Kuhn Capital's CyberPulse Suite
M&A Factoids ↗
Dashboard #3 of 6 Major Threat Sponsors (as measured by global impact)
⚡ THREAT INTEL
🛡 4,000+ ransomware attacks daily globally 💰 Healthcare sector avg. breach: $9.77M 👥 3.5M unfilled cybersecurity jobs worldwide 🎣 90% of attacks start with phishing ⚡ 97 zero-day exploits documented in 2023 🏥 Healthcare most targeted sector — 5th consecutive year 🏭 Manufacturing #2 most attacked industry globally 🔑 Credential theft drives 24% of all breaches 🌐 Supply chain attacks up 100% YoY — Verizon DBIR 2025 💸 Avg. ransomware payment: $2.73M — Sophos 2025 🔓 68% of breaches involve human error or social engineering ⏱ Median attacker dwell time: 14 days before detection 🤖 AI-assisted attacks accelerating — CrowdStrike 2025 🌍 $10.5T projected global cybercrime cost by 2025 📧 Business email compromise losses: $2.77B — FBI IC3 2024 🔒 Only 41% of orgs fully deploy MFA — IBM 2025 ⚠ 47.1M DDoS attacks in 2025 — Cloudflare Q4 🕵 Nation-state actors behind 34% of breaches 💡 AI & security automation saves avg. $1.9M per breach 🛠 Patch gap: avg. 55 days from CVE to exploitation 🛡 4,000+ ransomware attacks daily globally 💰 Healthcare sector avg. breach: $9.77M 👥 3.5M unfilled cybersecurity jobs worldwide 🎣 90% of attacks start with phishing ⚡ 97 zero-day exploits documented in 2023 🏥 Healthcare most targeted sector — 5th consecutive year 🏭 Manufacturing #2 most attacked industry globally 🔑 Credential theft drives 24% of all breaches 🌐 Supply chain attacks up 100% YoY — Verizon DBIR 2025 💸 Avg. ransomware payment: $2.73M — Sophos 2025 🔓 68% of breaches involve human error or social engineering ⏱ Median attacker dwell time: 14 days before detection 🤖 AI-assisted attacks accelerating — CrowdStrike 2025 🌍 $10.5T projected global cybercrime cost by 2025 📧 Business email compromise losses: $2.77B — FBI IC3 2024 🔒 Only 41% of orgs fully deploy MFA — IBM 2025 ⚠ 47.1M DDoS attacks in 2025 — Cloudflare Q4 🕵 Nation-state actors behind 34% of breaches 💡 AI & security automation saves avg. $1.9M per breach 🛠 Patch gap: avg. 55 days from CVE to exploitation
NATION-STATE METRICS
Infrastructure Focus
+24% YoY
68%

Proportion of tracked state operations targeting power grids and water infrastructure.

Median APT Dwell Time
-15% YoY
42 Days

Median time state attackers remain in victim undetected.

State-Backed Crypto Theft
Highest Peak
$1.2B

Funds stolen mostly by North Korea then used to buy weapons.

Supply Chain Attacks
+12% YoY
34%

Share of breaches by state-related actors.

THREAT CAMPAIGNS BY ORIGIN

Country % of Total Data Source
China
44% (Volt Typhoon)
CrowdStrike '26
Russia
28% (Midnight Blizzard)
Verizon '25
Iran
16% (Mint Sandstorm)
MDDR Report
Other
12% (Combined)
Mandiant '25

THREAT TARGETS

Target Profile Attack Weight Data Source
Gov / Diplomatic
32%
MDDR Sector
Critical Infrastructure
26% (Grid Focus)
Volt Typhoon
IT & Cloud Systems
14% (Downstream)
Verizon Core
Other
28% (Aggregated)
Mandiant Base
Attack Weight is a normalized index combining attack frequency, velocity, and severity. Rather than tracking absolute attempt frequencies, it clarifies aggregate asset investment and structural impact.
ORGANIZED CYBERCRIMINAL METRICS
Average Ransom Demand
+18% YoY
$4.2M

Average ransom demand when attacker both encrypts and steals data.

Initial Access via IABs
Highest Peak
72%

Share of ransomware attacks using credentials stolen by 3rd-party Initial Access Brokers.

Data-Only Extortion Share
+30% YoY
46%

Data stolen and held for ransom — payment doesn’t guarantee no public exposure/resale.

Median Recovery Time
-5% YoY
22 Days

How long on average it takes victims to restore basic operations.

MALICIOUS INSIDER METRICS
IP Exfiltration Events
54%

Share of insider attacks involving IP theft.

Detection Window Delay
85 Days

How long on average before victims detect data theft.

HACKTIVIST COLLECTIVE METRICS
Peak DDoS Volume
4.8 Tbps

Record high attack volume registered in 2025.

Public Targets Share
61%

Share of politically-motivated attacks on government websites, utilities and public services.

IN SUM: THREAT TYPE CHARACTERISTICS
Actor Profile Origin Dwell Time Technology Stack Strategic Intent
Nation-State State Actor Nodes 42 Days LotL scripts, zero-days, firmware wipes, supply chain backdoors. Geopolitical espionage, infrastructure sabotage, long-term persistent presence.
Cybercriminal Global Syndicates 22 Days RaaS kernels, credential stealers, initial access tokens. Direct financial extraction, high-volume asset monetization tactics.
Insider Internal Network 85 Days Auth keys, unmonitored storage, logic bombs, shadow drops. Intellectual property theft, unauthorized corporate data leak operations.
Hacktivist Decentralized Cells < 1 Day Botnets, layer 7 DDoS scripts, open-source defacement kits. Ideological disruption, public target embarrassment, political message signaling.
Sources
CrowdStrike Global Threat Report · Feb 2026 · Verizon DBIR · May 2026 · Microsoft Digital Defense Report · 2025 · Mandiant Threat Intelligence · 2025