Are attackers retooling?

Multiple industry reports and quarterly bulletins indicate a growing trend in vulnerability exploitation (noted as a 34% year-over-year increase in the 2025 DBIR) and continued prominence of email- and identity-based attacks; adversaries may be shifting to more disposable infrastructure to evade takedowns. The report recommends defenders focus on fundamentals: rapid patching and vulnerability management, up-to-date asset inventory, behavioral monitoring on endpoints to detect post-exploit activity, and strong identity security.