In February 2026, Palo Alto Networks published the findings of its incident response teams for the year 2025. More than 750 major cyberattacks handled across more than 50 countries. What the report reveals is not a catalogue of new offensive tools. It is confirmation that attackers are gaining ground on known weaknesses, moving faster, with fewer resources than before.
Four signals deserve careful reading, without shortcuts.
AI Has Quadrupled the Speed of the Fastest Attacks
In 2024, the fastest quartile of intrusions reached data exfiltration in 285 minutes. In 2025, that same group gets there in 72 minutes. Not because attackers have become more skilled. Because they have automated steps that were still manual a year earlier.
The report documents ransomware deployment scripts showing characteristics consistent with AI-assisted development: unusually thorough commenting, standardised variants, efficiency-focused fallback logic. The practical result: near-mechanical execution across hundreds of systems simultaneously, with no human operator required at each step.
The other side of this shift is less technical but equally telling. An attacker with no technical background used a large language model to structure an extortion campaign after stealing data, including pressure messages, deadlines and negotiation tactics. He recorded his threat videos from his bed, visibly intoxicated, reading the AI-generated script word for word. The victim received a perfectly structured demand. AI did not make this individual dangerous. It made his incompetence invisible.
What this means in practice: according to Unit 42 data, attackers begin scanning for newly discovered vulnerabilities within 15 minutes of a CVE being published. For most organisations, the time it takes for an alert to reach the right person, a decision to be made, and a patch applied to internet-facing assets is measured in hours. That window no longer exists.
Identities: Not the Entry Point, But the Internal Highway
The report establishes that identity-related weaknesses are present in nearly 90% of investigated incidents. This figure circulates widely, and is frequently misread. It does not mean that identities are the primary initial access vector. The two leading entry points remain phishing and software vulnerability exploitation, each accounting for 22% of cases.
Identities are what attackers exploit once inside, to move through the environment without triggering alerts. The distinction matters strategically: hardening the perimeter and limiting what an intruder can do once inside are two separate workstreams. Conflating them means over-investing on the outside while leaving the interior wide open.
An analysis of 680,000 cloud accounts conducted across Unit 42 investigations found that 99% of users, roles and services had excessive permissions, some unused for more than 60 days. A concrete example: an IT contractor who left a company four months ago but whose service account still holds administrative rights over the Azure environment. An attacker who compromises that account through credentials sold on the dark web does not need to force anything. They log in, and they move.
The question is not whether this scenario is possible. It is how many accounts of this type exist in your environment today, and whether anyone has a complete list.
SaaS Integrations: An Attack Surface Nobody Is Mapping
In 2022, SaaS applications were involved in 6% of incidents handled by Unit 42. In 2025, that figure reaches 23%. The increase reflects a straightforward reality: organisations have massively interconnected their tools through standardised authorisation protocols, without maintaining a rigorous registry of those connections.
The attack mechanism is well documented in the report. Attackers used valid OAuth tokens from an integration between two commercial tools, a sales engagement platform and a CRM, to access a target company’s Salesforce environment. The generated traffic was indistinguishable from normal automated synchronisation. The post-incident investigation revealed that the company had nearly 100 third-party integrations connected to Salesforce, many of them dormant, some registered to former employees.
This is not an edge case. It reflects a configuration found in the vast majority of organisations that have been running a SaaS ecosystem for several years. Each authorised integration inherits access rights at the moment of its creation. Those rights are not automatically revoked when the integration stops being used. Over time, every connected tool becomes a potential exposure surface that no one is watching.
In 2025, the Most Effective Malware Was Called "Candidate" or "Contractor"
China, North Korea and Iran account for the bulk of state-sponsored activity documented in the report. What changed in 2025 is not who is attacking, but how deeply they embed themselves and how long they stay undetected.
China-aligned groups have shifted toward compromising virtualisation and infrastructure layers. The BRICKSTORM malware, publicly attributed to Chinese state-sponsored actors by CISA, concealed its command-and-control communications inside ordinary encrypted web sessions, making detection through standard network monitoring extremely difficult. The objective is no longer to extract a batch of data. It is to establish durable, invisible access.
North Korea operates differently. The Wagemole campaign enabled North Korean operatives to obtain remote employment as employees or contractors at US and European organisations. Legitimate internal access, income routed back to the regime, espionage running in parallel. In 2025, Unit 42 identified and evicted activity linked to this campaign from more than 20 enterprise environments. Iran, for its part, created fraudulent recruitment portals mimicking aerospace and defence companies, delivering malware through fake application packages signed with valid code-signing certificates.
These techniques primarily target large organisations. But mid-sized companies operating as subcontractors or partners in sensitive sectors, defence, energy, critical infrastructure, are documented as rebound targets. The supply chain remains the least monitored path toward the most protected systems.
What This Report Changes in Terms of Priorities
More than 90% of intrusions documented by Unit 42 were enabled not by sophisticated exploits but by misconfigurations and inconsistently applied controls. Attackers are not innovating. They are walking through what has been left open.
Three workstreams this report puts back at the top of the list: reducing patch latency on internet-facing assets, auditing active access rights across cloud and SaaS environments, and mapping third-party integrations to identify dormant or orphaned connections. None of the three requires exceptional budget. Each requires operational rigour that few organisations sustain over time.
This is precisely the kind of continuous monitoring that Stroople, holder of the Expert Cyber label awarded by Cybermalveillance.gouv.fr, implements for organisations that do not have a dedicated team capable of maintaining that level of vigilance.
Key Takeaways
- 72 minutes: the median exfiltration time for the fastest quartile of attacks in 2025, down from 285 minutes in 2024.
- 99% of cloud accounts analysed in Unit 42 investigations had excessive access rights.
- SaaS integrations were involved in 23% of incidents in 2025, up from 6% in 2022. Most organisations have no up-to-date registry of these connections.
Source: Palo Alto Networks Unit 42, Global Incident Response Report 2026, February 2026, based on 750+ incidents handled between October 2024 and September 2025.
