M-Trends 2025: State-Sponsored IT Workers Emerge as Global Threat

More than anything, Mandiant’s M-Trends 2025 report demonstrates how attackers rapidly evolve their methods to counter improved defenses. There’s no let up.

The annual M-Trends report from Mandiant is a key source of threat intelligence for industry, packed with statistics from Mandiant’s own incident investigations and enriched with Google Threat Intelligence Group (GTIG) research. But it is important to understand how the report is compiled to maximize its value.

Firstly, while Mandiant is a major player in incident investigations, the telemetry involved is limited in comparison to other major security vendors’ telemetry (such as EDR providers). This doesn’t limit the value of Mandiant’s numbers but does mean they cannot be interpreted as global statistics. A good example is seen in the Targeted Industries section, which is dominated by attacks against the finance sector (17.4%). The healthcare sector comes fifth at only 9.3%.

This ...