The Data Is the Target: What 177 DFIR Investigations Reveal About Identity, AI and Speed

Ransomware groups don’t always bother encrypting any more. Why would they, when the data was already gone before anyone noticed. Across 177 incidents this year, Triskele Labs’ DFIR team found that identity, not malware, is the common entry point: ransomware actors walking in through unsecured VPN and RDP, and BEC attackers bypassing MFA entirely through session token theft, valid credentials and all. AI hasn’t invented new attacks, it’s made the old ones faster and put them in reach of people who couldn’t have run them a year ago. This session unpacks what’s actually changed in the incident room, why technical debt quietly multiplies the severity of a breach, and why the gap between “something’s wrong” and “the right expert is in the room” is now the single variable that decides how an incident ends.