Unit 42's 2026 Incident Response Report Highlights Identity Risks and Faster Data Theft
Summary
Unit 42's 2026 report draws on more than 750 incident response cases. Identity weaknesses featured in nearly 90% of investigations, while the fastest quartile of intrusions reached data exfiltration in 72 minutes, down from 285.
Key points
- The study covers more than 750 cases handled from October 1, 2024, through September 30, 2025; affected organizations were headquartered in over 50 countries, with about 65% based in the U.S.
- Unit 42 reports that identity weaknesses played a material role in nearly 90% of investigations, while preventable coverage gaps or inconsistent controls contributed to more than 90% of incidents.
- The fastest quartile of intrusions reached exfiltration in 72 minutes, compared with 285 minutes in 2024. Phishing and vulnerability exploitation each accounted for 22% of initial access.
- Activity crossed multiple attack surfaces in 87% of intrusions, and 48% involved browser-based activity. The report highlights risks from SaaS integrations, vendor tools and inherited permissions.
- Encryption appeared in 78% of extortion cases. Attackers impacted backups in 26% of extortion cases, while data theft remained a source of leverage even when victims could restore systems.
- Recommendations include phishing-resistant MFA, least privilege for human and machine identities, unified telemetry, automated containment and stronger controls over application dependencies and integrations.
- The authors note dataset bias toward larger organizations with more mature security postures and adjusted some analyses to address overrepresented vulnerability investigations.
Article Details
- Publisher
- Palo Alto Networks Unit 42
- Report Period
- 2024-10-01 to 2025-09-30
- Scope
- Global incident response investigations involving organizations headquartered in over 50 countries, supplemented by threat research, telemetry, open-source information and responder observations.
- Sample Size
- More than 750 incident response cases; some analyses use filtered or smaller subsets.
- Key Statistics
- Identity weaknesses played a material role in almost 90% of investigations.
- Preventable gaps in coverage or inconsistently applied controls materially contributed to more than 90% of incidents.
- The quickest quartile of intrusions reached exfiltration in 72 minutes in 2025, compared with 285 minutes in 2024.
- 87% of intrusions involved activity across multiple attack surfaces.
- Identity-based techniques accounted for 65% of initial access: identity-related social engineering contributed 33%, credential misuse/brute force 21%, and identity policy/insider risk 11%.
- Recommendations
- Unify identity, endpoint, network, cloud and SaaS telemetry, and automate containment through validated playbooks with explicit response authority.
- Continuously verify access and enforce least privilege for human and machine identities; retire legacy roles and unnecessary permissions.
- Prioritize phishing-resistant MFA using FIDO2/WebAuthn hardware keys for high-value roles.
- Apply provenance checks, identity controls and integrity protections to dependencies, integrations, build pipelines and AI-enabled workflows.
- Maintain continuous exposure inventories, prioritize actively exploited business-critical risks, and harden browser-based access on managed and unmanaged devices.
MITRE ATT&CK
T1074 · Data StagedAttackers aggregated and staged sensitive information before exfiltration; data staging was also recorded among observed collection techniques.T1078 · Valid AccountsAttackers used stolen credentials and valid, over-permissioned accounts to gain access, escalate privileges and move laterally.T1110 · Brute ForceBrute force was reported among identity-based initial access methods and observed credential-access techniques.T1213 · Data from Information RepositoriesThe report describes attackers seeking repositories with weak controls and lists collection from information repositories among observed techniques.T1219 · Remote Access ToolsRemote access tools represented 39% of techniques observed within the command-and-control tactic, not 39% of cases.T1486 · Data Encrypted for ImpactEncryption appeared in 78% of extortion cases in 2025.T1490 · Inhibit System RecoveryThe appendix records inhibition of system recovery among observed impact techniques; the narrative separately reports that attackers impacted backups in 26% of extortion cases.T1550 · Use Alternate Authentication MaterialAttackers reused stolen session tokens to masquerade as legitimate users; alternate authentication material was also recorded in the observed-techniques appendix.T1566 · PhishingPhishing accounted for 22% of initial access in the report's investigations.T1567 · Exfiltration Over Web ServiceExfiltration over web services represented 62% of techniques observed within the exfiltration tactic; this is not a case-prevalence figure.
Vendors
Countries
ChinaAcross campaigns affiliated with China, North Korea and Iran, we observed:IranAcross campaigns affiliated with China, North Korea and Iran, we observed:North KoreaAcross campaigns affiliated with China, North Korea and Iran, we observed:United Stateswere headquartered in the U.S. Cases involving organizations based in Europe, the Middle East and Asia Pacific formed the
Industries
Financial Servicesmanufacturing, financial services and healthcare each exhibit distinct mixes of intrusion types, reflecting variationHealthcaremanufacturing, financial services and healthcare each exhibit distinct mixes of intrusion types, reflecting variationHigh Techpatterns in how threat activity aligns with sector-specific operations and technology stacks. High technology,Manufacturingmanufacturing, financial services and healthcare each exhibit distinct mixes of intrusion types, reflecting variationProfessional and legal servicesFigure 23. Investigation type by industry: Manufacturing. Figure 24. Investigation type by industry: Professional and Legal Services.State and local governmentFigure 27. Investigation type by industry: State and Local Government. Figure 28. Investigation type by industry: Healthcare.Wholesale and RetailFigure 25. Investigation type by industry: Wholesale and Retail.