Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Ransomware attacks increased by 17.2% percent year-over-year in 2025, with the group Qlin dominating the threat landscape, according to data generated by the LevelBlue SpiderLabs team. These attacks focused primarily on the manufacturing and technology sectors, with the US by far being the most targeted nation. 2025 continued the trend of yearly increases; however, over the last few years, the rate of attacks has somewhat slowed.

Executive Summary NIST CSF 2.0 defines what must be achieved; Organizational Change Management (OCM) determines whether it becomes real. Security programs stall not because the framework is unclear, but because leadership behavior, ownership, and workforce adoption weren’t designed and measured from the start.

For years, security vendors have treated SIEM and XDR as two distinct pillars of their security stack - one built for broad log visibility and compliance, the other designed for high-fidelity detection and rapid response. However, as hybrid environments expanded and attackers began exploiting identity, endpoint, cloud, and network surfaces simultaneously, those boundaries blurred.

With only a few days remaining in 2025, we sat down with Sundhar Annamalai, Chief Strategy Officer, LevelBlue, to discuss some of the major inflection points facing the cybersecurity industry in the coming year.

As 2025 closes and we look toward 2026, the cybersecurity industry is bracing for radical changes that go beyond just intensifying existing problems. To help prepare for these new challenges, at least as much as is possible, a few of our experts weigh in on the defining shifts across the security landscape, from the evolution of nation-state tactics and the crisis in core internet infrastructure to the necessary, strategic pivot toward cyber resilience and identity-centric defenses like Zero Trust.

As 2025 comes to a close, it’s the perfect time to look back at the last year to see what LevelBlue as a company accomplished. We can point to the thousands of clients that we helped keep secure, more than a few acquisitions that have resulted in the creation of LevelBlue as the world’s largest pure-play MSSP company and pulling it all together are the accolades from industry analyst firms and the media showing the extent and depth of our expertise.

At this time last year, LevelBlue asked its experts to offer up some thoughts on what the coming year, 2025, would bring. So, with a year of hindsight, let’s keep ourselves honest and take a look to see what we got right and where we were a bit off. December 2025.

In 2026, one theme will become impossible for security and infrastructure leaders to ignore. The architecture that once secured the enterprise no longer aligns with how the enterprise actually works. Users are everywhere. Applications are everywhere. Data is everywhere. Threats are everywhere. What is not everywhere is consistency.

Frost & Sullivan has recognized LevelBlue as a Growth Index leader in the just-released Frost Radar: Managed Detection and Response, 2025. Companies plotted on the Frost Radar are the leaders in the industry for growth, innovation, or both. This recognition indicates LevelBlue is a leader in Managed Detection and Response (MDR) and an organization others should look to when deciding how to best solve their cybersecurity needs.

For the second consecutive year, LevelBlue has been named a top-ranked Managed Security Services Provider (MSSP), placing fifth on the prestigious MSSP Alert’s Top MSSP 250 list for 2025. “LevelBlue is the world’s largest pure-play Managed Security Services Provider (MSSP), offering AI-driven, cloud-native cybersecurity solutions across managed security, MDR, offensive security, strategic advisory, and incident response,” MSSP Alert said.

LevelBlue is redefining what clients and partners can expect from a managed security provider. Through a new partnership with Tenable, a world-class leader in vulnerability management, LevelBlue is introducing unlimited, enterprise-grade vulnerability scanning for all clients and partners using the LevelBlue USM platform — included at no additional cost.

Over the years, cybersecurity predictions tend to all sound the same. Ransomware attacks will continue, supply-chain incidents will increase, and phishing will remain a problem. However, the tail end of 2025 and 2026 presented the cybersecurity industry with a new concern, Agentic AI. Agentic AI capabilities far exceed the basic AI concerns that were reported in the past. Its ability to make decisions and take actions on its own, without needing a human to approve every step, is a game-changer.

For centuries, threat actors, both cyber and physical, have understood the benefits of using extortion to further their criminal activities. This has led some cyber threat groups to create Extortion-as-a-Service (EaaS) businesses. These are a formalized way for cybercriminals to offer extortion services to others for a fee or profit share. And, as we shall see, it is just one of many newer -as-a-service models that threat actors are applying.

In 2026, I expect the Australian cybersecurity landscape to look less like a loose collection of tools and more like a contested systems market where a handful of platforms quietly run the show. After 20 years in this industry, I can see the center of gravity shifting from individual point products to integrated decision engines that sit across identity, data and operations.

LevelBlue SpiderLabs ransomware tracker noted a slight dip in the overall number of attacks that took place in November 2025, but the research team saw the threat group Cl0p surge, conducting 98 attacks during the month, up from just 13 in October. LevelBlue SpiderLabs derived the information from its ransomware-tracking tool, which gathers data from a variety of open intelligence sources and our own proprietary research.

Unexpected attacks are the hardest to fend off. In the realm of cyber, Zero Day vulnerabilities are among the greatest risks, as these software flaws are unknown and exploited before a fix is available, potentially compromising the thousands of organizations that are unwittingly using vulnerable software.