CYFIRMA Update Says Malware-Free, Identity-Led Intrusions Are on Track to Become the Norm
Summary
CYFIRMA's mid-year update reports that 82% of 2025 detections were malware-free and eCrime breakout averaged 29 minutes. It expects identity- and session-based intrusions without persistence to remain a dominant pattern.
Key points
- CYFIRMA says 82% of 2025 detections were malware-free, up from 79%.
- The update reports an average eCrime breakout time of 29 minutes in 2025, 65% faster than in 2024; the fastest observed time was 27 seconds.
- It says 67% of incidents began with identity compromise rather than malware.
- The outlook expects malware-free activity to rise toward 90–95% and persistence-free, credential- and session-based intrusions to become more common.
- The article recommends shifting defensive attention from malware hunting toward identity and session telemetry, with faster containment.
Article Details
- Publisher
- CYFIRMA
- Report Period
- Q3 2026 check-in; mid-year 2026 update
- Scope
- Tracking predictions about persistence-free, identity-led intrusions, malware-free detections, and eCrime breakout time.
- Key Statistics
- 82% of 2025 detections were reported as malware-free, up from 79%.
- Average eCrime breakout time was reported as 29 minutes, 65% faster than in 2024.
- The fastest observed breakout time in 2025 was 27 seconds.
- 67% of incidents were reported to start with identity compromise rather than malware.
- Recommendations
- Pivot from malware hunting to identity and session telemetry.
- Assume attackers may already be inside using legitimate tools.
- Prioritize containment speed over forensic depth.