A source-cited rolling one-year synthesis of Kroll's public cyber-risk, threat-landscape, incident-response, resilience, exposure-management, and governance publications. The chronology now spans August 2025 through July 2026 and connects active campaigns, threat speed, known weaknesses, measurable business impact, ownership, remediation capacity, and proof that risk was actually reduced.
| Field | Value | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| User Topic | What Kroll's current public cyber corpus says leaders should do differently about exposure, resilience, governance, incident economics, AI-enabled discovery, and the gap between security plans and demonstrated response. | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Interpreted Questions | Which weaknesses are being industrialized at scale? Where are identity and non-human identity risks hiding? Can the organization respond at attacker speed? Who owns remediation, how is materiality measured, and what evidence proves that exposure and recovery risk declined? | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Initial Observations | Kroll's corpus is unusually decision-oriented. It argues that attackers are industrializing familiar weaknesses, while AI increases discovery and exploitation speed. Its 1,000-person resilience survey found a persistent strategy gap, substantial financial impact, and a response-time mismatch. The recurring conclusion is that inventory, ownership, prioritization, remediation, verification, and cross-functional governance matter more than adding another isolated control.[1][2][3][4][5][6][7][8][9][10][11]First cited source Aug 22, 2025 · Latest cited source Jul 6, 2026 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Source Coverage |
Complete Tier 0–8 counts are shown here. The 11 retained sources and their claim treatment are identified in Citations. Planned integrations are not counted as checked or selected. |
Reporting-Period Statistics
At-a-glance measures from the retained evidence set. Citations identify the source controlling each statistic.
Period Coverage
365 calendar days, inclusive. Records are included by their first-observed date inside this window; the period does not imply that every underlying incident began or was confirmed during it.
1,000[4]
Survey Respondents
Cybersecurity decision-makers across the Kroll study population.Evidence dated Mar 18, 2026
10[4]
Countries Surveyed
Multi-country survey scope; results are not a universal census.Evidence dated Mar 18, 2026
72%[4]
Strategy Alignment Gap
Respondents reporting a gap between cybersecurity strategy and business priorities.Evidence dated Mar 18, 2026
$20.9M+[4]
Average Reported Impact
Survey-reported average financial impact, not a verified universal incident-loss figure.Evidence dated Mar 18, 2026
Evidence-Prioritized Access Paths
Kroll's focus is not one malware family; it is the repeatable exploitation of known identity, configuration, human, and machine-account weaknesses at automated scale.
Publisher-observed access path
Retained Kroll evidence; local exposure and prevalence require validation
Publisher-observed access path
Retained Kroll evidence; local exposure and prevalence require validation
| Vector / Evidence | How It Starts | Attacker Outcome | What to Monitor |
|---|---|---|---|
1 Publisher-observed access path Human identity compromise[2]Evidence dated May 18, 2026 Retained Kroll evidence; local exposure and prevalence require validation | Weak authentication, targeted social engineering, or breached credentials. | Valid-looking access that blends into normal user behavior. | Impossible travel, session anomalies, unusual privilege use, transaction changes, and proxy-backed access. |
| Exposed API keys, service accounts, embedded credentials, or poorly governed agents. | Persistent privileged access that may survive employee credential resets. | Unused or ownerless identities, abnormal API calls, old secrets, and privilege expansion. | |
| Automated discovery finds reachable, unowned, or slowly remediated exposure. | Repeatable exploitation before the organization can prioritize and close the path. | Internet reachability, exploit evidence, business criticality, compensating controls, and overdue remediation. | |
4 Publisher-observed access path Executive social engineering[2]Evidence dated May 18, 2026 Retained Kroll evidence; local exposure and prevalence require validation | AI combines public, social, and breached data into a credible pretext. | Fraud, credential capture, extortion, or manipulated high-value decisions. | Urgent transaction changes, new payment instructions, identity verification failures, and executive impersonation. |
Intended Reader and Decision Context
Who this brief is written for, the geographic and organizational lens it uses, and how readers should apply the intelligence.
