Cybersecurity Awareness Month always lands at a strange angle: it asks organizations to think hard about security for 31 days, right as the year’s actual incident data is nearly complete. So rather than treat this as a snapshot of one month, this recap looks at the patterns that defined the year leading into it, the shifts that showed up consistently across incident response data, threat intelligence reporting, and the kinds of engagements that firms like CyberClan run every week. Awareness Month is the moment these patterns get named out loud; they were built over the preceding twelve.
Five stood out clearly enough to be worth walking through in detail, not because they’re novel, exactly, but because each one crossed a threshold this year that changes what “prepared” actually has to mean.
Pattern 1: Identity Became the Perimeter and the Perimeter is Losing
The single clearest shift in the data this year is that attackers have largely stopped needing to break in. They log in. Palo Alto Networks’ Unit 42 2026 Incident Response Report found identity-based techniques, phishing, stolen credentials, brute force, insider activity, drove 65% of initial access cases, and identity compromise played a material role in nearly 90% of all investigations. Separately, Sophos’s 2026 ransomware research put the figure even higher for ransomware specifically, finding roughly 79% of attacks now start with a stolen identity rather than a technical exploit.
What’s driving it isn’t just credential theft in the old sense, it’s that multi-factor authentication, long treated as the fix, has developed its own exploitable gaps. Unit 42 documented widespread session token theft via adversary-in-the-middle attacks, which lets attackers capture an already-authenticated session and walk past MFA entirely, along with long-lived access tokens in SaaS platforms that persist without repeated login. Layered on top: 99% of cloud users, roles, and services analyzed carried excessive permissions, many unused for 60+ days, meaning that when an identity is compromised, it usually opens far more than the one account it belonged to.
This is precisely the gap continuous monitoring is built to close, and it’s the core of what a 24/7 SOC is actually watching for now, not just malware signatures, but behavioral anomalies: a login from an impossible location, a token being used somewhere it’s never been used before, a service account suddenly touching systems it has no history with. That kind of detection depends on UEBA and threat-hunting capability actively watching identity behavior around the clock, which is exactly the layer CyberClan’s Managed Security Services is built around, rather than a control most organizations can bolt on after the fact.
Pattern 2: AI Gave Social Engineering a Voice, and a Script
The second pattern is the one security teams saw coming and still got hit by anyway: AI-generated voice and video made social engineering dramatically more convincing, and attackers scaled it like a business function. CrowdStrike tracked a 442% increase in voice phishing (vishing) attacks between the first and second half of 2024, and by Q1 2025, Cisco Talos found vishing accounted for over 60% of phishing-related incident response engagements, a complete reversal from a few years ago, when voice-based attacks were the exception rather than the dominant vector.
The scale this reached is worth sitting with. The ShinyHunters/Scattered Spider campaign that ran through late 2025 and into 2026 compromised 760+ organizations, including major names like Google, Cisco, and Harvard, largely by recruiting callers at $500–$1,000 per call to run pre-written scripts impersonating IT help desks, talking real employees into resetting credentials or approving MFA pushes for accounts that weren’t theirs. Cisco’s own CRM breach in July 2025 traced back to a single employee compromised this way. Voice cloning technology needs as little as three seconds of audio to produce a replica now rated as indistinguishable from a real voice by human listeners, and deepfake-enabled fraud losses are projected to reach $40 billion by 2027.
The uncomfortable truth about this pattern is that it targets the one layer technical controls can’t fully patch: a person on the phone, under time pressure, talking to someone who sounds exactly like they’re supposed to. It’s why the training component of a security program has stopped being a checkbox and become genuinely load-bearing and why, when a vishing call does succeed, what happens in the following minutes matters enormously. A SOC watching for the anomalous access that follows a successful social engineering call, and an incident response team that can be live within 15 minutes when it’s caught, are the two layers that actually contain this pattern rather than just hoping training prevents every instance of it.
Pattern 3: The Edge Device Race Got Dramatically Faster
For years, unpatched perimeter devices, VPNs, firewalls, edge gateways, were a known but slow-moving risk. That changed sharply this year. Verizon’s 2026 Data Breach Investigations Report found edge devices and VPNs now account for 22% of exploitation-driven breaches, up from just 3% the year before, a sevenfold increase in twelve months, and enough to push vulnerability exploitation past stolen credentials as the number one initial access vector for the first time in the report’s 19-year history.
What made this year different wasn’t just more vulnerabilities, it was speed. The median time from a CVE disclosure to mass exploitation of edge devices is now measured in days, and for several 2025 appliance vulnerabilities, opportunistic scanning began within hours of the advisory going public. The old assumption that a patching cycle measured in weeks was defensible no longer holds for internet-facing infrastructure. And tellingly, this pattern doesn’t run separately from Pattern 1: the same DBIR data found 73% of ransomware victims had infostealer or credential-leak activity in the year before the breach, suggesting identity compromise and edge exploitation are increasingly two stages of the same intrusion rather than competing techniques.
