Lots of great info in the Microsoft Digital Defense Report as always, but I found the trends in initial access across the last two years pretty interesting (based off IR engagements). ⬆️public application / appliance exploitation ⬆️phishing (I would guess driven by a shift to device code auth based phishing) ⬇️social engineering ⬇️unknown (I wonder if this largely device code auth phishing being somewhat easy to spot in Entra logs, hence less unknowns this year?) Everything else was mostly static year on year. This and more good stuff - aka.ms/mddr