{"id":23685,"date":"2026-10-13T09:43:37","date_gmt":"2026-10-13T09:43:37","guid":{"rendered":"https:\/\/any.run\/cybersecurity-blog\/?p=23685"},"modified":"2026-10-13T09:47:24","modified_gmt":"2026-10-13T09:47:24","slug":"threat-data-for-enterprises","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/","title":{"rendered":"What&#8217;s Really Attacking Your Industry? Insights From 74K Sandbox Analyses"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Every day, thousands of SOC and IR teams worldwide analyze suspicious files, emails, and links with <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noopener\">ANY.RUN<\/a>. Beyond individual investigations, this activity generates <a href=\"https:\/\/any.run\/cybersecurity-blog\/h1-2026-cyber-risk-report\/\" target=\"_blank\" rel=\"noopener\">valuable data<\/a> on emerging threats, industry trends, and SOC operational performance. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Drawing on real-world investigations across thousands of organizations, ANY.RUN provides visibility into threats affecting <a href=\"https:\/\/any.run\/cybersecurity-blog\/phishing-risk-industries\/\" target=\"_blank\" rel=\"noopener\">different sectors<\/a>, from banking to retail. Security teams can see not only what they&#8217;re encountering, but also how those threats compare with the broader industry landscape. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Detecting a single threat gives you a verdict. Understanding it in the context of your industry&#8217;s threat landscape helps you make a decision. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This visibility helps SOC leaders benchmark performance, identify emerging risks, and make informed decisions about detection and response priorities. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To show what this looks like in practice, we examined 74,086 <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">Sandbox<\/a> analyses from one financial organization over a quarter and compared its findings with <a href=\"https:\/\/any.run\/cybersecurity-blog\/phishing-us-finance\/\" target=\"_blank\" rel=\"noopener\">banking<\/a>-sector benchmarks. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Takeaways <\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Threat data reveals more than individual verdicts. <\/strong>It shows which submissions are most likely to be malicious, how quickly threats are detected, and which malware families are prevalent. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Industry intelligence puts findings into context.<\/strong> Comparing an organization&#8217;s data with industry benchmarks reveals differences in threat exposure and helps prioritize security efforts. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>ANY.RUN already has visibility into threats across industries. <\/strong>Organizations can benefit from this knowledge without waiting to encounter every threat themselves. <\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>These insights can be applied to your own organization. <\/strong>ANY.RUN offers <a href=\"https:\/\/any.run\/enterprise\/#contact-sales\" target=\"_blank\" rel=\"noopener\">personalized demos<\/a> using your organization&#8217;s data to show its threat landscape, SOC performance metrics, and industry comparisons. <\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What Can Threat Data Reveal About Your Organization? <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every suspicious file or URL analyzed contributes to a bigger picture of an organization&#8217;s threat landscape. Over time, this data reveals which submissions are most likely to be malicious, how quickly threats are detected, and where potential risks are concentrated. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Combined with industry-wide intelligence, these findings help security leaders understand not just what&#8217;s happening in their own environment, but how it compares with <a href=\"https:\/\/any.run\/cybersecurity-blog\/us-soc-pain-points\/\" target=\"_blank\" rel=\"noopener\">threats affecting their sector<\/a>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To illustrate this, we&#8217;ll use data from 74,086 <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">Sandbox<\/a> analyses conducted by an anonymized financial organization between March 30 and June 22, 2026. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The findings reveal some interesting differences between individual threat exposure and industry-wide trends. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Data Methodology &amp; Privacy <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The statistics in this article are generated automatically from public ANY.RUN analyses and telemetry shared by participating organizations. Industry-wide insights are based on aggregated data, without manual access to customers&#8217; private analyses. Organization-specific reports are accessible only to the respective customer. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Which Submissions Are Most Likely to Be Malicious <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Over the quarter, files accounted for <strong>39.5%<\/strong> of submissions, while URLs made up the remaining <strong>60.5%<\/strong>. The analyses covered four operating systems: <a href=\"https:\/\/any.run\/cybersecurity-blog\/anyrun-macos-sandbox\/\" target=\"_blank\" rel=\"noopener\">Windows, Linux, Android, and macOS.