X-Force Threat Intelligence Index 2026

Organizations continue to face security incidents not due to sophisticated adversary techniques, but because foundational security controls are often inconsistently implemented or poorly maintained.

Basic measures such as comprehensive logging, timely patching, proper access management and secure configuration of deployed technologies are often neglected or only partially enforced. In some cases, critical security tools are installed without proper tuning, leaving misconfigurations and visibility gaps that undermine their intended effectiveness. These operational shortcomings rather than advanced threat capabilities can provide adversaries with the opportunity to establish and maintain access. Strengthening adherence to core cybersecurity hygiene remains essential to reducing overall risk.

Understanding how these issues are exploited in practice requires insights from real-world adversarial testing. X-Force Red, an elite team of hackers and researchers, conducts exercises which provide a glimpse into many of the methods that attackers can use to exploit vulnerabilities in victim environments. To best organize the findings, we have categorized the results of their penetration testing engagements into the MITRE Corporation’s Common Attack Pattern Enumeration and Classification (CAPEC) framework.

CAPEC was designed to standardize how to describe, analyze, and reason about attacker behavior. It provides a public, structured catalog of attack patterns that adversaries repeatedly use to exploit systems, people and processes. The goal is to capture how attacks work at a conceptual and operational level, independent of any specific vulnerability, exploit or campaign.

The following chart lists the top ten attack patterns discovered by X-Force Red in 2025.

The frequency of these CAPEC attack patterns highlights significant systemic weaknesses in access control, credential management and software configuration.

• The high occurrence of exploiting incorrectly configured access control security levels (CAPEC-180) suggests misconfigurations remain a primary entry point for attackers, indicating persistent gaps in governance and enforcement of security policies.
  
  
• The prominence of password brute forcing (CAPEC-49) and scanning for vulnerable software (CAPEC-310) reflects widespread exposure due to weak authentication practices and insufficient vulnerability management.
  
  
• Frequent instances of query system for information (CAPEC-54) and code injection (CAPEC-242) reveal ongoing issues with information disclosure and insecure coding, which can facilitate further compromise.
  
  
• Patterns such as privilege escalation (CAPEC-233) and session hijacking (CAPEC-593) demonstrate once attackers gain a foothold, they are able to move laterally and maintain persistence, amplifying the impact of initial breaches.

Collectively, these trends indicate organizations face compounded risks from both preventable technical flaws and operational oversights. This finding underscores the need for stronger configuration controls, proactive vulnerability management and secure development practices to mitigate recurring exploitation paths.