Expel Quarterly Threat Report, Q1 2025: Q1 by the numbers

Expel’s Q1 2025 Quarterly Threat Report summarizes SOC incident investigations, reporting that identity-based attacks made up 66.2% of incidents, non-targeted malware 20.9% (with 61.9% of those being infostealers driven largely by the click-fix technique), and cloud infrastructure incidents were primarily due to misconfigurations and exposed keys; the report breaks trends down across cloud-based services, endpoints, and cloud infrastructure to guide defensive priorities.