<\/a> <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But what does this investigation volume reveal about the threats reaching the organization, and how does its detection performance compare with industry benchmarks? <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The organization&#8217;s malicious yield was <strong>12.8%<\/strong>, almost identical to the <strong>banking-sector median of 13.0%<\/strong>. Yet this overall figure hides significant differences between submission types. <\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-409\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"5\"\n           data-wpID=\"409\"\n           data-responsive=\"0\"\n           data-has-header=\"0\">\n\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-bold\"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Total analyses\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        74,086\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-bold\"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Analysis verdicts\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        8,520 malicious \u00b7 992 suspicious \u00b7 64,574 clean\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-bold\"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Analyzed\u00a0sample types\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        39.5% files, 60.5% URLs\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-bold\"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Total\u00a0malicious\u00a0yield\u00a0\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        12.8%\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell wpdt-bold\"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Malicious yield by\u00a0sample type\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        58.8% for files, 25.6% for URLs\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-409'>\ntable#wpdtSimpleTable-409{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-409 td, table.wpdtSimpleTable409 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<p class=\"wp-block-paragraph\">Files showed more than twice the malicious yield of URL-based samples. The differences become even more apparent when looking at individual file formats. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PowerShell scripts had the highest malicious yield at 88.2%, followed by MSI installers at 75.2% and Outlook email files at 71.5%. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Executables followed at 70.5%, with Android APK files at 59.3%, ZIP archives at 51.4%, and EML email files at 41.9%. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"412\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectorfiletypes-1024x412.png\" alt=\"\" class=\"wp-image-23703\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectorfiletypes-1024x412.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectorfiletypes-300x121.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectorfiletypes-768x309.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectorfiletypes-370x149.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectorfiletypes-270x109.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectorfiletypes-740x297.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectorfiletypes.png 1214w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Share of malicious samples by submitted file format. ANY.RUN data, Q2 <\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">The findings show why file extensions and submission sources alone are insufficient for determining whether an object is malicious. Even common formats like ZIP archives had a malicious yield above 50% in this dataset. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For SOC leaders, these breakdowns provide visibility into where malicious findings are concentrated, helping teams review investigation priorities and workload distribution. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How Quickly Threats Are Detected <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Despite the investigation volume and variety of submissions, the organization achieved a median time to detection of 15.1 seconds with ANY.RUN, compared with 16.9 seconds across the banking sector. <\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-408\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"3\"\n           data-rows=\"3\"\n           data-wpID=\"408\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        MTTD\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        P95 Time to Detection\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"C1\"\n                    data-col-index=\"2\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        Threats Detected\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        15.1 sec\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        1.4 min\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C2\"\n                    data-col-index=\"2\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        4,874\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Industry median: 16.9 sec\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        95% of measured detections occurred within this\u00a0period\u00a0\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C3\"\n                    data-col-index=\"2\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Recorded automatically over the quarter\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-408'>\ntable#wpdtSimpleTable-408{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-408 td, table.wpdtSimpleTable408 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<p class=\"wp-block-paragraph\">What&#8217;s more, half of all threats were detected within <strong>the first 16.7% of the <\/strong><a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\"><strong>Sandbox<\/strong><\/a><strong> session runtime. <\/strong>In other words, malicious activity could often be identified well before the full analysis session was complete. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is where ANY.RUN&#8217;s accumulated <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noopener\">threat intelligence<\/a> makes a difference. As suspicious files and links are investigated across organizations and industries, the resulting knowledge helps enterprises recognize previously observed threats and malicious behavior more quickly. <\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\n<span class=\"highlight\">How fast does your SOC detect threats?<\/span>\n<br>\nExplore your metrics against industry benchmarks.