Key Takeaways
- Mandiant’s M-Trends 2026 report, drawn from over 500,000 hours of 2025 incident response work, puts the median time between an initial access broker’s foothold and hand-off to a ransomware operator at 22 seconds — down from more than 8 hours in 2022.
- Non-human identities (service accounts, OAuth tokens, API keys) now outnumber human identities by wide and growing margins across enterprises, and industry research ties a majority of recent security incidents to compromised machine credentials.
- Voice phishing (“vishing”) targeting IT help desks has overtaken email phishing as an initial access technique, while attackers increasingly bypass endpoint monitoring altogether by mounting virtual machine snapshots offline.
- Espionage-linked intrusions are lasting far longer — some undetected for more than five years — creating a mismatch with the 90-day telemetry retention window many organizations still rely on.
- Ransomware crews have shifted from “encrypt and extort” to actively destroying backup and recovery infrastructure first, turning incident response into a resilience problem rather than a cleanup exercise.
A 96,000% Compression, and Nowhere for Human Triage to Hide
In 2022, a security analyst who caught an intrusion within a few hours was doing their job well. According to Google Cloud’s newly released M-Trends 2026 report, that same window has now collapsed to 22 seconds — the median time it takes an initial access broker to establish a foothold and pass control to a ransomware operator. Three years ago the figure was measured in hours; today it’s measured in the time it takes to read a phishing alert.
That single statistic is why the cybersecurity world has spent the past several weeks in something close to a scramble. It isn’t just a faster attack — it’s evidence of an industrialized division of labor, where one group specializes in getting a foothold and immediately auctions or pre-arranges the hand-off to a second group built for high-impact, hands-on-keyboard damage. Mandiant researchers describe this as increasingly automated: initial access brokers now frequently pre-stage the second group’s malware or tunnels during the original infection, so the “hand-off” isn’t a phone call between criminals — it’s a scripted transition.
The Persistence Paradox: Two Extremes at Once
M-Trends 2026 frames this as a split personality in the threat landscape. Financially motivated crews are optimizing for speed and destruction — get in, dismantle recovery options, extort. State-aligned espionage groups are doing the opposite: settling in for years. The report notes dwell times for some espionage intrusions stretching beyond five years, part of a broader rise in global median dwell time to 14 days in 2025 (up from 11 in 2024).
That divergence creates what analysts are calling the “persistence paradox.” Most organizations retain security telemetry for roughly 90 days — a window built around the assumption that breaches get discovered in weeks, not years. Against a multi-year espionage campaign, that retention policy effectively erases the evidence investigators would need to scope the damage. Editorial coverage of the report, including analysis published by ComplexDiscovery, has flagged this as a governance and eDiscovery problem as much as a technical one, particularly for regulated sectors already facing tight breach-disclosure clocks under rules like the SEC’s four-day incident reporting requirement and the EU’s Digital Operational Resilience Act.
Snapshot Mounting and the Death of the Help Desk Password Reset
Two technical shifts are doing a lot of the work behind these numbers, and both route around defenses built for a previous era of attacks.
The first is a move away from email phishing — which fell to just 6% of observed initial infection vectors in 2025, down from 14% the year before — toward voice-based social engineering. Groups tracked under names like UNC3944 have refined techniques for calling corporate help desks and talking their way past multi-factor authentication, using the same social skills that once targeted call centers now aimed squarely at IT support staff. Voice phishing climbed to become the second most common initial infection vector industry-wide, and the top vector observed in cloud-specific intrusions.
The second is what practitioners are nicknaming the “snapshot mounting” problem: rather than working inside a live, monitored environment where endpoint detection tools are watching, attackers compress and copy virtual hard disks directly at the hypervisor level, then mount those snapshots offline to search for credentials and sensitive data. Because this activity never touches a running guest operating system, it slips past data-loss-prevention tools that were built to watch processes, not disk images. Ransomware is then deployed at the hypervisor layer itself — encrypting the infrastructure that runs dozens of virtual machines in one stroke, rather than one machine at a time.
