# Report | Cyber Security Report, 2026

## ANNUAL EDITION 14th CYBER SECURITY REPORT 2026

### TABLE OF CONTENTS:
01 INTRODUCTION  
02 CYBER SECURITY TRENDS  
03 AI LANDSCAPE IN CYBER SECURITY  
04 GLOBAL ANALYSIS  
05 HIGH PROFILE VULNERABILITIES  
06 2026 PREDICTIONS
07 RECOMMENDATIONS  
08 AN EXPOSURE MANAGEMENT PERSPECTIVE

## 01 INTRODUCTION
### LOTEM FINKELSTEIN VP Research

In 2025, the threat landscape evolved rapidly, becoming more interconnected and challenging to manage. Our analysis of global telemetry and incidents reveals a fundamental shift, marked by the emergence of new attack surfaces and techniques. Attackers are integrating AI, identity abuse, exposure exploitation, and ransomware into their campaigns. The most significant change is the accelerated pace and scale at which attack opportunities are being executed. Data indicates that attackers are linking access, execution, and impact across various domains. This report is structured around attacker behavior and real-world data. The subsequent chapters delve into where attackers are focusing their efforts, how different techniques reinforce each other, and which exposure patterns most frequently lead to impact.

## 02 CYBER SECURITY TRENDS
### BEYOND EMAIL: MULTI-CHANNEL SOCIAL ENGINEERING

In social engineering attacks, threat actors attempt to manipulate human victims into providing the initial access. By 2025, social engineering expanded beyond traditional email-based attacks to adopt multi-platform and cross-channel approaches.

### ClickFix: Social Engineering That Shifts Execution to the User

ClickFix emerged as one of the most significant social engineering techniques in 2025, manipulating users into executing malicious actions. This technique has proven highly effective due to its simplicity and ability to bypass security controls.

#### ClickFix Success
In 2025, ClickFix activity increased by approximately 500% compared to the previous year. The technique has been widely adopted across the threat landscape and utilized by established cybercriminal groups.

### Voice-Based Social Engineering
Voice phishing and impersonation gained significant traction in 2025. Threat actors posed as trusted figures and pressured victims into taking actions that compromised network security.

### Victim-Initiated Social Engineering
In 2025, we observed a growing trend where attackers steered targets into initiating contact, thereby increasing the perceived legitimacy of the interaction. One identified campaign involved attackers abusing organizations’ public “Contact Us” pages to pose as legitimate business inquiries.

### Social Engineering Activity on Business Communication Platforms
Threat actors are increasingly expanding social engineering beyond email to messaging platforms such as Microsoft Teams and Slack. These platforms are being abused as high-trust attack surfaces, enabling attackers to bypass standard email defenses.

## THE 2025 RANSOMWARE ECOSYSTEM
The number of ransomware victims reached record highs in 2025, as the criminal ecosystem underwent rapid reconfigurations. Ransomware operations increasingly incorporate AI into different stages of the attack lifecycle.

### Mid-Year RaaS Disruption and Affiliate Realignment
In Q2, several high-profile RaaS programs abruptly disappeared, while victim count remained above 2024 baselines. The number of published victims increased significantly, underscoring the resilience of affiliates in the ransomware model.