\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktoenterprise\" rel=\"noopener\" target=\"_blank\">\nRequest Demo <\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p class=\"wp-block-paragraph\">These metrics help SOC leaders move beyond individual verdicts to understand investigation workloads, benchmark detection performance, and <a href=\"https:\/\/any.run\/cybersecurity-blog\/efficient-soc-for-fast-response\/\" target=\"_blank\" rel=\"noopener\">make informed decisions<\/a> about operational priorities. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How Your Threat Exposure Differs From Industry Averages <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No single SOC can see the full threat landscape on its own. But by comparing an organization&#8217;s investigations with data from industry peers, security leaders can understand which threats are widespread, which are emerging, and where their own exposure differs from the sector average. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN provides this broader perspective for enterprise security teams through real-world investigations across organizations and industries. Let&#8217;s look at what the comparison reveals for the financial organization in our study. <\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-406\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"2\"\n           data-rows=\"3\"\n           data-wpID=\"406\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Metric\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:50%;                    padding:10px;\n                    \"\n                    >\n                                        Finding\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        19\u00a0unique malware families\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Places the organization in the top 1% of banking-sector peers for\u00a0observed\u00a0family diversity\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        10\/10\u00a0sector-characteristic families\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        All ten families identified as characteristic of the banking sector were\u00a0observed\u00a0in the organization's analyses\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-406'>\ntable#wpdtSimpleTable-406{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-406 td, table.wpdtSimpleTable406 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<p class=\"wp-block-paragraph\">These findings show why industry benchmarks and organization-specific data need to be considered together. One reveals what&#8217;s typical for the sector; the other shows where an organization&#8217;s actual threatexposure differs. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The comparison also revealed a striking difference in threat composition. For the financial organization, <strong>74.8%<\/strong> of analyzed threats were malicious code and <strong>25.2%<\/strong> were phishing. Across the wider banking sector, phishing accounted for <strong>88.9%<\/strong> of threats. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For SOC leaders, this distinction matters. Relying on sector averages alone could lead teams to underestimate the resources needed to investigate executable malware in their own environment. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Industry-wide intelligence shows what&#8217;s typical for your sector, while your own investigation data reveals where your exposure differs. Together, they provide a stronger basis for detection priorities and resource planning. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Which Threats Are Prevalent Across Your Industry <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">ANY.RUN&#8217;s data from 85 banking organizations shows which threats are most prevalent across the sector. For example, Sneaky2FA and Tycoon were observed in roughly 7 out of 10 organizations. <\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nSee how your threat landscape compares.\n<br>\nRequest a demo to explore <span class=\"highlight\">your data against benchmarks<\/span>.\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktoenterprise\" rel=\"noopener\" target=\"_blank\">\nRequest Demo <\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<p class=\"wp-block-paragraph\">But the threat landscape extends far beyond a handful of common families. Across <strong>380<\/strong> malware families observed in ANY.RUN&#8217;s threat flow, even the most frequently detected accounts for just <strong>4.8%<\/strong> of detections. This shows that threats aren&#8217;t concentrated in just two or three dominant families. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Stealer-type threats lead the observed behavioral categories at <strong>38.4%<\/strong>, while ransomware accounts for just 1.6%. <\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"412\" src=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectormalwarethreats-1024x412.png\" alt=\"\" class=\"wp-image-23702\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectormalwarethreats-1024x412.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectormalwarethreats-300x121.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectormalwarethreats-768x309.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectormalwarethreats-370x149.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectormalwarethreats-270x109.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectormalwarethreats-740x297.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/bankingsectormalwarethreats.png 1214w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>10 malware families that define the banking sector. ANY.RUN data<\/em> <\/figcaption><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">This is the core of ANY.RUN&#8217;s approach: organizations don&#8217;t have to wait until a threat reaches their environment to learn about it. Industry-wide intelligence is already available when the first suspicious file or link is submitted for analysis. