Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Jenny Judy, analyst, Optiv Global Threat Intelligence Center (gTIC) and Aamil Karimi, principal consultant, Optiv gTIC
From artificial intelligence (AI) to quantum computing, today’s technology breakthroughs are rapidly becoming tomorrow’s attack surfaces. In a world where innovation and exploitation evolve in tandem, an organization’s threat landscape has never been more volatile or complex. Actionable threat intelligence is essential: to recognize emerging patterns, anticipate adversary behavior, and stay one step ahead.
With this in mind, the Optiv Global Threat Intelligence Center (gTIC) has identified key insights and predictions designed to help organizations strengthen their defenses and prepare for what’s ahead in 2026.
1. Adversaries’ Reliance on AI Will Escalate
AI will increasingly serve as both a weapon and a workforce multiplier for adversaries.
- Insider Threat Amplification: AI will continue to enable threat actors to infiltrate global organizations under the guise of legitimate employment for the purpose of espionage and sabotage.
- Lower Barriers to Entry: As AI tools become more accessible, the level of effort to conduct sophisticated social engineering, impersonation, and credential theft campaigns will continue to drop, expanding the threat surface.
2. Exposed or Improperly Secured Credentials Will Remain a Top Risk
Despite rising security awareness, credential exposure will remain one of the most significant risks for compromise across industries.
- Credential Reuse Across Platforms: Data leaks from one service or retailer will continue to fuel widespread brute-force and account-checking campaigns targeting other platforms, including enterprise software, VPN clients, and firewalls.
- Credentials as Prime Targets: Once inside a network, capturing additional credentials will remain a key objective for threat actors, enabling Privilege Escalation and Lateral Movement within compromised environments.
3. Ransomware Attacks Will Remain Elevated But Less Concentrated
The ransomware ecosystem continues to evolve, marked by fragmentation, adaptability, and an influx of new players.
- Rising Volume of Victims: Optiv gTIC’s monitoring of ransomware data-leak sites revealed an increase in total victims from 5,014 in 2024 to 5,757 between Jan. 1 and Oct. 7, 2025, indicating sustained operational activity despite law enforcement pressure.
- Shifting Dominance: The top three most active ransomware-as-a-service (RaaS) groups changed notably year over year. In 2024, the top three most active groups, based off posted victims to their data-leak sites, were LockBit (531), RansomHub (529), and Play (357). In 2025, as of Oct. 7, the top three most active groups, again based off data-leak site postings, are Qilin (575), Akira (518), and Cl0p (362).
- Fragmented but Familiar: While the number of ransomware groups continues to grow and attacks become more dispersed among smaller, opportunistic actors, focusing on overlapping tools and techniques-rather than attribution alone-will be essential in reducing noise, improving clarity, and enabling proactive, defense-in-depth security strategies.
4. Threat Actor Rebranding Will Accelerate Despite Disruptions
Law enforcement operations have demonstrated an increased ability to disrupt major cybercriminal groups and seize their infrastructure. However, these actions rarely deter cybercriminals’ ability to continue operating.
For example, in late September, the Scattered Lapsus$ Hunters announced their collective “retirement.” While citing recent arrests of co-conspirators (the group reportedly consists of threat actors behind Scattered Spider, Lapsus$, ShinyHunters, and others), the overall messaging around the announcement did not suggest a complete end to potential future operations. Shortly after the announcement, a data leak site attributed to the group listed 39 victims, which were likely compromised prior to the reported retirement.
Threat groups may vanish in name, but their tactics, tools, and infrastructure persist. In tracking overlapping techniques and tooling across multiple threat groups, defenders look to prioritize these recurring indicators of activity over attribution and branding. It is Highly Likely that over the next 12 months, threat actors will continue to rebrand, rebuild, and reemerge, leveraging new infrastructure and aliases to evade detection and sustain their operations.
Preparing for What’s Next
As the cyber threat landscape becomes increasingly unpredictable and decentralized, true resilience will depend on foresight and adaptability. The organizations that thrive must leverage threat intelligence to take decisive action against identified current threats as well as mature threats based on emerging trends.
By transforming intelligence into strategy, organizations can be proactive, strengthen their defenses, and evolve. With an intelligence-driven approach, organizations can build a stronger, more agile security posture in 2026 and beyond.
##
