is the top technique for the third consecutive year.

One in four attacks involve stealing saved passwords from browsers to authenticate as valid users.