2025 Cybersecurity Year in Review: Patterns That Mattered

A different shape than usual year-in-review

The standard year-in-review post lists ten or twenty named incidents and ranks them by impact. Those posts age fast — by the time the next quarter's breaches land, half the list is no longer the most relevant data point. What we have found more useful, after a year of running engagements, is a read on the patterns behind the incidents. Patterns age more slowly than headlines do.

What follows is a synthesis of recurring patterns we observed in reported incidents and in our own engagements through 2025. Specific incidents are cited only where they illustrate a pattern that showed up repeatedly.

Pattern 1: Identity-driven access remained dominant

The most common initial-access vector across reported incidents in 2025 was the same as it was in 2024 and 2023: compromised, stolen, or coerced credentials. The technology stack around identity continues to evolve — passkeys, conditional access, just-in-time privileged access, identity-attack monitoring — but the gap between organizations that have built mature identity defenses and organizations that have not remains the largest single risk factor.

The variants we saw most:

• Stolen session tokens. Infostealer malware lifting cookies and tokens from endpoints, then replaying them to bypass MFA on the destination service.
• SSO downgrade and bypass. Federation paths that allowed local-account login when SSO was supposed to be enforced. Service accounts bypassing the MFA requirement that human accounts had to clear.
• OAuth consent abuse. Adversaries persuading users to grant access to attacker-controlled applications, then using the granted scope to read mail, files, or calendars without further user interaction.
• Help-desk social engineering. Attackers persuading help-desk staff to reset passwords or add MFA devices on accounts they had no claim to.

Pattern 2: Supply-chain compromise as a real category

Supply-chain incidents continued to demonstrate that "trust" is the largest unmonitored attack surface most organizations have. The variants in 2025 covered:

• Build-pipeline compromise. Adversaries gaining access to a vendor's CI/CD and injecting malicious changes into shipped artifacts.
• Dependency confusion and typosquatting. Especially in npm and PyPI ecosystems, with new variants attempting to evade the basic detection patterns deployed in 2023–2024.
• Vendor account compromise. A breach at one organization providing the credentials for many others. The blast radius of a compromised IDP or compromised SaaS-vendor admin account is often broader than the vendor's own customers realize.
• Trusted-relationship abuse. Partner integrations with elevated trust used as the initial-access path into the actual target.

Pattern 3: Cloud configuration drift

Cloud-misconfiguration breaches did not announce themselves with novel TTPs in 2025. They announced themselves with the same TTPs as in prior years — public storage, exposed admin endpoints, overly permissive IAM, secrets in code or CI — at scale. The story of the year was not new attacks on cloud; it was that organizations continued to drift into the same misconfigurations despite the tooling that exists to detect them.

Pattern 4: Authorization flaws in API surfaces

Reported API incidents through 2025 continued to be dominated by broken object-level authorization. Specific examples differed; the underlying pattern did not. The depth of API testing programs at organizations shipping APIs publicly remains uneven, and the gap between organizations that test their APIs as carefully as they test their web frontends and those that do not continues to be visible in incident data.

Pattern 5: AI-feature security as a new category

This was the first year where AI-feature security incidents — prompt injection, data leakage from RAG features, tool-use abuse — appeared in mainstream incident reporting at a meaningful rate. Two things drove the increase: more products shipping LLM-backed features, and more researchers and adversaries probing those features specifically. The patterns we wrote about in our LLM security guide showed up at scale.

Pattern 6: Detection and response inequality

One observation that was not directly about attacks: the gap in detection-and-response maturity between large enterprises with mature SOCs and everyone else widened in 2025. Mid-market organizations that had not yet stood up real detection programs increasingly faced adversaries operating with techniques honed against larger targets. The "we are too small to be a target" defense was less true in 2025 than at any prior point.

What this implies for 2026 testing

Three priorities for security programs heading into 2026, drawn from these patterns:

1. Harden identity hard. MFA on everything. Conditional access. Just-in-time privileged access. Phishing-resistant credentials (passkeys) where the platform supports them. Identity-attack monitoring (IAM activity logs, session-token theft detection, OAuth-consent monitoring).
2. Test inside the trust boundary. Authenticated pentest with explicit role-matrix and tenant-boundary coverage. Most real breaches happen inside the trust boundary; perimeter-only testing covers the wrong attack surface.
3. Treat supply chain as a real category. Vendor risk reviews with technical depth, not just questionnaires. Build-pipeline integrity checks. SBOM and dependency-provenance work for code you ship.