* [Blog](https://www2.paloaltonetworks.com/blog)
* [Palo Alto Networks](https://www2.paloaltonetworks.com/blog/corporate/)
* [AI and Cybersecurity](https://www2.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/)
* The Case for Multidomain ...

# The Case for Multidomain Visibility

[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2025%2F10%2Fcase-for-multidomain-visibility%2F)  
[](https://twitter.com/share?text=The+Case+for+Multidomain+Visibility&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2025%2F10%2Fcase-for-multidomain-visibility%2F)  
[](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2025%2F10%2Fcase-for-multidomain-visibility%2F&title=The+Case+for+Multidomain+Visibility&summary=&source=)  
[](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www2.paloaltonetworks.com/blog/2025/10/case-for-multidomain-visibility/&ts=markdown)  
\[\](mailto:?subject=The Case for Multidomain Visibility)  
Link copied  
By [Unit 42](https://www.paloaltonetworks.com/blog/author/unit-42/?ts=markdown "Posts by Unit 42")  
Oct 01, 2025  
8 minutes  
[AI and Cybersecurity](https://www.paloaltonetworks.com/blog/security-operations/category/ai-and-cybersecurity/?ts=markdown)  
[AI Security](https://www.paloaltonetworks.com/blog/category/ai-security/?ts=markdown)  
[Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity-2/?ts=markdown)  
[Data Security](https://www.paloaltonetworks.com/blog/category/data-security/?ts=markdown)  
[Incident Response](https://www.paloaltonetworks.com/blog/category/incident-response/?ts=markdown)  
[Reports](https://www.paloaltonetworks.com/blog/category/reports/?ts=markdown)  
[Unit 42](https://www.paloaltonetworks.com/blog/category/unit42/?ts=markdown)  
[cyberattacks](https://www.paloaltonetworks.com/blog/tag/cyberattacks/?ts=markdown)  
[Global Incident Response Report](https://www.paloaltonetworks.com/blog/tag/global-incident-response-report/?ts=markdown)

## Findings from the 2025 Unit 42 Global Incident Response Report

Cyberattacks rarely follow a linear path. While security teams often zero-in on initial access vectors, like phishing emails, exposed services and credential abuse, these only mark the starting point. What happens next is far more complex. According to the [2025 Global Incident Response Report](https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report), 84% of investigated cases involved activity across multiple attack fronts, with 70% spanning at least three vectors and some touching as many as six. These are not isolated incidents; they're coordinated campaigns.

Today's attackers move laterally, escalating privileges, targeting identities, exploiting cloud misconfigurations and exfiltrating data, sometimes simultaneously. That level of sophistication and the multipronged approach makes for a strong case against operating in silos. Tools that only monitor one domain or that lack integration can leave critical threat signals buried under alert noise or trapped in disconnected logs.

In 85% of cases, Unit 42 incident responders had to access multiple types of data sources to complete their investigation. For matters where this wasn't the case, that's not a failure of collection, but of visibility and context. This is what multidomain attacks look like in the field, and why cross-domain correlation and unified response capabilities are now essential for any modern security operations center (SOC).

## Initial Intrusion Sets the Stage for Escalated Access

While attacks rarely stay confined to a single vector, Unit 42 found initial access still plays a defining role in how incidents unfold. In 2024, [phishing](https://www.paloaltonetworks.com/cyberpedia/what-is-phishing) once again became the leading access method, overtaking software and API vulnerabilities (which topped the list the previous year). Phishing accounted for 23% of incidents, with [business email compromise](https://www.paloaltonetworks.com/cyberpedia/what-is-business-email-compromise-bec-tactics-and-prevention) (BEC) responsible for 76% of those cases.

These attacks don't just succeed because of clever lures, but also because of missing or misconfigured foundational controls. Lack of [multifactor authentication](https://www.paloaltonetworks.com/cyberpedia/what-is-multi-factor-authentication) (MFA) was a factor in 28% of cases, weak or default passwords were in 20%, and insufficient brute-force or account lockout policies were 17%. That's a wide spread of approaches, not to mention overpermissioned accounts, which are common in fast-moving cloud and hybrid environments, having also contributed to privilege escalation in 17% of cases.

Just behind phishing, software and API vulnerabilities were exploited in 19% of incidents, and previously compromised credentials accounted for 16%. These entry points aren't just technical distinctions; they often map to different threat actor profiles. For instance, nation-state actors displayed a clear preference for exploiting software and API flaws, targeting unpatched systems and exposed services to quietly gain footholds without triggering user-facing alerts.

Understanding which vectors are favored and why can help teams tailor both prevention and detection strategies. But as attacks rapidly move beyond the entry point, initial access is only one part of a much larger picture.

