Italian organizations account for about 7% of initial-access data sold on cybercriminal forums in Intel471’s research, second only to the United States at 30%, according to Dark Reading. The distinctive finding is how brokers gained entry: vulnerability exploitation accounted for 57% of Italian cases, compared with 23% involving credentials.
The findings put exposed software and web infrastructure at the center of the Italian picture. But the reasons remain hypotheses. Intel471 points to slower patching, opportunities to reuse exploitation methods across organizations, and Italy’s large population of small businesses as possible explanations.
Vulnerabilities dominate the Italian findings
Dark Reading reported the findings from an Intel471 report shared ahead of its release. Initial access brokers obtain footholds in organizations and sell that access to other criminals. Their listings describe a market for compromised access; they are not a census of every cyberattack.
In the Italian data, 49% of access sales involved victim-owned web infrastructure, while remote access and remote desktop tools accounted for 26%. Italy also ranked fourth among countries most targeted by ransomware, according to the research.
The pattern differs sharply from Intel471’s global figures for 2025, published in its 2026 Cyber Threat Trends & Outlook report. Globally, remote access and remote desktop tools represented 67% of broker listings. Credentials were advertised as the attack type in 49% of listings, while exploited vulnerabilities appeared in 6.5% of cases.
Those comparisons describe different datasets. They do not establish why Italian organizations appear so prominently in the access market.
Bulk sales suggest repeatable compromises
Intel471 cybercrime analyst Gianluca Tiepolo told Dark Reading that 90% of Italian initial-access offers were “wholesale” offers. He characterized these as the result of broad vulnerability exploitation rather than operations specifically targeting Italy.
Tiepolo’s assessment is that Italian organizations patch more slowly than those in other countries. He also described historically slower adoption of security technology, saying endpoint detection and response tools became popular in Italy around 2020–2021. These are proposed explanations for the findings, rather than demonstrated causes.
A related hypothesis is that common technologies and unresolved vulnerabilities allow criminals to reuse a working exploitation method across many exposed businesses, reducing the effort needed for each compromise. Researchers did not identify the particular technologies or vulnerabilities that would establish this explanation.
Milan-based security company Cleafy told Dark Reading it had observed attackers reusing tools, infrastructure and techniques across Italian banking targets. Cleafy explicitly cautioned that those observations do not establish a disproportionately large Italian initial-access market.
Italy’s business composition offers another possible explanation. Dark Reading cited an OECD report stating that SMEs made up 99.9% of Italian firms in 2023, with micro-enterprises accounting for 94.8%. Tiepolo said Intel471’s extortion data showed disproportionate targeting of small and medium-sized businesses, which could help explain Italy’s prominence.
The research therefore highlights vulnerability-driven access sales and bulk compromise as the central findings. Slower patching, reusable attacks and the business mix remain explanations to investigate, rather than settled causes.
