Expel Quarterly Threat Report, Q2 2025: Q2 by the numbers

**Executive summary:** Expel's Q2 2025 Quarterly Threat Report summarizes SOC investigations from April–June 2025, finding identity-based attacks accounted for ~67% of incidents, non-targeted malware comprised ~13.8% (with Lumma infostealer activity reduced), cloud infrastructure incidents increased due to misconfigurations, and industry-specific impacts (financial services, manufacturing, healthcare) are detailed with recommended defensive focus areas.