Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects
Kaspersky's 2025 compromise assessments reveal missed incidents, persistent threats, and response gaps.
Kaspersky's 2025 compromise assessment findings highlight significant trends in undetected threats, with 60% of incidents missed due to lack of high-confidence alerts. Nearly a third of detected incidents persisted for over three months, and the oldest discovered threat had been active for four years. The analysis also points to the reliance of threat actors on LoLBins and remote management tools, and the critical need for continuous monitoring and proactive threat hunting to mitigate high-severity compromises.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Kaspersky?
Get an email when a new story names Kaspersky, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonKaspersky's 2025 compromise assessment findings reveal that 60% of security incidents went undetected because organizations lacked high-confidence alerts, allowing threat actors to persist unnoticed for months or even years. The oldest discovered threat had been active for four years, demonstrating how dangerously long dwell times can become when continuous monitoring and proactive threat hunting are absent. Attackers leveraged Living-off-the-Land Binaries (LoLBins) and legitimate remote management tools specifically to evade detection, blending into normal network activity. This matters because extended dwell time dramatically increases the potential damage from data exfiltration, ransomware deployment, and lateral movement across the environment.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Managed detection and response (MDR)
A team watches and responds around the clock when you cannot.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — PurpleFox
- malware — LionTail