Orange Cyberdefense Security Navigator 2026 Reports Incident and Threat Trends
Report discovered via Awesome Annual Security Reports.
Summary
Orange Cyberdefense’s 2026 report presents incident, response-time, vulnerability-scanning and SMB detection data, alongside trends in hacktivism, cyber extortion and digital sovereignty.
Key points
- From October 2024 to August 2025, Orange Cyberdefense recorded 139,373 potential incidents and 19,053 confirmed incidents, with a reported global true-positive rate of 13.7%.
- Among confirmed incidents, 56.9% were attributed to internal actors and 39.1% to external actors; misuse and hacking were the most common action categories.
- The report says 72.6% of true-positive incidents were confirmed and resolved within a day, while 86.6% were resolved within five days.
- SMB micro-SOC data covering 1,943 customers and about 1.5 million endpoints reported 1.63 million resolved incidents, with 51% confirmed as true positives.
- Vulnerability-scanning operations recorded 1,289,451 findings across 60,837 assets; the report says findings typically remain open for about six months.
- The report describes rising hacktivism activity targeting Nordic countries, including increased coordination and attacks linked to real-world events.
Article Details
- Publisher
- Orange Cyberdefense
- Report Period
- October 2024 to September 2025, with confirmed-incident data covering October 2024 to August 2025
- Scope
- Security operations, confirmed incidents, SMB micro-SOC detections, vulnerability scanning, cyber extortion monitoring, and hacktivism trends
- Sample Size
- Confirmed incidents: 19,053; SMB micro-SOC data: 1,943 customers, approximately 1.5 million endpoints, and 1.63 million resolved incidents; vulnerability scanning: 1,289,451 findings across 60,837 assets.
- Key Statistics
- For October 2024 to August 2025, 139,373 potential incidents yielded 19,053 confirmed incidents; the reported global true-positive rate was 13.7%.
- Of confirmed incidents, 56.9% were attributed to internal actors and 39.1% to external actors.
- For SMB micro-SOC data from September 2024 to September 2025, 835,640 of 1.63 million resolved incidents (51%) were confirmed as true positives; 85% were resolved within one hour and 4% remained unresolved.
- From October 2024 to September 2025, vulnerability scanning recorded 1,289,451 findings across 60,837 assets; most vulnerabilities remained open for approximately six months.
- Among true-positive incidents, 40.6% were confirmed and resolved within an hour, 72.6% within a day, and 86.6% within five days.
- Recommendations
- Maintain human oversight for nuanced or multi-stage intrusions.
- Address supplier maturity and supply-chain security as collective responsibilities.
- Build resilient, independent digital capabilities while managing technological dependencies.
People
Bjørn RasmussenIdentified as CTO Norway at Orange Cyberdefense.Bo DrejerIdentified as Director–GRC & Advisory at Orange Cyberdefense.Charl van der WaltIdentified as Global Head of Security Research and quoted on Europe's cybersecurity resilience.Jensen HuangQuoted as CEO of Nvidia on China's rise in AI research, patents, and STEM education.Joen MagieresIdentified as Chefkonsulent at Dansk Erhverv.Sanne AagaardIdentified as Marketing Manager Denmark at Orange Cyberdefense.Søren PedersenIdentified as CTO Denmark at Orange Cyberdefense.Ursula von der LeyenQuoted as President of the European Commission on European AI and independent digital infrastructure.
Threat Actors
Vendors
Capgemini- **Bleu**: A joint venture between Orange and Capgemini delivering Microsoft Azure and Microsoft 365 in a Trusted Cloud designed for organizations with high security and data sovereignty requirements. Operating underNvidia- **Jensen Huang (CEO Nvidia)**: Highlighted China's massive rise in AI research, patents, and STEM education, noting a complete flip in global technological leadership over the past decade.Orange CyberdefenseOrganization: Orange Cyberdefense
Products
Core Fusion- **Events**: ELDoXg/XsDR, Network sensors, SIEM, enriched incident data from Core Fusion platform.Microsoft 365 Apps for Enterprise- **Bleu**: A joint venture between Orange and Capgemini delivering Microsoft Azure and Microsoft 365 in a Trusted Cloud designed for organizations with high security and data sovereignty requirements. Operating underMicrosoft Azure- **Bleu**: A joint venture between Orange and Capgemini delivering Microsoft Azure and Microsoft 365 in a Trusted Cloud designed for organizations with high security and data sovereignty requirements. Operating under
Countries
China- **Jensen Huang (CEO Nvidia)**: Highlighted China's massive rise in AI research, patents, and STEM education, noting a complete flip in global technological leadership over the past decade.Ukraine3. **Establishment Era (2014 and Onward)**: More cynical and reactionary, governments tolerate or even support, targeting national infrastructure, IT Army of Ukraine, NoName057(16), CyberAveng3rs.