SonicWall Report Frames Cybersecurity as Prevention, Not Panic

SonicWall’s 2026 Cyber Protect Report presents a blunt message for business leaders: many damaging cyber incidents do not begin with exotic zero-day attacks, but with ordinary weaknesses that organizations can identify, prioritize and fix. The report is especially focused on small and midsize businesses, managed service providers and managed security service providers that must defend against enterprise-level risks without enterprise-level resources.

A protect-first report, not just another threat review

SonicWall’s 2026 Cyber Protect Report is framed differently from a traditional threat report. Rather than limiting the discussion to what attackers are doing, the document focuses on what organizations can do before an incident becomes a crisis. That distinction matters. The report’s central argument is that prevention, configuration discipline and operational follow-through are now as important as detection tools.

According to the report, small and midsize businesses, often referred to as SMBs, remain essential to the economy but face many of the same cyber risks as larger enterprises. The challenge is that they usually operate with smaller budgets, leaner IT teams and less specialized security expertise. SonicWall positions cybersecurity for these organizations not as a purely technical function, but as a business continuity issue tied to payroll, customer trust, reputation, insurance requirements and long-term survival.

The report also highlights a recurring operational failure: poor security configuration. SonicWall notes that misconfiguration has moved sharply up the OWASP Top 10 ranking, rising from number six in 2017 to number two in 2025. The broader message is that many exposures are not created by the absence of tools, but by tools that are not properly configured, monitored or maintained.

Attack volume may be lower, but precision is rising

The executive summary points to a more complicated threat environment than simple year-over-year volume comparisons might suggest. Several categories in the report show declines in total activity, including malware ticks, intrusion ticks and ransomware hits. However, SonicWall says high and medium severity intrusion hits increased 20.8%, reaching 13 billion. In practical terms, the report suggests that attackers may not simply be attacking more; they are attacking with more precision.

SonicWall distinguishes between hits and ticks. Hits represent the total number of times a threat or rule is triggered, while ticks represent the unique intervals or events in which a threat was observed. That distinction helps explain why a decline in raw volume does not necessarily equal lower risk. A security team may see less noise overall while still facing a higher concentration of activity that is more actionable, targeted or consequential.

For business leaders, the implication is direct: the margin for error is shrinking. If more meaningful attacks are being concentrated into fewer signals, teams cannot afford poorly tuned alerts, unpatched internet-facing systems or access policies that allow one compromised account to move freely across the environment.

Five numbers that define the report

13 billion high and medium IPS hits

The report identifies 13 billion intrusion prevention system hits tied to high and medium severity exploitation attempts, a 20.8% increase. SonicWall’s reading is that while overall intrusion activity may appear relatively stable, the quality and intent behind important attacks are increasing. In other words, organizations are dealing with less random noise and more activity that demands attention.

0.47% of rules generate 80% of detections

SonicWall reports that just 0.47% of detection rules generate 80% of what customers see. Operationally, that finding is important because it gives security teams a clearer starting point for prioritization. The most active rules should be reviewed, tuned and monitored carefully so teams can reduce alert fatigue while preserving visibility into meaningful threats.

825 million Log4j-related attacks

The report says Log4j-related attacks continued at massive scale, with more than 825 million attempts in 2025. Log4j, widely associated with the Log4Shell vulnerability first disclosed in 2021, remains a reminder that old vulnerabilities do not disappear simply because they are no longer new. If systems remain unpatched, automated scanning and exploitation attempts can continue for years.

36,000 vulnerability scans per second

SonicWall also cites more than 36,000 automated vulnerability scans per second and says bad bot traffic reached 37% of global internet traffic. This is particularly relevant for public websites, VPN portals, firewalls, cloud applications and other services exposed to the internet. For SMBs, it means exposure can be discovered quickly, even if the organization believes it is too small to attract attention.

IoT attacks up 11%

The report says attacks against internet of things devices rose 11% year over year, reaching 609.9 million IPS hits in 2025 and peaking in December. The concern is familiar but persistent: cameras, routers, sensors, DVRs, printers and similar devices often run with weak passwords, old firmware or default configurations. One compromised device can become a foothold for broader network access.

