Check Point

Microsoft was the most impersonated brand in Q2 2026, appearing in 23% of all brand phishing attempts.

The top five impersonated brands — Microsoft, LinkedIn, Google, Apple, and Amazon — together accounted for more than 50% of all brand phishing attempts this quarter.

Open AI’s ChatGPT entered the top ten most impersonated brands for the first time.

High-risk enterprise AI prompts doubled over the year, increasing from about 1 in every 50 interactions to 1 in every 25 interactions.

Highly trained reviewers correctly detected approximately 41% of AI-generated faces.

Between 87% and 93% of organizations experienced at least one high-risk AI interaction each month.

Only 7.8% of vulnerability alerts warrant Critical or High attention after exploitability validation, so more than 90% do not require immediate remediation focus.

Phishing websites account for 10.5% of critical exposures, up sharply from 1.0% the year before.

76% of all critical exposures come from just two categories: vulnerabilities and internal information disclosure.

52% of AI workloads span hybrid environments

78% of organizations report confirmed or suspected AI-related security incidents over the past year

64% of organizations say their architecture needs redesign to support AI workloads

1 in every 28 GenAI prompts posed a high risk of sensitive data leakage in March 2026 and 91% of organizations using GenAI tools regularly were impacted by this risk.

The education sector was the most targeted industry in March, experiencing an average of 4,632 cyber-attacks per organization per week, a 6% decrease year over year.

In March 2026, 672 ransomware attacks were reported globally. This represents an 8% decrease year over year, yet a 7% increase compared to February

Clop accounted for 13% of published attacks in February.

Telecommunications was the third most targeted sector, averaging 2,699 weekly attacks per organization, up 6% year over year.

Organizations used an average of 11 different GenAI tools in February.

The top malware list for Latin America includes 3 RATs, 2 Botnets (FakeUpdates, Androxgh0st), and 1 Downloader (FakeUpdates).

The global weekly average for cyber attacks is 1,955.

62% of malicious files in Latin America were delivered via email in the last 30 days.

The average organization runs ten AI applications per month.

Detections of long, malicious prompt-injection payloads increased roughly fivefold between March and May 2026.

Vulnerabilities account for 78.2% of critical exposures in Utilities.

Vulnerabilities account for 56.4% of critical exposures in Government.

Internal information disclosure accounts for 63.6% of critical exposures in Healthcare.

Internal information disclosure accounts for 42.7% of critical exposures in Financial Services.

Healthcare records the slowest median remediation time at 158.8 hours.

42.6% of all critical exposures are vulnerabilities, more than double the 18.7% recorded the year before.

Utilities resolve 30% of critical exposures within one hour.

76% of organizations rate datacenter security as critical for AI

71% of organizations report increased web application firewall (WAF) false positives

88% of organizations say AI has increased security complexity

67% of organizations report fragmented security policies

24% of organizations cannot confirm whether they experienced an AI-related security incident due to lack of visibility

48% of organizations cite non-human identities (AI agents, APIs) as a top concern

24% of organizations say they have no AI-specific access controls

78% of organizations have either experienced an AI-related security incident or cannot determine whether they have

There is a 51-point gap between organizations' intent to secure AI in the cloud and their capability to enforce that security

26% of organizations report having the architecture to enforce their AI-related cloud security strategy

16% of organizations enforce AI access controls consistently across the environment

86% of leaders rate unified security management across cloud, datacenter, and edge as critical for AI workloads

35% of organizations say their datacenter security can support current AI needs

77% of organizations have updated their security strategy for cloud in response to AI

24% of organizations can fully inspect AI traffic without impacting performance

54% of organizations have experienced an AI-related security incident

North America was the most affected region by ransomware in March 2026, accounting for 55% of reported incidents, followed by Europe at 24% and APAC at 12%.

The average number of weekly cyber-attacks in March per organization reached 1,995, representing a 4% decrease month over month and a 5% decline compared to March 2025.

Business services remained the most targeted sector by ransomware in March 2026, accounting for 35% of ransomware victims, followed by consumer goods & services (14%) and industrial manufacturing (13%).

Hospitality, Travel & Recreation recorded a 30% year-over-year increase in attacks in March 2026.