Security Report · raw.githubusercontent.com

CyberProof 2026 Threat Report Highlights Identity Abuse and Enterprise Platform Exploitation

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

CyberProof’s 2026 threat report reviews 2025 intrusions, highlighting identity abuse, SaaS integration compromise, rapid enterprise vulnerability exploitation, and operational disruption. It recommends stronger help-desk verification and OAuth controls.

Key points

The report identifies identity compromise as a recurring driver of major intrusions, including IT impersonation, help-desk manipulation, MFA resets, and abuse of legitimate remote-support tools.
CyberProof reports a 17% year-over-year increase in vulnerability exploitation, highlighting SAP NetWeaver CVE-2025-31324, SharePoint CVE-2025-53770, and Oracle E-Business Suite CVE-2025-61882.
Salesforce ecosystem campaigns abused OAuth tokens and connected applications, including Drift and Gainsight, rather than vulnerabilities in Salesforce’s core platform; claims and third-party reporting indicated hundreds of affected tenants.
The report cites a 58% quarter-over-quarter rise in retail ransomware activity in Q2 2025 and describes how manufacturing, retail, and aviation incidents disrupted operations through shared technology dependencies.
CyberProof describes increased reuse of infrastructure, affiliates, and tradecraft among criminal groups, alongside overlap between state-aligned and financially motivated intrusion methods.
Its 2026 forecasts include more deepfake-assisted vishing, legitimate RMM tool abuse, regulatory-pressure extortion, and exposure from ungoverned AI use.
Recommendations include strict verification for account recovery, least-privilege OAuth access, token auditing and revocation, and recovery exercises covering identity compromise, SaaS outages, and critical third-party dependencies.

Article Details

Publisher: CyberProof
Report Period: 2025-01-01/2025-12-31
Scope: Global cyber incidents, enterprise vulnerability exploitation, identity abuse, ransomware, supply-chain compromise, and geopolitical cyber activity.
Key Statistics: Vulnerability exploitation accounted for an estimated 25–35% of successful ransomware incidents across observed intrusions in 2025; the underlying sample size was not disclosed.
Publicly disclosed ransomware incidents affecting global retail increased by 58% in Q2 2025 compared with Q1.
Manufacturing attacks increased by 61% compared with the previous year, and the sector accounted for 26% of all attacks in 2025, according to the report.
More than 400 organizations globally were reportedly impacted by exploitation of the SharePoint vulnerability discussed in the report.
Reported ClickFix activity increased by over 500% in 2025 and represented close to 8% of blocked attack attempts; the report did not disclose the underlying observation population.
Recommendations: Continuously validate user behavior, privilege use, and authentication context across cloud, SaaS, and on-premises environments.
Protect MFA resets, account recovery, and remote-support approvals with strict identity verification, escalation controls, and monitoring.
Maintain visibility into SaaS integrations, enforce least-privilege API access, audit token scope and usage, and implement token revocation and application allowlisting.
Identify operational dependencies on third-party platforms and incorporate their potential disruption into resilience planning, incident-response exercises, and contractual security requirements.
Test backups, recovery procedures, and incident-response playbooks against data theft, partial outages, identity compromise, and SaaS disruption, rather than encrypted endpoints alone.