IBM X-Force Threat Intelligence Index 2025 Insights

Keypoints

• The report follows a structured format with sections including foreword, key takeaways, introduction, analysis of AI’s role in cybersecurity, attack vectors, threat trends, vulnerabilities, and strategic action guides, providing a comprehensive overview of the evolving threat landscape.
• Manufacturing remains the most targeted industry for four consecutive years, with significant impacts from ransomware and data theft—due to continued reliance on legacy systems.
• Phishing and abuse of valid account credentials are the leading initial access methods, accounting for 30% of incidents in 2024, with phishing being increasingly sophisticated through AI integration.
• Infostealers have become a persistent threat, with an 84% increase in weekly phishing-delivered infostealer attacks, emphasizing the shift toward stealthy identity-driven intrusions.
• Attacks leveraging AI are evolving: threat actors now utilize AI to craft deepfakes, automated phishing emails, and malicious code, expanding attack surfaces in and around AI infrastructures.
• Over 30% of cybersecurity incidents involve exploitation of public-facing applications, with active post-compromise scanning indicating persistent lateral movement and escalating risks if undetected.
• Ransomware remains prevalent at 28% of malware cases but shows a decline, likely due to increased defenses and shifts in attacker tactics, including focus on data exfiltration.
• Dark web analysis reveals that 60% of the top vulnerabilities discussed had exploits available within two weeks of disclosure, many involving nation-state-grade tools targeting critical systems like Fortinet and Palo Alto products.
• Use of cloud-hosted phishing campaigns increased significantly, especially in Latin America, complicating defense efforts as legitimate cloud services are exploited for malicious distribution.
• Malicious PDF files are now the most common malware carriers, often obfuscating URLs through encryption and hiding malicious links inside benign-looking attachments, making detection more challenging.
• The proliferation of vulnerabilities, exploits, and zero-day threats underscores the necessity of adopting zero trust principles, segmenting networks, and maintaining rapid patch management to mitigate advanced attacks.