Incident Response Insights for November 2024

This technical report presents insights from incident response activities as of November 2024. It documents various incident types, including ransomware, email compromise, network intrusion, and unauthorized access, highlighting a marked increase in network intrusion cases while noting a decrease in ransomware and other incidents. The report details trends across different industry sectors, indicating increased incidents in construction, legal, financial services, and technology, while manufacturing and healthcare saw declines. Year-to-date trends reveal that ransomware has consistently dominated incident volumes, accounting for a significant portion of total cases. The report also identifies key threat actors involved in ransomware incidents, including notable groups such as Blacksuit and Akira. Additionally, it outlines the top five security controls for underwriting focus, emphasizing the importance of timely patching, email filtering, end-user education, multi-factor authentication, and endpoint detection and response. These insights aim to inform organizations about current cybersecurity threats and recommended practices to enhance their defenses.