And that’s a wrap, the report is worth a read. You should balance it out with something like Sophos yearly report too - Mandiant is expensive, Sophos has SMB data.
The long story short about why GenAI is missing from all of the data is vendors have blown the threat wildly out of proportion - AI is porn for execs - and why build a rocket launcher when you can just pick up the key from under the front door mat. Concentrate on security fundamentals, threat actors want you to be distracted.