2026 Global Threat Intelligence Report

Zero-day vulnerabilities are being mass exploited in as little as 24 hours after discovery.

Ransomware-as-a-Service (RaaS) groups were responsible for over 87% of all ransomware attacks.

In 2025, one in three vulnerabilities (33%) had publicly available exploit code.

Vulnerability disclosures increased by 12% between January 2025 and December 2025.

AI-related illicit discussions increased by 1,500% between November and December 2025.

Ransomware incidents increased by 53% between January 2025 and December 2025.

3.3 billion compromised credentials and cloud tokens make identity the primary exploit vector.

Over 11.1 million machines were infected with infostealers in 2025.