Security Report · raw.githubusercontent.com

Intezer’s 2026 AI SOC Report Finds Threats Hidden in Low-Severity Alerts

Oct 20, 2026 · Original Report (PDF) ↗

Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.

Summary

Intezer’s analysis of 25 million security alerts from 2025 found genuine threats among low-severity events, persistent infections despite reported mitigation, and widespread phishing abuse of trusted services.

Key points

The report analyzes 2025 telemetry across Intezer’s global customer base, including 25 million alerts, 180 million files, 550,000 emails, and 82,000 endpoint forensic investigations.
Of 3.9 million low-severity or informational endpoint alerts, approximately 77,000 represented real incidents, according to Intezer.
Live endpoint scans found roughly 2,600 active infections; about 1,300 had alerts that the endpoint protection vendor reported as mitigated.
Of 550,000 user-reported suspected phishing emails, approximately 42,000 were confirmed malicious. Brand impersonation and callback scams were the leading techniques.
Attackers abused legitimate developer hosting and payment services, CAPTCHA barriers, and concealed content in SVG, PDF, and OpenXML files to support phishing and evade inspection.
Only about 2% of impossible-travel alerts represented confirmed compromises; VPNs, mobile routing, and security-service infrastructure contributed to false positives.
Defense evasion and persistence dominated cloud alert tactics, while roughly 70% of AWS control findings concerned S3 hardening, including access restrictions, logging, and encrypted transport.

Article Details

Publisher: Intezer
Report Period: 2025-01-01 to 2025-12-31
Scope: Aggregated, anonymized analysis of endpoint, network, phishing, identity, and cloud security activity across Intezer’s global customer base.
Sample Size: More than 25 million security alerts across 10 million monitored endpoints and identities.
Key Statistics: Intezer reports that fewer than 2% of alerts required human escalation, with 98% verdict accuracy and a sub-minute median triage time.
Among 9.25 million endpoint alerts, approximately 3.9 million were informational or low-severity; about 77,000 of those alerts represented real incidents.
Of approximately 82,000 live endpoint scans, 2,600 identified active infections; approximately 1,300 of those infections had been reported as mitigated by the source vendor.
Of 550,000 user-reported phishing emails analyzed in 2025, approximately 42,000 were confirmed malicious, slightly less than 8%.
Approximately 70% of cloud security control findings grouped by service related to S3 security hardening.
Recommendations: Investigate low-severity and informational alerts rather than relying on severity labels to exclude them from triage.
Use behavioral and memory-based analysis to identify concealed payloads and verify whether endpoint threats remain active after reported mitigation.
Combine scanner alerts with threat intelligence and affected-device or account context to determine whether a breach occurred.
Modernize internal authentication traffic to use encrypted transport, including LDAPS or StartTLS instead of unencrypted LDAP.
Harden S3 configurations by enforcing encrypted transport, enabling server access logging, and restricting cross-account access.

Indicators of compromise

Type	Indicator	Context
IPV4	`139[.]144[.]52[.]241`	Identified malicious vulnerability scanner associated with 478 alerts.
IPV4	`141[.]98[.]80[.]118`	Malicious password brute-force source associated with 438 alerts.
IPV4	`172[.]245[.]163[.]134`	Identified malicious port scanner associated with 417 alerts.
IPV4	`185[.]44[.]76[.]10`	Identified malicious port scanner associated with 564 alerts.
IPV4	`195[.]140[.]213[.]28`	Identified malicious port scanner associated with 474 alerts.
IPV4	`45[.]134[.]26[.]32`	Identified malicious port scanner associated with 414 alerts.
IPV4	`45[.]142[.]193[.]107`	Identified malicious port scanner associated with 519 alerts.
IPV4	`45[.]224[.]42[.]19`	Malicious SSH brute-force source associated with 1,095 alerts.
IPV4	`46[.]17[.]96[.]38`	Identified malicious port scanner associated with 656 alerts.
IPV4	`79[.]124[.]62[.]122`	Identified among the report’s most active malicious scanners; generated 4,462 port-scanning alerts.