Most breach post-mortems follow the same script. The attacker was sophisticated. The zero-day was unavoidable. The threat landscape had evolved. Nobody’s fault, really — just the cost of operating in a dangerous world.
SonicWall just published data that kills that story. Kills it by name.
The 2026 SonicWall Cyber Protect Report is the first in the company’s history built around protection outcomes rather than threat statistics. What they found wasn’t a bunch of novel attack vectors. It was seven recurring operational failures showing up in breach after breach — gaps that SonicWall named the Seven Deadly Sins of Cybersecurity. Not because the term is dramatic, but because these aren’t obscure problems. Every MSP in the room already knows them. That’s what makes the data uncomfortable.
The Attack Surface Isn’t What You Think It Is
Before you get to the sins, the threat picture matters. High and medium severity attacks surged 20.8% to 13.15 billion hits last year. Overall volume held roughly flat. That means attackers aren’t swinging more often — they’re connecting more often. Precision is increasing. Randomness is decreasing. The “spray and pray” attack profile is giving way to something more targeted, and that targeting is increasingly aimed at SMBs.
A few numbers worth holding:
Ransomware fell 33.9% in overall volume. That’s the headline most people ran with. But ransomware was present in 88% of SMB breaches in 2025, compared to just 39% at large enterprises. The frequency dropped. The concentration at the SMB level went up. Your clients didn’t get safer — they just became a more refined target.
Automated bots now generate more than 36,000 vulnerability scans per second, accounting for more than half of all internet traffic. The question isn’t whether your client will be scanned. It’s whether they’ll be found vulnerable when they are. And then there’s Log4j, which four years after public disclosure still generated 824.9 million IPS hits in 2025. Old vulnerabilities don’t retire. Attackers keep using them because defenders keep leaving them unpatched.
The Seven Sins
Here’s what SonicWall found when they stopped counting attacks and started counting failures. These aren’t hypothetical risk categories. They come from actual breach investigations, security assessments, and incident reviews.
Sin 1 — Ignoring the Fundamentals. Identity, cloud, and credential compromise account for 85% of actionable security alerts. The preferred attack vector isn’t a zero-day. It’s a stolen password walking through an unguarded door. The fundamentals aren’t hard to fix — they’re hard to sustain. That’s a different problem, and it has a different solution.
Sin 2 — False Confidence. The “we’re too small to be a target” assumption is dangerous, but it’s not the only trap. 80% of IT leaders say they can contain an incident in under eight hours. IBM data shows attackers dwell undetected for an average of 181 days. Both numbers can’t be right. One of them reflects reality.
Sin 3 — Overexposed Access. 48% of breaches involved compromised VPN credentials as the initial access vector. Once inside a flat network, attackers don’t need sophisticated tools. Average lateral movement occurs within 48 minutes of initial compromise. In the fastest observed cases, full propagation took 18 minutes. Eighteen minutes from credential theft to full network access. If you’re still selling VPN-plus-firewall as a security posture in 2026, that number should change the conversation.
Sin 4 — Reactive Posture. The average breach goes undetected for 181 days. 44% of alerts go uninvestigated because of alert fatigue and talent constraints. Attackers aren’t waiting to be found. They’re operating in the gaps your team doesn’t have bandwidth to cover.
Sin 5 — Cost-Driven Decisions. A single SMB breach can exceed $4.91 million in downtime and recovery costs. Organizations with incident response plans save an average of $1.23 million per breach. Cheap security isn’t cheap. It’s cheap up front. Your clients doing the “do we really need MDR?” math are solving the wrong problem.
Sin 6 — Legacy Access Models. VPN CVEs grew 82.5%, with 60% rated high or critical. VPNs authenticate once, then trust everything after. Attackers don’t need to break through the perimeter. They just need valid credentials and time. Zero Trust isn’t a buzzword. It’s the architectural response to this specific problem.
Sin 7 — Chasing Hype Over Execution. The average enterprise runs 45 security tools. Nearly half of security professionals spend more time maintaining tools than defending against attacks. AI is a force multiplier — but it multiplies whatever’s underneath it. In environments where the fundamentals are broken, more AI tools multiply the chaos.
What’s Actually Dead Here
The myth that SMB breaches happen because the attacker was too sophisticated.
That story protects a lot of people. It protects the vendor who sold a tool that wasn’t configured correctly. It protects the MSP who didn’t push back on the client who refused MFA. It protects the client who ignored the patch notification for six months. Sophisticated attackers are real — but they’re not the ones hitting most of your clients. Basic gaps are.
The SonicWall data shows a straightforward pattern: organizations that apply the fundamentals consistently don’t need to survive novel attacks, because they’re not getting hit by novel attacks. They’re getting hit by Sin 3 and Sin 6, over and over, in slightly different configurations.
The Business Problem for MSPs
If your security conversation with clients is built around threat narratives — the evolving landscape, the sophisticated actors, the AI-powered attacks — you’re having the wrong conversation. You’re also making your own job harder. Threat narratives require your clients to believe in invisible threats. The Seven Sins are visible. You can show them on an assessment. You can put them on a remediation roadmap. You can charge for closing each one.
The MSPs who will benefit most from this report aren’t the ones who read it and nod. They’re the ones who use it as a sales framework. Take your next QBR. Walk through the seven categories. Score your client against each one. Show them where they score a three out of ten on overexposed access. That conversation leads somewhere. “The threat landscape is evolving” doesn’t.
The report is telling you your clients are losing to preventable failures. That’s not a threat intelligence story. It’s a services gap story. Every gap on that list is a managed service you can sell.
If you want the full data set, the 2026 SonicWall Cyber Protect Report is available directly from SonicWall. Read it before your next client meeting, then ask them which of the seven they’re most exposed to. You already know the answer. So do they.
Related: Your MSP Tools Are Someone Else’s Attack Chain | The Profitable MSP Plays a Different Game