CYFIRMA Says Identity and Infrastructure Telemetry Are Reshaping Incident Investigations
Summary
CYFIRMA’s Threat Horizon update says investigations increasingly rely on identity, cloud and infrastructure telemetry. It reports rising malware-free detections and telemetry gaps, and urges defenders to retain logs beyond default windows.
Key points
- CYFIRMA reports that 79% of detections were malware-free, up from 40% in 2019; it also cites a latest figure of 82%.
- The update says about 90% of Unit 42 incident-response cases involved identity loopholes, and 67% of incidents began with identity compromise.
- It reports a twofold increase in telemetry gaps, describing missing logs as the second-leading incident-response factor.
- The series expects attribution to rely more on infrastructure reuse, including hosting, domains and identity patterns, rather than malware samples.
- CYFIRMA recommends treating identity and cloud telemetry as tier-one forensic evidence and extending log retention beyond default windows.
Article Details
- Publisher
- CYFIRMA
- Report Period
- Q3 2026 check-in and mid-year 2026 update; published 2026-10-27
- Scope
- Prediction tracking on identity, cloud, and infrastructure telemetry in incident response and threat attribution.
- Key Statistics
- Malware-free detections were reported at 79%, with a latest figure of 82%, compared with 40% in 2019.
- Approximately 90% of Unit 42 incident-response cases involved identity loopholes.
- 67% of incidents reportedly began with identity compromise rather than malware.
- Telemetry gaps reportedly doubled year over year; missing logs were ranked the #2 incident-response factor.
- Recommendations
- Treat identity and cloud telemetry as tier-1 forensic evidence.
- Extend log retention well beyond default windows.