Report by ExtraHop
The 2026 ExtraHop Global Threat Landscape Report
Key Findings
31% of security and IT leaders identify agentic/API logic failures as security incidents tied to AI systems.
27% of security and IT leaders report undetermined baseline behavior enables anomalous actions to go undetected, delaying critical alerts.
Average ransom payment dropped to $2.8 million, down from $3.6 million in 2025.
83% of ransomware victims paid a ransom, up from 70% previously.
Downtime per incident averaged almost 30 hours.
85% of security and IT leaders identify security incidents, data exposures, or near misses where the root cause is an AI system.
35% of security and IT leaders identify shadow AI exposure as security incidents tied to AI systems.
38% of security and IT leaders report attacker activity mirrors legitimate, authorized workflows and processes, delaying critical alerts.
30% of security and IT leaders report alert fatigue causes initial detections to be deprioritized, delaying critical alerts.
Security teams require mid-to-high levels of manual intervention for detection, at 42%.
Security teams require mid-to-high levels of manual intervention for alert triage, at 43%.
Security teams require mid-to-high levels of manual intervention for investigation, at 49%.
SOC analysts spend just 44% of their time on proactive efforts like threat hunting and detection engineering.
30% of security and IT leaders report AI-generated alerts produce false positives that negatively impact investigation timelines.
40% of security and IT leaders identify AI-enhanced external attacks as security incidents tied to AI systems.
38% of security and IT leaders identify compromised AI identity and session theft as security incidents tied to AI systems.
36% of security and IT leaders identify third-party vendor or supply chain breaches involving integrated AI or agents as security incidents tied to AI systems.
Adversaries maintained access to enterprise networks for nearly 2.5 weeks on average before being detected in ransomware incidents.
49% of organizations did not detect the threat until after data is stolen, up from 31% the previous year.
14% of organizations were unaware of an attack until they receive a ransom demand, compared to 6% the previous year.
34% of security and IT leaders report adversaries use valid, high-privilege account permissions, delaying critical alerts.
55% of security and IT leaders cite AI agents, agentic infrastructure, and Gen AI applications as the biggest cybersecurity risk to their organization.
Security teams require mid-to-high levels of manual intervention for response, at 47%.
41% of security and IT leaders report attackers use encrypted channels to bypass detection, delaying critical alerts.