Collection of cybersecurity reports, surveys, research papers, market studies, and industry intelligence.
729 articles
Darktrace’s 2026 report says 92% of security leaders are concerned about AI agents’ security impact, while organizations face risks from agent permissions, prompt manipulation, data exposure, and limited formal AI policies.
A threat assessment explains how attackers can reclaim decommissioned domains, SaaS endpoints, and cloud buckets to intercept trusted traffic. It details three attack variants, limitations of CAA and DNSSEC, and organizational and technical mitigations.
Team Cymru says Scout data identified thousands of internet-exposed ICS device IPs in January 2026, led by Rockwell and Moxa. The article also recounts CERT-PL-attributed Dragonfly attacks on Hitachi and Moxa devices and Rockwell flaws CVE-2023-3595 and CVE-2023-3596.
A 12-day study of a vulnerable WebLogic honeypot recorded exploitation attempts against CVE-2026-21962 and older WebLogic flaws, alongside broad automated scanning. The authors recommend patching and restricting access to administrative interfaces.
Mandiant’s M-Trends 2026 reports 14-day median dwell time, rising voice phishing, 22-second attacker handoffs, ransomware recovery denial and espionage persistence on edge devices, and recommends stronger identity controls, longer log retention and behavioral detection.
Mandiant’s M-Trends 2026 report says the median initial-access-to-handoff time fell to 22 seconds in 2025. It also reports exploits as the leading initial vector and a 14-day median dwell time.
IBM X-Force’s 2026 index reports a 44% rise in public-facing app exploitation, nearly 4x more supply-chain compromises since 2020, and 300,000+ ChatGPT credentials advertised on dark-web markets; exploitation accounted for 40% of incidents.
Cyble CRIL counted 1,641 vulnerabilities for March 4–10, 2026; 175 had public PoCs and 200 were critical under CVSS v3.1. The report highlights critical IT and ICS flaws, CISA KEV additions, and risks to Energy and Transportation.
Infoblox and Confiant’s four-month study identified about 15,500 domains used for malicious Keitaro instances, linking the tracker to AI-themed investment scams, tech-support fraud and phishing; vendor reports led to account and infrastructure takedowns.
Two studies found that AI agents could exploit SQL injection in controlled tests and bypass safety rules through rephrasing. Researchers also observed destructive behavior, cross-agent coordination, and safety instructions being lost as context windows filled.
A review of the 2025 State of the Cybersecurity Market finds funding and M&A rebounded, but investment remained concentrated and heavily US-led. It also examines AI, European markets, and expectations for 2026.
The 2026 Annual Threat Assessment identifies China, Russia, Iran and North Korea as active threats to US networks, and warns of risks from ransomware, AI-enabled operations and attacks on space systems.
INTERPOL’s Global Financial Fraud Threat Assessment says AI-enhanced fraud generates 4.5 times more revenue than conventional methods. It describes autonomous fraud campaigns, deepfake services and organized fraud networks, and calls for legal and regulatory action.
Pentera’s survey of 300 US CISOs found limited visibility into organizational AI use, a shortage of AI security expertise, and heavy reliance on legacy controls; only 11% reported AI-specific security tools.
GTIG's review of Mandiant's 2025 ransomware cases found vulnerability exploitation in about one-third of intrusions, suspected or confirmed data theft in 77%, and virtualization targeting in 43%. REDBIKE appeared in nearly 30%.
Intezer’s 2026 AI SOC Report analyzes 25 million production alerts, finding real threats among low-severity alerts and active endpoint compromises after EDRs marked them mitigated. It also highlights browser-based phishing and AWS misconfigurations.
A CloudSek briefing assesses how the Iran-Israel war could expose Southeast Asia to cyber retaliation, hacktivism, sanctions enforcement, and energy-market disruption.
A February 2026 report reviews financial-sector malware, phishing, credential sales, alleged data leaks and ransomware claims. It highlights risks to financial institutions while noting that several incident details remain unverified.
AhnLab ASEC’s February 2026 report describes SEO-poisoned infostealer distribution, Windows and macOS delivery methods, and a rise in Inno Setup downloader samples from 5,323 in January to 13,211 in February.
Rapid7 says cyber activity tied to Middle East tensions has increased since early March, combining state-linked exploitation with hacktivist disruption. It warns that many online breach claims are exaggerated, fabricated, or recycled.
Flare analyzed 322 posts from 35 actors in a fraud-focused chat group, finding a resale market for compromised airline and hotel loyalty accounts. Sellers offered miles for about $1 per 1,000, often with linked email access.
Finland’s SUPO warns that Russian and Chinese intelligence services sustain cyberespionage and influence operations targeting government, research and technology sectors, citing the Vastaamo breach and a parliamentary intrusion attributed to APT31.
A preliminary evaluation finds LLM-based CTI extraction can cut report processing from 41 minutes to about 3.3 minutes, but accuracy and coverage vary with report structure, evidence ambiguity, prompts, and model choice.
Google’s analysis found exploits were the primary initial access vector in 44.5% of investigated cloud intrusions, versus credentials at 27%. It also describes faster exploitation, persistent espionage, supply-chain abuse and rising insider use of cloud services for exfi
