2026: The Threats That Matter

There is little doubt that 2026 has been marked by a significant increase in threat activity across both the cyber and physical domains. For European organizations, much of this increase can be traced back to the wider confrontation between Russia and Europe following Russia’s full-scale invasion of Ukraine. More than four years into the conflict, its effects continue to extend far beyond the battlefield and have become a defining factor in the threat landscape facing organizations across the continent.

At the same time, another topic has dominated industry discussions: artificial intelligence. Depending on who you ask, AI is either about to unleash a wave of autonomous cyberattacks, fundamentally transform cybercrime, or become an existential threat to humanity itself. While these debates attract attention, they can also make it difficult to focus on the threats organizations are dealing with today.

If we step back from the noise and look at what defenders are actually facing, a more nuanced picture emerges.

Geopolitics Continues to Drive the Threat Environment

Throughout 2026, we have seen a sharp increase in hybrid activity linked to geopolitical tensions. Defense sector supply chains have remained attractive targets, particularly those connected to European support for Ukraine. Critical infrastructure organizations have also experienced elevated levels of attention from both state and state-aligned actors.

At the same time, intelligence and security services across Europe have repeatedly warned of the potential for further Russian escalation and raised assessments concerning destructive cyber operations.

This is an important reminder that cybersecurity can no longer be viewed solely as a technology problem. Increasingly, organizations must think about cyber threats alongside physical security, supply chain resilience, business continuity, and geopolitical risk. The boundaries between these domains continue to blur as hostile actors combine cyber operations, influence campaigns, espionage, sabotage, and other forms of hybrid activity to pursue strategic objectives.

The AI Debate Has Obscured Some of the Immediate Risks

While geopolitics has increasingly shaped the threat environment, organizations have simultaneously had to navigate an intense debate around artificial intelligence.

Predictions vary dramatically. Some warn of an imminent “zero-day apocalypse” driven by AI-assisted attackers, while others focus on longer-term existential risks that extend far beyond cybersecurity. Yet much of the debate remains centred on what could happen rather than what is already happening.

In reality, many organizations are already facing what could be described as a zero-day pandemic. The challenge is compounded by an ever-growing volume of vulnerabilities and patches. In September alone, roughly 14,000 CVEs generated remediation requirements, placing enormous pressure on security and IT teams. The term “apocalypse” may be more accurately applied to patch management itself, as few organizations have the resources to keep pace with the volume of updates required.

The result is a cascading effect across already stretched systems and teams. As patch backlogs grow, maintaining visibility, prioritizing remediation efforts, and understanding which assets are truly critical becomes more important than ever. The challenge is no longer just identifying vulnerabilities. It is deciding which risks matter most and ensuring limited resources are focused where they will have the greatest impact.

Looking at the current threat environment, much of the activity affecting organizations today still relies on familiar tactics, techniques, and procedures. AI is undoubtedly changing parts of the equation, but its impact should not be overstated.

The challenge for defenders is to separate future possibilities from present realities.

Ransomware Is Growing Again, But AI Is Not the Whole Story

One notable development during 2026 is the return of growth in ransomware and data extortion activity.

Organizations across sectors have experienced an increase in financially motivated attacks, particularly extortion-focused operations, and there are few indications that this pressure will diminish in the near term.

However, attributing the increase solely to AI would miss several important developments taking place within the cybercriminal ecosystem.

One of the trends has been a shift in victimology. Threat actors are increasingly hitting smaller organizations than they did only a few years ago. This may indicate that larger organizations have gradually become more mature and resilient, forcing attackers to invest greater effort for the same return. Another factor may also be, that actors are being more opportunistic and leveraging initial attack vectors that can be scaled. Such as vulnerabilities in edge devices. As a result, many actors appear to be shifting their focus toward organizations with fewer resources and less developed security programs.

At the same time, ransomware affiliate programs continue to evolve into increasingly attractive business models. These structures lower barriers to entry, distribute operational risk, and create incentives for a wider range of participants. They also make it easier for financially motivated insiders to monetize privileged access to enterprise environments, creating additional opportunities for attackers.

Another notable development has been the continued emergence of threat actors originating from what is often referred to as the “hacker com” ecosystem.

Unlike the established ransomware landscape, which has traditionally been dominated by Russian-language criminal actors, these groups generally emerge from English-language online communities with members primarily drawn from Western or Western-oriented countries. In recent years, they have demonstrated particular proficiency in cloud environments, often showing a level of familiarity with modern enterprise platforms that exceeds what is typically observed among more traditional ransomware operators.

Part of this advantage likely stems from access and exposure. These actors have often grown up using the same cloud platforms, identity systems, collaboration tools, and development environments that their targets depend on. By contrast, some Russian-based threat actors have faced more limited access to certain technologies because of sanctions and broader geopolitical restrictions.

These groups have also distinguished themselves through sophisticated social engineering operations. Their fluency in English and familiarity with Western business culture, communication styles, and organizational structures allows them to conduct highly effective impersonation campaigns and trust-based attacks. Rather than relying exclusively on technical exploitation, these actors frequently leverage human relationships, convincing impersonations, and extensive pre-attack reconnaissance to gain a foothold.

While they do not yet match the scale of the largest ransomware ecosystems, they represent a growing threat category that aligns closely with the realities of modern enterprise environments.

Taken together, these developments provide a more convincing explanation for the increased volume of cybercrime than AI adoption alone.

