Report by SonicWall
2026 Professional Services Protect Brief
Key Findings
Professional services generated 3 billion IPS events in the first half of 2026, the largest absolute attack volume of any industry tracked.
Professional services recorded 69.9 million ransomware hits in the first half of 2026, more than any other vertical.
Directory traversal, malformed request probes and remote code execution signatures accounted for 72% of all IPS volume in the professional services sector.
SIPVicious VoIP exploitation generated 332 million combined hits in professional services, with the related signatures ranked #3 and #6 by volume.
Ten active ransomware families operated simultaneously against the professional services sector in the first half of 2026, including Filecoder (19.1 million hits across 113 organizations), Gandcrab (11.9 million) and Ryuk (10.5 million).
Apache Log4j2 (Log4Shell) generated 107 million hits in the professional services sector, 2.5 years after public disclosure and emergency patching across the industry.
460 organizations in the professional services sector are actively detecting ransomware campaigns, representing the broadest exposure of any vertical.