Threat actors exfiltrate data 4x faster via endpoint gaps

The article notes that the 2026 Unit 42 Global Incident Response Report shows threat actors are now moving four times faster to exfiltration than in 2025, with attackers deliberately exploiting blind spots created by relying on endpoint data. It highlights that 75% of incidents Unit 42 investigated had critical evidence of the initial intrusion in logs, yet complex, disjointed systems could make that information hard to access or operationalise.

The piece argues that detection must go beyond the endpoint, stitching together cloud security logs, CASB alerts and EDR telemetry to reveal the full breach narrative. It identifies three scenarios where an endpoint‑only view fails: a cloud‑to‑endpoint pivot, covert C2 and identity theft, and rogue assets such as Shadow IT.

To counter these threats, it advocates a single‑pane‑of‑glass, AI‑driven SOC platform like Cortex XSIAM, enabling alert stitching, ML‑based incident scoring and user and entity behaviour analytics, with all logs in a single repository. According to the 2026 Unit 42 Global Incident Response Report, organisations should ingest telemetry from every IT zone to stop threats effectively. 1 May 2026.