Cybersecurity & Privacy — 2026-03-23
Mandiant M-Trends 2026: Initial Access Handoff Drops to 22 Seconds; Voice Phishing Surpasses Email
Mandiant's M-Trends 2026 report, based on 500,000+ hours of incident response, reveals the median time between initial access and handoff to secondary threat groups collapsed from 8+ hours (2022) to 22 seconds (2025). Voice phishing now accounts for 11% of initial intrusion vectors, surpassing email phishing at 6% (down from 22% in 2022). Exploited vulnerabilities remain the top vector at 32%. Prior compromise — where access is inherited from another threat actor — accounts for up to 30% of ransomware operations, indicating a maturing access-broker ecosystem.
Analysis
The 22-second initial access handoff metric represents a fundamental shift from the hours-to-days timelines that shaped current incident response doctrine. Combined with voice phishing surpassing email phishing for the first time, this report invalidates several baseline assumptions in enterprise security architectures.
The 22-second initial access handoff metric represents a fundamental shift from the hours-to-days timelines that shaped current incident response doctrine. Combined with voice phishing surpassing email phishing for the first time, this report invalidates several baseline assumptions in enterprise security architectures.
4 sources
- M-Trends 2026: Initial Access Handoff Shrinks From Hours to 22 Seconds -
SecurityWeek - The phone call is the new phishing email -
CyberScoop - M-Trends 2026: Data, Insights, and Strategies From the Frontlines -
Google Cloud Blog - Faster attacks and recovery denial ransomware reshape threat landscape -
CSO Online