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Drawing on investigations across the industry, ANY.RUN already has intelligence about which threats are prevalent, how they&#8217;re changing, and how frequently they appear among sector peers. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">When a suspicious file or link is submitted for analysis, this broader knowledge helps put individual findings into context. For SOC leaders, it provides a stronger basis for reviewing detection coverage, prioritizing threat hunting, and allocating resources according to both industry trends and their organization&#8217;s actual exposure. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why Does Consistent Threat Visibility Matter? <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The findings demonstrate how fast detection and industry-wide <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noopener\">threat intelligence<\/a> provide visibility beyond individual investigations. But this visibility is most valuable when it&#8217;s part of everyday SOC operations, not just occasional incident response. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The organization maintained <strong>100%<\/strong> working-day coverage, with a<strong> 9.2\/10 team satisfaction score<\/strong>, <strong>CSAT of 80.5<\/strong>, and <strong>74.9% 30-day retention<\/strong>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Together, these metrics show that the insights come from consistent operational use, providing a foundation for ongoing SOC monitoring and reporting. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Could ANY.RUN Reveal About Your Organization? <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The findings above are just one example of what can be learned by combining an organization&#8217;s investigation data with ANY.RUN&#8217;s industry-wide <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises%20&amp;utm_term=131026&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noopener\">threat intelligence<\/a>. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For enterprise SOC teams, ANY.RUN can automatically generate dashboards with key threat landscape and operational metrics, helping security leaders monitor performance, identify trends, and make data-driven decisions. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here&#8217;s what you can get with ANY.RUN: <\/p>\n\n\n\n<div class=\"wpdt-c row wpDataTableContainerSimpleTable wpDataTables wpDataTablesWrapper\n\"\n    >\n        <table id=\"wpdtSimpleTable-405\"\n           style=\"border-collapse:collapse;\n                   border-spacing:0px;\"\n           class=\"wpdtSimpleTable wpDataTable\"\n           data-column=\"3\"\n           data-rows=\"6\"\n           data-wpID=\"405\"\n           data-responsive=\"0\"\n           data-has-header=\"1\">\n\n                    <thead>        <tr class=\"wpdt-cell-row \" >\n                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"A1\"\n                    data-col-index=\"0\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        Reporting area\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"B1\"\n                    data-col-index=\"1\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        What you can track and measure\u00a0                    <\/th>\n                                                <th class=\"wpdt-cell \"\n                                            data-cell-id=\"C1\"\n                    data-col-index=\"2\"\n                    data-row-index=\"0\"\n                    style=\" width:33.333333333333%;                    padding:10px;\n                    \"\n                    >\n                                        Example metrics\u00a0                    <\/th>\n                                        <\/tr>\n                    <tbody>        <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A2\"\n                    data-col-index=\"0\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Operational management\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B2\"\n                    data-col-index=\"1\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Investigation\u00a0workloads by day and hour, peak activity, and workload distribution across analysts to support staffing decisions.\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C2\"\n                    data-col-index=\"2\"\n                    data-row-index=\"1\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Peak load\u00a02.5\u00d7\u00a0the median hour;\u00a0100%working-day coverage\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A3\"\n                    data-col-index=\"0\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Threat landscape research\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B3\"\n                    data-col-index=\"1\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Threats affecting your organization compared with industry benchmarks, including prevalent families and differences in exposure.\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C3\"\n                    data-col-index=\"2\"\n                    data-row-index=\"2\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        19 malware families\u00a0observed; top\u00a01%\u00a0among sector peers for family diversity\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A4\"\n                    data-col-index=\"0\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Executive security reporting\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B4\"\n                    data-col-index=\"1\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Detection speed, malicious yield, and threat breakdowns by file format, platform, and region, ready for leadership reporting.