The seven deadly sins of cybersecurity

SonicWall organizes much of the report around what it calls the seven deadly sins of cybersecurity. The structure is useful because it moves the conversation from abstract risk to specific behavior: what organizations ignore, assume, overexpose, delay, underfund or overhype.

1. Ignoring the fundamentals

The first failure is also the most common: neglecting the basics. The report points to gaps in multifactor authentication, patching, password hygiene, administrative privileges and default credentials. SonicWall says 85% of actionable alerts involve identity, cloud or credentials. It also notes that 61% of exploits occur within 48 hours of a proof-of-concept being published, while 77% of organizations need seven or more days to patch.

That gap between attacker speed and defender response creates the exposure window. The report also cites an average of 102 days to patch high-severity vulnerabilities in financial services and says 32% of ransomware incidents began with an exploited vulnerability. For SMBs, the risk is amplified when one or two accounts have administrative access to email, files, backups, servers, cloud services and customer data.

SonicWall also highlights business email compromise and payment fraud through its partner Cysurance, which reports that 98% of its claims come from business email compromise and funds transfer fraud. The practical recommendation is simple but critical: verify by voice any change to payment information before money moves.

2. False confidence

The second sin is believing the organization is safer than it really is. SonicWall identifies several patterns: assuming the business is too small to be targeted, assuming tools equal protection, or assuming backups and response plans will work even if they have never been tested.

The report says 88% of breaches affecting SMBs involved ransomware, compared with 39% in large enterprises. It also notes a sharp disconnect between confidence and reality: 80% of IT leaders believe they can detect and contain a breach in under eight hours, yet the average dwell time before detection is listed at 181 days. SonicWall further reports that 69% of IT professionals believe leaders overestimate preparedness, while only 46% contained or recovered from their most recent attack or simulation with minimal impact.

The lesson is that confidence is not a control. Verification is. That means realistic tabletop exercises, tested backup restoration, working logs, reviewed alerts and honest reporting between technical teams and executive leadership.

3. Overexposed access

The third failure involves excessive access, permissive rules, flat networks and VPNs that expose too much of the internal environment. SonicWall says 41% of compromised environments had Any/Any rules, 33% had broad subnet-to-subnet rules, 18% had excessive inbound exposure and only 8% were properly segmented.

The report also states that 48% of breaches involved compromised VPN credentials and that 92% of organizations experienced incidents involving lateral movement. Once inside, attackers can move quickly: SonicWall cites an average lateral movement time of 48 minutes, with the fastest observed at 18 minutes. Restrictive rules and segmentation can delay attackers by as much as seven times, giving defenders valuable time.

For SMBs, this is especially important because many operate flat networks where workstations, servers, cameras, printers, backups and administrative systems are too closely connected. If an attacker enters through VPN or valid credentials, the blast radius can be wide.

4. Reactive security posture

The fourth sin is relying mainly on alerts and response after something has already happened. SonicWall’s report warns that if an organization only reacts, the attacker controls the clock. Alerts may arrive late, go unreviewed or be buried under noise.

The report cites 181 days on average to identify a breach, 44% of alerts going uninvestigated and 75% of SOC analysts lacking time for threat hunting. It also points to an average of 960 alerts per day, with large organizations seeing more than 3,000 daily alerts. SonicWall says 90% of SOCs are overloaded by false positives and backlogs, while 41% of critical alerts are missed at least weekly.

This is not only a technology issue; it is a human issue. The report says 33% of analysts are considering leaving because of burnout, and 70% of analysts with less than five years of experience leave within three years. For SMBs without a 24/7 security operation, the problem can be more basic: alerts may exist, but no one is consistently watching them.

5. Cost-driven security decisions

The fifth sin is making security decisions mainly on upfront cost rather than protection outcomes. SonicWall’s position is that cheap security can become expensive security when it fails to reduce real risk. The report says organizations with incident response plans save 1.23 million dollars per breach and cites a global average breach cost of 4.44 million dollars. It also says lack of cybersecurity talent adds 1.57 million dollars to breach cost.

