Cyberattack Trends - Insights from Kaspersky's 2026 Report

What Happened

The Kaspersky Security Services report for 2026 sheds light on the evolving landscape of cyberattacks, drawing from data collected through their Managed Detection and Response (MDR) and Incident Response (IR) services. The report reveals that in 2025, Kaspersky processed an average of 15,000 telemetry events per host daily, resulting in approximately 400,000 alerts. This data highlights the increasing sophistication and volume of cyber threats facing organizations worldwide.

The report not only details the number of incidents but also categorizes them by industry. Government and industrial sectors remain the most targeted, while the IT sector has seen a notable rise in incident response requests, surpassing financial organizations this year. This shift underscores the growing focus on IT security as a critical area of concern.

Who's Being Targeted

In 2025, the distribution of cyberattacks revealed that 18.5% of incidents targeted government entities, with 16.6% aimed at industrial organizations. The IT sector's rise to prominence in the rankings indicates a shift in threat actors' focus. Financial organizations, previously a primary target, have seen a decline in attacks, suggesting that adversaries are adapting their strategies to exploit vulnerabilities in less fortified sectors.

The report also highlights that over 80% of attacks utilized initial vectors such as exploitation of public-facing applications and trusted relationships. This trend indicates that attackers are increasingly leveraging existing trust to infiltrate organizations, making it essential for businesses to reassess their security measures.

Key Trends and Statistics

Kaspersky's report outlines several key trends in cyberattacks for 2025:

• The number of high-severity incidents has decreased, continuing a downward trend since 2021. This suggests that while adversaries are still active, organizations are improving their defensive measures.
• A significant number of vulnerabilities exploited were related to Microsoft products, with many leading to remote code execution without authentication.
• The use of legitimate tools in attacks, such as PowerShell and Mimikatz, indicates that adversaries are increasingly relying on tools that blend in with normal operations to avoid detection.

These findings reveal a landscape where attackers are not only persistent but also evolving their tactics to circumvent traditional defenses.

What You Should Do

Organizations should take proactive steps to bolster their defenses against the trends identified in the Kaspersky report. Here are some recommended actions:

• Enhance monitoring: Implement advanced monitoring solutions to detect unusual activity, especially regarding trusted relationships and public-facing applications.
• Regular vulnerability assessments: Conduct frequent assessments to identify and patch vulnerabilities, particularly those associated with widely used software like Microsoft products.
• Employee training: Ensure that employees are aware of the latest phishing tactics and social engineering techniques that attackers may use to gain access.

By staying informed and adapting to the changing threat landscape, organizations can better protect themselves against the increasing sophistication of cyberattacks.