\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C4\"\n                    data-col-index=\"2\"\n                    data-row-index=\"3\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        15.1 sec\u00a0MTTD;\u00a012.8%\u00a0malicious yield\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A5\"\n                    data-col-index=\"0\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Investigation quality control\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B5\"\n                    data-col-index=\"1\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Analyst engagement with samples and activity following detection to\u00a0identify\u00a0excessive or insufficient manual investigation.\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C5\"\n                    data-col-index=\"2\"\n                    data-row-index=\"4\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        140 interactions\u00a0per task;\u00a027.5%\u00a0of session time spent actively investigating\u00a0                    <\/td>\n                                        <\/tr>\n                            <tr class=\"wpdt-cell-row \" >\n                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"A6\"\n                    data-col-index=\"0\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Adoption and team satisfaction\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"B6\"\n                    data-col-index=\"1\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        Team usage, satisfaction, retention, and coverage across roles and regions to evaluate ongoing adoption.\u00a0                    <\/td>\n                                                <td class=\"wpdt-cell \"\n                                            data-cell-id=\"C6\"\n                    data-col-index=\"2\"\n                    data-row-index=\"5\"\n                    style=\"                    padding:10px;\n                    \"\n                    >\n                                        9.2\/10\u00a0team satisfaction;\u00a074.9%\u00a030-day retention\u00a0                    <\/td>\n                                        <\/tr>\n                    <\/table>\n<\/div><style id='wpdt-custom-style-405'>\ntable#wpdtSimpleTable-405{ table-layout: fixed !important; }\ntable#wpdtSimpleTable-405 td, table.wpdtSimpleTable405 th { white-space: normal !important; }\n<\/style>\n\n\n\n\n<p class=\"wp-block-paragraph\">These insights support everyday operational management, industry benchmarking, and executive-level security reporting. SOC leaders can use them to monitor workloads, identify gaps, and present measurable findings to management. <\/p>\n\n\n\n<!-- Regular Banner START -->\n<div class=\"regular-banner\">\n<!-- Text Content -->\n<p class=\"regular-banner__text\">\nSee what ANY.RUN can reveal about your organization.<br>\nGet a <span class=\"highlight\">personalized demo<\/span> based on your own data.\n<\/p>\n<!-- CTA Link -->\n<a class=\"regular-banner__link\" id=\"article-banner-regular\" href=\"https:\/\/any.run\/enterprise\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktoenterprise\" rel=\"noopener\" target=\"_blank\">\nRequest Demo <\/a>\n<\/div>\n<!-- Regular Banner END -->\n<!-- Regular Banner Styles START -->\n\n<style>\n.regular-banner {\ndisplay: flex;\ntext-align: center;\nflex-direction: column;\nalign-items: center;\ngap: 1.5rem;\nwidth: 100%;\npadding: 2rem;\nmargin: 1.5rem 0;\nborder-radius: 0.5rem;\nfont-family: 'Catamaran Bold';\nmargin-inline: auto;\nbackground: rgba(32, 168, 241, 0.1);\nborder: 1px solid rgba(75, 174, 227, 0.32);\n}\n\n.regular-banner__text {\nfont-size: 1.5rem;\nmargin: 0;\n}\n\n.highlight {\ncolor: #ea2526;\n}\n\n.regular-banner__link {\npadding: 0.5rem 1.5rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: #FFFFFF;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\n}\n\n.regular-banner__link:hover {\nbackground-color: #68CBFF;\ncolor: white;\n}\n<\/style>\n<!-- Regular Banner Styles END -->\n\n\n\n<h2 class=\"wp-block-heading\">About ANY.RUN <\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noopener\">ANY.RUN<\/a> provides malware analysis and threat intelligence solutions used by 700,000+ cybersecurity professionals across 16,000+ organizations, including 74 of the Fortune 100. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Its <a href=\"https:\/\/any.run\/features\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktosandboxlanding\" target=\"_blank\" rel=\"noopener\">Interactive Sandbox<\/a> enables SOC teams to safely investigate suspicious files, URLs, and malware, providing real-time visibility into threat behavior. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Built on data from real-world investigations, ANY.RUN&#8217;s <a href=\"https:\/\/any.run\/threat-intelligence-lookup\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktotilookuplanding\" target=\"_blank\" rel=\"noopener\">Threat Intelligence Lookup<\/a> helps teams validate threats, uncover context, and support detection and response. <a href=\"https:\/\/any.run\/threat-intelligence-feeds\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=threat-data-for-enterprises&amp;utm_term=131026&amp;utm_content=linktotifeedslanding\" target=\"_blank\" rel=\"noopener\">Threat Intelligence Feeds<\/a> deliver fresh, actionable IOCs into existing security workflows. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Every day, thousands of SOC and IR teams worldwide analyze suspicious files, emails, and links with ANY.RUN. Beyond individual investigations, this activity generates valuable data on emerging threats, industry trends, and SOC operational performance. Drawing on real-world investigations across thousands of organizations, ANY.RUN provides visibility into threats affecting different sectors, from banking to retail. Security [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":23689,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4],"tags":[57,10,34],"class_list":["post-23685","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-lifehacks","tag-anyrun","tag-cybersecurity","tag-malware-analysis"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>What\u00a0Can\u00a0ANY.RUN\u00a0Reveal\u00a0About\u00a0Your\u00a0Threat\u00a0Landscape?<\/title>\n<meta name=\"description\" content=\"What\u00a0does\u00a0ANY.RUN\u00a0know\u00a0about\u00a0threats\u00a0affecting\u00a0your\u00a0industry?