System Intrusion

Incidents in this pattern include unauthorized network or system access linked to state-affiliated actors and/or exhibiting the motive of espionage.

All dates on the interactive DBIR website represent the calendar year of the incident. These values will differ from the print DBIR in cases where the DBIR collection period was used. This does not affect the validity of the analysis. To read more, see the Methodology section of the print DBIR.


Confirmed breaches


Total incidents

Pattern System Intrusion

Incidents Across All Patterns



This line chart shows how the breaches in System Intrusion compare to the other patterns over time.



System Intrusion vs. industries


Understanding the relationship between patterns and industries is a cheat-sheet for how to plan what to protect in your organization. If you know the most likely doors attackers will use to access your defenses, then you also know where to put the most locks. While all basic security controls must be addressed, this inside knowledge allows you to place priority for resource allocation on the areas where your organization needs it most.