SonicWall 2026 Report Highlights Persistent Security Gaps Facing SMBs
Summary
SonicWall’s 2026 Cyber Protect Report identifies weak authentication, slow patching and excessive access as persistent SMB risks. Its 2025 telemetry shows high- and medium-severity intrusion detections rose 20.8% despite nearly flat overall intrusion volume.
Key points
- SonicWall recorded 13 billion high- and medium-severity IPS hits in 2025, up 20.8%, while total intrusion hits declined 0.3%. These figures count detections, including repeated activity, rather than confirmed compromises.
- Just 0.47% of detection rules generated 80% of customer alert volume, highlighting concentrated activity and the need for careful alert prioritization.
- Log4j exploitation attempts generated more than 825 million detections in 2025, demonstrating continued targeting of older vulnerabilities.
- IoT detections increased 11% to 609.9 million and peaked in December; ransomware detections fell 36.6% year over year.
- SonicWall attributes 85% of actionable security alerts to identity, cloud or credential compromise and reports compromised VPN credentials as the initial access vector in 48% of breaches in its data.
- The report recommends phishing-resistant MFA for remote and administrative access, urgent patching of critical internet-facing systems, least privilege, network segmentation and application-level access controls.
- SMBs are urged to test backup restoration and incident response, verify monitoring coverage, and fully configure existing tools before buying new platforms or relying on AI capabilities.
Article Details
- Publisher
- SonicWall
- Report Period
- 2025
- Scope
- Threat telemetry, breach investigations, and security-control failures affecting SMBs and mid-market organizations, supplemented by third-party research.
- Key Statistics
- High- and medium-severity IPS detections reached 13 billion in 2025, up 20.8% year over year, while total intrusion attempts remained approximately flat.
- The report recorded more than 825 million attempts targeting the Log4j vulnerability in 2025; these are detections, not confirmed compromises.
- IoT IPS detections reached 609.9 million in 2025, up 11% year over year, with activity peaking in December.
- According to SonicWall data, identity, cloud, and credential compromise accounted for 85% of actionable security alerts.
- According to SonicWall data, compromised VPN credentials were the initial access vector in 48% of breaches; the supplied content does not disclose the underlying breach sample size.
- Recommendations
- Enforce MFA on all accounts, prioritizing remote and administrative access; adopt phishing-resistant MFA for those access paths and change default credentials.
- Prioritize critical and internet-facing systems for patching, establish maximum acceptable patch windows, and maintain structured patch workflows.
- Audit privileges, remove inactive accounts and expired tokens, segment networks, and replace broad VPN access with role-based application-level controls and continuous session monitoring.
- Provide 24/7 monitoring, tune detection rules, establish recurring threat hunting, and test incident response playbooks and backup restoration.
- Verify every payment-information change through a voice call to a known number rather than through email or chat.
MITRE ATT&CK
T1078 · Valid AccountsThe report describes attackers using stolen valid credentials, including compromised VPN credentials, to enter environments while appearing to be legitimate users.T1133 · External Remote ServicesAttackers used VPN remote access with compromised credentials as an initial entry path into internal networks.T1550.004 · Web Session CookieThe report describes attackers using session cookies to bypass multi-factor authentication.T1555.003 · Credentials from Web BrowsersThe report states that infostealer malware harvests credentials directly from browsers.T1595 · Active ScanningAutomated bots scanned publicly accessible systems for vulnerabilities, exposed services, and configuration weaknesses.