The 2026 threat landscape: who attacks, why and how
Lesson 2 of 6
2The 2026 threat landscape: who attacks, why and how
The big pictureEvery year Verizon analyses more than 22,000 confirmed breaches in 145 countries, and IBM works out what each one cost. These numbers are not for memorising; they decide where you spend your time and money on protection.
What the picture shows: Out of every 100 breaches: 62 involve a person, 48 involve ransomware, and 31 began by exploiting a flaw, overtaking stolen credentials (13) for the first time.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Picture the crime report for your city: which areas are riskiest, which doors burglars usually use, and how much victims lose. The yearly security reports are that bulletin for the digital world, and this year they say: burglars mostly come in through "broken doors" whose owners forgot to fix them.
DBIR 2026: exploitation is 31% of initial access against 13% for credentials, the human element 62%, ransomware 48% (69% of victims did not pay), third-party involvement 48%. Only 26% of critical CISA KEV flaws were fully fixed, with a median of 43 days. IBM 2026: average cost USD 4.99M (+12%), about SAR 27M in Saudi Arabia, a 247-day breach lifecycle, defensive AI saved 1.93M and cut 65 days, and 67% used AI tools on personal accounts (shadow AI).
Before You Start
🛡️What is cybersecurity?
You know what threat, vulnerability and risk mean.
The Core Idea
1What do the 2026 numbers say?
The headline this year: exploiting flaws became the top way attackers get in (31%), overtaking stolen credentials for the first time. The reason is that organisations patch slowly: only a quarter of known critical flaws were fully fixed, with a median of 43 days, while attackers start within days.
And the price keeps rising: the average cost of a breach hit a record, and breaches that go over 200 days before discovery cost clearly more. On the other side, organisations using automation and AI in defence saved close to two million dollars and cut two months off the cycle.
2Who attacks, and why?
Knowing the attacker's motive tells you what they will go after. Money is behind most attacks, but it is not the only motive.
| Attacker | Motive | Example |
|---|---|---|
| Cybercriminals | Money | Ransomware gangs, card theft |
| State-backed groups | Spying, influence, sabotage | Long-term intrusions (APT) into infrastructure |
| Hacktivists | A political or social message | Defacing sites, denial of service |
| Insiders | Revenge, money or carelessness | An employee leaks data or is tricked |
3The best-known attacks in one line
| Attack | The idea |
|---|---|
| Ransomware | Encrypt and steal the victim's files, then extort payment or threaten to publish |
| Phishing | A fake message that steals a password or runs malware |
| Malware | Viruses, self-spreading worms, trojans, spyware |
| DDoS | Flooding a service from thousands of machines until it stops |
| Supply chain | Breaking into a supplier or library to reach its customers |
| Credential stuffing | Trying passwords leaked from one site on others |
Ransomware today is double extortion: the attacker steals data before encrypting it, so even if you restore from backups they threaten to publish it. That is why backups alone are no longer enough, and stopping the entry and watching data leaving matter just as much.
4The supply chain and shadow AI
Your security does not stop at your borders: a third party was involved in nearly half of breaches. A compromised npm library, an IT support vendor with access to your servers, or a cloud tool you trust. And a new risk appeared: staff pasting work data into AI tools on personal accounts, outside the company's oversight.
Worked example
The task: a small company can afford only three measures this year. Based on the 2026 numbers, what do you pick?
The answer: (1) fast patching of internet-facing systems first, guided by the list of actually exploited flaws, because exploitation is the top way in. (2) MFA on email and the VPN, because people and stolen credentials feature heavily. (3) an offline, tested backup, because ransomware shows up in about half of breaches.
Myth vs Reality
| Myth | Reality |
|---|---|
| Big attacks only hit big companies. | Automated attacks look for the flaw, not the name; small companies are easier because they are less protected. |
| Paying the ransom gets everything back. | There is no guarantee the decryption key works or the stolen data is deleted, and 69% of victims in 2026 did not pay. |
Where you meet it at work
📊Security manager
Builds the year's plan on report numbers, not on headlines.
📰At home
You read news of a breach and know what kind it is and why it happened.
Test your understanding
According to the Verizon DBIR 2026, what is the most common initial access?
Exploitation reached 31%, overtaking stolen credentials (13%), so patching is a priority.
Why are backups alone no longer enough against ransomware?
That is double extortion: restoring fixes the encryption, but it does not stop the leak.
What usually separates a "nation-state" attacker from an "organised crime" one?
The motive decides the target, the method and the patience.
An attack that came in through a trusted software update used by thousands of companies is a:
It hits many victims through a third party they trust.
Why do we care about the numbers in reports like the DBIR?
Exploitation, credentials and the human element set defence priorities.
Quick review cards
Check Your Understanding
How do a cybercriminal and a state-backed group differ in their goal?
The first wants money fast; the second wants spying or sabotage and stays inside the network for a long time unnoticed.
Why is the time to discover a breach tied to its cost?
The longer the attacker stays, the more they steal and the further they spread, so clean-up, losses and fines grow.
Why has exploitation risen as the first way in?
Because internet-facing systems are many and patching is slow, and attackers exploit a flaw within days of it going public.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.