## Why Multidomain Attacks Are So Hard to Catch

Multidomain attacks aren't just widespread, they're quiet by design. Threat actors know that most security tools are scoped to a single environment, whether that's cloud infrastructure, SaaS applications or on-premises networks. Without cross-domain correlation, attackers can slip through the cracks, moving from one system to another without raising alarms. What looks benign in isolation (a login, a script execution, an API call) can amount to a coordinated breach when viewed in full.

These operations are often low and slow on purpose. They unfold over days or weeks, making gradual moves that avoid rate-based alerts or behavioral thresholds. This makes them fundamentally harder to detect, especially when fragmented logging, inconsistent telemetry formats and disconnected detection systems prevent the full picture from coming together. Even when logs are normalized, valuable context (e.g., the identity or risk posture of a specific asset) can be lost in translation.

Consider these real-world examples drawn from the desks of Unit 42:

* **Cloud-to-Cloud Escalation:** An attacker compromises AWS credentials, and then, uncovers hard-coded GitHub tokens in a repository. From there, they locate Google Cloud service account keys buried in CI/CD workflows. With no single platform tracking movement across providers, each action appears routine, until the attacker has full control across multiple cloud environments.
* \*\*SaaS Misuse Via Trusted Identities:\*\*A third-party contractor's Entra ID credentials are phished. Using SSO, the attacker accesses internal tools, like Jira, and then, quietly exfiltrates data using Slack or Dropbox. All the activity flows through trusted applications, using legitimate identities. Without robust user behavior analytics, there's nothing to flag as suspicious.
* \*\*IT-to-OT Lateral Movement:\*\*An attacker buys valid VPN credentials from the dark web. With access granted, they pivot across internal IT systems and eventually reach OT environments through an IoT device, where minimal monitoring and legacy protocols provide little resistance. The VPN login looked valid, and OT visibility gaps gave the attacker space to operate unnoticed.

These examples underscore the central truth: Multidomain detection isn't a logging problem, it's a correlation and context problem. Without unified visibility, even the best security teams will struggle to respond before significant damage is done.

## What Works Defending Against Multi-Domain Attacks?

Stopping multidomain attacks requires more than better alerts or more logging; it demands a shift in how security teams think about visibility, detection and response. As attackers move laterally across cloud, SaaS, IT and OT environments, defenders need integrated telemetry, smarter analytics and automated workflows that keep pace with threats.

#### Unify Telemetry and Apply AI at Scale

To detect cross-domain attacks, analysts need a full, correlated view of what's happening across all systems, not just logs, but contextual metadata, identity activity and security signals from every layer of the stack. But that's only half the challenge: The volume of data is too large and fast-moving to analyze manually. AI and machine learning are essential to identify patterns, filter noise and surface signals that would otherwise go unnoticed. A streamlined security ecosystem, where tools natively integrate and share telemetry, further reduces complexity and accelerates threat detection. The [Cortex^®^ platform](https://www.paloaltonetworks.com/cortex), for example, correlates telemetry, identity data and behavioral analytics across every domain, so SOC teams can detect complex attacks in real time.

#### Strengthen Identity and Access Controls

In multidomain breaches, identity is almost always the common denominator. Overpermissioned accounts, federated SSO and dormant service accounts create ideal conditions for lateral movement. Defenders should enforce MFA everywhere (including on service accounts), implement least privilege and actively monitor identity relationships across domains. Even partial implementation of [zero trust](https://www.paloaltonetworks.com/cyberpedia/what-is-zero-trust-network-access-ztna) principles can reduce risk and prevent attackers from turning one compromised credential into full enterprise access.

#### Use AI-Powered Behavioral Analytics to Spot Anomalies

Rule-based detections struggle to keep up with the pace and creativity of attacker techniques. AI-powered behavioral analytics offer a scalable way to detect abnormal activity, even when it originates from trusted accounts and applications. By learning what "normal" looks like for users, systems and services, these models can flag subtle deviations (e.g., logins at odd times, lateral movement across unusual systems, rapid privilege escalation) before they become full-blown incidents.

#### Automate Response Actions to Buy Time

Speed matters. The longer it takes to contain a threat, the more domains it can touch. Automated response workflows can immediately revoke credentials, isolate endpoints or block IP addresses without waiting on manual approval. When your SOC platform integrates with IT and business systems, you remove friction points that delay containment and increase exposure. The goal isn't to replace analysts; it's to give them a head start when every second counts.

Multidomain attacks are here to stay. But with integrated telemetry, smarter identity governance and automation backed by AI, defenders can stay ahead of attackers even when they're coming from every direction at once.

## See the Attack, Respond with Confidence

Attackers no longer operate within boundaries and neither should your defenses. Stopping multidomain attacks requires unified visibility with smarter detection and faster response. Security teams need tools and partners that can help them correlate signals across environments, surface the real threats and respond before damage spreads.

To dive deeper into the tactics, techniques and trends shaping today's threat landscape, download the full [2025 Global Incident Response Report](https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report). And when you need help investigating complex incidents or managing detection and response around the clock, [contact Unit 42](https://start.paloaltonetworks.com/contact-unit42.html) to engage with expert defenders.

