Annual Threat Report Released

Each year the global cybersecurity community waits with anticipation for the publication of our Annual Threat Report. This comprehensive document provides a snapshot of the most significant attack trends, breakthrough techniques, and lessons learned from the past twelve months. In 2024, we saw a surge in supply chain compromises, where adversaries targeted widely used software components to gain footholds in multiple organizations at once. Notable examples include attacks on major managed service providers and open-source libraries trusted by thousands of developers.

The report also dedicates a chapter to the continuing rise of ransomware. While high-profile cases dominate headlines, many small and medium businesses remain the primary targets. They often lack the resources for robust incident response or negotiating with criminal groups. To illustrate the broader impact, we partnered with Recorded Future to compile statistics on average ransom demands, downtime, and the cost of rebuilding systems. The numbers are sobering: some companies experienced weeks of disruption and millions in recovery expenses. However, there are bright spots, including new public-private partnerships aimed at dismantling ransomware infrastructure.

Another key section addresses the evolving threat of nation-state espionage. Sophisticated intrusions continue to strike sectors such as energy, defense, and technology. We include case studies detailing how attackers used zero-day vulnerabilities and living-off-the-land techniques to remain undetected for months. For additional insights, see our companion research at Nation-State Espionage Operations. By studying these events, security teams can better identify early warning signs and implement defenses before intrusions escalate.

Download the full report from our contact page or follow industry updates from partners like MITRE. We encourage you to share feedback or request a custom briefing to dive deeper into the findings. Staying informed is essential to building a resilient security strategy for the year ahead.