Security Report · raw.githubusercontent.com

Kaspersky 2026 Report Highlights Exploited Applications, Trusted Access and SOC Detection Gaps

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

Kaspersky’s 2026 report finds public-facing application exploits accounted for 43.7% of investigated initial access vectors in 2025. It also highlights trusted-relationship compromises and gaps in SOC detection coverage.

Key points

The report draws on Kaspersky MDR, Incident Response, Compromise Assessment and SOC Consulting data. Its customer distribution is geographically uneven, with the largest share in the CIS.
Among investigated IR cases, public-facing application exploits accounted for 43.7% of initial access vectors, valid accounts for 25.4% and trusted relationships for 15.5%. Compromised service providers enabled downstream customer intrusions.
Data encryption was the most common resulting damage in IR investigations, accounting for 39.4%. Half of the vulnerabilities identified in IR engagements enabled remote code execution.
High-severity incidents represented 3.8% of MDR incidents in 2025, down from 14.3% in 2021. Average detection and reporting time for high-severity incidents fell from 53.9 minutes in 2024 to 42.1 minutes.
IR attack-duration groups ranged from a median of less than one day for rapid attacks to 108 days for long-lasting attacks; median response effort increased from 20 to 100 hours across those groups.
A SAP NetWeaver case involved malicious DLL sideloading through legitimate executables. The destructive payload truncated files larger than 5 MB, permanently destroying data beyond that threshold.
SOC assessments found mean detection-rule coverage of data sources was 43%, with network telemetry, databases and web servers commonly uncovered. Compromise Assessment statistics indicated 18.6% of detected incidents were found manually.

Article Details

Publisher: Kaspersky Security Services
Report Period: 2025-01-01 to 2025-12-31
Scope: Worldwide incident statistics from Managed Detection and Response, Incident Response, Compromise Assessment, and SOC Consulting customers.
Sample Size: Approximately 21,000 MDR incidents reported to customers; total cross-service sample size not disclosed.
Key Statistics: High-severity incidents represented 3.8% of MDR incidents in 2025, compared with 4.7% in 2024.
Mean time to detect and report high-severity MDR incidents was 42.1 minutes in 2025, compared with 53.9 minutes in 2024.
Among IR-investigated cases, initial vectors included exploitation of public-facing applications (43.7%), valid accounts (25.4%), and trusted relationships (15.5%).
Mean correlation-rule coverage of event sources across SOC assessments was 43%.
In Compromise Assessment projects, approximately 18.6% of detected incidents were found through manual threat hunting.
Recommendations: Apply timely security patches, enforce effective password policies and multifactor authentication, and limit contractor access.
Implement configuration management together with formal change and access management procedures.
Regularly back up critical data and store backups securely.
Establish corporate security awareness programs addressing phishing and malicious user execution.
Combine continuous monitoring with regular Compromise Assessments, and tune SOC detection rules to the organization's infrastructure.

Indicators of compromise

Type	Indicator	Context
MD5	`2dfef0c375933b725c047a7e25b27cee`	Malicious MpClient.dll wiper sideloaded by a legitimate Microsoft Defender executable in the SAP NetWeaver attack case.
MD5	`7c6f83f4aaa783ebaaa2d6f64930f597`	Malicious calibre-launcher.dll identified as an AdaptixC2 backdoor and sideloaded using Calibre.