2025 Threat Intelligence Index: Dark Web, AI, & Ransomware Trends

0:00 – 2:40

The surprising good news, and the catch hiding underneath it

The video opens with a straightforward promise: if information is power, then threat intelligence is one of the few ways defenders get to see the battlefield before they are hit. From there, the host starts with an unexpected twist, some of the headline numbers are actually encouraging. Ransomware is down for the third year in a row, and payments are down 35%. That is not framed as luck. He points to law enforcement disruption of major ransomware rings as one reason the pressure seems to be working. But the relief comes with a catch. Attackers are not simply giving up, they are changing the business model. Instead of encrypting data and charging to unlock it, many are now stealing the data first and threatening to leak it publicly, or simply using it for their own purposes. That shift matters because it changes what “recovery” means. If your files are encrypted, you can think about restoration. If your data is stolen, the damage keeps spreading even after systems come back online. The second piece of good news is just as striking: phishing attacks are down 50%. Since phishing has long been one of the main causes of breaches, that sounds like a big defensive win. The host deliberately leaves a curiosity gap here, warning viewers not to celebrate yet because there is a flip side coming later. That structure is useful because it mirrors how security works in real life. A lower number in one category does not mean attackers are weaker overall, it often means they found a more efficient route. He closes this opening stretch with a third positive trend: persistent malware is also down. This is the kind of malware that digs in and is hard to remove, so a reduction here is meaningful. The host credits better EDR, endpoint detection and response, which means tools that watch individual devices and help detect and contain suspicious behavior. In plain terms, the expensive security investments many organizations made are finally showing up on the scoreboard. So the opening message is not that the threat is gone. It is that some defenses are working, and that success is already forcing criminals to adapt.