The Annual State of Cyber 2026
Four teams, one picture. Our GRC, DFIR, Offensive Security and SOC teams report on the tactics, trends and takeaways shaping Australian and New Zealand organisations this year.
The Annual State of Cyber 2026
Four teams, one picture. Our GRC, DFIR, Offensive Security and SOC teams report on the tactics, trends and takeaways shaping Australian and New Zealand organisations this year.
Hear directly from the Triskele Labs team behind the State of Cyber report
The Year in Numbers
177
DFIR incidents responded to
355
offensive engagements conducted
2,705
vulnerabilities identified
222,843
alerts processed by the SOC
Read the 2026 Report
Digital Forensics and Incident Response
Ransomware and Business Email Compromise defined this year's incident landscape, with data theft moving ahead of encryption as the real point of leverage. Some groups now skip encryption altogether, extorting purely on the threat of publishing what they have already taken.
Digital Forensics and Incident Response
Ransomware and Business Email Compromise defined this year's incident landscape, with data theft moving ahead of encryption as the real point of leverage. Some groups now skip encryption altogether, extorting purely on the threat of publishing what they have already taken.
Managed Detection and Response
The SOC took on more clients this year while cutting the noise each one generated, and detection times for high-severity alerts nearly halved. The gains reflect ongoing, client-specific tuning rather than a smaller book of business.
Managed Detection and Response
The SOC took on more clients this year while cutting the noise each one generated, and detection times for high-severity alerts nearly halved. The gains reflect ongoing, client-specific tuning rather than a smaller book of business.
What This Year's Data Shows
Four teams, four vantage points, and the same patterns kept surfacing across governance, incident response, offensive testing and detection.
-
Identity Is Still the Front Door
The most common way in during live incidents, and the most common serious finding under test.
-
AI Compresses Timelines, Not Tactics
It has not created a new class of attack; it has cut the time needed to run the ones we already know.
-
Technical Debt Multiplies Severity
Rarely the root cause, but it reliably turns a contained problem into a company-wide crisis.
-
The Data Is the Target
Increasingly, it is the data itself under attack, not the systems around it.
We are the only cybersecurity experts you'll ever need to talk to.
We consider every business we work with a partner - not just a customer. At Triskele Labs, we work with you to understand your risks, goals, challenges and culture to develop Cyber Security solutions tailored to your business. With us by your side, you can be confident that your data and systems are secure - and that you have a trusted, responsive and experienced partner to protect your business.