| Audience Field | Assessment |
|---|---|
| Audience fieldPrimary audience | AssessmentExecutives, CISOs, CIOs, incident-response leaders, threat-intelligence teams, SOC leaders, risk owners, and business-continuity leaders who need a decision-ready view of one publisher's strongest public research. |
| Audience fieldDecision use | AssessmentUse the card to identify recurring access paths, actor and campaign changes, affected technologies, likely business impact, and control priorities that deserve validation inside the reader's own environment. |
| Audience fieldSource posture | AssessmentKroll is the controlling source for publisher-specific observations. External facts repeated in a publication retain the original attribution and are not upgraded into independently verified IntelliOS findings. |
| Audience fieldUpdate model | AssessmentA dedicated publisher agent checks the complete monitored corpus weekly on tuesday at midday et, keeps a cumulative rolling one-year window, and sends Page Alerts only for material source-backed changes. |
Chronology and Decision Milestones
Entries are ordered from oldest to newest across the full rolling year. Kroll publications use their public date; source-defined observation periods remain explicit, and the opening 2025 threat report is labeled as baseline context rather than activity newly observed inside the window.
Published threat baseline
Kroll's first-half 2025 threat report describes BEC as prominent, phishing as the leading initial-access path, and Akira, PLAY and LockBit as persistent ransomware operations. The report is retained as the rolling year's opening baseline; its underlying observations predate part of this card's window.[7]
Browser and crypto abuse
Kroll connects compromised websites, fake browser-update prompts and blockchain-hosted instructions to infostealer delivery and crypto theft. The useful control is to detect browser-to-script execution and wallet or credential access, not merely block one domain.[7]
Software supply chain
Kroll reports a wider second wave that targeted npm, GitHub and cloud credentials, used pre-install execution and could attempt destructive deletion when exfiltration failed. Package counts and repositories do not equal unique victim organizations.[8]
Retail disruption
Kroll's retail analysis connects social engineering and help-desk abuse with mass-exploitation campaigns and prolonged operational disruption. Retail continuity plans must assume identity compromise, supplier outages and trading interruption can arrive together.[9]
Post-incident disclosure
Across annual reports from 12 breached firms, Kroll found cyber and incident language increased sharply after disclosure and remained elevated. The finding argues for decision-ready evidence, materiality governance and a durable remediation narrative before an incident forces the issue.[10]
Retail resilience
Kroll's retail guidance emphasizes social engineering, third-party access, business interruption and crisis coordination. Seasonal staffing and thin change windows make tested escalation and recovery capacity part of day-to-day loss prevention.[11]
Resilience survey
In Kroll's survey of 1,000 decision-makers across 10 countries, 72% reported a gap between cybersecurity strategy and business priorities. Governance must translate security work into business outcomes and accepted risk.[4]
Incident economics
Kroll's surveyed organizations reported average potential financial impact above $20.9 million. The figure is a survey result, not a universal loss average, but it supports explicit scenario quantification.[4]
Response readiness
Kroll reports that 99% of surveyed organizations have an incident-response plan, while only 19% believe they can respond within minutes. Exercises should measure mobilization, containment, decision, and recovery time rather than document existence.[4]
Threat economics
Kroll identifies weak identity, poor authentication, misconfiguration, social engineering, and automation as the scalable attack engine. A disciplined known-exposure program can therefore remove more risk than novelty-driven prioritization.[2]
Identity risk
Kroll highlights API keys, service accounts, and machine credentials as privileged, persistent, and often weakly monitored. Incident containment that resets only employee credentials may leave a durable access path.[2]
Human attack surface
Kroll warns that AI can aggregate records, credentials, and social context into targeted fraud and extortion. Executive protection and high-risk transaction verification should be treated as cyber controls.[2]
Governance
Kroll applies the Three Lines of Defense model to cyber speed and complexity: operations own risk, the second line independently challenges and monitors it, and audit supplies objective assurance.[5]
AI-speed exposure management
Kroll argues that AI compresses vulnerability discovery and weaponization timelines. Leaders need inventory, ownership, prioritization, remediation, verification, and board-ready evidence that exposure actually decreased.[3]
Enterprise-risk integration
