Eye Security’s report is based on 343 incidents investigated between January 1 and December 31, 2025, across mid-market organisations in the Benelux and Germany, representing 2,064 hours of incident response work.

Business email compromise (BEC) accounted for 81% of all investigated cases, making it the dominant form of cyber intrusion observed.

Geographically, activity was concentrated in the Netherlands (66%), reflecting the dominant customer base, followed by Belgium (21%) and Germany (11%). Across all regions in the dataset, BEC consistently emerged as the primary incident type where MDR was present, indicating that visibility drives observed incidence rates.

The data reveals a structural gap between organisations with and without continuous monitoring. In MDR-enabled environments, median dwell time for BEC was 19 minutes. In contrast, in non-monitored environments, threat actors remained undetected for a median of 18 days. This disparity extends to response timelines, directly affecting the ability to contain financial and operational impact.

BEC is overwhelmingly an identity-driven threat. Over 99% of incidents occurred in Microsoft 365 environments, reflecting the prevalence of Microsoft 365 within the analysed environments. Multi-factor authentication (MFA) was bypassed in 79% of cases, most commonly through session hijacking techniques such as adversary-in-the-middle. Phishing via link remains the dominant entry vector, increasingly reinforced by generative AI.

Identity has become the primary attack surface, and detection speed is the defining variable in limiting impact. Preventive controls alone are insufficient. Effective defence depends on continuous visibility across environments, rapid investigation, and the ability to respond within minutes.