QNAP Newsroom

Taipei, Taiwan, October 22, 2026 – In support of Cybersecurity Awareness Month this October, QNAP® Systems, Inc., a leading provider of storage, networking and data protection solutions, today released its Global Enterprise Cyber Resilience Report 2026. Drawing on self-assessments from 1,838 organizations across 93 countries, the report revealed that half of respondents (922 organizations) fall into the "Developing" or "High Risk" maturity tiers. The findings indicate that many organizations continue to treat data backup as the finish line rather than building systematic resilience against evolving ransomware and supply-chain attacks.

The survey evaluated eleven controls across four stages: data protection and backup, identity and access control, threat monitoring and active defense, and business continuity and recovery. Key findings include:

• The illusion that backup equals security: 83% of surveyed organizations keep offsite backups, yet nearly half of this group (49%, or 896 organizations) leave these backups online around the clock without immutable or deletion protection. In the event of compromised administrator credentials, attackers can delete, alter or encrypt these backups.
• Identity as a primary vulnerability: 24% of enterprises protect core storage using only basic usernames and passwords. According to the Verizon Data Breach Investigations Report, credential abuse is the most common initial access vector.
• Internal networks remain unmonitored blind spots: 29% of organizations lack internal threat detection, and only 13% deployed enterprise-grade detection, the lowest score among all eleven evaluated controls. Undetected intruders can move laterally before stealing or encrypting critical data.

"What stands out most in these findings is that while most organizations are aware of security risks, many have invested resources without aligning them to how attackers actually operate," said Jack Liou, CEO of QNAP. “Organizations already understand the need for backups. What truly determines whether they can withstand an attack is whether those backups are insulated from deletion, whether internal network threats are intercepted proactively, and how quickly core operations can recover.”

QNAP recommends that organizations assess their security maturity and prioritize one to three high-impact controls across four key areas:

• Data Protection and Backup: Automate offsite backups with HBS 3 and isolate backup copies with Airgap+. Enable WORM immutable storage in QuTS hero to ensure backups cannot be deleted or altered, even by attackers with compromised administrator privileges.
• Identity and Access Control: Enforce multi-factor authentication (MFA) and role-based access control (RBAC) to block credential-based intrusion and contain potential damage from any single compromised account.
• Threat Monitoring and Active Defense: Deploy ADRA NDR X to illuminate internal network blind spots invisible to traditional endpoint detection and response (EDR). The agentless solution detects lateral movement, lures out hidden threats using Threat Trap deception technology, and automatically isolates compromised devices.
• Business Continuity and Recovery: Leverage QNAP High Availability (HA) architecture to reduce Recovery Time Objectives (RTO) from days or hours to near-seamless failover.

Download the full report at: QNAP Global Enterprise Cyber Resilience Report 2026