Kroll frames exposure as a shared enterprise-risk discipline requiring technical reachability, financial impact, legal posture, ownership, documentation, and defensible decisions.[3]
Advisory operating model
Kroll describes a conversation-heavy assessment process that translates policy, technology, and process findings into recommendations. The value is not the questionnaire; it is a governed sequence of risk-reduction decisions.[6]
Bottom Line Up Front
Security assessments need to end in an owned 12-to-18-month roadmap: Kroll describes a conversation-heavy assessment process that translates policy, technology, and process findings into recommendations. The value is not the questionnaire; it is a governed sequence of risk-reduction decisions.[6]Evidence dated Jul 6, 2026
Discovery is becoming abundant; remediation velocity is the scarce resource: Kroll argues that AI compresses vulnerability discovery and weaponization timelines. Leaders need inventory, ownership, prioritization, remediation, verification, and board-ready evidence that exposure actually decreased.[3]Evidence dated Jun 17, 2026
The second line must challenge whether cyber risk is actually controlled: Kroll applies the Three Lines of Defense model to cyber speed and complexity: operations own risk, the second line independently challenges and monitors it, and audit supplies objective assurance.[5]Evidence dated Jun 5, 2026
Attackers are industrializing known weaknesses instead of waiting for exotic zero-days: Kroll identifies weak identity, poor authentication, misconfiguration, social engineering, and automation as the scalable attack engine. A disciplined known-exposure program can therefore remove more risk than novelty-driven prioritization.[2]Evidence dated May 18, 2026
Non-human identities can survive a human credential reset: Kroll highlights API keys, service accounts, and machine credentials as privileged, persistent, and often weakly monitored. Incident containment that resets only employee credentials may leave a durable access path.[2]Evidence dated May 18, 2026
Cyber strategy and business priorities remain misaligned: In Kroll's survey of 1,000 decision-makers across 10 countries, 72% reported a gap between cybersecurity strategy and business priorities. Governance must translate security work into business outcomes and accepted risk.[4]Evidence dated Mar 18, 2026
Decision Context
Kroll's public cyber research makes a clear argument: today's advantage goes to the organization that can remove known, reachable exposure faster than attackers can industrialize it. Novel exploit discovery matters, but weak identities, misconfiguration, social engineering, and unowned remediation still create the repeatable path to loss.[2][3]First cited source May 18, 2026 · Latest cited source Jun 17, 2026
The resilience problem is organizational as much as technical. Kroll's survey found widespread misalignment between security and business priorities, even though respondents recognized cyber as a core risk. Plans and budgets therefore need measurable operating outcomes: time to detect, mobilize, contain, recover, and prove that corrective action worked.[4]Evidence dated Mar 18, 2026
Identity must include machines as well as people. Service accounts, APIs, embedded credentials, agents, and other non-human identities can retain privilege after ordinary credential-reset actions. Asset and identity inventories should show owner, purpose, privilege, use, rotation, and revocation paths.[2][3]First cited source May 18, 2026 · Latest cited source Jun 17, 2026
Kroll's governance publications place independent challenge between operations and audit. The first line owns and remediates risk; the second line tests whether prioritization, acceptance, and reporting are defensible; audit verifies the system. Collapsing those roles weakens accountability.[5]Evidence dated Jun 5, 2026
The executive decision is to manage cyber exposure as a capacity-constrained portfolio. Rank what attackers can reach and what the business cannot tolerate, assign owners and deadlines, verify remediation, quantify residual risk, and report decisions in language finance, legal, risk, and the board can act on.[3][4][5][6]First cited source Mar 18, 2026 · Latest cited source Jul 6, 2026
Executive Briefing Priorities
Security assessments need to end in an owned 12-to-18-month roadmap — Kroll describes a conversation-heavy assessment process that translates policy, technology, and process findings into recommendations. The value is not the questionnaire; it is a governed sequence of risk-reduction decisions.[6]Evidence dated Jul 6, 2026
Discovery is becoming abundant; remediation velocity is the scarce resource — Kroll argues that AI compresses vulnerability discovery and weaponization timelines. Leaders need inventory, ownership, prioritization, remediation, verification, and board-ready evidence that exposure actually decreased.[3]Evidence dated Jun 17, 2026
The second line must challenge whether cyber risk is actually controlled — Kroll applies the Three Lines of Defense model to cyber speed and complexity: operations own risk, the second line independently challenges and monitors it, and audit supplies objective assurance.[5]Evidence dated Jun 5, 2026
