Report by Cognyte
2026 Threat Landscape Report
Key Findings
In 2025, AI enabled attackers to automate up to 80–90% of a specific nation-state espionage campaign.
In 2025, cybercriminal groups led threat activity in North America with 52%.
In 2025, ransomware groups claimed 7,809 victims, a 27.3% year-over-year increase.
In 2025, the U.S. accounted for roughly one-third of global ransomware incidents.
In 2025, the Linux Kernel recorded 2,257 reported vulnerabilities, the highest number among projects.
In 2025, the Lumma infostealer was responsible for 2.2 million dark web listings, roughly 42% of the total.
In 2025, the Qilin group was responsible for 12.8% of ransomware attacks.
In 2025, nation-state activity accounted for 56.6% of threat activity in the Middle East.
In 2025, stolen credentials were linked to 22% of data breaches.
In 2025, nation-state activity accounted for 67% of threat activity in APAC.
In 2025, AI generated 82.6% of phishing content.
In 2025, nearly 50,000 new vulnerabilities were disclosed with an average CVSS score of 6.6.
In 2025, total ransomware payments fell 23%.