Why Non-Human Identities Are the New Front Door
If there’s a connective thread between the speed of the hand-off and the stealth of the snapshot technique, it’s identity — specifically, the kind that doesn’t belong to a person. Non-human identities (NHIs), a category that spans service accounts, OAuth tokens, API keys, and now AI agents, have become the largest and least-supervised population of credentials inside most companies. Industry estimates on the exact ratio vary widely, with some security vendors putting NHIs at 25 to 50 times the number of human accounts, and others citing figures well above 80-to-1 in large enterprises — but the direction of travel is consistent across every source: that ratio is climbing fast as AI agent adoption accelerates.
The reason attackers favor these credentials is structural, not incidental. A service account can’t complete a multi-factor prompt. An OAuth token doesn’t have working hours to establish a behavioral baseline against. And because these credentials are typically provisioned once and rarely reviewed, a single compromised token can cascade across every downstream system that trusted it — a dynamic that played out in last year’s Salesloft-Drift breach, where compromised OAuth tokens gave attackers a path into more than 700 connected customer organizations through one point of failure. Mandiant’s own report adds a further wrinkle: it has observed attackers weaponizing legitimate local AI command-line tools inside compromised environments specifically to hunt for and steal developer credentials like GitHub and NPM tokens.
What Happens Next: The 48-Hour Audit Scramble
The immediate, practical fallout is already visible. Security teams are being pushed into emergency audits of API tokens and OAuth grants — the kind of housekeeping that normally happens on a quarterly cycle, now compressed into days. Mandiant’s own guidance in the report leans the same direction: treat low-impact alerts (the kind an initial access broker generates) as urgent signals of an imminent second-stage attack, and isolate virtualization and backup management systems as Tier-0 assets walled off from the rest of the network, including from the domain infrastructure they’re meant to protect.
Longer term, the pressure is squarely on security vendors to deliver something faster than a human analyst can be — autonomous, sub-second isolation systems that can act on a suspicious non-human identity before a 22-second clock runs out. Whether “agentic AI defense” can mature quickly enough to match an attack timeline that has already compressed by three orders of magnitude in three years is the open question the rest of 2026 will answer.
Frequently Asked Questions
What is the “22-second hand-off” in the M-Trends 2026 report? It’s the median time Mandiant observed in 2025 between an initial access broker gaining a foothold in a network and handing that access off to a ransomware operator for high-impact exploitation — down from over 8 hours in 2022.
What are non-human identities (NHIs) and why do they matter here? NHIs are credentials used by machines rather than people — service accounts, OAuth tokens, API keys, and AI agents. They can’t complete multi-factor authentication and are rarely reviewed, making them an increasingly favored target for attackers seeking persistent, low-visibility access.
What is “snapshot mounting” in a cyberattack? It refers to attackers copying virtual hard disks at the hypervisor level and mounting them offline to search for data, bypassing detection tools designed to monitor activity inside a running operating system.
Why is the 90-day telemetry retention window considered a problem now? Because M-Trends 2026 found some espionage-linked intrusions going undetected for more than five years, far outlasting the 90-day logs many organizations keep, leaving investigators without records to fully scope a breach.
Is this trend specific to any one industry? No. M-Trends 2026 found incidents spanning more than 16 industry verticals, with high tech overtaking financial services as the most frequently targeted sector in 2025.
Closing Analysis
What remains unresolved is whether enterprise security operations — and the vendors that serve them — can compress their own response timelines fast enough to matter against a 22-second benchmark. Expect the next few months to bring a wave of vendor announcements repositioning existing tools as “agentic” or “autonomous,” alongside genuine investment in non-human identity governance platforms. The harder, slower work — actually inventorying and revoking years of accumulated service accounts and OAuth grants — is the part least likely to happen on anyone’s marketing timeline, and the part on which the next headline breach will most likely turn.
