Security operations firm Arctic Wolf has published its 2025 Security Operations Report, analysing more than 330 trillion security observations.

Despite unprecedented investment in cybersecurity, the pace and complexity of today’s threats continue to challenge even the most mature organisations. Attackers are moving faster, targeting new attack surfaces, and exploiting new vulnerabilities in ways that traditional defences often miss.

The insights in the 2025 Security Operations Report give leaders a benchmark to measure their own programs, identify gaps, and prioritise defences that drive measurable resilience.

The report highlights the importance of constant vigilance, with more than half of alerts (51%) occurring outside of standard business hours and 15% of all alerts taking place over weekends. This underscores the scale of threats organisations face when security teams are at their thinnest.

At the heart of the findings is the performance of the Aurora Platform, which cut through an enormous 330 trillion raw observations to generate just 8.6 million alerts. That equates to a noise reduction rate of more than 99.99999% – or a single alert for every 138 million observations.

AI and human expertise continue to work in tandem to accelerate response. Alpha AI handled the triage of 10% of alerts, removing the need for more than 860,000 manual reviews. This automation has helped drive a 37% reduction in Mean Time to Ticket (MTTT) over the past two years.

Certain sectors remain especially attractive targets for attackers. Education, healthcare, and manufacturing once again recorded the highest attack volumes – a trend fuelled by outdated infrastructure, the value of data held, and a low tolerance for downtime.

Recommended reading

• API and Bot Attacks Cost Businesses £141 Billion A Year 
• NCSC Issues Advisory to Combat China-linked Cyber Threat
• NCSC Releases Cyber Incident Response Guidance for CEOs

The report also points to “mega events” that demonstrate how adversaries are evolving their playbooks. High-profile campaigns such as Fortinet’s “Console Chaos” and SonicWall’s CVE-2024-40766 reveal how attackers are exploiting weaknesses in identity and VPN systems to escalate privileges and encrypt unmonitored systems in as little as 90 minutes.

“Today’s threat landscape is defined by round-the-clock attacks that target identity, exploit timing, and drive alert fatigue, leaving defenders to navigate increasingly complex tactics,” said Dan Schiappa, president, Technology & Services, Arctic Wolf.

“Because we operate at global scale, we have unmatched visibility into how attackers adapt and how defenders respond. This report distils those insights into clear guidance organisations can use to strengthen defences and prepare for what comes next.”