Adversaries shifted 80% of their tradecraft toward stealth, evasion, and persistence in 2025.

February 14, 2026

Adversaries shifted 80% of their tradecraft toward stealth, evasion, and persistence in 2025. — This cybersecurity statistic was published by Picus Security in February 2026. It covers topics including Stealth, Evasion, Persistence. The original data appears in Red Report 2026. For the full methodology and detailed findings, refer to the original report.

Source

View Original Report

Published on 2/10/2025

Share or Copy this stat

Frequently Asked Questions

What does this statistic say?

Adversaries shifted 80% of their tradecraft toward stealth, evasion, and persistence in 2025. This data was published by Picus Security and covers Stealth, Evasion, Persistence.

Where does this data come from?

This statistic comes from Red Report 2026, published by Picus Security on February 14, 2026. You can view the original report at https://www.picussecurity.com/red-report.

What cybersecurity topics does this cover?

This statistic relates to Stealth, Evasion, Persistence. Browse more statistics on Stealth or from Picus Security.

CYBERSTATS

Adversaries shifted 80% of their tradecraft toward stealth, evasion, and persistence in 2025.

Source

Share or Copy this stat

Frequently Asked Questions

Want More Statistics Like This?

Related Statistics

In 2024, there was a 47% increase in phishing emails evading detection by Microsoft’s native security and secure email gateways.

There has been a 57.9% increase in phishing attacks being sent from compromised accounts getting through traditional detection.

One in five attacks in 2024 displayed some form of evasive technique designed to evade traditional network and endpoint-based security controls

21% of ransomware incidents involved installing backdoors for persistence.

DirectDefense mapped alerts to the MITRE ATT&CK® framework to identify the top five tactics. The top five tactics identified are: Initial Access, Persistence, Lateral Movement, Execution, and Credential Access.

For Persistence, the most observed technique by DirectDefense is MFA Interception, where attackers manipulate MFA settings to maintain access. Alerts triggered for Persistence include: New MFA Authenticator App Added, Account Manipulation.

Browse by Topic

Stay Ahead of Cyber Threats