Fortinet Predicts AI-Driven, Industrialized Cybercrime Will Accelerate Attacks in 2026
Summary
FortiGuard Labs predicts cybercrime will further industrialize in 2026, with AI, automation, and specialized services speeding attacks and data monetization. It urges defenders to integrate threat intelligence, identity controls, exposure management, and response.
Key points
- FortiGuard Labs predicts that purpose-built autonomous agents will take on tasks such as credential theft, phishing, and lateral movement with less human oversight.
- The report expects AI to help criminals analyze stolen data, prioritize victims, and tailor extortion or resale operations more quickly.
- It predicts that botnets and access brokers will provide ready-made infrastructure for ransomware and data-exfiltration campaigns, including attacks on operational technology.
- The report warns that criminal groups may repurpose destructive techniques such as firmware corruption and device bricking for financial leverage.
- It says human and non-human identities will become a central security control and recommends unique credentials, least privilege, time-limited access, and behavioral monitoring.
- For defenders, it recommends connecting threat intelligence, continuous threat exposure management, and incident response, using integrated security operations to speed detection and containment.
- The report expects greater public-private and law-enforcement collaboration, alongside education and intervention efforts intended to deter cybercrime recruitment.
Article Details
- Publisher
- FortiGuard Labs (Fortinet)
- Report Period
- 2026 predictions; published 2025-11-13
- Scope
- Global cyberthreat predictions, including cybercrime operations and defensive capabilities
- Key Statistics
- The report cites a World Economic Forum estimate that the average annual cost of cybercrime is expected to exceed $23 trillion by 2027.
- Recommendations
- Integrate threat intelligence, exposure management, and incident response into a continuous operational system.
- Apply least-privilege and time-bound access controls to human and non-human identities.
- Monitor identity behavior across EDR, NDR, SIEM, SOAR, and CNAPP platforms.
- Enforce governance, auditing, and privacy controls for automated identities interacting with sensitive or regulated data.
- Use continuous exposure discovery, validation, and remediation to support faster detection and containment.
Tools
Industries
Healthcaresimultaneously . Critical infrastructure and healthcare remain disproportionately affected, particularly in areas whereManufacturingmanufacturing, healthcare, and utilities. The Ransomware-as-a-Service (RaaS) model is already expanding into OTUtilitiesmanufacturing, healthcare, and utilities. The Ransomware-as-a-Service (RaaS) model is already expanding into OT