2025 SonicWall Cyber Threat Report: Key Findings for Business and IT Decision-Makers
The SonicWall Cyber Threat Report continues to be an anticipated and valuable annual publication. The first edition of the report was published over a decade ago. Cybersecurity professionals use it to get data-backed insights into the current cybersecurity threat landscape. As threats evolve each year, the report continues to document the current landscape and provide advice on dealing with threats. The 2025 edition of the report is now available, and you can download it for free.
SonicWall and Renaissance work together in Ireland to deliver SonicWall’s cybersecurity products and services to MSPs and their clients. Have a look at the solutions available. If you have any questions about anything related to the SonicWall report or their cybersecurity solutions, contact Renaissance and speak to Andrei or Jayden.
Since the SonicWall Cyber Threat Report is free to download, reproducing the findings in detail here doesn’t make sense. We will highlight the main findings to whet your appetite and entice you to grab the full report. If you are a fan of bite-sized summaries, a SonicWall 2-page executive summary is available.
General Overview
The SonicWall blog has a recent post that summarises the findings in the latest Cyber Threat Report. Paraphrasing from that blog:
Not only are cybercriminals getting smarter – they’re getting faster. […] hackers are now using public exploit code within 48 hours of release. Making matters worse is how long it takes organisations to patch critical security flaws.
For businesses and security professionals, the window for prevention is shrinking rapidly. Legacy security solutions are no longer enough. Businesses must adopt a new mindset to combat modern cyber threats. To stay ahead, companies need real-time threat intelligence, continuous monitoring and proactive defence strategies.
In the rest of this blog, we’ll briefly highlight the main threat findings. Read the full report for the details and reach out to Andrei or Jayden in Renaissance for advice on solutions to counter these threats.
The Speed of Exploitation Has Reached Alarming Levels
One of the interesting findings in the report is the speed at which threat actors are now exploiting vulnerabilities. According to SonicWall’s data, 61% of hackers leverage new exploit code within 48 hours of it becoming publicly available. This extremely condensed attack window puts considerable pressure on organisations to discover and implement patches and updates almost immediately.
As noted by an MSP quoted in the report: “As an MSP, we see firsthand how quickly cyber threats evolve. The speed at which threat actors utilise publicly available weaponised code, often within one to four days, reinforces the critical need for proactive security measures. The days of waiting weeks to patch vulnerabilities are over. Attackers have reduced their response time to hours, pointing to the need that businesses need an MSP that can proactively monitor, detect, and respond to emerging threats before they lead to costly breaches.”
Ransomware Remains a Dominant and Costly Threat
Ransomware continues to plague organisations across the globe. The report highlights an increase in attack volume, with Latin America seeing a staggering 259% rise and North America experiencing an 8% increase. The healthcare sector was particularly hard hit, with over 198 million Americans impacted by ransomware breaches in 2024.
The financial impact of Ransomware is alarming. The average ransomware payment reached approximately €790,000 ($850,700) in 2024, but the total cost of an attack often exceeds €4.5 million ($4.91 million) when downtime and recovery costs get factored in.
Business Email Compromise (BEC) Attacks Continue to Accelerate
BEC attacks have significantly increased, accounting for 33% of reported cyber insurance events in 2024 — up from just 9% in the previous year. The threat report notes that global losses from BEC attacks exceeded nearly €3 billion ($2.95 billion)! This figure is larger than the entire annual budget of the Cybersecurity and Infrastructure Security Agency (CISA) in the United States.
Generative AI-powered tools have made these attacks more challenging to detect, with threat actors now able to mimic company writing styles and craft highly contextualised phishing emails with relative ease.
In Europe, Strela Stealer is one of the most persistent and dangerous threats. The Strela Stealer malware steals email login data from well-known email clients and sends it back to the attacker’s servers.
AI Is Lowering the Barrier to Entry for Cybercriminals
Speaking of Generative AI, the report identifies a concerning trend. AI-powered tools are making sophisticated attacks more accessible to less skilled threat actors. For example, Server-Side Request Forgery (SSRF) attacks saw a 452% increase compared to 2023, with AI tools helping attackers identify unpatched systems, automate exploit chaining, and evade detection. Generative AI also helps attackers polish their attack methods and supporting collateral in many other areas.
Living Off the Land Binaries (LOLBins) Present a Growing Threat
Living Off the Land Binaries (LOLBins) attacks use legitimate programs in computer operating systems that have legitimate uses to keep computers running. Cyber attackers increasingly leverage LOLBins for attacks. SonicWall’s research identified schtasks.exe, cmd.exe, and powershell.exe as the most abused LOLBins, accounting for over 80% of all identified cases. Using these legitimate system components allows attackers to hide their activities using trusted system components, making detection significantly more challenging.
Everyday Files Have Become Significant Attack Vectors
Alongside LOLBins, attacks that use standard files as attack vectors are increasing, with HTML and PDF being the most significant file types targeted. Data cited in the report shows that 38% of malicious files detected were HTML-based, with PDFs following closely behind at 22%. Attackers often embed QR codes within malicious PDFs that direct victims to phishing sites designed to steal credentials. These everyday file types can evade security systems while exploiting the human element — a strategy that has proven highly effective in getting initial access before launching more sophisticated attacks.
IoT and Encrypted Threats Continue to Rise
The Internet of Things (IoT) remains a significant vulnerability, with attacks surging by 124% in 2024. IoT cameras have become a primary target, with SonicWall preventing over 17 million attacks on these devices alone. These attacks often target devices in government facilities and other sensitive locations, making them particularly concerning. Encrypted threats against IoT rose by 93%, highlighting the increasingly sophisticated methods attackers use to hide their activities and bypass traditional security measures.
Recommendations In the SonicWall Report
The report concludes with several pages that discuss how to build an effective cybersecurity defence system. It’s a simplification of what’s in the report, but here are seven key takeaways:
- Implement Real-Time Monitoring & Patch Management - With attackers exploiting vulnerabilities within a few days, organisations must continuously scan for attackers’ activities and apply patches ASAP.
- Adopt a Zero Trust Security Model - Enforce strict access controls and validate every access request, assuming no implicit trust.
- Leverage 24/7 SOC Services - MSPs should partner with security vendors offering Security Operations Centre (SOC) services and round-the-clock monitoring to ensure real-time threat detection.
- Enhance Ransomware Preparedness - Implement regular backups (have air-gapped backups), network segmentation, and endpoint detection and response solutions.
- Strengthen IoT Security - Secure IoT devices by changing default credentials, applying firmware updates, and restricting network access.
- Monitor Cloud Environments - Enforce multi-factor authentication and least-privilege access policies for cloud resources.
- Conduct Regular Cybersecurity Awareness Training - Human error remains a major attack vector. Regular training can significantly reduce this risk.
Conclusion
The 2025 SonicWall Cyber Threat Report paints a clear picture — cyber threats are evolving at an unprecedented pace, becoming more sophisticated, diverse, and damaging. For MSPs, this highlights the critical importance of adopting a proactive and layered approach to security. This provides an opportunity to enhance services to existing and new clients.
As one partner noted in the report: “Cybercriminals are becoming more strategic, combining new attack methods with proven tactics to exploit vulnerabilities. The cost of a cyberattack isn’t just financial — it can permanently damage a company’s reputation and disrupt operations. Businesses need a security partner that stays ahead of evolving threats, providing proactive protection, real-time monitoring, and strategic defences to defend their most critical assets.”