Editor’s Note: Mandiant’s M-Trends 2026 report, grounded in over 500,000 hours of frontline incident response, delivers a set of findings that cybersecurity, information governance, and eDiscovery professionals should treat as operational benchmarks rather than background reading. Access-broker handoffs measured in seconds, ransomware crews that destroy recovery infrastructure before encrypting anything, and AI-enabled malware that rewrites itself hourly — these are not projections but documented patterns from 2025 investigations. This article traces how those patterns reshape board-level risk conversations, regulatory exposure, and the evidentiary landscape for future disputes. It also surfaces an often-overlooked dimension: the growing universe of AI-generated records — from SOC decision traces to meeting transcripts — that are fast becoming discoverable, holdable, and contestable. For practitioners who must defend not only their networks but also their decisions, these findings offer a concrete framework for recalibrating detection, retention, and response strategies before the next breach.

Industry News – Cybersecurity Beat

Twenty-Two Seconds to Hand-Off: Inside Mandiant’s M-Trends 2026 Findings

ComplexDiscovery Staff

Attackers are handing off access inside compromised networks in as little as 22 seconds — barely enough time for a SOC analyst to finish reading the alert that signals the breach has begun. That statistic, drawn from Mandiant’s just-released M-Trends 2026 report, captures a threat landscape that has undergone a structural shift: intrusions are no longer single-actor events but coordinated handoffs inside an industrialized ecosystem where speed determines who profits.

In 2022, the median time between initial access and handoff to a secondary threat group was over eight hours, according to Mandiant. Three years later, that window has collapsed to 22 seconds. Jurgen Kutscher, vice president of Mandiant Consulting at Google Cloud, put the shift in plain terms: the vast majority of successful intrusions still stem from fundamental human and systemic failures, but the pace at which those failures are exploited has changed the math for defenders entirely.

The report, grounded in over 500,000 hours of frontline incident response investigations conducted globally in 2025, lands at a moment when cybersecurity, information governance, and eDiscovery professionals are grappling with overlapping pressures — faster attacks, contested digital evidence, and a growing universe of AI-generated records that may be subject to litigation holds and regulatory review.

Exploits Still Lead, but Voice Phishing Is Surging

Mandiant’s findings do not exist in isolation. IBM’s 2026 X-Force Threat Intelligence Index, released in February, independently found that vulnerability exploitation was the leading cause of attacks at 40% of incidents observed — corroborating the exploit-first pattern from a different dataset and methodology. The World Economic Forum’s Global Cybersecurity Outlook 2026 reported that 87% of surveyed organizations identified AI-related vulnerabilities as the fastest-growing cyber risk over the past year.

Within M-Trends specifically, exploitation of internet-facing systems remained the leading initial infection vector for the sixth consecutive year, accounting for 32% of cases where Mandiant could identify the entry point. Edge devices — VPNs, firewalls, and other boundary systems — continue to draw adversary attention because they are exposed, often lack deep logging, and rarely receive the same change-control discipline applied to core business applications.

What changed in 2025 is what came next on the list. Voice phishing climbed to the second-most common initial infection vector at 11%, displacing traditional email phishing, which fell to just 6% — less than half its share the prior year. Kutscher described the shift as a move toward interactive, rapport-building social engineering that exploits help desks and IT support workflows. “This type of social engineering attack is extremely powerful,” he noted, adding that it requires impersonation skills that threat actors have been actively refining.

In cloud-specific compromises, the pattern was even starker. Voice phishing accounted for 23% of intrusions, largely driven by the ShinyHunters and Scattered Spider groups, followed by third-party compromise at 17%, stolen credentials at 16%, email phishing at 15%, and insider threats at 14%. For organizations with hybrid environments, these numbers suggest that cloud entry points now demand at least the same level of detection engineering and legal-hold awareness as on-premises infrastructure.

