Attackers are handing off access in 22 seconds, Mandiant finds

Mandiant's M-Trends 2026 summary reports that exploits remained the leading initial entry vector in 2025, with voice phishing rising and attackers accelerating access hand-offs; the report documents active zero-day exploitation against enterprise servers, ransomware actors systematically targeting backup, virtualization and identity infrastructure, growth in malware families and threat clusters, longer global dwell times driven by espionage and nation-state activity, and emerging use of AI to augment reconnaissance and social engineering.