About breakthrough rate
Breakthrough rate tracks the prevalence of a given tool in attacks. It measures its ability to break through security controls in order for a user to be able to interact with it.
The breakthrough rate score reflects the expected number of attacks that will reach a user each month, across an organization with an average of 10,000 employees.
Global breakthrough rate
Sep 2026: 33 attacks per 10,000 employees per month.
- Jun 2026: 22 attacks per 10,000 employees per month
- Jul 2026: 21 attacks per 10,000 employees per month
- Aug 2026: 41 attacks per 10,000 employees per month
- Sep 2026: 33 attacks per 10,000 employees per month
How we assess breakthrough rate
When Push sees a malicious page as the user loads and interacts with it in their web browser, it has already broken through multiple control layers.
For a typical attack, this might include an email-delivered link that has successfully passed filtering and into the inbox, that wasn’t blocked when clicked. Then, the attack passes through layers of network and web security controls depending on the organizational setup: from secure web gateway inspection through to safe browsing checks against known-bad page URLs, through to sandbox analysis of webpages used in the delivery chain.
Because Push sees what the user sees and can analyze every page and interaction in real time, we intercept the attack at the point that malicious elements are loaded onto a page: in other words, where the attack actually happens.
What the ratings mean
- Extreme
- The tool is reaching users at the highest rate Push observes. Expect multiple attacks per month to break through to employees in a typical organization.
- Highest
- High
- The tool reaches users regularly. Attacks break through most months in a typical organization.
- Moderate
- The tool reaches users at a steady but lower rate. Attacks break through intermittently rather than every month.
- Emerging
- The tool has only recently started reaching users, or does so rarely. Too little history to establish a trend.
- Inactive
- Push has not seen the tool reach a user this month. It remains tracked because tools often return after a pause.
- Lowest
What it doesn’t tell you
Not a measure of attempts
We're not measuring total attempts in the wild, we're measuring the ability of a tool or technique to reach the user.
It’s a sample
Data is collected from browsers that Push monitors, not the whole internet.
Ratings move
Tools change and controls catch up. A reduction in breakthrough rate is not a reflection that a tool is declining in terms of general prevalence in attempts.