Cyberattacks on professional, scientific, and technical services (PSTS) organizations rose 69% last quarter, and how attackers get in has changed. Phishing fell from 23% to 17% of observed techniques, while Web Shell tripled from 2% to 6%. Attackers are targeting internet-facing edge devices and staying there. PSTS firms hold client data, source code, intellectual property, and trusted access into client networks, so one foothold can reach many organizations.
The Offense Executes Faster Than Firms Can Patch
The window between vulnerability disclosure and active weaponization has collapsed. This quarter, exploited vulnerabilities jumped from 62 to 109, while same-day exploitation nearly doubled from 17 to 32. High-profile flaws in Ivanti Connect Secure and Microsoft SharePoint were weaponized as soon as they were disclosed.
Attackers primarily targeted remote access gateways:
SonicWall SMA1000: Two zero-days left over 400 devices exposed to full remote code execution.
Cisco Catalyst SD-WAN Manager: CVE-2026-76504, a maximum-severity CVSS 10 flaw, allows attackers to bypass API authentication and gain full administrative access.
Ransomware groups are focused on this sector. Groups including The Gentlemen, Qilin, Inc Ransom, and DragonForce—alongside newcomer Dire Wolf—all posted PSTS victim numbers well above all-sector averages. This sector is a deliberate, primary target.
Every unpatched gateway is an open door into your network, and from there, into your clients’ networks. Attackers also work outside your perimeter, with credential exposure and lookalike domain impersonations accounting for 70% of our digital risk alerts. By the time a spoofed domain is discovered, your clients may have already received the fake.
Why Traditional Defenses Can’t Close This Gap
Most firms respond with one of three moves. Each fails at the edge for a structural reason.
Centralizing in a SIEM: Detection waits until data is ingested and indexed, which takes hours. A web shell acts in that window. Data that costs too much to store goes unmonitored, so coverage has holes where attackers choose to work.
Outsourcing to an MSSP: A provider that watches one tool cannot connect a password spray, an SD-WAN compromise, and a stolen build secret. That is one intrusion seen as three small events. You also give up control over how your defense runs.
Adding headcount: More analysts doing human-speed triage still lose to machine-speed attacks.
The sector is getting faster. Mean time to contain fell 69%, from 2 hours and 6 minutes to 39 minutes. Firms using automated response playbooks contained threats in 3 minutes on average. The difference between those two numbers is the attacker’s working time.
How Agentic Defense Executes Across PSTS Environments
ReliaQuest’s agentic AI security operations platform, GreyMatter, addresses this architectural challenge.
One language across every tool. The Universal Translator maps every field from every connected tool to OCSF the moment it connects, without requiring centralization first. A web shell on a gateway, a spray against email accounts, and a stolen credential line up as one attack chain. Analysts do not pivot between consoles to find it.
Detection where the attack happens. Detection at source runs correlation logic inside each integrated technology, so data never has to leave the tool. Detection in transit runs single-event and multi-event correlation on data as it moves—before it is parsed, indexed, or stored. Credential abuse sequences resolve in motion, not hours after ingestion.
Agentic Teammates that do the work. Six Agentic Teammates split security work into hundreds of single-task agents. Your team sets the objective and controls the outcome. The teammates execute around the clock.
Cost that stays flat. The AI Model Broker selects the best-performing model for each task based on cost, speed, and accuracy. Pricing stays flat, with no tokens, queries, or per-investigation charges. Customers see $2 to $4 back for every $1 they spend.
How Security Leaders Can Take Action
Enforce phishing-resistant multi-factor authentication (MFA) on all VPN and RDP connections and completely disable any unused remote services.
Patch edge appliances immediately. If a patch is unavailable, mitigate risk by restricting internet exposure, limiting management access to trusted IPs or VPNs, rotating credentials, and monitoring for unusual API activity.
Block Rclone and similar unauthorized tools using application allowlisting.
Search for web shells and indicators of compromise on all internet-facing systems.
No patch cycle wins when exploitation happens the same day a flaw is disclosed. GreyMatter’s Agentic Defense detects and responds at machine speed, while your team stays in control.
