Virtual Threat Briefing | Nov 26th

Push's most wanted: The attacker toolkits breaking through enterprise security controls

Most threat intelligence tells points to what attackers are doing in the wild, but not its impact. Push's threat intelligence hub tracks a different measure: Breakthrough rate.


Breakthrough rate counts the attacks that reach a user's browser after email security, web gateways, and safe-browsing checks have all had their chance to stop them.


In October 2026, an organization of 10,000 employees could expect 31 of these attacks every month. That's 31 cases where technical controls preventing the attack from reaching the user failed.


Knowing which toolkits get through, and how they do it, is the fastest way to find the gaps in your own defenses.

Join Luke Jennings, Push's VP Research, for a tour of Push's threat intelligence hub and a close look at the kits with the highest breakthrough rates right now. Together, they cover adversary-in-the-middle (AiTM) phishing, authorization phishing, ClickFix, and remote management (RMM) tool delivery.

What breakthrough rate measures, and why it tells you more than attack volume
Which techniques and kits reached users most often over the past few months
Why some kits are better than others about breaking through, and how it changes over time
How to use this intelligence, and why the browser is where you can see and stop these attacks

Can't make it? Register anyway and we'll send you the recording.

Push forward double slash
Luke JenningsVP Research
Complete the form below
Trusted by:
Sophos
Gitlab
Thinkst
Cribl
Ramp
Enter some text...