Web DDoS attacks more than doubled during the first half of 2026 as organizations faced growing threats across networks, applications and APIs, according to new research from Radware.
Radware’s H1 2026 Global Threat Analysis Report draws on data from the company’s cloud and managed security services as well as research from its threat intelligence team. The findings point to increases in DDoS activity and application attacks, while also highlighting a shrinking window between vulnerability disclosure and active exploitation.
Web DDoS activity rises sharply
Radware recorded a 110.6% increase in Web DDoS attacks compared with the first half of 2025 and a 36.3% increase compared with the second half of last year. Web DDoS mitigations recorded during the first six months of 2026 were already equivalent to nearly 83% of the volume recorded during all of 2025.
If the first-half pace continues through the end of the year, Radware estimates Web DDoS attacks could increase approximately 166% year over year in 2026.
If the H1 pace continues, Radware estimates North America could see the largest increase, with Web DDoS attacks potentially rising about 190%. Radware projects increases of approximately 60% in EMEA, 39% in Central and Latin America and 27% in APAC if current trends continue.
Network-layer DDoS activity also increased. Radware recorded an average of 110 network DDoS attacks per customer per day in H1 2026, up 36.6% from its 2025 baseline.
Attack techniques are also changing. Direct-path UDP floods accounted for 73% of all packets Radware mitigated during the period and more than 80% when fragmented UDP traffic was included.
Technology companies received the largest share of network DDoS attacks, accounting for 59.4% of the total and averaging 509 attacks per customer per day. Financial services accounted for another 20.8%.
Geographically, North America received 43.1% of network DDoS attacks, while the Middle East experienced the highest frequency, averaging 520 attacks per customer per day.
Web application and API attacks double
Radware also reported a 104% increase in malicious web application and API transactions over 2025 levels. Organizations experienced more than 14,000 malicious transactions per application per day during the first half of the year.
Vulnerability exploitation accounted for 62.1% of the web application and API attacks recorded by Radware, while North America accounted for 79.5% of malicious application and API transactions globally.
The report also points to a significant reduction in the amount of time defenders have to respond to newly discovered vulnerabilities.
According to Radware’s threat intelligence data, the mean time between a CVE announcement and the first detected exploitation fell from 53 days after disclosure in 2024 to 21.5 days in 2025. In H1 2026, that figure fell below zero, meaning exploitation was being detected before the corresponding CVE was publicly announced.
Radware said the zero-day rate in its data surpassed 80%, indicating that more than four out of five of the vulnerabilities it tracked were exploited before their official CVE announcement.
AI and expanding API use create new risks
The report also examines how the adoption of AI agents and increasingly capable AI models could affect the threat landscape.
AI agents can access systems, call APIs, execute tasks and download software dependencies, expanding the potential attack surface as organizations give autonomous systems greater access to corporate environments.
Radware’s survey research found that 77% of organizations are deploying or implementing AI agents and autonomous workflows, but only 17.2% reported having full visibility into the AI agents operating in their environments.
API development is accelerating at the same time. More than 70% of surveyed organizations said they increased their use of internally developed APIs over the past year, and 81.2% now push production API updates at least weekly. However, only 6.9% said they fully document their internal APIs, while 43% document less than 70% of them.
“Attackers are increasingly operating at machine speed — launching direct-path DDoS attacks, exploiting vulnerabilities and using agentic AI to automate and speed up their attacks,” said Pascal Geenens, vice president of threat intelligence at Radware. “At the same time, organizations are rapidly deploying AI agents and APIs without complete visibility into their expanding attack surfaces. The growing gap between the speed of attacks and the ability of organizations to detect and respond to them is fundamentally changing the threat landscape.”
Bad bots and hacktivism remain persistent threats
Bad bot activity also remained high during the first half of 2026, reaching nearly 60% of the total volume Radware recorded during all of 2025. North America accounted for 50.1% of global bad bot activity, followed by APAC at 23.2%.
Meanwhile, hacktivist DDoS activity continued to follow geopolitical events. Although overall public attack claims declined from their Q2 2025 peak, Radware recorded a 103% month-over-month increase in March 2026 that coincided with military developments in the Middle East.
Europe accounted for 48% of hacktivist DDoS attack claims during H1. Israel was the most frequently targeted country at 16.9% of claims, followed by Ukraine at 8.4% and the United States at 7.7%.
Government organizations accounted for 37.2% of claimed attacks. Pro-Russian groups remained particularly active, with NoName057(16) responsible for 40.5% of the hacktivist attack claims tracked by Radware during the first half of the year.
Radware’s findings point to higher attack volumes alongside faster vulnerability exploitation and rapidly expanding AI and API environments, giving security teams less time to identify and respond to emerging threats.
