M-Trends 2026: High-Tech Overtakes Finance as Top Cyber Target; Dwell Time Rises to 14 Days

Mandiant's M-Trends 2026 report, based on 500,000+ hours of incident response investigations in 2025, reveals high-tech companies now comprise 17% of investigations, surpassing financial services (14.6%) for the first time. Median global dwell time increased to 14 days from 11 in 2024. North Korean espionage campaigns registered 122-day median dwell times, outpacing all other actors. Mandiant tracked 661 new threat clusters and 714 new malware families in 2025 alone, bringing totals to over 5,000 tracked clusters and 6,000 malware families. Vulnerability exploits dominated initial access at 32% for the sixth consecutive year, while voice phishing surged to 11% and traditional email phishing declined to 6%. ClickFix social engineering using deceptive CAPTCHAs expanded globally.