1. AI-Powered Threats and Automated Escalation

Generative AI tools have automated social engineering by eliminating spelling errors, regional phrasing bugs, and awkward syntax from phishing campaigns. Threat actors now leverage highly customized, scalable LLM models to build persuasive lures once restricted to well-resourced espionage syndicates.

• The AI Breach Multiplier: Generative AI models are utilized in roughly 16.6% (1 in 6) of confirmed corporate data breaches, primarily deployed to generate convincing deepfake identities and automated phishing funnels.
• The Financial Tail Risk: While the worldwide cost baseline stands at $4.44 million per breach, the economic impact inside the United States has hit an all-time high of $10.22 million. This environment means even a localized compromise can threaten the survival of an SMB client.
• Credential Stuffing Acceleration: AI-driven credential stuffing bots run continuous login loops against cloud endpoints, resulting in an average of 31% of users across monitored environments showing credential exposure in any given month.
• Industrialized Spray Campaigns: Automated password spraying campaigns utilize more than 14,000 unique source IPs each month, with infrastructure footprints scaling at a month-over-month rate of 13%. This indicates a shift toward automated, highly coordinated attacks.
• The Evolving Phishing Blueprint: Attackers use AI automation across 15 or more distinct tactical execution paths. Threat hunting frameworks have shifted away from identifying basic typos to evaluating advanced typography anomalies, including structural patterns like proper em dash syntax.

2. Identity Exploit Vectors and Session Theft

As organizations enforce basic perimeter configurations, identity security has overtaken endpoint monitoring as the primary focus of corporate defense. Threat actors focus heavily on abusing valid, authenticated sessions rather than trying to brute-force complex passwords.

• The Exposure Baseline: The presence of at least one verified credential compromise stands as a permanent condition for 89% of small and mid-sized corporate directory landscapes.
• Continuous Perimeter Pressure: Unauthorized or unauthenticated connection attempts represent approximately 28% to 30% of global corporate sign-in traffic, maintaining a steady baseline across all deployment regions.
• The Token Hijacking Pivot: Session hijacking has grown by 23% over a 180-day window, establishing it as the fastest-accelerating identity risk factor. Adversaries deploy Adversary-in-the-Middle (AiTM) frameworks to capture valid session tokens, bypassing traditional Multi-Factor Authentication (MFA) prompts entirely.
• The Human Factor Challenge: Despite software vulnerability exploits serving as a leading initial entry vector, credential abuse occurs in 13% of downstream breaches, and human interactions are involved in 62% of corporate compromises overall.
• Industrialized Connection Routing: Threat groups route authentication attempts through known-malicious hosting infrastructure and compromised VPN endpoints, causing these malicious connection attempts to scale by 50% over a 120-day monitoring window.
• Geographic Incident Clustered Mapping: Geographically, the United States accounts for 75.4% of all recorded AiTM proxy phishing incidents. This distribution points to a dense concentration of target assets and a highly developed Phishing-as-a-Service (PaaS) marketplace focused on North American corporate frameworks.

3. Email Manipulation and Business Email Compromise (BEC)

Email platforms remain a primary vector for financial fraud. Once an attacker compromises an identity, they frequently use quiet mailbox configuration changes rather than malware execution to divert financial transactions.

• The Scope of Extortion Loss: Business Email Compromise accounts for over $2.77 billion across 21,442 formalized complaints to the FBI IC3, making it the second most expensive cybercrime category globally.
• SMB Loss Metrics: Confirmed BEC incidents targeting mid-tier corporate architectures range from $140,000 to $1.5 million per event, a loss level that directly impacts corporate solvency.
• Defensive Containment Spikes: Automated messaging systems triggered a 240% increase in email isolation actions to counter inbound fraud. This activity is paired with a near 100% expansion in malicious mailbox rule changes by threat actors seeking to maintain long-term access.
• Abusing Mailbox Rules for Persistence: Rogue inbox modifications (mapped directly to MITRE ATT&CK technique T1098.003) serve as a primary method for sustaining access. In the United States, 304 unique instances showed a 13-fold increase in malicious rule generation, used by attackers to hide administrative alerts and delete vendor payment queries silently.
• Impersonation via SendAs Privileges: Telemetry logs caught nearly 2 million unique SendAs execution requests, a clear indicator of widespread email impersonation where attackers hijack trusted internal addresses to route fraudulent invoice updates.

