Rapid7, Inc. released its Quarterly Threat Landscape Report, revealing that human operators remain the primary drivers of modern cyber threats despite widespread warnings about autonomous AI attacks.
The report shows AI is used as an operational component in just 8% of tracked incidents. While automation increasingly handles tactical execution, human actors still select most targets and dictate attack intent. Drawing from vulnerability research, frontline incident response, and underground monitoring, the newly announced Rapid7 Intelligence connects these insights to deliver a comprehensive view of adversary operations.
“Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation, which hasn’t materialized. Only 8% of tracked reporting cites AI as an operational component,” said Christiaan Beek, Vice President of Rapid7 Intelligence. “But that’s a snapshot of adoption, not a ceiling. Agentic capabilities are advancing faster than any organization, attackers included, can rework its processes around them. The question is when, not if, agentic exploitation scales. Defenders need to move past reactive patching and start grounding their risk appetite in concrete days of exposure.”
Key findings include:
- Vulnerability exploitation continues to accelerate: Attackers exploit high-severity vulnerabilities within an average of just three days, with 71% occurring in the first week—underscoring the urgent need to address critical exposures faster than traditional patching cycles allow.
- U.S. organizations accounted for the largest volume of ransomware listings. Rapid7 recorded 1,112 U.S. ransomware leak-site listings, roughly eight times Germany’s total, with The Gentlemen (342), Qilin (339), and INC Ransom (99) leading group activity.
- “Holy Grail” vulnerabilities drive attacks. 79% of exploited flaws required no authentication and no user interaction, giving adversaries direct, remote access into enterprise environments.
- Compromised access drove underground market activity. Of 63 monitored posts, 41 advertised Remote Desktop Protocol (RDP) or network access.
Across espionage and cybercrime campaigns, threat groups change, but core tactics persist, including command and scripting interpreters, credential theft, and remote-access exploitation. These patterns underscore the need for behavioral detection and response, not static lists of known groups.
What this means for security operations
The findings from the third quarter of 2026 point to clear priorities for security teams: identify exposed assets, assess what attackers can exploit, and prioritize fixes by business impact. While the report findings show cyber threats remain human-driven, attackers are still leveraging AI to accelerate campaigns, making it critical for defenders to rapidly patch remotely exploitable vulnerabilities rather than wait for scheduled updates.
To read a full copy of the report, visit here.
