What the Cyber Threat Reports Are Telling Us

What does this mean for elections?

By Mike Moser

Election officials are the stewards of democracy, quite literally. (Thank you!) They are tasked with upholding the integrity, security, and resilience of the electoral process, often with limited resources and an eye toward smooth operations. However, those duties have significantly expanded since 2017 following the federal government’s designation of elections as critical infrastructure. Almost immediately following Russia’s 2016 attempt to interfere with U.S. elections, we kept hearing about “cyber, cyber, cyber”. Election officials were essentially asked overnight to become cybersecurity and IT experts. 

That trend continues to this day; however, the risks have evolved, with physical security now equally paramount, and officials are now facing both professional and personal threats. Yet cybersecurity threats continue to persist. Each time the threat landscape evolves, so, too, do the expectations of election officials, and that can be difficult to navigate, especially when there’s a lot of noise cluttering the bigger picture, all while operating in an environment where federal support for election security has become less predictable.

As the Exchange has been on the road, engaging directly with the election community, we continue to hear officials’ concerns across myriad risk domains: cybersecurity, physical security, and operational security. Those conversations prompted us to take a closer look at what the broader cybersecurity research community is saying to help cut through the noise as we navigate the 2026 midterm election cycle. 

Every year, the cybersecurity industry’s leading organizations publish annual findings, and this year several of those reports landed around the same time. Together, we reviewed seven of those reports, which are noted below. We decided to read them so you don’t have to. What follows draws on those reports to give you a grounded, simple picture of the cyber threat landscape you’re operating in right now. 

At a Glance

Seven major cybersecurity reports published in 2025 and 2026 describe a threat environment that is faster, more automated, and harder to recover from than it was just a year ago. These are not theoretical risks: they reflect the conditions election offices are operating in right now. Most incidents are traced back to preventable gaps, not sophisticated techniques.

Six trends with direct relevance to election offices:

1. Attacks are faster and more frequent. Organizations faced nearly 2,000 cyber attacks per week in 2025. Once attackers gain initial access, they can move across a network in under 30 minutes.
2. Stolen credentials are the primary entry point. Nearly two-thirds of initial access events were identity-driven. Multi-factor authentication on every account remains the most impactful protection available.
3. AI is making attacks harder to detect. Attacks are faster, more personalized, and cheaper to launch. AI impersonation of known officials and internal accounts is an active and documented risk.
4. Ransomware is growing and now targets your ability to recover. Operators are deliberately destroying backup infrastructure to force payment. An untested or online-only backup is not a reliable recovery path.
5. The window to patch before exploitation is near zero. Attackers scan for known vulnerabilities within minutes of public disclosure. Only 26% of critical vulnerabilities were remediated in 2025.
6. Vendor and cloud breaches are rising. A single compromised vendor can disrupt multiple jurisdictions simultaneously. Your vendor’s security posture matters as much as your own.

See the Mitigations and Recommendations section below for practical, prioritized steps any office can take regardless of size or budget.

Reports Used

The following reports were used to assemble this piece: 

• CrowdStrike 2026 Global Threat Report: Year of the Evasive Adversary
• Mandiant (Google Cloud Security) M-Trends 2026 Report
• Check Point Cyber Security Report 2026: 14th Annual Edition
• Unit 42 (Paloalto Networks): Global Incident Response Report 2026
• Cisco Talos: 2025 Year in Review
• Verizon: 2026 Data Breach Investigations Report
• Microsoft: Digital Defense Report 2025

Key Trends

We found six trends worth highlighting that resonated across most reports, in no particular order. Notably, we hope that these findings spur productive conversations in the election community about proactive defense as you consider your broader security posture.  

Finding #1 – Attacks are faster and more frequent than ever

Most reports paint a picture of an environment that has escalated in both scale and speed, often outpacing the capacity of most organizations, particularly smaller or under-resourced ones.

To put a finer point on this, Check Point found that organizations faced an average of 1,968 cyber attacks per week in 2025, representing an 18% year-over-year increase and nearly a 70% increase since 2023. CrowdStrike saw the average time for a criminal attacker to move from initial access to spreading across a victim’s network drop to 29 minutes. Unit 42 found that 87% of intrusions in 2025 involved simultaneous activity across multiple systems or environments, with almost half involving browser-based activity. Finally, Mandiant noted the median dwell time, or the time between when an attacker first gains access versus detection, rose from 11 to 14 days in 2025.

