Compromise Assessments Reveal Long-Term Threats and Detection Gaps
TL;DR
Kaspersky’s 2025 compromise assessments highlight a concerning trend of undetected threats persisting for extended periods in organizations, with missed incidents often linked to inadequate monitoring and response practices. Proactive assessments are shown to significantly reduce the occurrence of high-severity threats.
Main Analysis
Kaspersky’s compromise assessments in 2025 uncovered serious vulnerabilities within organizational security postures, revealing that 30.8% of incidents and 52% of high-severity compromises remained undetected for over three months. The oldest incident identified had been dormant for four years. Key findings indicate that many organizations lack the high-confidence alerts necessary to detect malicious activities promptly, with 60% of missed incidents attributed to inadequate alerting mechanisms. Notably, incidents that were manually discovered accounted for 20% of the findings.
The assessments also emphasized the significance of proactive evaluations in reducing missed incidents. Organizations that underwent assessments following known incidents exhibited the highest proportions of high-severity findings, while regular auditing revealed more low-level threats, underscoring the importance of continuous monitoring. Factors contributing to missed detections include ineffective communication practices, reliance on outdated incident response playbooks, and flexibility in adapting these protocols to evolving threats.
Furthermore, Kaspersky’s assessments found that malicious persistent threats often reside unnoticed in backups, indicating a critical need for better backup management and asset inventories to avoid reintroducing threats post-incident response.
Defensive Context
Organizations should pay particular attention to the described threats if they operate in environments where extended dwell times are likely, such as networks with significant legacy systems or insufficient monitoring. Sectors such as government, education, and finance—which accounted for a notable percentage of the incidents—should prioritize proactive compromise assessments to mitigate hidden threats. Agile incident response capabilities are vital, especially in environments handling sensitive data or critical infrastructure.
Why This Matters
The potential for threats to lie undetected for substantial periods poses severe risks, including long-term data compromise or system exploitation. Enterprises that fail to harness active threat detection strategies run the risk of not only immediate losses but also long-term reputational damage.
Defender Considerations
Organizations should consider integrating regular compromise assessments into their security policy and aligning them with incident response practices. Identifying dormant threats post-incident response is crucial for comprehensive threat visibility. Building robust alerting mechanisms and fostering a culture of continuous monitoring can directly reduce the dwell time of advanced threats.
Indicators of Compromise (IOCs)
No specific IOCs were provided in the article. However, the existence of dormant threats and malicious artifacts highlights a general need for organizational vigilance regarding system and network monitoring.
