In 2025, browser privilege escalation vulnerabilities surged 183%.

Phishing accounts for 44% of AI-assisted initial access attempts.

Prior compromise was the top initial infection vector in ransomware operations at 30%, up from 15% in 2024.

Median time between initial access and hand-off to a secondary threat group was 22 seconds in 2025, down from more than 8 hours in 2022.

Prior compromise accounted for 10% of initial infection vectors globally, ranking third-most common.

17% of phishing cases involved voice-based social engineering (vishing).

Threat actors exploited identity issues to gain initial access in 83% of the incidents involving major cloud and SaaS-hosted environments.

Initial access by threat actors using misconfiguration, which accounted for 29.4% of incidents in the first half of 2025, dropped to 21% in H2 2025.

In one intrusion, data exfiltration began within four minutes of initial access.

In the fastest cases, attackers moved from initial access to data exfiltration in 72 minutes, four times faster than the previous year.

Comcast Business detected 4.7 billion phishing attempts, which specifically targeted human error and poor credential hygiene.

SCATTERED SPIDER moved from initial access to encryption by deploying ransomware in under 24 hours in one observed case

The top initial access vector observed in 2024 was a tie between exploitation of public facing applications and use of valid account credentials, both representing 30% of X-Force incidence response engagements.

The average time from initial access to domain control has shrunk to under two hours.

For Initial Access, the most observed technique by DirectDefense is Valid Accounts, which involves leveraging stolen credentials for unauthorized access. Alerts triggered for Initial Access include: First Ingress Authentication from Country, Multiple Country Ingress Authentications, Multiple Wireless Country Authentications.

DirectDefense mapped alerts to the MITRE ATT&CK® framework to identify the top five tactics. The top five tactics identified are: Initial Access, Persistence, Lateral Movement, Execution, and Credential Access.

4 of 5 (83%) financial fraud claims began with email.

Email was the preferred entry vector for cybercriminals, driving 43% of claims.