Attackers are industrializing known weaknesses instead of waiting for exotic zero-days — Kroll identifies weak identity, poor authentication, misconfiguration, social engineering, and automation as the scalable attack engine. A disciplined known-exposure program can therefore remove more risk than novelty-driven prioritization.[2]Evidence dated May 18, 2026
Non-human identities can survive a human credential reset — Kroll highlights API keys, service accounts, and machine credentials as privileged, persistent, and often weakly monitored. Incident containment that resets only employee credentials may leave a durable access path.[2]Evidence dated May 18, 2026
Cyber strategy and business priorities remain misaligned — In Kroll's survey of 1,000 decision-makers across 10 countries, 72% reported a gap between cybersecurity strategy and business priorities. Governance must translate security work into business outcomes and accepted risk.[4]Evidence dated Mar 18, 2026
The reported average financial impact exceeds $20.9 million — Kroll's surveyed organizations reported average potential financial impact above $20.9 million. The figure is a survey result, not a universal loss average, but it supports explicit scenario quantification.[4]Evidence dated Mar 18, 2026
Plans are widespread, but rapid response confidence is not — Kroll reports that 99% of surveyed organizations have an incident-response plan, while only 19% believe they can respond within minutes. Exercises should measure mobilization, containment, decision, and recovery time rather than document existence.[4]Evidence dated Mar 18, 2026
Threat exposure management now belongs to the CISO, CFO, General Counsel, CRO, and board — Kroll frames exposure as a shared enterprise-risk discipline requiring technical reachability, financial impact, legal posture, ownership, documentation, and defensible decisions.[3]Evidence dated Jun 17, 2026
AI can turn fragmented public and breached data into executive-grade social engineering — Kroll warns that AI can aggregate records, credentials, and social context into targeted fraud and extortion. Executive protection and high-risk transaction verification should be treated as cyber controls.[2]Evidence dated May 18, 2026
BEC, phishing, ransomware and crypto theft were converging into one monetization landscape — Kroll's first-half 2025 threat report describes BEC as prominent, phishing as the leading initial-access path, and Akira, PLAY and LockBit as persistent ransomware operations. The report is retained as the rolling year's opening baseline; its underlying observations predate part of this card's window.[7]Evidence dated Aug 22, 2025
CLEARFAKE and EtherHiding showed how trusted web traffic could carry credential and wallet theft — Kroll connects compromised websites, fake browser-update prompts and blockchain-hosted instructions to infostealer delivery and crypto theft. The useful control is to detect browser-to-script execution and wallet or credential access, not merely block one domain.[7]Evidence dated Aug 22, 2025
Shai-Hulud 2.0 moved npm compromise into pre-install execution, cloud-secret theft and destructive fallback — Kroll reports a wider second wave that targeted npm, GitHub and cloud credentials, used pre-install execution and could attempt destructive deletion when exfiltration failed. Package counts and repositories do not equal unique victim organizations.[8]Evidence dated Nov 25, 2025
Scattered Spider and Cl0p made identity abuse and third-party software risk board-level retail dependencies — Kroll's retail analysis connects social engineering and help-desk abuse with mass-exploitation campaigns and prolonged operational disruption. Retail continuity plans must assume identity compromise, supplier outages and trading interruption can arrive together.[9]Evidence dated Nov 26, 2025
A breach changed how sampled companies described cyber risk for years afterward — Across annual reports from 12 breached firms, Kroll found cyber and incident language increased sharply after disclosure and remained elevated. The finding argues for decision-ready evidence, materiality governance and a durable remediation narrative before an incident forces the issue.[10]Evidence dated Jan 23, 2026
Retail defense has to protect the transaction, workforce identity and operating schedule—not only payment data — Kroll's retail guidance emphasizes social engineering, third-party access, business interruption and crisis coordination. Seasonal staffing and thin change windows make tested escalation and recovery capacity part of day-to-day loss prevention.[11]Evidence dated Feb 6, 2026
Source-Bound Exposure and Targeting
This is not a raw victim list. Publicly named organizations are shown when reliable sources identify them, with confirmation and attribution boundaries preserved. Where no defensible name exists, IntelliOS uses the narrowest supported exposure population. Sector or geography matches remain scoping signals; they do not prove compromise.
