# Annual State of Pentesting Report LP

## SEO Information

**Page Title:** Packetlabs Annual State of Pentesting Report

**Meta Description:** Download our 2026 State of Penetration Testing Report and see how attackers are moving across identity, cloud, applications, and infrastructure.

**OG Image:**

![Annual Pentest Report Mock Up w Glow ](//images.ctfassets.net/yewqr8zk7e5s/2BDKx5PQWMQJu3GFk112wd/5f7fcbcd701c1ca63b2e1410fbaddba2/Report_Mock_Up_w_Glow__1_.png)

**Twitter Account:** pktlabs

**Site Name:** Packetlabs

**Site URL:** https://www.packetlabs.net

---

## Inside 2,300+ Penetration Tests: What the Data Reveals About the Changing Threat Landscape

Download our 2026 State of Penetration Testing Report and see how attackers are moving across identity, cloud, applications, and infrastructure.

**Form ID:** cb843707-25ba-4747-beb3-8fbe97907010

**Hub ID:** 20040397

---

## Statistic Section

### Statistics

- Engagements Analyzed: 2,3K+
- 16,000+ Findings analyzed: 16K+
- Years Reporting Window: 4+

---

## Four Years of Real-World Offensive Security Data

**Variant:** Content+Image Block

Between January 2022 and June 2026, Packetlabs completed **more than 2,300 penetration testing engagements and analyzed over 16,000 findings** across applications, infrastructure, cloud, identity, mobile, social engineering, AI/LLM, and more. Over that period, one thing became increasingly clear: the environments being tested were changing, and so were the paths attackers could use to move through them.

**Download the report to learn:**

*   **Where risk is concentrating** across identity, cloud, applications, and infrastructure.
    
*   **How attack paths are evolving** as trust relationships connect more of the modern environment.
    
*   **What AI-enabled applications are revealing** about both new risks and familiar application and infrastructure weaknesses.
    
*   **What to prioritize next**, from hybrid identity and assumed-breach testing to attack-path analysis and layered controls.

**Section Image:**

![Annual State of Pentesting Report Mock Up](//images.ctfassets.net/yewqr8zk7e5s/2OHL0U1lpltJqRUJjDfhYL/f2c732667722e792c45c89435d013c63/Report_Mock-Up_V1.png)

---

## Key Findings from 2,300+ Penetration Tests

**Variant:** light

### Icon Cards

#### 40.7% of engagements surfaced at least one critical or high-severity finding.

![068-view](//images.ctfassets.net/yewqr8zk7e5s/1BGDUU0uxhdUTjSLzMJyEh/9c1bf7fffbe9090a4fa7ad00136c5510/068-view.svg)

#### 48.9% of serious findings were identity-related.

![023-hacker](//images.ctfassets.net/yewqr8zk7e5s/74nPKi5aRHmoMYI9CbjVAg/7538994935fead5fb421ee4bcfc70721/023-hacker.svg)

#### >90% of hybrid infrastructure assessments found a path from privileged access in one ecosystem to privileged access in another.

![027-key](//images.ctfassets.net/yewqr8zk7e5s/7zzWJy4YZxbmOVzdwfMfoG/4b29eb347d53098916fb19f3085e5b81/027-key.svg)

#### 87% success rate for phishing originating from a legitimate, already-compromised internal account when the identity matched the pretext.

![039-malware](//images.ctfassets.net/yewqr8zk7e5s/3Q5vpDGSy5Vvdko1QNTm5z/097474e5b706e85fbf0bf1299abfea59/039-malware.svg)

---

## Why Security Leaders Choose Packetlabs

**Variant:** Content+Image Block

Since 2011, Packetlabs has been helping organizations find real attack paths, prioritize remediation, and prove measurable risk reduction through human-led penetration testing.

**95% Manual Testing** Our pentest services combine expert manual testing with targeted automation to show what attackers could reach across infrastructure, identity, and cloud environments.

**OSCP-Minimum Testers** Every tester holds OSCP at a minimum, with advanced certifications across the team, including OSEP, OSWE, GXPN, GWAPT, GMOB, GSNA, GCIH, CISA, and CISSP.

**CREST-Accredited and SOC 2 Type II Attested** Work with a trusted pentest company in Canada built for security, compliance, and vendor-risk requirements.

**Retesting Included** Retesting is included so your team can confirm fixes and show measurable risk reduction.

**Section Image:**

![CyberSecurityOverview Validated Defenses](//images.ctfassets.net/yewqr8zk7e5s/WdGzFVGGucqT2lbHtrakK/94128d07690e487befc81154f31d51e2/CyberSecurityOverview_Validated_Defenses.png)

---

## See the Findings From 2,300+ Penetration Tests

**Variant:** CTA Block

Get the data, trends, and offensive-security insights behind the shift toward identity, cloud, and connected attack paths.

**Background Image:**

![Hero Half Variant 05](//images.ctfassets.net/yewqr8zk7e5s/2DfyVVVFzZMapHEfaDa6hj/44bcbc42b28174dbb8d0ef9d99631665/Hero_Half_Variant_05.png)

### Calls to Action

- [Download Now](#annual-state-of-pentesting-form)

---