After collecting and analyzing data, based on a comprehensive review of incident response investigations conducted over the past three years on behalf of organizations across various industries, CrowdStrike is offering key takeaways on emerging trends in cyber intrusions and notable adversary tactics, techniques, and procedures (TTPs). Highlights and key findings: Operating under attack is the new normal Nearly all affected organizations experienced almost immediate reinfection attempts. On average, adversaries engage in aggressive infection reattempt efforts within two days of remediation efforts. Organizations need to defend against multiple concurrent attackers In a quarter of the examined cases, CrowdStrike identified multiple distinct adversary teams operating in the victim environment.