| Victim / exposure population | Sectors | Geography | Confirmation status | How companies should use it |
|---|---|---|---|---|
| Victim / exposure populationOrganizations with unresolved known weaknesses[2]Evidence dated May 18, 2026 | SectorsCross-industry | GeographyGlobal | Confirmation statusKroll expert assessment, not a victim list | How companies should use itRank reachable identity, configuration, and exposure debt by business consequence. |
| Victim / exposure populationOrganizations deploying AI and agentic workflows[3]Evidence dated Jun 17, 2026 | SectorsTechnology-enabled enterprises | GeographyGlobal | Confirmation statusRisk and governance assessment | How companies should use itInventory models, agents, non-human identities, data flows, tools, and code-development exposure. |
| Victim / exposure populationOrganizations with security-business misalignment[4]Evidence dated Mar 18, 2026 | SectorsSurvey spans multiple industries | Geography10 countries | Confirmation statusSelf-reported survey findings | How companies should use itCreate common risk language, decision rights, acceptance criteria, and measurable resilience outcomes. |
| Victim / exposure populationComplex regulated enterprises[5]Evidence dated Jun 5, 2026 | SectorsFinance, critical services, public companies, cross-industry | GeographyGlobal | Confirmation statusGovernance guidance | How companies should use itSeparate first-line ownership, second-line challenge, and independent audit assurance. |
Distinct Operational Records
Credential abuse, session hijacking, residential proxies, and non-human identities turn familiar weaknesses into scalable intrusion.[2]Evidence dated May 18, 2026
Faster discovery increases pressure on prioritization, remediation ownership, and verification capacity.[3]Evidence dated Jun 17, 2026
Business priorities and cybersecurity work remain disconnected for much of the surveyed population.[4]Evidence dated Mar 18, 2026
Formal plans are common, but confidence in minute-scale response is low.[4]Evidence dated Mar 18, 2026
Source-Bound Actor Context
Sets risk appetite, resolves ownership conflicts, and funds remediation capacity.[3][4]First cited source Mar 18, 2026 · Latest cited source Jun 17, 2026
Owns and operates cyber risk controls and remediation.[5]Evidence dated Jun 5, 2026
Provides independent challenge, guidance, monitoring, and risk aggregation.[5]Evidence dated Jun 5, 2026
Supplies objective assurance that governance and controls work as represented.[5]Evidence dated Jun 5, 2026
Exploit identity, configuration, human susceptibility, and automation rather than depending on unprecedented techniques.[2]Evidence dated May 18, 2026
Enterprise Exposure
Service accounts, APIs, and machine credentials need the same ownership and monitoring discipline as privileged users.[2][3]First cited source May 18, 2026 · Latest cited source Jun 17, 2026
Create new discovery capacity and new identities, tools, data paths, and governance obligations.[3]Evidence dated Jun 17, 2026
Technology only matters when findings are prioritized, assigned, remediated, and verified.[3]Evidence dated Jun 17, 2026
Can make credential abuse resemble ordinary user access and complicate detection.[2]Evidence dated May 18, 2026
Current Carry-Forward Watchlist
Prioritized source-backed developments that convert the rolling activity record into named operational monitoring requirements.
