M-Trends 2026

Mandiant and Google Cloud published M-Trends 2026 based on over 500,000 hours of Incident Response engagement data, with two central findings for this update: the 393-day average dwell time for UNC5221 BRICKSTORM intrusions targeting US and UK legal services, BPOs, SaaS providers and technology firms ; and the emergence of Recovery Denial tactics, in which ransomware operators specifically target backup and disaster-recovery infrastructure to extend the remediation window and increase negotiating leverage.

M-Trends is Mandiant's flagship annual intelligence report, now in its 17th year and produced under Google's ownership since the 2022 acquisition. The report aggregates findings from Mandiant's global incident-response practice, making it one of the largest dwell-time and attacker-behaviour datasets available in the public domain. Prior M-Trends reports have been cited by CISA, NCSC and the European Commission in regulatory guidance.

For enterprise security and board audiences, M-Trends 2026's 393-day benchmark is the primary data point for assessing the adequacy of detection and response capability against nation-state-calibre threat actors. The Recovery Denial finding has direct implications for backup-infrastructure architecture: if attackers are systematically targeting backup and DR systems, an organisation's recovery timeline is only as reliable as its offline or immutable backup posture.