Mandiant

Mandiant, now part of Google Cloud following the 2022 acquisition, published M-Trends 2026 based on over 500,000 Incident Response hours, with the central findings for this update being the 393-day average dwell time for UNC5221 BRICKSTORM intrusions and the emergence of Recovery Denial as a ransomware tactic targeting backup infrastructure. Mandiant's original Incident Response on CitrixBleed 2023 is also cited as the authoritative technical account of the exploit path that CitrixBleed 3 reproduces.

Mandiant is one of the most-cited threat intelligence and Incident Response firms globally, with a reputation built on attribution of advanced persistent threat groups and large-scale breach investigations. Its M-Trends annual report is the largest single synthesis of real-world incident-response data in the public domain. Google's acquisition in 2022 for $5.4 billion integrated Mandiant into Google Cloud's Chronicle security platform.

For the wider security market, Mandiant's BRICKSTORM reporting is the definitive technical account of UNC5221's tradecraft. The 393-day dwell benchmark has immediate implications for enterprise detection and response posture: any IR programme that does not account for vCenter/ESXi telemetry gaps and legitimate-Cloud C2 relay patterns is missing the specific attack class Mandiant documented at scale.