Public-sector incident research puts retention and trust relationships first

Findings and evidence

Mandiant’s public-sector discussion draws on its 2025 investigations to examine persistent intrusions, virtualization management and interconnected cloud services. It highlights how limited telemetry retention can constrain later reconstruction.

Why it matters

Define retention around investigation needs as well as storage cost. Identity, management-plane and integration records should remain correlatable with endpoint evidence when an incident spans several systems.

Scope and limits

This is a selected public-sector interpretation of Mandiant’s caseload. Findings from investigated incidents should not be generalized as the prevalence or timing of all public-sector attacks.

Primary source

Google / Mandiant: original publication. Source published 2026-07-13. Brief prepared by websec.gr on 26 September 2026. This is an editorial research summary, not a claim of independent replication.