Identity-based vulnerabilities continue to play a central role. Compromised credentials, tokens or incorrect identity configurations were involved in almost 90% of the incidents investigated. Attackers use legitimate credentials to move laterally and extend privileges without triggering traditional security mechanisms.

The risk in the software supply chain is also increasing. In 23% of cases, the attack was carried out via third-party SaaS providers. Since 2022, the number of such incidents has increased by a factor of 3.8. Attackers circumvent conventional perimeter security concepts by abusing trusted integrations and dependencies.

The complexity of attacks continues to increase. 87% of the incidents investigated spanned multiple attack surfaces, in complex cases up to ten different environments. Endpoints, networks, cloud infrastructures, SaaS applications and identity systems are often affected simultaneously.

The browser is becoming a central point of attack: almost 48% of incidents involved browser-based activities. Everyday work processes such as email use, web access and SaaS applications are becoming a gateway.

A change can be seen in blackmail attacks. The proportion of encryption-based attacks has fallen from 92% to 78%. Increasingly, perpetrators are foregoing encryption and instead focusing directly on data theft and operational disruptions.

The report identifies misconfigurations, insufficient transparency and excessive trust relationships in complex IT environments as recurring causes. In over 90% of the cases analyzed, configuration errors or gaps in security coverage facilitated the attack. Many organizations operate 50 or more security solutions, making consistent implementation and evaluation difficult.

Palo Alto Networks is also presenting MSIAM (Managed XSIAM 2.0), a managed version of its SOC platform Cortex XSIAM. The offering includes a round-the-clock Security Operations Center with continuous attack detection and processing, proactive threat hunting, automated response and support for various EDR systems.