AI Is Changing Cybercrime, but the Fundamentals Remain the Same

Artificial intelligence is unquestionably being integrated into cybercriminal operations. It lowers barriers to entry, improves social engineering at scale, accelerates content creation, and increases efficiency throughout many stages of the attack lifecycle.

What it has not done, at least not yet, is fundamentally change how most organizations are compromised.

Threat actors are still buying credentials stolen by infostealer malware and logging into environments with legitimate accounts. They are still exploiting vulnerabilities in internet-facing systems and edge devices. They are still abusing trust through phishing, vishing, and other forms of social engineering.

Many of these activities may now be supported by AI, but the underlying mechanics remain largely unchanged.

For defenders, this is an important observation. The controls that mattered before the rise of generative AI continue to matter today. Identity security, vulnerability management, credential monitoring, detection capabilities, visibility across the environment, and incident response readiness remain the foundation of effective security programs.

The basics still work because attackers are still attacking through the basics.

Supply Chains Are Becoming a Prime Target

If there is one tactical shift that deserves particular attention, it is the growing focus on software supply chains and CI/CD environments.

Recent incidents, including campaigns such as Shai-Hulud, have demonstrated the value of targeting development environments, build pipelines, and trusted software distribution mechanisms. As organizations increasingly automate development and deployment processes, these systems present opportunities for threat actors to achieve scale that would be difficult to accomplish through traditional intrusion activity. This positions developer accounts as the new sought after credentials for actors looking to initiate supply chain attacks.

The industry has likely not yet seen the full consequences of this trend.

From an attacker’s perspective, supply chain compromises are highly attractive. Rather than targeting organizations individually, a successful compromise of a supplier, software repository, or development pipeline can provide access to numerous downstream victims simultaneously.

Now that this approach has demonstrated its value, it is reasonable to expect continued interest in software supply chains and CI/CD infrastructure in the coming years.

What Organizations Should Be Doing

Despite the increasing complexity of the threat environment, many of the most effective defensive measures remain unchanged.

• Build security awareness and security culture within the organization.
• Maintain a strong focus on patching internet-facing systems and edge devices.
• Monitor for leaked and compromised credentials.
• Ensure comprehensive visibility across the environment.
• Regularly test incident response capabilities.
• Verify that backups are functional, recoverable, and isolated from the primary environment.

None of these recommendations are new. Yet they continue to provide meaningful protection against the majority of attacks observed today.

The Elephant in the Room

When looking beyond the discussion surrounding AI, there remains a more immediate concern for Europe.

Russia is becoming increasingly aggressive in both rhetoric and action. While much of the public cybersecurity conversation focuses on risks that AI may create years from now, Europe faces a hostile actor, armed with nuclear weapons, capable of causing disruption today.

As we move into the winter months, it is reasonable to expect continued activity across the hybrid spectrum. This includes cyber operations. Much of the activity observed in recent years, such as DDoS attacks, website disruptions, or the publication of webcam footage, can largely be categorized as nuisance activity rather than strategically significant attacks.

The greater concern is the potential for state-directed cyber operations against critical infrastructure.

As temperatures drop, disruptions affecting power, heating, water, telecommunications, and other essential services become significantly more impactful. Cyber operations targeting such infrastructure may also be accompanied by physical acts of sabotage conducted by low-level or disposable operatives, creating effects that are amplified across multiple domains.

Whether such escalation occurs remains uncertain, but it is a scenario that organizations and governments should continue to prepare for.

Looking Beyond Cybersecurity

As we enter the final months of 2026, organizations should be careful not to lose perspective.

Not every DDoS attack is an attack on critical infrastructure. Not every cyber incident is a strategic act of sabotage. Overstating relatively minor events risks amplifying the objectives of hostile actors by creating fear and attention disproportionate to the impact they actually achieve.

The same principle applies to AI.

Organizations should remain critical consumers of AI-related threat narratives. There is undoubtedly malicious potential in this technology, and its long-term impact remains uncertain. Whether AI ultimately benefits attackers more than defenders is still an open question.

What we can say with confidence today is that the fundamentals continue to work.

Organizations that consistently implement proven security controls remain significantly better positioned than those searching for revolutionary solutions to problems that have not changed nearly as much as some would suggest.

Finally, resilience should be viewed through a broader lens than cybersecurity alone.

Organizations should carefully assess their dependencies and ask difficult questions about how they would operate under adverse conditions. What happens if power is unavailable for an extended period? How would employees work without heating or running water? How would critical services continue if internet connectivity was severely disrupted?

These are uncomfortable questions, but they are no longer hypothetical ones.

Final Thoughts

The defining characteristic of the 2026 threat environment is not artificial intelligence. Nor is it any single threat actor, malware family, or criminal campaign.

Rather, it is the convergence of cyber threats, geopolitical tensions, physical security concerns, supply chain vulnerabilities, and operational resilience into a single challenge facing European organizations.

While AI continues to command headlines, the reality is that attackers remain heavily dependent on the same methods that have worked for years: stolen credentials, vulnerability exploitation, social engineering, and increasingly, supply chain compromise.

As a result, organizations do not need entirely new security paradigms to manage today’s threats. They need consistent execution of proven security fundamentals while simultaneously preparing for the broader operational risks created by an increasingly unstable geopolitical environment.

The organizations that succeed in the years ahead will be those that can do both. They will continue to execute the basics exceptionally well, while also understanding that resilience now extends far beyond cybersecurity and into every aspect of how a business operates.