Eye Security’s Incident Response Report 2026 is based on 630 investigated incidents affecting small and medium-sized businesses.

Across Benelux and Germany over a three-year period, of which 454 business email compromise (BEC) cases, 30 ransomware investigations, and 106 compromise assessments

As adoption in the DACH region increased, Germany accounted for 6% of incidents in 2024 and 13% in 2025.

The core findings reveal that threat actors increasingly exploit trust and identity, shifting from technical vulnerabilities to human and relationship-based compromise (e.g. social engineering). Business email compromise remains the most frequent incident type, accounting for over 70% of all cases investigated. In 41% of BEC incidents, threat actors gained access through phishing techniques.

The data additionally highlights a widening resilience gap between organisations with Managed Detection and Response (MDR) and those without.

MDR-enabled environments consistently detected intrusions earlier, reduced dwell time, and contained breaches before they escalated. For BEC incidents alone, MDR-protected environments reduced the median dwell time from over 24 days (about 3 and a half weeks) to just 23.8 minutes.

As threat actors continue to exploit legitimate tools and trusted identities, early detection and expert-led investigation have become the decisive differentiators. In 2026, the speed of detection, human oversight, and AI-augmented decision-making will define the new frontier of defence.