Skip to main content
Skip to footer
Q3 2026 saw identity and access become the currency of compromise. Financially motivated, state-sponsored, and geopolitically driven actors alike favored operator-led remote access, token and session theft, and commoditized phishing-as-a-service over custom-built malware. This lowered barriers to entry while complicating detection for defenders.
Geopolitics remained a reliable predictor of targeting, from Iran-linked pre-positioning against Gulf energy infrastructure to Russian influence operations timed to European elections. Confirmed pump and controller manipulation at US water utilities made critical infrastructure risk real, while AI became a standing feature of the attack lifecycle.
Download this report to:
- See how identity and AI reshaped Q3 attacks
- Identify risks for your sector and region
- Prepare for ransomware that targets your recovery