Why this matters for election security

The threat environment described in these reports indicates threats are outpacing defenses. When the average time to move from initial access to spreading across a network is 29 minutes, the window between a suspicious alert and a significant intrusion can close before anyone is aware that an incident has even begun. The tempo and scale described in these reports are a useful context for election offices evaluating their detection and response capabilities, their relationships with IT and security partners, and the value of having incident response plans that are current and practiced before an active voting period begins. Pre-established relationships with internal and external security partners, tested incident response plans, and regular exercises are no longer optional.

Finding #2 – Username/Password theft is the primary entry point

Every report explored how actors access systems, and a predominant theme emerged: rather than breaking through defenses, attackers are walking through the front door. In other words, attackers are using stolen credentials, compromised legitimate accounts, or accounts with more permissions than necessary. Election offices are high-value targets for credential theft. Offices without dedicated security monitoring are more exposed to this pattern, which is why multi-factor authentication (MFA) should be enabled on every account, including vendor accounts. This remains one of the most impactful protections available to any office.

Unit 42 found that 65% of initial access was identity-driven. Microsoft also noted that identity-based attacks rose 32% in just the first half of 2025, and CrowdStrike found that valid account abuse accounted for 35% of cloud incidents.

However, the methods for stealing credentials are evolving, with traditional email phishing declining. For example, Mandiant found it dropped from 14% to 6% of initial attack vectors in 2025, as more sophisticated tactics replaced it. Vishing (voice phishing) became the second most common initial infection vector, behind software exploits. Cisco Talos also found that attackers are frequently using already-compromised accounts to send phishing messages internally, which is more challenging to detect and easier to trust.

Why this matters for election security

Like other sectors, election offices rely heavily on email, phones, VPNs, and remote access tools, all of which can be attack vectors for credential theft.

Finding #3 – AI is accelerating attacks

Another documented shift across these reports is attackers’ adoption of artificial intelligence. It’s important to note that AI is not replacing traditional attack methods, but it does make them faster, harder to detect, and lowers the barrier to entry for potential actors.

CrowdStrike noted an 89% year-over-year increase in attacks by AI-enabled adversaries in 2025 and saw that AI is being used throughout the attack lifecycle: speeding up reconnaissance, developing compelling messaging, generating and debugging malicious code, and assisting attacks in evading detection by blending into normal activity. Unit 42 observed a measurable impact on evolving attack techniques, where the fastest attacks in 2025 reached data exfiltration in just 72 minutes, down from 285 minutes the year before. Check Point went as far as to say 2025 was “the year of AI impersonation”, where tools are becoming more mature and personalizing manipulation. This growing maturity was also shared across most of the reports.

Why this matters for election security

Elections are high-profile, publicly accessible operations that rely on common tools like email and phones to coordinate activities, communicate with voters, and interact with vendors and partners. Often, officials’ names, roles, and contact information are publicly available, too. The AI-enabled techniques documented in these reports target those channels where attacks are now hyper-personalized, may impersonate key personnel, and are more difficult to detect. Understanding that these tools have matured and are in active use helps election officials evaluate their own exposure and the verification practices they have in place.

Finding #4 – Ransomware is growing and targeting recovery

While ransomware itself is not new, and state and local governments remain attractive targets, it grew in 2025 and took a larger share of reported breaches than in prior years. Perhaps more important is the shift in how ransomware operators are approaching their plans.

The Verizon 2026 DBIR reported ransomware in 48% of breaches, up from 44% the year before. Check Point also noted ransomware reached record highs in 2025 despite law enforcement taking significant steps to dismantle several ransomware groups, at least temporarily. Mandiant noted a tactical shift among ransomware operators, moving toward preventing recovery rather than stealing data, with the goal of making it more difficult to recover without paying.

Why this matters for election security

The strategic shift from data theft to denial of recovery can prove problematic in addition to any disruption caused by a ransomware event. An election office that cannot restore its systems because the backups were wiped or destroyed, especially during an active voting period, exposes a scenario worse than simple data loss. Tested, offline backups, and a documented continuity of operations plan (COOP) are becoming more operationally necessary than in prior years.

Finding #5 – The gap between patching and remediation is widening

Several reports highlighted a consistent pattern where there’s a widening gap between patching systems and exploitation. Specifically, the reports note that known vulnerabilities are being exploited before organizations can patch them in a timely manner. 

Verizon went so far as to say this is a historic shift, with exploitation of vulnerabilities now the most common way attackers gain initial access to a system, at around 31%. Often, edge devices, such as firewalls, VPNs, and network gateways that sit on the outside of an organization’s perimeter network are targeted. Similarly, Unit 42 observed scanning activity for known vulnerabilities within minutes of publication. CrowdStrike also documented a 42% year-over-year increase in zero-day exploitation, which is where attackers exploit a vulnerability before anyone knows it exists. At the same time, Verizon found that only 26% of critical vulnerabilities, specifically those on CISA’s Known Exploited Vulnerabilities (KEV) catalog, were remediated in 2025.