#### Key Takeaways:

* **Cyberattacks are complex and multidomain:** Modern cyberattacks rarely follow a linear path. Attacks often span multiple attack fronts (70% across at least three vectors) and move laterally across different environments (cloud, SaaS, IT, OT). This makes them difficult to detect with tools that operate in silos.
* **Unified visibility and correlation are essential:** Stopping multidomain attacks requires integrated telemetry, smarter analytics and automated workflows. Security teams need a full, correlated view of what's happening across all systems. It isn't just logs, but also contextual metadata, identity activity and security signals from every layer of the stack.
* **AI-powered solutions and strong identity controls are crucial:** AI and machine learning are essential to identify patterns and surface signals in the vast volume of data. Additionally, strengthening identity and access controls (MFA everywhere, least privilege, monitoring identity relationships) and using AI-powered behavioral analytics to spot anomalies are critical for defending against these sophisticated threats.

*** ** * ** ***

## Related Blogs

### [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Reports](https://www.paloaltonetworks.com/blog/category/reports/?ts=markdown), [Unit 42](https://www.paloaltonetworks.com/blog/category/unit42/?ts=markdown)

[#### Why Threat Actors Succeed](https://www2.paloaltonetworks.com/blog/2025/10/why-threat-actors-succeed/)

### [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Reports](https://www.paloaltonetworks.com/blog/category/reports/?ts=markdown), [Unit 42](https://www.paloaltonetworks.com/blog/category/unit42/?ts=markdown)

[#### Closing the Cloud Security Gap](https://www2.paloaltonetworks.com/blog/2025/10/closing-the-cloud-security-gap/)

### [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Reports](https://www.paloaltonetworks.com/blog/category/reports/?ts=markdown), [Unit 42](https://www.paloaltonetworks.com/blog/category/unit42/?ts=markdown)

[#### Social Engineering on the Rise --- New Unit 42 Report](https://www2.paloaltonetworks.com/blog/2025/07/social-engineering-rise-new-unit-42-report/)

### [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity-2/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Reports](https://www.paloaltonetworks.com/blog/category/reports/?ts=markdown), [Threat Prevention](https://www.paloaltonetworks.com/blog/category/threat-prevention-2/?ts=markdown), [Threat Research](https://www.paloaltonetworks.com/blog/category/threat-research/?ts=markdown), [Unit 42](https://www.paloaltonetworks.com/blog/category/unit42/?ts=markdown)

[#### Top Three Ways Organizations Were Unprepared for Cyberattacks in 2023](https://www2.paloaltonetworks.com/blog/2024/11/top-three-ways-organizations-were-unprepared-for-cyberattacks-in-2023/)

### [AI Security](https://www.paloaltonetworks.com/blog/category/ai-security/?ts=markdown), [Data Loss Prevention](https://www.paloaltonetworks.com/blog/category/data-loss-prevention/?ts=markdown), [Data Security](https://www.paloaltonetworks.com/blog/category/data-security/?ts=markdown), [Product Features](https://www.paloaltonetworks.com/blog/sase/category/product-features/?ts=markdown)

[#### Eight Data Security Problems Finally Solved in the Browser Era](https://www2.paloaltonetworks.com/blog/sase/eight-data-security-problems-finally-solved-in-the-browser-era/)

### [AI Governance](https://www.paloaltonetworks.com/blog/category/ai-governance/?ts=markdown), [AI Security](https://www.paloaltonetworks.com/blog/category/ai-security/?ts=markdown), [Cybersecurity](https://www.paloaltonetworks.com/blog/category/cybersecurity-2/?ts=markdown), [Partners](https://www.paloaltonetworks.com/blog/category/partners/?ts=markdown)

[#### AI, Quantum Computing and Other Emerging Risks](https://www2.paloaltonetworks.com/blog/2025/10/ai-quantum-computing-emerging-risks/)

### Subscribe to the Blog!

Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more.
![spinner](https://www2.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up  
Please enter a valid email.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.  
This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.  
{#footer} {#footer}

## Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)

* [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown)

* [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown)

## Company

* [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)
* [Careers](https://jobs.paloaltonetworks.com/en/)
* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)
* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)
* [Customers](https://www.paloaltonetworks.com/customers?ts=markdown)
* [Investor Relations](https://investors.paloaltonetworks.com/)
* [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)
* [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown)

## Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)
* [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)
* [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)
* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
* [Event Center](https://events.paloaltonetworks.com/)
* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)
* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown)
* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)
* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown)
* [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown)
* [Tech Docs](https://docs.paloaltonetworks.com/)
* [Unit 42](https://unit42.paloaltonetworks.com/)
* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)
* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown)
* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown)
* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown)
* [Documents](https://www.paloaltonetworks.com/legal?ts=markdown)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language