HITRUST 2025 H2 Threat Analysis Confirms HITRUST Assessments Continue to Mitigate Top Attack Techniques as Adversaries Accelerate Use of AI-Driven Tactics

FRISCO, Texas, Feb. 19, 2026 /CNW/ -- HITRUST, the leading provider of information security assurance for risk management and compliance, today released its 2025 H2 Cyber Threat Adaptive (CTA) Report, providing new evidence that HITRUST's continuously updated e1, i1, and r2 assessments portfolio remains highly effective at mitigating the top adversarial techniques used across real-world attacks in 2025. The second-half analysis reviewed 588,588 threat indicators, 4,650 intelligence articles, and 425 publicly reported breaches, mapping 46,175 data points to the MITRE ATT&CK® framework to evaluate which security controls most effectively reduce risk.

HITRUST found that the most prevalent attack vectors--phishing, exploitation of public-facing applications, remote service exploitation, drive-by compromise, and event-triggered execution--continue to be mitigated by controls already embedded in HITRUST's assessments, reaffirming the strength of the HITRUST CSF as a dynamic, threat-aligned security framework.

HITRUST Controls Evolve at the Speed of Threat

For the first time, this year's first-half analysis led HITRUST to remove one requirement from the e1 assessment after threat intelligence confirmed that a previously included control did not map to any techniques observed in this reporting period. This change underscores the value of a threat-adaptive assurance model--ensuring organizations maintain a strong baseline without unnecessary or outdated requirements.

"Cyber threats are evolving faster than static security programs can react," said Gregory Webb, CEO of HITRUST. "Adversaries update their tactics every day. Security programs must evolve just as quickly, and HITRUST is the only standards organization continuously integrating real-world threat intelligence directly into its assessments. When the data tells us a control isn't necessary, we remove it. When threats shift, we adapt. That's what modern cybersecurity assurance requires, and that's why HITRUST-certified environments achieved 99.41% resilience in 2025."

HITRUST's Cyber Threat Adaptive program systematically analyzes real-world threat intelligence, breach data, and adversary behavior to ensure that control requirements in the HITRUST CSF remain effective against actual cyber threats. The CTA program is designed to ensure that HITRUST assessments are not theoretical or backward-looking. Each quarter, HITRUST analyzes live threat data to validate whether its control requirements effectively mitigate the most active, emerging, and evolving attack techniques. Findings from H2 further confirm that organizations using HITRUST gain measurable, data-backed resilience against the techniques adversaries rely on most.

Key Findings from the H2 2025 CTA Report

1. Phishing Remains the Most Common Initial Access Technique

Phishing and spear-phishing campaigns--now increasingly powered by generative AI--continue to dominate incident activity.

2. Exploitation of Public-Facing Applications and Remote Services Increasing

Unpatched web applications, APIs, and remote access technologies (RDP, VPN, collaboration tools) remain high-value targets.

3. Drive-By Compromise Persists Across Industries

Compromised websites, malicious ads, and embedded scripts continue to deliver malware at scale.

4. Attackers Increasing Use of Persistence Techniques

Event-triggered execution techniques are being used to maintain footholds after initial compromise.

5. Highest Growth Technique: External Remote Services

H2 saw the largest proportional increase in attacks targeting external remote services, reflecting adversaries' growing focus on exploiting remote access pathways to gain and maintain unauthorized access.

"Adversaries are scaling their operations using automation and AI-enabled tactics and shifting to high-impact and fast-emerging attack vectors like virtualization abuse," said Andrew Russell, Vice President of Standards at HITRUST. "The CTA program ensures HITRUST assessments adjust at the pace of these evolving tactics, giving organizations defenses that remain both current and defensible."

Broader Impact on Enterprise and Third-Party Risk

As attackers increasingly target the extended enterprise--from SaaS platforms and cloud infrastructure to managed service providers and supply chain partners--the blast radius of a single exploited vulnerability has grown dramatically. These H2 CTA findings reinforce that modern cyber risk is no longer confined to internal systems; it extends to every interconnected vendor, API, and digital service an organization relies on. Ensuring that these connections remain resilient is now a foundational requirement for business continuity.

"In modern enterprises, every connection--every SaaS platform, API, vendor, and cloud service--creates both opportunity and exposure," said Ryan Patrick, Executive Vice President, TPRM Customer Solutions, HITRUST. "The question executives must ask is no longer whether they are compliant, but whether they--and the vendors and partners they rely on--are genuinely resilient. HITRUST delivers measurable, adaptive resilience grounded in real-world threat intelligence."

Download the Full H2 2025 CTA Report

The complete H2 2025 CTA Report, including control mappings and method descriptions, is available at: https://hitrustalliance.net/cyber-threat-adaptive

About HITRUST

HITRUST is the leader in validated cybersecurity assurance used in third-party risk management and compliance. HITRUST delivers assurance and certification programs for the application and independent validation of security, privacy, and AI controls, harmonized across more than 60 authoritative standards and frameworks. Its threat-adaptive approach combines tiered, selectable assessments (e1, i1, r2, and AI), an ecosystem of over 100 independent assessment firms, centralized quality assurance, standardized reporting, and a powerful SaaS platform to enable consistent, defensible, and scalable assurance. For nearly 20 years, HITRUST has defined the standard for trustworthy cybersecurity proof, helping organizations demonstrate measurable cybersecurity resilience across their enterprises and third-party ecosystems.

Contact:
Leslie Jenkins
Senior Director of Marketing
[email protected] 

SOURCE HITRUST Services Corp.