Skip to main content
Packetlabs Company Logo

Annual State of Pentesting Report LP

Inside 2,300+ Penetration Tests: What the Data Reveals About the Changing Threat Landscape

Download our 2026 State of Penetration Testing Report and see how attackers are moving across identity, cloud, applications, and infrastructure.

Engagements Analyzed
2,3K+
16,000+ Findings analyzed
16K+
Years Reporting Window
4+

Four Years of Real-World Offensive Security Data

Between January 2022 and June 2026, Packetlabs completed more than 2,300 penetration testing engagements and analyzed over 16,000 findings across applications, infrastructure, cloud, identity, mobile, social engineering, AI/LLM, and more. Over that period, one thing became increasingly clear: the environments being tested were changing, and so were the paths attackers could use to move through them.

Download the report to learn:

  • Where risk is concentrating across identity, cloud, applications, and infrastructure.

  • How attack paths are evolving as trust relationships connect more of the modern environment.

  • What AI-enabled applications are revealing about both new risks and familiar application and infrastructure weaknesses.

  • What to prioritize next, from hybrid identity and assumed-breach testing to attack-path analysis and layered controls.

Annual State of Pentesting Report Mock Up

Key Findings from 2,300+ Penetration Tests

40.7% of engagements surfaced at least one critical or high-severity finding.

48.9% of serious findings were identity-related.

>90% of hybrid infrastructure assessments found a path from privileged access in one ecosystem to privileged access in another.

87% success rate for phishing originating from a legitimate, already-compromised internal account when the identity matched the pretext.

Why Security Leaders Choose Packetlabs

Since 2011, Packetlabs has been helping organizations find real attack paths, prioritize remediation, and prove measurable risk reduction through human-led penetration testing.

95% Manual Testing Our pentest services combine expert manual testing with targeted automation to show what attackers could reach across infrastructure, identity, and cloud environments.

OSCP-Minimum Testers Every tester holds OSCP at a minimum, with advanced certifications across the team, including OSEP, OSWE, GXPN, GWAPT, GMOB, GSNA, GCIH, CISA, and CISSP.

CREST-Accredited and SOC 2 Type II Attested Work with a trusted pentest company in Canada built for security, compliance, and vendor-risk requirements.

Retesting Included Retesting is included so your team can confirm fixes and show measurable risk reduction.

CyberSecurityOverview Validated Defenses

See the Findings From 2,300+ Penetration Tests

Get the data, trends, and offensive-security insights behind the shift toward identity, cloud, and connected attack paths.

Download Now