This is the pattern that punishes slow decision-making specifically. An unpatched appliance discovered mid-incident isn’t a finding for a quarterly report, it’s an active, live-fire containment decision, and it’s exactly the scenario incident response retainers exist for: a team that can get a responder engaged within 15 minutes and start making isolation decisions before a days-old CVE becomes a days-old breach.
Pattern 4: One Vendor’s Bad Day Became Everyone’s Incident
The fourth pattern is about blast radius. Black Kite’s 2026 Third-Party Breach Report found that each vendor breach in 2025 cascaded to an average of 5.28 downstream companies publicly compromised, the highest figure recorded to date, and more than double the 2.46 downstream companies per breach measured just four years earlier, in 2021. Across 136 verified breach events, the report identified 719 named victim organizations, plus an estimated 26,000 additional “shadow victims” who were affected but never publicly disclosed, together touching roughly 433 million people.
The disclosure timeline made this worse, not better. Median detection time for these breaches was a relatively fast 10 days, but the average gap between detection and public disclosure stretched to 117 days, up from 76 days the year before. That gap is what Black Kite calls the “Silent Window”: a period where downstream organizations are exposed through a vendor relationship they may not even know is compromised, with no way to know it yet.
For a mid-market company, this pattern is the hardest one to control directly, because the vulnerability doesn’t live in your own environment, it lives in a vendor’s. It’s also why vendor risk review belongs inside a governance program rather than treated as a one-time procurement question, and why, when a downstream notification does land, the recovery work looks less like a single-company incident and more like reconstructing trust across an entire environment quickly: restoring specific systems (Active Directory, Exchange, cloud tenancy) without importing whatever compromised the vendor in the first place. That’s precisely the kind of surgical recovery post-breach remediation work is built for, bringing systems back online deliberately, with security improvements built into the restoration rather than just restoring the prior state.
Pattern 5: Fewer Ransoms Paid, But the Extortion Got Meaner
The last pattern connects directly to a question this blog covered in detail a few weeks ago: whether to pay. The data on that question kept moving throughout the year. Unit 42’s 2026 report found that encryption appeared in just 78% of extortion incidents in 2025, down from above 90% in prior years, meaning a growing share of attacks skip encryption entirely and go straight to the threat of publishing stolen data, since that threat alone is often enough leverage without the operational noise of locking down every endpoint. At the same time, median ransom demands kept climbing, from $1.25 million in 2024 to $1.5 million in 2025, even as the earlier post on ransom payment outcomes showed the actual payment rate falling to historic lows and negotiated final payments landing well below the opening demand.
Put together, this is a more calculating adversary than the one security teams were up against a few years ago: fewer victims paying, so attackers lean harder on data theft and public pressure rather than pure encryption; demands opening higher, because negotiators expect to be talked down; and outcomes increasingly decided in the room with counsel and an insurer rather than in a panic. It’s also, not coincidentally, exactly the shift that makes a pre-negotiated incident response retainer and a documented, tested plan (the subject of two other posts in this series link to include) worth more than they were two years ago, the room that room matters more than ever.
What Ties These Five Together
Read side by side, these patterns aren’t five unrelated trends, they’re one trend viewed from five angles. Attackers are increasingly skipping the noisy, detectable parts of an intrusion (malware drops, brute-force login attempts) in favor of methods that look, to most monitoring tools, like normal activity: a real login with a real session token, a real employee talking to what sounds like real IT support, a vendor’s compromised credential moving quietly downstream. The common thread across all five is that the moment of compromise increasingly doesn’t look alarming, the alarm only comes once something has already gone wrong, and by then the relevant question isn’t “how do we prevent this” but “how fast can we see it, and how fast can someone competent start acting on it.”
That’s the throughline connecting detection, response, and recovery into a single continuum rather than three separate purchases: Managed Security Services exists to catch the quiet version of these attacks while they’re still quiet; Incident Response exists for the moment quiet stops being possible; and Post-Breach Remediation exists to bring an environment back deliberately once the immediate threat is contained, rather than rebuilding in a panic and reintroducing the same gap that let the attacker in the first time.
Heading Into Next Year
None of these five patterns are going to reverse on their own, and most point toward the same handful of practical priorities for a mid-market security program heading out of this Awareness Month: treat identity monitoring and phishing-resistant MFA as the actual perimeter, not a compliance line item; run at least one realistic social-engineering test a year that specifically includes a phone-based scenario, since email-only phishing tests no longer reflect how these attacks actually arrive; get edge device and VPN patching onto a cycle measured in days for anything internet-facing, not weeks; add a vendor incident clause to the incident response plan so a third-party notification has a defined response path instead of an improvised one; and make sure the retainer, the tested plan, and the insurer conversation are all in place before any of the above becomes a live incident rather than a planning exercise.
That last point is really the summary of everything else on this list, and it’s the same note this whole blog series keeps landing on from different directions: the organizations that came through this year’s incidents in the best shape weren’t the ones that avoided every attack, nobody does, they were the ones who’d already answered, in writing, who’s in charge, who to call, and how fast that call gets picked up.