Why this matters for election security

While election infrastructure is unique in some regard, where critical systems like voting systems are air-gapped from the broader network, elections still rely on common administrative infrastructure, such as VPNs, remote access tools, firewalls, workstations,  etc, to connect to systems and manage operations. Those are precisely the edge devices described in these reports as targets for exploitation. An extended remediation window, coupled with exploitation beginning within minutes of public disclosure, means election organizations that don’t patch quickly face greater risk. For offices with limited or no dedicated IT staff, CISA’s KEV catalog is a helpful prioritization tool available at no cost. 

Finding #6 – Vendors continue to be a target, even cloud providers

Vendors have long been a target and a prime choice for sophisticated actors because they represent a consolidated point of entry. Rather than targeting multiple organizations and expending more resources,  they can focus more resources on one target and disrupt multiple organizations that rely on those services after successful intrusion. This idea continues to hold as more organizations move their data and operations into cloud environments or rely on software-as-a-service (SaaS) applications. 

CrowdStrike found a 37% overall rise in cloud-focused intrusions in 2025 and noted that these actors are usually abusing legitimate identity and authentication systems instead of exploiting vulnerabilities. Mandiant describes a concerning cascading effect in SaaS breaches. When a single shared software vendor is compromised, downstream disruption becomes a defining characteristic of the modern technology environment. Verizon also saw a 60% year-over-year increase in third-party breaches, where their root-cause analysis illustrated a few common denominators: insecure authentication, the absence of MFA, improper credential rotation, and excessive user privileges, not necessarily sophisticated techniques.

Why this matters for election security

Election administration has increasingly moved to cloud-hosted technology and shared technology vendors for voter registration, communications, and other functions. The cascading downstream effects described by Mandiant are directly applicable, where a single compromised vendor can simultaneously trigger incidents across multiple election offices. Third-party breaches have also increased. For election offices, the security posture of shared election technology vendors is equally as important as their own security.

Mitigations and Recommendations

The threats noted across the seven reports are important, but they are not insurmountable. These incidents largely stemmed from preventable gaps rather than novel techniques. The following recommendations are those that research consistently identifies as high-value actions for organizations, including election offices.

Prioritize the essentials

Establishing a solid foundation can go a long way in mitigating potential risk. Safeguards like multi-factor authentication on every account, applying the principle of least privilege, and maintaining an inventory of all assets, including hardware, software, and user accounts, support a healthier security posture. These three things can help address root causes that appear across major breach categories documented in these reports. For election offices working through baseline cyber hygiene, the Exchange’s First Things First: Cybersecurity Fast Wins for Election Offices offers a practical starting point that prioritizes controls relevant to election infrastructure.

Prepare before you need it

It’s really not a matter of ‘if’, but ‘when’. This isn’t to say that the integrity of the election will be affected, but the events these reports call attention to open up the possibility of administrative disruptions that election officials should plan for and work with partners to identify or strengthen mitigations. Incident response plans, tested offline backups, and continuity procedures need to be reviewed, updated, and practiced before your next active voting period. Ransomware operators are now targeting backup and recovery infrastructure, meaning an untested backup is not a reliable recovery path. The Exchange’s Communicating During an Election Incident and It Starts with a Team: Building Your Election Security Working Group provides frameworks for planning and building internal and external relationships that support a timely response.

Train for disruptions

Social engineering and phishing remain common attack vectors, and AI has made it harder to detect. Election workers need to understand that a familiar-sounding phone call, a plausible email, or an urgent request from a known official can be fake, and that verification procedures are becoming increasingly necessary. Similarly, vendors remain a top target, where a disruption to one vendor can disrupt multiple jurisdictions simultaneously. Vendors are an extension of the jurisdiction’s network and should have equally stringent security requirements that are routinely reviewed and refreshed. The Exchange’s Phishing Threats: Essentials for Safeguarding Election Infrastructure offers tips on phishing risk and shares potential controls.

Lean on the support ecosystem

Election offices are not operating in this environment alone. The operating environment may have shifted in early 2025, but support still exists, even if it looks a little different. CISA continues to provide the Known Exploited Vulnerabilities catalog among cyber hygiene scanning and other services. The Exchange offers education, training, and exercises for interested organizations. Engaging these resources before an event is a key step any office can take, regardless of size or budget.