Security Report · raw.githubusercontent.com

Darktrace 2026 Threat Report Highlights Identity Abuse, Phishing and Data Extortion

Oct 20, 2026 · Original Report (PDF) ↗

Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.

Summary

Darktrace’s 2026 report analyzes 2025 customer telemetry, highlighting identity compromise, cloud abuse and data extortion. It recorded over 32 million high-confidence phishing emails, 70% of which passed DMARC authentication.

Key points

The report combines 2025 customer telemetry, behavioral anomalies and incident investigations with external intelligence; regional findings are influenced by Darktrace’s customer distribution.
SaaS/Microsoft 365 account compromise and email-based social engineering accounted for nearly 70% of recorded incidents in the Americas, where most regional customers are US-based.
Cloud account and email compromises represented 58% of incidents observed among European customers, exceeding network-based compromises.
Darktrace detected over 32 million high-confidence phishing emails globally; 70% passed DMARC authentication, over 8.2 million targeted VIPs and over 1.2 million used QR codes.
Manufacturing accounted for 29% of recorded ransomware incidents in the Americas. The report describes increasing use of pre-encryption exfiltration and data-leak pressure.
Critical infrastructure case studies describe attackers abusing trusted accounts, shared gateways and third-party services, including a compromised energy-sector SaaS account used to download PLC configuration files.
Defensive recommendations include privileged-account monitoring, MFA hardening, timely patching, network segmentation and visibility into cloud identities and exposed edge infrastructure.

Article Details

Publisher: Darktrace
Report Period: 2025-01-01 to 2025-12-31
Scope: Global customer threat detections, SOC investigations, cloud honeypot observations, and regional and sector analysis. Findings are influenced by customer distribution; email analysis excludes unavailable June 2025 data.
Sample Size: Over 32 million high-confidence phishing emails; total customer and incident sample sizes not disclosed.
Key Statistics: Darktrace / EMAIL detected over 32 million high-confidence phishing emails in 2025, including over 8.2 million targeting VIPs; June data was unavailable.
70% of phishing emails analyzed by Darktrace successfully passed DMARC authentication.
SaaS/M365 account compromise and phishing or email-based social engineering accounted for nearly 70% of recorded incidents in the Americas, where the customer population was predominantly US-based.
Cloud account and email compromises accounted for 58% of incidents observed among Darktrace customers in Europe in 2025, versus 42% for network-based compromises.
In 78% of Akira cases identified by Darktrace, the suspected entry vector was an edge device such as a VPN gateway or firewall; most involved a SonicWall appliance.
Recommendations: Continuously monitor privileged accounts, alert on new administrative credential usage on servers, and treat external VPN logins to domain controllers as high-severity events.
Harden MFA, establish device baselines, and constrain access through least privilege.
Patch vulnerable platforms promptly and prioritize remediation using exploitability, exposure, and behavioral indicators rather than severity scores alone.
Segment networks, restrict unnecessary outbound ports, monitor DNS for domain generation algorithms, and isolate suspicious devices.
Strengthen phishing resilience, detect macro abuse, and maintain visibility into suspicious execution and persistence behaviors.