The 2.0 percentage points East Asia added over the quarter [3] are not explained by the one category the report singles out in that region. Malicious scripts and phishing pages rose 0.93pp there, to 4.86% [12], which leaves a little under half the regional move sitting in other categories [5]. That arithmetic is deliberately loose: the metric counts ICS computers on which something was blocked, and a single machine can land in several categories, so the parts never sum to the whole. What it does rule out is a reading in which East Asia had a phishing quarter and nothing else, which matches Kaspersky's own note that every threat type except miners rose in the region [4].
Growth rankings and level rankings are also answering different questions. East Asia led the growth tables for scripts and phishing, spyware, viruses and internet-borne threats [4], yet its 4.86% script rate still sits 0.56pp below the 5.42% global average for that category [3]. A region can top the movement charts and remain a below-average place to own an OT asset.
Biometrics is the opposite case: a sector with a level problem. At 26.44% [5] it stands 7.29pp above the global figure [2] and within 1.46pp of Africa, the worst-scoring region in the dataset [8]. It also leads the industry tables for malicious scripts and phishing pages, malicious documents, spyware, ransomware and worms, and it is the only surveyed industry where the email figure exceeds the internet figure [7]. Kaspersky attributes that profile to internet-connected devices, heavy email use for data exchange and approvals such as access granting, and minimal cybersecurity controls at the organisations running the systems [6]. The inverted email-to-web ratio is the part with a budget attached, because it points at the approvals mailbox rather than the browser. Regional and sector effects compound: in East Asia the biometrics script rate reached 9.01%, roughly 1.85 times the regional average for that category [13][4].
Denylisted internet resources are the category to watch structurally. They have risen for two consecutive quarters to 4.31% globally, moving from third place to second and displacing spyware, and they increased in every region [14]. Russia leads at 5.17%, 0.86pp above the global figure [15][6], and inside Russia the concentration is in electric power at 6.61% and in engineering and ICS integration at 5.62% [16]. Those are outbound connections from engineering workstations, not inbound intrusions.
The report states that the global average is falling across all selected industries [8] without offering a cause, so the decline supports no inference about attacker effort. It also coexists with increases in denylisted resources, malicious documents, worms, ransomware and AutoCAD malware [10], and with 10,904 distinct malware families blocked on industrial systems in the quarter [9]. Malicious documents had declined for three straight quarters to a three-year low before turning back up to 1.77% [17], with South America adding 1.35pp to reach 3.56%, its fourth-highest figure in three years [17][18]. The gap between Africa and Northern Europe is 19.8pp, or a factor of about 3.4 [1], which is wider than the global number itself would suggest is possible.
