Global · Dublin Base · DORA · NIS2 · EU AI Act · ISO 42001

Threat Radar — Top 10 Cyber Threats

Strategic post-mortem intelligence on the Top 10 cyber threats — each analysed through a governance failure lens with doctrine-mapped remediation.

Major Incidents & Threat Intelligence

Threat Radar — Top 10 Cyber Threats (2025–2026)

Strategic post-mortem intelligence — not news. Each threat is analysed through a governance failure lens with doctrine-mapped remediation and board-level implications.

01
Agentic AI & Autonomous Malware
CRITICAL
CrowdStrike 2026 Global Threat Report: 89% YoY increase in AI-enabled attacks. Average eCrime breakout time now 29 minutes (65% faster than 2024); fastest observed: 27 seconds. Autonomous AI agents account for 1 in 8 reported AI breaches. Unit 42 2026: identity loopholes drive nearly 90% of incident investigations as AI boosts the full attack lifecycle.
Attack Vector
LLM-orchestrated attack chains with autonomous decision trees, polymorphic payload generation, self-modifying C2 infrastructure; AI-led tool orchestration coordinating simultaneous multi-target intrusions (GTG-1002 model, Nov 2025)
Governance Failure
No AI-specific threat model in risk registers; SOC playbooks assume human-speed adversaries; board risk appetite statements do not account for autonomous threat escalation at 27-second breakout velocity
Doctrine Remedy
AI Accountability Stack™ — deploy adversarial AI red-team cadence, mandate AI-aware detection layers, update risk appetite to include autonomous threat velocity
Board Implication
Directors face personal liability if AI threat modelling is absent from enterprise risk framework — SEC/DOJ precedent applies to negligent oversight of emerging technology threats
02
AI-Powered Deepfake Fraud
CRITICAL
Voice cloning has crossed the "indistinguishable threshold" — a few seconds of audio now produces convincing clones with natural intonation and breathing (Fortune, Dec 2025). 1 in 4 Americans report being fooled by deepfakes. UN warns deepfakes are a global wake-up call to organised fraud (UN News, Mar 2026). Major retailers report 1,000+ AI-generated scam calls per day. US AI-facilitated fraud losses projected to reach $40B by 2027 (CAGR 32%).
Attack Vector
Real-time voice cloning, video synthesis of C-suite executives, BEC 2.0 with AI-generated contextual pretexting
Governance Failure
Single-factor executive authorisation for high-value transactions; no out-of-band verification mandate; identity assurance policies pre-date generative AI
Doctrine Remedy
Decision Rights Architecture™ — enforce multi-party authorisation with cryptographic verification for all transactions exceeding materiality thresholds
Board Implication
Fiduciary duty requires verification controls proportionate to fraud risk; absence constitutes negligent governance under corporate law
03
Software Supply Chain Hijacks
CRITICAL
Five major supply-chain attacks in March 2026 alone. Axios npm compromise (100M weekly downloads) attributed by Google GTIG to North Korean group UNC1069 — WAVESHAPER.V2 backdoor deployed across Windows/macOS/Linux (Google, Apr 2026). TeamPCP campaign hit LiteLLM (3.4M daily PyPI downloads), Trivy, KICS, and Telnyx in 8 days — harvesting cloud credentials, SSH keys, and CI/CD secrets (Datadog, Mar 2026). 36 additional malicious npm packages exploited Redis/PostgreSQL for persistent implants (Apr 2026).
Attack Vector
Trojanised updates via compromised build pipelines, malicious package injection (npm/PyPI), CI/CD credential theft, code-signing key compromise
Governance Failure
No SBOM mandate; third-party risk assessments evaluate compliance, not code integrity; vendor contracts lack breach notification and code audit clauses
Doctrine Remedy
Contract Control Matrix™ — mandate SBOMs, code-signing verification, build attestation, and continuous dependency scanning in all vendor agreements
Board Implication
NIS2 Art. 21 and DORA Art. 28 impose supply chain due diligence — board accountability for third-party ICT risk is now statutory
04
Hyper-Speed Ransomware
CRITICAL
