Kaspersky's analysis of its 2025 compromise assessment engagements reveals a significant number of undetected threats, with many persisting for months or even years. These assessments, which examine networks for signs of compromise, found that a substantial portion of incidents were missed by existing security tools and processes.
A key finding is that 60% of discovered incidents were not flagged by an organization's security tools, requiring manual detection. Furthermore, nearly a third of all identified incidents took over three months to detect, and over half of the high-severity compromises had historical activity spanning more than three months. The oldest incident uncovered in 2025 had been dormant for four years.
The reports highlight that malicious files, such as web shells, are frequently found in backups and are restored during incident response, remaining undetected until a comprehensive compromise assessment is performed. In 40% of cases, web shells were discovered in backups.
Threat actors are observed to leverage legitimate tools, including remote management software and "Living off the Land" binaries (LoLBins), which were present in all engagements that resulted in detected incidents. The analysis stresses that monitoring tools alone are insufficient; operational maturity, including the proper configuration of these tools and the human review of low-confidence alerts, is crucial. Organizations lacking continuous monitoring and proactive threat hunting were found to have an 84-86% increased likelihood of experiencing high- and medium-severity incidents.
Communication breakdowns within organizations also contribute to missed incidents, impacting the effectiveness of incident response efforts. The reports emphasize that incident response playbooks need to be treated as living documents, updated as new artifacts are discovered, to reduce the risk of overlooking threats.
Kaspersky's compromise assessment service identified that approximately 71% of incidents in 2025 occurred in the META region, with APAC and CIS regions accounting for the remainder. The government sector was most affected, representing about 29% of incidents, followed by education (19%) and financial (17%) sectors.
The most common detection logic families, indicating high-fidelity signs of compromise, were "Credentials from dumps" (12.4%), followed by "Specific living-off-the-land (LOTL) tools" and "Specific malware families," both at 11.2%.
Organizations requested compromise assessments for various reasons, with general audits being the most common (56%). However, post-incident checkups, requested after an initial incident response, showed the highest proportion of high-severity findings (40.7%), suggesting that limited incident response activities may not fully uncover the extent of a compromise. Merger and acquisition assessments, which scan target networks before integration, showed a more balanced distribution of incident severities.
The analysis also points to insufficient vulnerability management as a catalyst for high-severity compromises, with examples of overly permissive Group Policy Object (GPO)-based software distribution leading to issues. The presence of dormant, disk-based malware and persistent, multi-stage attacks were also noted as common findings.
