Report | Cyber Security Report, 2026 | Check Point Software

Report | Cyber Security Report, 2026

ANNUAL EDITION 14th CYBER SECURITY REPORT 2026

01 INTRODUCTION

LOTEM FINKELSTEIN VP Research

In 2025, the threat landscape evolved rapidly, becoming more interconnected and challenging to manage. Our analysis of global telemetry and incidents reveals a fundamental shift, marked by the emergence of new attack surfaces and techniques. Attackers are integrating AI, identity abuse, exposure exploitation, and ransomware into their campaigns. The most significant change is the accelerated pace and scale at which attack opportunities are being executed. Data indicates that attackers are linking access, execution, and impact across various domains. This report is structured around attacker behavior and real-world data. The subsequent chapters delve into where attackers are focusing their efforts, how different techniques reinforce each other, and which exposure patterns most frequently lead to impact.

02 CYBER SECURITY TRENDS

BEYOND EMAIL: MULTI-CHANNEL SOCIAL ENGINEERING

In social engineering attacks, threat actors attempt to manipulate human victims into providing the initial access. By 2025, social engineering expanded beyond traditional email-based attacks to adopt multi-platform and cross-channel approaches.

ClickFix: Social Engineering That Shifts Execution to the User

ClickFix emerged as one of the most significant social engineering techniques in 2025, manipulating users into executing malicious actions. This technique has proven highly effective due to its simplicity and ability to bypass security controls.

ClickFix Success

In 2025, ClickFix activity increased by approximately 500% compared to the previous year. The technique has been widely adopted across the threat landscape and utilized by established cybercriminal groups.

Voice-Based Social Engineering

Voice phishing and impersonation gained significant traction in 2025. Threat actors posed as trusted figures and pressured victims into taking actions that compromised network security.

Victim-Initiated Social Engineering

In 2025, we observed a growing trend where attackers steered targets into initiating contact, thereby increasing the perceived legitimacy of the interaction. One identified campaign involved attackers abusing organizations’ public “Contact Us” pages to pose as legitimate business inquiries.

Social Engineering Activity on Business Communication Platforms

Threat actors are increasingly expanding social engineering beyond email to messaging platforms such as Microsoft Teams and Slack. These platforms are being abused as high-trust attack surfaces, enabling attackers to bypass standard email defenses.

THE 2025 RANSOMWARE ECOSYSTEM

The number of ransomware victims reached record highs in 2025, as the criminal ecosystem underwent rapid reconfigurations. Ransomware operations increasingly incorporate AI into different stages of the attack lifecycle.

Mid-Year RaaS Disruption and Affiliate Realignment

In Q2, several high-profile RaaS programs abruptly disappeared, while victim count remained above 2024 baselines. The number of published victims increased significantly, underscoring the resilience of affiliates in the ransomware model.