Publicly reported ransomware attacks reached 7,200 in 2025, up 47% from 4,900 in 2024 (Recorded Future). Despite volume surge, total payments declined as more organisations refuse to pay. Top groups: Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi. Emerging shift: many groups skip encryption entirely, using pure data extortion. Cross-platform encryption and insider recruitment via native English speakers accelerating in 2026.
Attack Vector
Intermittent encryption for speed, EDR evasion via legitimate system tools, multi-stage extortion (encrypt + exfiltrate + DDoS threat)
Governance Failure
Recovery time objectives (RTO) assume hours/days, not minutes; backup isolation not validated; crisis communications untested; no board-approved ransom policy
Doctrine Remedy
Recoverability Mandate™ — enforce sub-4-hour RTO, immutable backup verification, automated isolation playbooks, and pre-approved crisis communication templates
Board Implication
Boards must pre-approve ransom decision framework and crisis authority delegation — post-incident improvisation constitutes governance failure
05
Identity-Centric Attacks (IAM Exploitation)
HIGH
Unit 42 Global Incident Response Report 2026: identity loopholes drive nearly 90% of all investigations, with AI boosting the full attack lifecycle. AiTM attacks increased 146% YoY with ~40,000 incidents detected daily. SpyCloud 2026: 8.6 billion stolen session cookies recaptured. 84% of compromised accounts had MFA enabled. Fastest observed intrusion-to-exfiltration: just 4 minutes (CrowdStrike 2026).
Attack Vector
MFA fatigue/push bombing, adversary-in-the-middle (AitM) proxy attacks, OAuth/OIDC consent phishing, session cookie replay
Governance Failure
Over-reliance on MFA as single compensating control; no phishing-resistant authentication mandate; privilege access reviews are quarterly, not continuous
Doctrine Remedy
Evidence Chain Model™ — deploy FIDO2/passkeys, enforce continuous authentication, implement just-in-time privilege elevation with session binding
Board Implication
80%+ of breaches involve compromised credentials — IAM governance must be a board-level risk metric, not an IT operational concern
06
Cloud & SaaS Entitlement Abuse
HIGH
Over-permissioned cloud identities (85% of cloud IAM) and SaaS sprawl now account for 50%+ of breach entry points. In Aug 2025, threat actor UNC6395 abused stolen OAuth tokens from Drift's Salesforce integration to compromise 700+ organisations via a trusted SaaS-to-SaaS connection. Misconfigurations, shadow AI tools, and unmanaged OAuth chains create lateral movement paths invisible to perimeter controls. Shadow AI usage added $670K to average breach cost (IBM 2026).
Attack Vector
Privilege escalation via misconfigured IAM roles, cross-tenant attacks, SSRF to cloud metadata endpoints, shadow IT SaaS token harvesting
Governance Failure
Cloud security posture management (CSPM) not integrated with GRC; entitlement reviews are manual and infrequent; shared responsibility model misunderstood at board level
Doctrine Remedy
Board-Survivable Cyber Architecture™ — enforce CSPM with continuous entitlement monitoring, CIEM integration, and cloud-native zero trust architecture
Board Implication
Cloud concentration risk is a board-level fiduciary concern — DORA ICT concentration provisions apply to critical cloud service dependencies
07
Post-Quantum Harvest-Now-Decrypt-Later
HIGH
Q-Day timeline accelerating: three papers in three months rewriting quantum threat estimates (Quantum Insider, Mar 2026). Google whitepaper indicates ECC vulnerable at ~1,200 logical qubits; Gidney RSA-2048 estimate reduced to under 1M physical qubits. Global quantum investment surged to $17.3B. Google introduces 2029 PQC migration timeline; Pentagon targets 2030 full PQC implementation. Android 17 integrating ML-DSA for PQC digital signatures at device scale. 2026 designated "Year of Quantum Security" by FBI/NIST/CISA.
Attack Vector
Bulk interception of TLS-encrypted traffic, VPN tunnel capture, exfiltration of encrypted databases for future quantum decryption
Governance Failure
No cryptographic inventory; quantum transition roadmap absent from strategic planning; data classification does not account for time-sensitivity of confidentiality
