Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Co-author: special thanks to Nikki Stanziale for their invaluable contributions to the research, insights, and development of this blog. While not listed as a primary author, their expertise and collaboration were instrumental in shaping the final content. Executive Summary Cybersecurity experts often say that humans are the weakest and most easily exploited attack vector.

“How could they see anything but the shadows if they were never allowed to move their heads?” — Plato, The Republic, Book VII.

Web Application and API Protection (WAAP) solutions have become increasingly vital in today’s cybersecurity strategies, providing essential defenses against attacks targeting web applications and APIs. It’s no surprise that APIs are growing in popularity, with 80% of companies reporting that more than half of their applications depend on APIs—a figure projected to reach 88% within the next 24 months (ESG Research, 2025).

Today marks an exciting day for LevelBlue and for the broader cybersecurity industry. I’m pleased to announce that LevelBlue has completed its acquisition of Trustwave, a global leader in cybersecurity and managed detection and response (MDR). This is more than a business transaction; it’s a strategic leap forward in our mission to redefine what it means to be a trusted cybersecurity partner in an increasingly complex, high-stakes world.

APIs operate throughout the digital world to support mobile applications, enable cloud capabilities, power GenAI tools, and conduct invisible operations during every digital interaction. As the growth of API usage accelerates, Akamai’s 2024 API Security Impact Report shows that organizations find it difficult to align their security efforts with the expanding risk domain.

In 2024, the average cost of an insider threat incident reached $17.4 million. When you consider that these types of incidents happen daily, it becomes clear that we’re facing a frequent and expensive danger. So, what is an insider threat? Today, it means much more than a data leak; it’s a strategic vulnerability that can disrupt business continuity.

To keep pace with rapidly evolving threats and the decreasing breakout times of attackers, the LevelBlue security operations team leverages multiple tools and key partnerships to shorten the time between detection and response. Below are some examples of the tools used by our SOC and some of the circumstances in which each tool would be used.

Cyberattacks don’t just hit networks. They hit trust. And once that’s gone, the road to recovery can be long and full of questions: Who got in? What did they take? Are they still lurking somewhere inside? That’s where digital forensics comes in. Think of it as the detective work behind the screen, the careful process of combing through digital traces to figure out what happened, how, and who was behind it.

Let’s be honest: few phrases can make your stomach drop faster than “your data has been compromised.” Whether you’re an individual trying to protect your passwords or a business managing millions of customer accounts, the fear of a data breach is real and growing. We live in a time where almost everything is online: our finances, our health records, our identities.

LevelBlue is proud to present the second edition of our biannual Threat Trends Report! This report builds on what we started in our first edition, providing cybersecurity teams with critical insights into current threats. Our second edition delves into threat actor activity observed in the first half of 2025 by LevelBlue Managed Detection and Response (MDR) and LevelBlue Labs threat intelligence teams.