| # | Threat / Category | Why It Matters | What to Monitor | IntelliOS Coverage |
|---|---|---|---|---|
| 1 | Threat / Category Advisory operating model Security assessments need to end in an owned 12-to-18-month roadmap[6]Evidence dated Jul 6, 2026 | Why it mattersKroll describes a conversation-heavy assessment process that translates policy, technology, and process findings into recommendations. The value is not the questionnaire; it is a governed sequence of risk-reduction decisions. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 2 | Threat / Category AI-speed exposure management Discovery is becoming abundant; remediation velocity is the scarce resource[3]Evidence dated Jun 17, 2026 | Why it mattersKroll argues that AI compresses vulnerability discovery and weaponization timelines. Leaders need inventory, ownership, prioritization, remediation, verification, and board-ready evidence that exposure actually decreased. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 3 | Threat / Category Governance The second line must challenge whether cyber risk is actually controlled[5]Evidence dated Jun 5, 2026 | Why it mattersKroll applies the Three Lines of Defense model to cyber speed and complexity: operations own risk, the second line independently challenges and monitors it, and audit supplies objective assurance. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 4 | Threat / Category Threat economics Attackers are industrializing known weaknesses instead of waiting for exotic zero-days[2]Evidence dated May 18, 2026 | Why it mattersKroll identifies weak identity, poor authentication, misconfiguration, social engineering, and automation as the scalable attack engine. A disciplined known-exposure program can therefore remove more risk than novelty-driven prioritization. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 5 | Threat / Category Identity risk Non-human identities can survive a human credential reset[2]Evidence dated May 18, 2026 | Why it mattersKroll highlights API keys, service accounts, and machine credentials as privileged, persistent, and often weakly monitored. Incident containment that resets only employee credentials may leave a durable access path. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 6 | Threat / Category Resilience survey Cyber strategy and business priorities remain misaligned[4]Evidence dated Mar 18, 2026 | Why it mattersIn Kroll's survey of 1,000 decision-makers across 10 countries, 72% reported a gap between cybersecurity strategy and business priorities. Governance must translate security work into business outcomes and accepted risk. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 7 | Threat / Category Incident economics The reported average financial impact exceeds $20.9 million[4]Evidence dated Mar 18, 2026 | Why it mattersKroll's surveyed organizations reported average potential financial impact above $20.9 million. The figure is a survey result, not a universal loss average, but it supports explicit scenario quantification. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 8 | Threat / Category Response readiness Plans are widespread, but rapid response confidence is not[4]Evidence dated Mar 18, 2026 | Why it mattersKroll reports that 99% of surveyed organizations have an incident-response plan, while only 19% believe they can respond within minutes. Exercises should measure mobilization, containment, decision, and recovery time rather than document existence. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 9 | Threat / Category Enterprise-risk integration Threat exposure management now belongs to the CISO, CFO, General Counsel, CRO, and board[3]Evidence dated Jun 17, 2026 | Why it mattersKroll frames exposure as a shared enterprise-risk discipline requiring technical reachability, financial impact, legal posture, ownership, documentation, and defensible decisions. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 10 | Threat / Category Human attack surface AI can turn fragmented public and breached data into executive-grade social engineering[2]Evidence dated May 18, 2026 | Why it mattersKroll warns that AI can aggregate records, credentials, and social context into targeted fraud and extortion. Executive protection and high-risk transaction verification should be treated as cyber controls. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 11 | Threat / Category Published threat baseline BEC, phishing, ransomware and crypto theft were converging into one monetization landscape[7]Evidence dated Aug 22, 2025 | Why it mattersKroll's first-half 2025 threat report describes BEC as prominent, phishing as the leading initial-access path, and Akira, PLAY and LockBit as persistent ransomware operations. The report is retained as the rolling year's opening baseline; its underlying observations predate part of this card's window. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 12 | Threat / Category Browser and crypto abuse CLEARFAKE and EtherHiding showed how trusted web traffic could carry credential and wallet theft[7]Evidence dated Aug 22, 2025 | Why it mattersKroll connects compromised websites, fake browser-update prompts and blockchain-hosted instructions to infostealer delivery and crypto theft. The useful control is to detect browser-to-script execution and wallet or credential access, not merely block one domain. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 13 | Threat / Category Software supply chain Shai-Hulud 2.0 moved npm compromise into pre-install execution, cloud-secret theft and destructive fallback[8]Evidence dated Nov 25, 2025 | Why it mattersKroll reports a wider second wave that targeted npm, GitHub and cloud credentials, used pre-install execution and could attempt destructive deletion when exfiltration failed. Package counts and repositories do not equal unique victim organizations. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 14 | Threat / Category Retail disruption Scattered Spider and Cl0p made identity abuse and third-party software risk board-level retail dependencies[9]Evidence dated Nov 26, 2025 | Why it mattersKroll's retail analysis connects social engineering and help-desk abuse with mass-exploitation campaigns and prolonged operational disruption. Retail continuity plans must assume identity compromise, supplier outages and trading interruption can arrive together. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 15 | Threat / Category Post-incident disclosure A breach changed how sampled companies described cyber risk for years afterward[10]Evidence dated Jan 23, 2026 | Why it mattersAcross annual reports from 12 breached firms, Kroll found cyber and incident language increased sharply after disclosure and remained elevated. The finding argues for decision-ready evidence, materiality governance and a durable remediation narrative before an incident forces the issue. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
| 16 | Threat / Category Retail resilience Retail defense has to protect the transaction, workforce identity and operating schedule—not only payment data[11]Evidence dated Feb 6, 2026 | Why it mattersKroll's retail guidance emphasizes social engineering, third-party access, business interruption and crisis coordination. Seasonal staffing and thin change windows make tested escalation and recovery capacity part of day-to-day loss prevention. | What to monitorValidate whether the behaviors, technologies, identities, or dependencies described by Kroll exist locally; escalate only when local evidence changes exposure or response decisions. | IntelliOS coverage |
Operational Standards from the Evidence
The practices below convert the retained public evidence into repeatable executive standards. Each lesson remains bounded to its cited sources.