Recovery Denial: The New Ransomware Playbook

Ransomware groups are no longer content to encrypt data and demand payment. M-Trends 2026 documents a systemic shift toward what multiple analysts now call “recovery denial” — deliberate attacks on the infrastructure organizations need to bounce back.

Mandiant’s investigations identified prolific groups using REDBIKE (Akira) and AGENDA (Qilin) ransomware that actively targeted backup infrastructure, identity services, and virtualization management planes before encrypting production workloads. In several cases, attackers exploited misconfigured Active Directory Certificate Services templates to mint administrator accounts that bypassed multi-factor authentication. In others, adversaries pulled credentials from enterprise vaults and forcibly changed privileged passwords to lock out responders mid-crisis.

Kutscher framed the evolution bluntly: modern ransomware is now a fundamental resilience problem, forcing organizations into a stark choice between paying or rebuilding from scratch. Financially motivated groups, he said, are optimized for immediate impact and deliberate recovery denial, while state-aligned actors prioritize long-term persistence.

These dynamics land differently across regulated sectors. In financial services, short dwell times and multi-actor intrusions complicate obligations under the SEC’s four-day incident-disclosure rule and the EU’s Digital Operational Resilience Act, increasing pressure on firms to prove how quickly suspicious activity was detected, contained, and reported. Healthcare organizations face parallel challenges as ransomware crews target systems that underpin patient care and clinical operations, intersecting with HIPAA breach-notification requirements and operational expectations around system availability. Critical-infrastructure operators must reconcile these trends with CISA directives and sector-specific resilience mandates, often under closer political and media scrutiny.

For governance and eDiscovery teams, recovery denial raises an uncomfortable question: if the backup and identity systems that store or orchestrate your recovery are compromised, how will you preserve and reconstruct the evidence necessary for regulatory reporting, contractual notifications, or litigation? Decoupling backup environments from corporate Active Directory and utilizing immutable storage are practical first steps, but they also need to be designed with legal and privacy teams at the table, not retrofitted after a breach.

Dwell Time Rises — Driven by Espionage, Not Slowness

Global median dwell time rose to 14 days in 2025, up from 11 days the prior year. That increase is counterintuitive in a landscape of faster attacks, but the explanation lies in the composition of Mandiant’s caseload. The uptick was driven largely by a high volume of cyber espionage investigations and North Korean IT worker operations, where the median dwell time was 122 days — with some intrusions persisting undetected for over a year.

North Korean operatives using fabricated identities to secure employment at Western technology companies remained a persistent insider threat throughout 2025, according to M-Trends 2026. These cases extend the boundary of what security and governance teams must consider “insider” risk, and they add complexity to background-check, access-management, and records-retention programs that were designed primarily with traditional employees in mind.

AI Malware Goes Operational

Alongside M-Trends, Mandiant and Google Threat Intelligence Group released a dedicated AI risk and resilience report that confirms a shift many defenders have been watching nervously: adversaries have moved from experimenting with AI to deploying it in live operations.

The report identifies two malware families — PROMPTFLUX and PROMPTSTEAL — that actively query large language models during execution. PROMPTFLUX, an experimental VBScript dropper first identified by GTIG in June 2025, uses the Gemini API to rewrite its own source code on an hourly basis, generating fresh malicious code on demand that evades signature-based detection. While still in testing phases and not yet capable of widespread compromise, it represents the first observed instance of “just-in-time” AI integration in malicious software. PROMPTSTEAL, attributed to the Russian government-backed actor APT28 (also tracked as FROZENLAKE), queries an LLM to generate one-line Windows commands for document theft — marking the first confirmed observation of state-sponsored malware querying an LLM in live operations against Ukraine.

Beyond malware, Mandiant’s AI risk report warns that the most pressing security challenges in AI pipelines are not exotic model-theft attacks but foundational gaps in governance and IT hygiene. Shadow AI — tools deployed by business units without security oversight — remains a critical friction point. AI Software Bills of Materials either do not exist or are not being maintained. And as agentic AI systems gain autonomy to take actions rather than just answer questions, the risk of excessive agency — AI tools operating with overly broad permissions — is becoming an operational concern that extends well beyond the security team.