Doctrine Remedy
Evidence Chain Model™ — commission cryptographic asset inventory, implement NIST PQC migration roadmap, classify data by confidentiality time-horizon
Board Implication
Data harvested today may include M&A strategy, IP, and personal data — boards must govern cryptographic transition as a strategic programme
08
Zero-Day Edge & IoT Exploitation
ELEVATED
Ivanti EPMM zero-days CVE-2026-1281 and CVE-2026-1340 (both CVSS 9.8) exploited in the wild since July 2025 — Germany's BSI confirmed state-linked exploitation 6 months before public disclosure. Both flaws enable unauthenticated RCE on mobile device management servers. Fortinet, WatchGuard, and Palo Alto edge devices also compromised in sustained 2026 attack campaigns targeting government, defence, and healthcare sectors.
Attack Vector
Zero-day exploitation of network edge appliances, firmware implants persisting across reboots, OT/IoT lateral movement via unmanaged devices
Governance Failure
Edge devices excluded from vulnerability management programme; firmware patching not mandated; asset inventory incomplete for OT/IoT
Doctrine Remedy
Contract Control Matrix™ — enforce vendor SLA for zero-day response, mandate network segmentation for edge devices, require firmware integrity verification
Board Implication
UK PSTI Act and EU CRA impose security-by-design obligations for connected devices — boards must ensure procurement governance includes firmware lifecycle management
09
Geopolitical CNI Sabotage
ELEVATED
China and Russia account for 57% of global state-sponsored cyber operations (2026). Salt Typhoon compromised US telecom providers including AT&T and Verizon, stealing metadata of political figures. Volt Typhoon maintains multi-year persistence in US energy, water, and transport CNI. Waterfall Threat Report 2026: nation-state and hacktivist attacks on critical infrastructure doubled YoY. Finland National Security Overview 2026 flags Russian and Chinese cyber espionage targeting government and CNI. BRICKSTORM malware actively deployed against VMware vSphere and Windows cloud platforms.
Attack Vector
Pre-positioned implants in SCADA/ICS, destructive wiper malware, coordinated multi-sector disruption timed to geopolitical flashpoints
Governance Failure
Geopolitical risk not integrated into cyber risk assessments; no threat-informed defence posture; cross-sector interdependencies unmapped
Doctrine Remedy
Board-Survivable Cyber Architecture™ — implement threat-informed risk assessment, model sector interdependencies, establish government liaison protocol
Board Implication
NIS2 essential entity obligations and national security directives require boards to demonstrate geopolitical threat awareness in risk governance
10
Insider Risk — AI-Amplified
ELEVATED
Insider risk costs hit $19.5M per organisation annually, up 20% since 2023 (Proofpoint 2026). 90% of organisations experienced at least one insider incident in the past 12 months. 94% report AI is increasing insider risk exposure — 74% describe it as moderate to significant. 39.7% of AI interactions involve sensitive data (Cyberhaven Labs 2026). Fastest data exfiltration: 1.2 hours from initial access, with one case at just 4 minutes. Shadow AI usage added $670K to average breach cost (IBM 2026). 74% of organisations rank negligent insiders as their top concern, ahead of malicious actors (59%).
Attack Vector
LLM-assisted bulk data summarisation and exfiltration, shadow AI tool data leakage, AI-generated pretexting of internal targets
Governance Failure
Insider threat programme does not account for AI-augmented capabilities; DLP policies pre-date generative AI; AI acceptable use policy absent or unenforced
Doctrine Remedy
AI Accountability Stack™ — enforce AI usage monitoring, DLP modernisation for LLM interactions, and insider threat programme augmented with behavioural analytics
Board Implication
Directors must ensure AI governance includes insider risk dimension — failure to control AI-enabled data loss exposes personal liability under data protection law
THREAT INTELLIGENCE LAST REFRESHED: April 2026 · AUTO-UPDATED DAILY
Reserve Mandate Email Direct