Best Practice
Lesson Learned
More discovery without more closure increases known exposure.
Minimum Operating Standard
Report time from discovery to ownership, mitigation, remediation, verification, and accepted residual risk.
Best Practice
Lesson Learned
Machine credentials can become durable backdoors.
Minimum Operating Standard
Every API key, service identity, and agent has an owner, purpose, privilege bound, rotation, monitoring, and revocation path.
Best Practice
Lesson Learned
A written plan does not prove minute-scale mobilization.
Minimum Operating Standard
Measure detection, escalation, authority, containment, communications, recovery, and decision latency in exercises.
Best Practice
Lesson Learned
Ownership, challenge, and assurance are distinct governance jobs.
Minimum Operating Standard
Publish decision rights, escalation thresholds, independent challenge, risk acceptance, and audit responsibilities.
Best Practice
Lesson Learned
Assessment value appears only when recommendations become owned work.
Minimum Operating Standard
Maintain a sequenced 12-to-18-month roadmap with accountable owners, dependencies, funding, evidence, and executive review.
Best Practice
Lesson Learned
Cyber risk competes for attention with other enterprise risks.
Minimum Operating Standard
Tie reachable exposure to downtime, legal, financial, operational, and reputational scenarios and state the uncertainty.
Automation Transparency
| Agent | Kroll Rolling Intelligence Card Publisher |
|---|---|
| Status | Active · rolling one-year automation |
| Cadence | Weekly on Tuesday at midday ET |
| Previous run | 26 Jul 2026 · material revision · Run kroll-publisher-activity-2026-07-26-initial |
| Previous result | Backfilled Kroll's rolling-year chronology to August 2025, added threat-landscape, Shai-Hulud, retail resilience, and post-incident disclosure research, and enforced oldest-to-newest ordering. |
| What the previous run found |
|
| Next run | Weekly on Tuesday at midday ET |
| Sources monitored |
|
| Publication and alert policy | Check weekly on tuesday at midday et. Publish and alert only when a new Kroll publication materially changes an actor, campaign, technology, initial-access, victimology, impact, response, resilience, or executive conclusion. No-change checks are logged but do not email subscribers. |
Related Intelligence and CARDS Records
Rolling Intelligence
Official advisories, exploited technologies, deadlines, and government response priorities that can validate or constrain publisher reporting.
Open productCARDS
Canonical actor identities, aliases, attribution boundaries, behaviors, relationships, and linked campaigns.
