News

Flashpoint Launches Its 2026 Global Threat Intelligence Report

Flashpoint has released its 2026 Global Threat Intelligence Report (GTIR), offering security leaders a clear view of the trends reshaping today’s threat landscape.

Built for teams across threat intelligence, vulnerability management, physical security, and the CISO’s office, the report draws on Flashpoint’s Primary Source Collection (PSC) to examine four converging forces driving cyber risk in 2026.

Among the report’s key findings is the growing role of agentic AI in cybercrime. Flashpoint recorded a 1,500% increase in AI-related illicit discussions between November and December 2025, highlighting how quickly threat actors are adopting AI to accelerate attack development and execution.

The report also shows how identity has become a primary target. In 2025, Flashpoint observed more than 11.1 million machines infected with infostealers, contributing to an underground market of 3.3 billion stolen credentials and cloud tokens.

At the same time, the window between vulnerability disclosure and exploitation is shrinking. Flashpoint found that disclosures rose by 12% in 2025, while 33% of vulnerabilities had publicly available exploit code, increasing the pressure on defenders to move faster.

The report also tracks the continued evolution of extortion. As organizations improve defenses against encryption-based attacks, ransomware groups are increasingly exploiting human trust instead. Flashpoint links that shift to a 53% rise in ransomware activity, with Ransomware-as-a-Service groups accounting for more than 87% of attacks.

Together, these trends point to a threat landscape that is more connected, automated, and fast-moving than ever before.

As Flashpoint Co-Founder and CEO Josh Lefkowitz says, "In 2026, cybercrime has reached a point of total convergence, where the silos that once separated malware, identity, and infrastructure have consolidated into a single, high-velocity threat engine - that agentic AI is rapidly transforming from human-led campaigns to machine-speed operations." -Backed by intelligence from the open, deep, and dark web, the 2026 GTIR gives security teams the insight they need to better anticipate emerging threats and strengthen defenses for the year ahead.