4. Ransomware Tactics and Endpoint Exploitation

Ransomware remains a highly disruptive threat to operational continuity, with attackers increasingly shifting toward “Living-off-the-Land” (LotL) tactics that turn an MSP’s own management utilities against client networks.

• The Extortion Divide: Ransomware occurs in 48% of enterprise breaches, up from 44% in prior reporting years. This growth comes even as median global payouts drop to $139,875, and only 31% of victims choose to comply with extortion demands.
• SMB Targeting Metrics: Ransomware is present in 88% of small and mid-sized business breaches, proving that SMBs serve as primary targets rather than secondary collateral damage.
• The True Impact of Operational Downtime: The financial impact of network downtime can run up to 50 times the cost of the ransom demand itself, proving that lost operating days and recovery friction are the real drivers of incident costs.
• Accelerating Pre-Encryption Sign Zones: Behavioral analytics engines caught a 190% increase in pre-encryption footprint indicators over a tight 50-day observation window, confirming that early-stage attacker discovery behavior is highly visible.
• Weaponizing RMM Architectures: Remote Monitoring and Management (RMM) tool manipulation represents the largest endpoint threat category, accounting for 26.2% of all endpoint security events. Attackers focus heavily on hijacking the trusted tools MSPs use to manage client environments.
• The Transition to Fileless Attacks: Traditional signature-dependent malware detections dropped by 55% during the same window that malicious behavioral anomalies scaled up. This shift confirms a widespread move toward fileless attacks that easily bypass standard file-scanning controls.
• Holiday Vulnerability Fluctuations: Ransomware events spiked to 8.2% of all recorded infrastructure threats in December, nearly doubling the historical 180-day baseline. This aligns with a long-running industry trend where threat actors time campaigns to holiday periods when engineering and security staffing levels are typically thin.

5. Cloud Multi-Tenant Environments & SaaS Risks

The shared cloud collaboration space has become a key target for data exfiltration and persistent backdoors, with attackers moving beyond traditional credentials to exploit application integration tokens.

• The OAuth Consent Abuse Surge: Malicious OAuth consent requests grew by 45% between October and January, followed by an additional 24% increase from January to February. Attackers leverage these persistent application tokens to maintain administrative access that completely survives a user password reset.
• Cross-Platform Infrastructure Abuse: Cross-platform exploitation drove a 2,000% increase in Google Workspace OAuth permission abuse, alongside 125,983 verified high-risk Google Workspace sign-ins. Securing a single cloud provider is no longer sufficient to protect a multi-tenant environment.
• The Microsoft Teams Phishing Vector: Collaboration tools are heavily leveraged as primary phishing channels, with over 3.1 million malicious link-bearing messages routed through Microsoft Teams over a 180-day window. This traffic bypasses the traditional SPF, DKIM, and DMARC verification layers designed to guard enterprise email.
• Defensive Budget Reallocation: Driven by these cloud vulnerabilities, cloud security spending has climbed by 28.8% year-over-year, making it the fastest-growing subsegment of global technology infrastructure spending.

6. Strategic H2 2026 Projections

As the industry moves through the second half of the year, security budgets and risk management strategies are adjusting to counter these automated threat trends:

• Managed Security Market Trends: Total worldwide information security spending is projected to reach $244.2 billion, representing a 13.3% year-over-year expansion. Managed security providers are seeing rapid growth as a widespread talent shortage drives organizations to outsource specialized security functions.
• The MSP Supply Chain Concentration Risk: Telemetry indicates that 98% of organizations would experience severe, immediate operational exposure if their primary MSP infrastructure were compromised or suddenly went offline. This systemic single point of failure explains why extortion syndicates are intensifying their focus on the managed services supply chain.
• The Incomplete Passkey Transition: While 68% of forward-looking organizations have deployed or are actively testing passwordless FIDO2 passkey architectures, 57% of daily business access still relies on traditional, phishable authentication methods. This deployment gap ensures that credential harvesting and session hijacking will remain dominant threat vectors for the foreseeable future.