Open productPublication History
| Version | Date | Change | Monitoring |
|---|---|---|---|
| Versionv1 | Date26 Jul 2026 | ChangeCreated the Kroll rolling one-year publisher card with Research Framing, Timeline, BLUF, Executive Summary, top-ten findings, victimology, campaigns, actors, technologies, access vectors, operational practices, AI agent status, and citations. | MonitoringWeekly on Tuesday at midday ET; material-change-only Page Alerts. |
| Versionv2 | Date26 Jul 2026 | ChangeBackfilled Kroll's rolling-year chronology to August 2025, added threat-landscape, Shai-Hulud, retail resilience, and post-incident disclosure research, and enforced oldest-to-newest ordering. | MonitoringWeekly on Tuesday at midday ET; material-change-only Page Alerts. |
Retained Sources and Claim Treatment
| # | Publisher | Published | Publication / Evidence | Why Used / Claim Treatment | Source |
|---|---|---|---|---|---|
| Source1 | PublisherKroll | PublishedNot available | Publication / evidenceSource indexecosystem monitor | Why used / claim treatmentAuthoritative first-party publication index monitored weekly. Individual publications control retained claims. | SourceKroll Publications https://www.kroll.com/en/publications |
| Source2 | PublisherKroll | Published2026-05-18 | Publication / evidenceSource indexincident response | Why used / claim treatmentKroll executive analysis based on frontline risk and response experience; it is an expert assessment rather than a prevalence dataset. | SourceToday's Cyber Risk Is the Industrialization of Known Weaknesses https://www.kroll.com/en/publications/cyber/today-cyber-risk-industrialization-of-known-weaknesses |
| Source3 | PublisherKroll | Published2026-06-17 | Publication / evidenceSource indexprimary research | Why used / claim treatmentKroll analysis of AI-enabled discovery, prioritization, governance, and remediation. External metrics retain their original attribution. | SourceManaging Cyber Exposure at AI Speed https://www.kroll.com/en/publications/cyber/managing-cyber-exposure-at-ai-speed |
| Source4 | PublisherKroll | Published2026-03-18 | Publication / evidenceSource indexprimary research | Why used / claim treatmentKroll-commissioned survey of 1,000 decision-makers in 10 countries; responses measure perceptions and practices, not verified incident outcomes. | SourceBridging the Cyber Resiliency Gap https://www.kroll.com/en/publications/cyber/state-of-cyber-resilience-2026 |
| Source5 | PublisherKroll | Published2026-06-05 | Publication / evidenceSource indexprimary research | Why used / claim treatmentKroll governance and risk-management analysis; cited external timing and landscape claims remain attributed. | SourceThe Evolving Role of the Second Line of Defense in a Complex Cyber Risk Landscape https://www.kroll.com/en/publications/cyber/second-line-of-defense-in-a-complex-cyber-risk-landscape |
| Source6 | PublisherKroll | Published2026-07-06 | Publication / evidenceSource indexincident response | Why used / claim treatmentFirst-party explanation of Kroll advisory practice and assessment-to-roadmap process; not an independent threat-frequency dataset. | SourceKroll Conversations: Meet the Cyber Strategy and Advisory Experts https://www.kroll.com/en/publications/cyber/kroll-conversations-meet-the-cyber-strategy-and-advisory-experts |
| Source7 | PublisherKroll | Published2025-08-22 | Publication / evidenceSource indexprimary research | Why used / claim treatmentKroll's first-half 2025 threat-landscape baseline. Its underlying observation period predates part of this card's rolling window, so the timeline uses the publication date and labels the finding as baseline context. | Source2025 Cyber Threat Landscape Report: A Lens on Crypto https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/threat-landscape-report-lens-on-crypto |
| Source8 | PublisherKroll | Published2025-11-25 | Publication / evidenceSource indexprimary research | Why used / claim treatmentKroll technical analysis of the renewed npm supply-chain campaign. Package and repository counts remain source-qualified and do not equal unique compromised organizations. | SourceShai-Hulud Returns With Mass Credential Theft https://www.kroll.com/en/publications/cyber/shai-hulud-returns-with-mass-credential-theft |
| Source9 | PublisherKroll | Published2025-11-26 | Publication / evidenceSource indexincident response | Why used / claim treatmentKroll sector-risk analysis that combines public incidents with expert response guidance. Named incidents retain their public-source status. | SourceRetail Sector Resilience to Scattered Spider and Cl0p https://www.kroll.com/en/publications/cyber/retail-sector-resilience-to-scattered-spider-and-cl0p |
| Source10 | PublisherKroll | Published2026-01-23 | Publication / evidenceSource indexprimary research | Why used / claim treatmentKroll analysis of annual reports from 12 breached firms. Counts measure disclosure language in that sample, not the prevalence or severity of cyber incidents. | SourceCyber Incidents: A Watershed Moment for Transparency https://www.kroll.com/en/publications/cyber/cyber-incidents-watershed-moment-transparency |
| Source11 | PublisherKroll | Published2026-02-06 | Publication / evidenceSource indexincident response | Why used / claim treatmentKroll retail-resilience guidance grounded in its advisory experience. It is retained for operational lessons, not as a victim or loss dataset. | SourceRetail Businesses: From At Risk to Resilient https://www.kroll.com/en/publications/cyber/retail-businesses-from-at-risk-to-resilient |