At the same time, the report warns against assuming that more tools automatically mean more protection. Large companies operate an average of 45 cybersecurity tools, while 46% of teams spend more time managing tools than defending. SonicWall also says 74% of repeat ransomware victims report having too many tools, and 61% say their tools do not integrate well.

The issue, then, is not always spending too little. Sometimes it is spending poorly. A practical approach begins with a simple risk register, mapping likely threats to necessary controls, consolidating tools where possible and prioritizing incident response planning, awareness training and managed security support when internal expertise is limited.

6. Reliance on legacy access models

The sixth sin is continuing to rely on older access models, particularly broad VPN access and trust based on network location. SonicWall argues that the traditional perimeter no longer works the way it once did. Users are distributed, applications are in the cloud and identity has become a central security boundary.

The report says 48% of breaches began with compromised VPN credentials. It also reports that VPN-related CVEs grew 82.5%, with 60% of those vulnerabilities rated high or critical. SonicWall says 90% of organizations have one or more VPN problems, while 83% of users are willing to bypass controls if those controls interfere with productivity.

The contrast is between network-first thinking and identity-first thinking. In the older model, a user inside the perimeter is trusted and often receives broad network access after one authentication event. In the newer model, access is verified continuously, granted by application and based on identity, device condition and context. The remediation path includes auditing VPN access, applying least privilege, monitoring sessions and using phishing-resistant MFA such as FIDO2 or hardware keys for remote and administrative access.

7. Chasing hype over execution

The seventh sin is chasing new technology, especially artificial intelligence, without executing the fundamentals. SonicWall does not argue that AI is negative. The report recognizes that AI is changing the speed and scale of both attack and defense. The problem is treating AI as a substitute for MFA, patching, segmentation, monitoring and response processes.

SonicWall reports an 89% increase in AI-enabled adversary attacks in 2025 and says AI is helping attackers with social engineering, malware and disinformation. At the same time, the report says organizations using AI-driven security can detect threats up to 60% faster. The divide is maturity: SonicWall says 90% of organizations do not have the maturity needed to face AI-driven threats, while only 10% do.

The best use of AI, according to the report’s logic, is as a multiplier over good fundamentals. Organizations that already have centralized logs, enforced access policies, disciplined patching, active monitoring and defined response workflows are better positioned to benefit from AI. If the foundation is weak, AI will not fix it by itself.

What SMBs should do next

The report’s recommendations can be summarized into a practical operating model for smaller organizations. First, close the fundamentals gap: implement MFA across critical access, prioritize patches for internet-facing and business-critical systems, audit administrative privileges and change default credentials on every device.

Second, replace assumptions with evidence. That means assessing the real environment rather than relying only on documentation, testing backup restoration, confirming that logs and alerts work, and conducting realistic tabletop exercises. Third, reduce the blast radius by segmenting networks, replacing broad VPN access with application-level controls and removing inactive accounts, tokens and service accounts.

Fourth, move from reactive to proactive. SMBs that cannot operate internal 24/7 monitoring should evaluate MSP or MSSP support. They should also create and test playbooks for ransomware, compromised credentials and data exfiltration, while measuring mean time to detect and mean time to respond.

Finally, spend for outcomes rather than appearances. Before buying another tool, organizations should verify that existing tools are fully deployed, integrated, monitored and aligned with the most likely risks. AI, when used, should accelerate disciplined execution, not distract from it.

The central takeaway from SonicWall’s report is that protection is not defined by how many security products an organization owns. It is defined by how well those controls are configured, monitored, maintained and tested.

Bottom line

SonicWall’s 2026 Cyber Protect Report delivers a practical warning for SMBs, MSPs and MSSPs: many breaches are not inevitable. They often emerge from preventable gaps such as missing MFA, slow patching, excessive access, flat networks, untested backups, alert overload and misplaced confidence.

For leaders, the priority should be execution. MFA on critical accounts, documented patching, network segmentation, tested backups, 24/7 monitoring, least privilege access and rehearsed incident response are not optional housekeeping tasks. They are the operating foundation of cyber resilience.

This article is based on the details provided from SonicWall’s 2026 Cyber Protect Report and attributes findings to the report where appropriate.