On the defensive side, the report and Google’s broader positioning indicate that AI-assisted security operations — including agent-assisted threat hunting, automated enrichment, and dark web intelligence analysis — are gaining traction as force multipliers for overstretched SOC teams. For security operations leaders, the practical takeaway is to treat AI not as a substitute for detection engineering but as a way to accelerate the labor-intensive work of enrichment, triage, and continuous control validation. Equally important: ensure that AI-assisted SOC workflows generate auditable decision traces, because those records are themselves potential evidence in future regulatory or litigation proceedings.

For information governance and eDiscovery professionals, the Mandiant AI risk findings translate into a concrete near-term challenge: cataloging, retaining, and governing a new category of records. Prompt logs, model interaction records, automated decision traces, and AI-generated meeting transcripts are all electronically stored information subject to the same preservation obligations as emails and contracts once litigation is reasonably anticipated. Recent commentary from K&L Gates and White & Case has underscored that AI-generated meeting transcripts — now routinely produced by default in major videoconferencing platforms — present overlapping consent, privacy, and privilege concerns that courts are only beginning to address.

Seyfarth Shaw’s 2026 Commercial Litigation Outlook reinforces the urgency, noting that organizations are no longer dealing with a single minutes document but a complex ecosystem of recordings, machine transcripts, AI summaries, and conventional notes. Without deliberate governance and retention frameworks, the risk of inconsistent records, spoliation claims, and privilege waiver escalates rapidly.

Vulnerability Exploitation Before Patches Exist

One of the most sobering data points in M-Trends 2026 is the estimated mean time to exploit newly disclosed vulnerabilities: negative seven days. Exploitation is routinely occurring before a patch is even available, collapsing the window defenders traditionally relied upon to assess, test, and deploy fixes.

That statistic changes the practical economics of vulnerability management. Organizations that depend on monthly patch cycles or risk-score-based prioritization may find themselves consistently behind adversaries who are exploiting flaws in the wild before vendors can respond. For regulated industries where patch timeliness is both a compliance metric and a litigation exposure, the negative-seven-day figure is a data point that belongs in board materials and regulatory filings — not just in security dashboards.

What This Means for Governance, Discovery, and the Board

The convergence of 22-second handoffs, recovery denial ransomware, AI-enabled operations, and pre-patch exploitation amounts to a structural challenge that extends well past the SOC. Defenders must now be prepared to demonstrate — often under external scrutiny — not just that they restored systems, but that they understand which actors touched which datasets, what logs survived, what AI agents did on their behalf, and why specific governance choices were made in real time.

For security leaders, Mandiant’s frontline data offers concrete external benchmarks for detection and response capabilities. Mapping your own dwell times, initial access patterns, and recovery dependencies against these figures turns vague concern into targeted investment. For governance and eDiscovery practitioners, the same data can inform the design of retention, legal-hold, and evidence-collection playbooks that assume contested logs, multi-actor intrusions, and AI-mediated decisions as normal conditions rather than outliers.

Boards and senior leaders should read M-Trends 2026 not as a technical annex but as a stress test for core assumptions around cyber insurance, vendor risk allocation, and the organization’s appetite for interruption. Questions like “Which revenue streams fail first if our identity provider is offline for days?” or “How fast can legal, risk, and security align on notification decisions under these conditions?” turn frontline statistics into strategic governance levers.

Against that backdrop, the question facing every cybersecurity, governance, and legal team is not whether the next M-Trends report will show even faster operations — it almost certainly will — but whether their organizations can close the gap between the speed of attack and the speed of investigation, preservation, and decision-making before regulators, courts, and adversaries force the issue for them.

News Sources

Assisted by GAI and LLM Technologies

Additional Reading

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

The post Twenty-Two Seconds to Hand-Off: Inside Mandiant’s M-Trends 2026 Findings appeared first on ComplexDiscovery.