Coordinated cyberattacks outpace defenses in organizations
Digital attacks no longer arrive alone: they move in coordinated waves, powered by artificial intelligence and human precision.
The new threat landscape reveals why defending organizations today is more complex than ever.
Invisible fear has become a daily reality in organizations. It is not just about vulnerable systems, but the certainty that, at some point, someone is already probing for entry.
In an environment where digital attacks advance at unprecedented speed and with sophisticated coordination, cybersecurity faces one of its greatest challenges: adapting to adversaries who no longer act in isolation, but as fully integrated operations.
This is highlighted in the 2026 Cybersecurity Report, based on direct analysis of global attack activity involving artificial intelligence (AI), ransomware, hybrid environments, and multichannel social engineering.
The report identifies a measurable shift in how attackers operate, coordinate, and escalate within enterprise environments, outpacing traditional defense models. Data shows that current campaigns deliberately combine AI, identity abuse, ransomware, perimeter infrastructure, and human interaction.
This technological convergence enables faster, harder-to-isolate attacks that move more quickly than most security programs are designed to manage.
AI: from business tool to attack vector.
The rapid adoption of AI in organizations has outpaced the implementation of adequate security controls. As a result, attackers have integrated this technology throughout the attack chain.
Within a three-month period, 90% of analyzed organizations encountered AI requests considered risky; one in 48 was classified as high risk, and more than 16% exhibited signs of data exposure, privilege abuse, or indirect manipulation of requests.
These critical incidents did not occur in test environments but within business workflows, customer service systems, and internal productivity tools. Furthermore, AI infrastructure itself has become a target.
An analysis by Lakera, a Check Point company, of approximately 10,000 Model Context Protocol (MCP) servers found security vulnerabilities in 40% of them. Today, AI systems form the operational core of organizations, and when they fail, the impact is large-scale.
Ransomware: more fragmented, faster.
During 2025, ransomware continued to grow in volume but with a different structure. Operations fragmented into smaller, automated, and specialized units, many of them supported by AI.
This shift led to more attacks, shorter dwell times within systems, and greater operational pressure on security teams. The report documents a 48% year-on-year increase in extortion victims and a 50% rise in new ransomware-as-a-service groups, in a context where reputation-based models are losing effectiveness.
Smaller, decentralized groups now dominate activity. Ángel Salazar, Channel Engineering Manager for Latin America at Check Point Software, states:
“AI is increasingly used to enhance target selection, negotiation, and pressure operations, especially in extortion scenarios based solely on data. More than half of known ransomware victims were located in the United States.”
Most of these attacks do not rely on novel vulnerabilities but on pre-existing access and the ability to act quickly once inside systems.
Hybrid environments: an advantage for attackers.
Operational expansion remains one of the main risk factors. As organizations combine on-premises devices, cloud services, and perimeter infrastructure, the attack surface grows.
The report notes that peripheral and unmanaged devices are increasingly used as initial access points and as bases from which attackers blend into legitimate network traffic.
In many cases, credential harvesting and lateral movement begin before defense teams detect anomalous behavior. Hybrid complexity ceases to be only a management challenge and becomes an operational advantage for adversaries.
Cyber operations and conflict.
During 2025, cyber operations became more visibly integrated into conflict contexts. Observed campaigns combined attacks on civilian systems, cloud services, and physical infrastructure, while AI accelerated influence operations and narrative manipulation. Civilian workspaces were used to undermine public trust and daily operations.
Beyond email.
Although email remains the primary channel for delivering malicious files, it no longer acts alone. 1.46% of all emails with attachments received by organizations were malicious.
Email accounted for 82% of these deliveries, compared with 18% for web-based attacks. Additionally, ClickFix activity grew by nearly 500%, and telephone impersonation emerged as a targeted intrusion technique in corporate environments.
Attackers now coordinate multiple channels—email, web, phone, and collaboration platforms—to manipulate users and bypass technical controls.
A clear message for 2026.
The report shows an 18% year-on-year increase in cyberattacks and a 70% rise since 2023. By 2025, organizations faced an average of 1,968 attack attempts per week.
The education sector recorded the highest volume, while healthcare, government, energy, automotive, hospitality, and agriculture experienced significant increases. Beyond the numbers, clear evidence points to a pattern: attackers combine speed, automation, and trust to scale their operations.
For security leaders planning the year ahead, the message is straightforward: attacks are already coordinated, exposure is measurable, and the next step is defining the response.
|
|
