[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fshm0RE8_S04oUAleCa5KkAm2Tq8WwH73XJFh6lf6bC0":3},{"article":4,"iocs":46,"watch_terms":54,"solutions":55,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"e39fd33c-6a3f-49ad-87a5-bf698a3eda09","Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects","missed-incidents-persistent-threats-and-response-gaps-insights-from-compromise-a-a663f8","Kaspersky Compromise Assessment specialists analyze trends from the service's 2025 projects and provide tips on how to enhance your organization's security.","Kaspersky's 2025 compromise assessment findings highlight significant trends in undetected threats, with 60% of incidents missed due to lack of high-confidence alerts. Nearly a third of detected incidents persisted for over three months, and the oldest discovered threat had been active for four years. The analysis also points to the reliance of threat actors on LoLBins and remote management tools, and the critical need for continuous monitoring and proactive threat hunting to mitigate high-severity compromises.","Kaspersky's 2025 compromise assessments reveal missed incidents, persistent threats, and response gaps.","https:\u002F\u002Fsecurelist.com\u002Fcompromise-assessment-findings-2025\u002F120542\u002F","https:\u002F\u002Fmedia.kasperskycontenthub.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F43\u002F2026\u002F07\u002F02075840\u002FSL-compromise-assessment-featured-scaled.png","2026-07-02T09:00:09+00:00","2026-07-02T10:00:23.971085+00:00",7,[17,20],{"name":18,"type":19},"Kaspersky","vendor",{"name":21,"type":22},"Compromise Assessment","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":23,"icon":25,"name":26,"slug":27},null,"Threat Intelligence","threat-intelligence",[29,34,39,44],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":40},{"id":41,"icon":25,"name":42,"slug":43},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":45},{"id":23,"icon":25,"name":26,"slug":27},[47,51],{"type":48,"value":49,"context":50},"malware","PurpleFox","In-memory infection evades conventional endpoint protection.",{"type":48,"value":52,"context":53},"LionTail","In-memory infection on critical Windows servers.",[18,21],{"controls":56,"vendors":140},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":87,"name":88,"problem":89,"products":90},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":116,"name":117,"problem":118,"products":119},"managed-detection-response","Managed detection and response (MDR)","A team watches and responds around the clock when you cannot.",[120,125,132],{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":121,"product_name":122,"url":123,"description":124},"rapid7-mdr","Rapid7 MDR","https:\u002F\u002Fwww.rapid7.com\u002Fservices\u002Fmanaged-detection-and-response-mdr\u002F","Managed detection and response, 24\u002F7.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":124},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","bitdefender-mdr","Bitdefender MDR","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fproducts\u002Fmanaged-detection-response-service",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-mdr","Truesec MDR","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fmanaged-detection-and-response","Managed detection and response from Truesec's security operations centre.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":157},"undetected-threats-linger-for-years-due-to-monitoring-and-response-gaps","Undetected Threats Linger for Years Due to Monitoring and Response Gaps","Kaspersky's 2025 compromise assessment findings reveal that 60% of security incidents went undetected because organizations lacked high-confidence alerts, allowing threat actors to persist unnoticed for months or even years. The oldest discovered threat had been active for four years, demonstrating how dangerously long dwell times can become when continuous monitoring and proactive threat hunting are absent. Attackers leveraged Living-off-the-Land Binaries (LoLBins) and legitimate remote management tools specifically to evade detection, blending into normal network activity. This matters because extended dwell time dramatically increases the potential damage from data exfiltration, ransomware deployment, and lateral movement across the environment.",[146,147,148,149,150,151,152,153,154,155,156],"CIS Control 8: Audit Log Management","CIS Control 13: Network Monitoring and Defense","CIS Control 17: Incident Response Management","NIST SP 800-61: Computer Security Incident Handling Guide","NIST DE.CM-1: The network is monitored to detect potential cybersecurity events","NIST DE.AE-3: Event data are collected and correlated from multiple sources","NIST RS.AN-1: Notifications from detection systems are investigated","MITRE ATT&CK: Living-off-the-Land Binaries (T1218)","MITRE ATT&CK: Remote Access Tools (T1219)","ISO\u002FIEC 27001: A.16 Information Security Incident Management","ITIL: Event Management and Incident Management processes",{}]