\u00a0See\u00a0how\u00a074K\u00a0analyses\u00a0reveal\u00a0risks,\u00a0benchmarks,\u00a0and\u00a0SOC\u00a0insights.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ANY.RUN\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/\"},\"author\":{\"name\":\"ANY.RUN\",\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"headline\":\"What&#8217;s Really Attacking Your Industry? Insights From 74K Sandbox Analyses\",\"datePublished\":\"2026-10-13T09:43:37+00:00\",\"dateModified\":\"2026-10-13T09:47:24+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/\"},\"wordCount\":1489,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/cover-scaled.png\",\"keywords\":[\"ANYRUN\",\"cybersecurity\",\"malware analysis\"],\"articleSection\":[\"Cybersecurity Lifehacks\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/\",\"name\":\"What\u00a0Can\u00a0ANY.RUN\u00a0Reveal\u00a0About\u00a0Your\u00a0Threat\u00a0Landscape?\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/cover-scaled.png\",\"datePublished\":\"2026-10-13T09:43:37+00:00\",\"dateModified\":\"2026-10-13T09:47:24+00:00\",\"description\":\"What\u00a0does\u00a0ANY.RUN\u00a0know\u00a0about\u00a0threats\u00a0affecting\u00a0your\u00a0industry?\u00a0See\u00a0how\u00a074K\u00a0analyses\u00a0reveal\u00a0risks,\u00a0benchmarks,\u00a0and\u00a0SOC\u00a0insights.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/#primaryimage\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/cover-scaled.png\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/cover-scaled.png\",\"width\":2560,\"height\":1243,\"caption\":\"enterprise security data\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/threat-data-for-enterprises\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity Lifehacks\",\"item\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/category\\\/lifehacks\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"What&#8217;s Really Attacking Your Industry? Insights From 74K Sandbox Analyses\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/any.run\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\\\/\\\/any.run\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\\\/\\\/any.run\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/www.any.run\\\/\",\"https:\\\/\\\/x.com\\\/anyrun_app\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/30692044\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/any.run\\\/\",\"name\":\"ANY.RUN\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g\",\"caption\":\"ANY.RUN\"},\"url\":\"https:\\\/\\\/any.run\\\/cybersecurity-blog\\\/author\\\/a-bespalova\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What\u00a0Can\u00a0ANY.RUN\u00a0Reveal\u00a0About\u00a0Your\u00a0Threat\u00a0Landscape?","description":"What\u00a0does\u00a0ANY.RUN\u00a0know\u00a0about\u00a0threats\u00a0affecting\u00a0your\u00a0industry?\u00a0See\u00a0how\u00a074K\u00a0analyses\u00a0reveal\u00a0risks,\u00a0benchmarks,\u00a0and\u00a0SOC\u00a0insights.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/","twitter_misc":{"Written by":"ANY.RUN","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/"},"author":{"name":"ANY.RUN","@id":"https:\/\/any.run\/"},"headline":"What&#8217;s Really Attacking Your Industry? Insights From 74K Sandbox Analyses","datePublished":"2026-10-13T09:43:37+00:00","dateModified":"2026-10-13T09:47:24+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/"},"wordCount":1489,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"image":{"@id":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/#primaryimage"},"thumbnailUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/cover-scaled.png","keywords":["ANYRUN","cybersecurity","malware analysis"],"articleSection":["Cybersecurity Lifehacks"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/","url":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/","name":"What\u00a0Can\u00a0ANY.RUN\u00a0Reveal\u00a0About\u00a0Your\u00a0Threat\u00a0Landscape?","isPartOf":{"@id":"https:\/\/any.run\/"},"primaryImageOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/#primaryimage"},"image":{"@id":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/#primaryimage"},"thumbnailUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/cover-scaled.png","datePublished":"2026-10-13T09:43:37+00:00","dateModified":"2026-10-13T09:47:24+00:00","description":"What\u00a0does\u00a0ANY.RUN\u00a0know\u00a0about\u00a0threats\u00a0affecting\u00a0your\u00a0industry?\u00a0See\u00a0how\u00a074K\u00a0analyses\u00a0reveal\u00a0risks,\u00a0benchmarks,\u00a0and\u00a0SOC\u00a0insights.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/#primaryimage","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/cover-scaled.png","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/10\/cover-scaled.png","width":2560,"height":1243,"caption":"enterprise security data"},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/threat-data-for-enterprises\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity Lifehacks","item":"https:\/\/any.run\/cybersecurity-blog\/category\/lifehacks\/"},{"@type":"ListItem","position":3,"name":"What&#8217;s Really Attacking Your Industry? Insights From 74K Sandbox Analyses"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/x.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"ANY.RUN","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4a921d1fbcf45a0476667c89b7999bc2bb3c028b518acc569da69c8797e53a84?s=96&d=mm&r=g","caption":"ANY.RUN"},"url":"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/23685","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=23685"}],"version-history":[{"count":10,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/23685\/revisions"}],"predecessor-version":[{"id":23712,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/23685\/revisions\/23712"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/23689"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=23685"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=23685"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=23685"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}