Every year the security industry announces that the threat landscape has changed. In 2026, the more accurate statement is that the economics have changed. Attacks that once required skill are now automated, and attacks that once required infrastructure now rent it by the hour. The result is not exotic new exploits so much as familiar techniques executed at overwhelming scale and polish.
Here is what is actually driving incidents this year, and what to do about each.
1. AI-assisted phishing and social engineering
The tell-tale signs defenders were taught to spot — broken grammar, clumsy phrasing, generic greetings — are gone. Generative models produce fluent, context-aware lures at scale, personalised from scraped public data. Voice cloning adds convincing phone-based pretexting ("vishing") to the mix.
Countermeasure: stop training people to spot typos and start building process resistance. Out-of-band verification for any request involving money or credentials. Phishing-resistant MFA (hardware keys/passkeys) so a convincing lure still cannot harvest a usable second factor. Assume the message is perfect and defend the action behind it.
2. Identity-first intrusions
Attackers increasingly do not "hack in" — they log in. Stolen session tokens, infostealer malware, and MFA-fatigue attacks turn a legitimate identity into the entry point. Once inside a cloud identity plane, lateral movement across email, files, and admin tools is trivial.
Countermeasure: treat identity as the primary perimeter. Short-lived sessions, conditional access based on device trust, separate privileged accounts, and aggressive alerting on impossible-travel and anomalous token use. The credential is the crown jewel now.
3. Ransomware's shift to extortion-only
Encrypting files is increasingly optional. Many groups have moved to data theft plus extortion: exfiltrate first, threaten publication, and skip the noisy encryption step that triggers detection. Backups no longer save you when the threat is disclosure, not deletion.
Countermeasure: reduce the blast radius of any single compromise. Segment networks, minimise data retention (you cannot leak what you never stored), encrypt sensitive data at rest with controlled keys, and monitor for large outbound transfers. Plan incident response around disclosure scenarios, not just recovery.
4. Supply-chain compromise
Why breach a hardened target when you can compromise a dependency it trusts? Poisoned open-source packages, malicious updates, and compromised build pipelines let one intrusion reach thousands of downstream victims.
| Vector | Example impact | Defence |
|---|---|---|
| Malicious dependency | Backdoor in a popular library | Dependency pinning, provenance checks, SBOMs |
| Compromised update | Signed but malicious release | Isolated signing, reproducible builds |
| Build-pipeline breach | Injected code at compile time | Hardened CI/CD, least-privilege runners |
5. The re-emergence of the human layer
As technical controls harden, attackers return to people. Help-desk social engineering — talking a support agent into resetting MFA — has become one of the most reliable enterprise intrusion paths of 2026. It requires no exploit at all.
Countermeasure: strong identity verification for support workflows, callback procedures, and treating account-recovery as a high-privilege operation deserving the same scrutiny as an admin login.
The through-line
None of these are novel in concept. What is new is that automation has removed the skill and cost barriers that used to limit them. The defensive response is correspondingly unglamorous: phishing-resistant authentication, least privilege, network segmentation, data minimisation, and rehearsed incident response.
Security in 2026 is not won by predicting the next exotic zero-day. It is won by making the ordinary attack expensive — because the ordinary attack, executed flawlessly at scale, is what actually gets people.