Cyber adversaries have figured out something important: the best way to beat security tools is to avoid triggering them at all.
There was a time when the cybersecurity threat model was pretty simple. Attackers used malware. Defenders blocked malware. Security vendors sold better ways to do it. Nobody loved the arms race, but at least everyone agreed on what the fight was about.
That’s shifted pretty significantly.
CrowdStrike’s 2026 Global Threat Report lays out exactly where things stand. Adversaries have largely stopped relying on malware. They’ve shifted to abusing legitimate tools, stolen identities, and the implicit trust built into enterprise systems. And it’s working.
Adam Meyers, SVP of Intelligence at CrowdStrike, set the tone during a press briefing for the report. He called 2025 the year of the evasive adversary. “They figured out a lot of new techniques to gain access and to move and to execute their objectives,” Meyers said. “But they focus on avoiding detection, and they do a lot of things to make it harder to find them as well.”
The Numbers Are Getting Worse
The headline stat should make every CISO uncomfortable: 82% of detections in 2025 were malware-free. Breakout time—the window between initial access and lateral movement—dropped to an average of 29 minutes, down from 62 minutes in 2023. The fastest recorded breakout was 27 seconds. “The average breakout time is almost half of what it was in 2023, which is terrifying to think about,” Meyers said. At that speed, defenders are operating under pressure that produces mistakes and burnout.
Other numbers: zero-day vulnerabilities exploited before public disclosure jumped 42%. AI-enabled adversary activity increased 89%. Cloud intrusions rose 37%, with state-nexus actors accounting for a 266% spike. These aren’t incremental shifts.
They’re Getting In With Your Own Credentials
Valid account abuse showed up in 35% of cloud intrusions. Meyers put it directly: “35% of the time, it’s legitimate credentials.” The front line has moved from malware to identity.
Several adversary groups have refined this to a repeatable playbook. Scattered Spider and Blockade Spider target hybrid identity environments—the junction between on-premises Active Directory and cloud platforms like Microsoft Entra ID. They run vishing campaigns to trick IT help desks into resetting credentials or enrolling new MFA devices. They don’t need a zero-day when a phone call does the same job.
The Gaps Defenders Aren’t Watching
Meyers noted during the briefing that the adversaries are operating in the gaps that defenders aren’t monitoring. “A lot of the gray space between where the threat analysts and the hunters are looking is where the adversaries are living,” he said. “If organizations don’t have good visibility into the identity space and the cloud and the unmanaged devices in their environment, they’re missing pieces of the puzzle that the adversaries are using.”
Network edge devices are the most acute version of this. Firewalls, VPN concentrators, and routers are trusted infrastructure that most organizations don’t instrument the way they do endpoints. “They don’t run modern security tools,” Meyers said. “They are effectively a black box for the defenders.”
China-nexus groups have built their entire access strategy around this blind spot. The report shows 40% of Chinese nexus exploits targeted edge devices, and these groups have been able to weaponize newly disclosed vulnerabilities within two days of public announcement. The patch exists. The window between when it’s available and when it’s applied is where China lives. In one Warp Panda incident tracked through incident response, the adversary had maintained persistent access for 22 months.
AI Is Making Social Engineering More Scalable
AI hasn’t handed attackers a new weapon so much as it’s made the old ones cheaper and harder to spot. The 89% increase in AI-enabled adversary activity in the report reflects real operational changes—not a marketing talking point.
Attackers are using AI to generate more convincing phishing emails—the typos and awkward phrasing that used to be a reliable signal are largely gone. They’re producing synthetic audio for vishing campaigns in multiple languages. Fancy Bear deployed a tool called Lamehug that reaches out to the Hugging Face API and asks an LLM to generate Windows commands for reconnaissance—then, if the target looks interesting, directs a second stage to find, bundle, and exfiltrate valuable files. The malware has no predefined functionality. It figures out what to do on the fly.
The AI attack surface is expanding on the other side, too. LangFlow, a popular low-code AI platform, had a vulnerability that ransomware operators used to deploy ransomware inside organizations. A malicious MCP server intercepted emails sent by an AI system and blind-copied an attacker-controlled address. The rush to deploy AI tools is outpacing the ability to secure them.
The $1.46 Billion Supply Chain Lesson
The most dramatic single incident in this year’s report is the theft of $1.46 billion from Bybit. North Korea’s Pressure Chollima group didn’t breach Bybit directly—they compromised Safe{Wallet}, a software provider Bybit trusted, and injected malicious code into the supply chain. Bybit’s own defenses were never triggered. It’s a pattern showing up more broadly: malicious npm packages, typosquatting attacks on open source libraries, compromised developer toolchains. A single supply chain compromise can reach thousands of downstream environments.
What Security Teams Should Actually Focus On
It’s worth stepping back before running through the recommendations. Richard Stiennon, chief research analyst at IT-Harvest, offered a useful counterweight: “Adversaries are going for low-hanging fruit like credentials and third parties. I caution, though, that the pointy end of the stick is the targeted attack, and those threat actors will use zero days and custom malware. So, yes, bread and butter measures are needed, but do not neglect the importance of countering determined attackers.” The 82% malware-free stat covers the broad population of attacks. Nation-state actors haven’t stopped building custom tools.
Identity threat detection has moved from a nice-to-have to a requirement. With valid credentials driving a third of cloud intrusions and vishing replacing zero-days as the preferred initial access method, security teams need real-time visibility into anomalous identity activity—unusual login patterns, MFA enrollment events, service account behavior, lateral movement through legitimate credentials.
Closing the cross-domain visibility gap is where a lot of this comes together. These adversary groups operate deliberately in the spaces between endpoint, identity, cloud, and unmanaged device coverage. Michelle Abraham, research director at IDC, pointed to a specific mechanism: “To counteract breaches that cross domains, organizations should integrate attack path analysis into their proactive exposure management programs to see how vulnerable assets connect into exploitable chains across the enterprise attack surface. The ability to find and sever these routes before attackers make use of them is critical, particularly in an environment where AI is compressing exploit development timelines.”
And AI systems need to be treated as an attack surface. Many AI platforms have minimal logging—vendors are racing to ship features, not audit trails. Organizations need to understand what AI tools are running, what they can access, and what anomalous behavior looks like in those systems.
The Harder Problem
What I keep coming back to is that the core challenge here isn’t really technical. Identity abuse, social engineering, and supply chain attacks are effective because they exploit the mechanics of how enterprise systems are supposed to work—the trust, the delegation, the integrations between platforms. Security teams are trying to catch threats that are specifically designed to look like normal operations. At 29-minute average breakout times, there’s not much margin to figure it out slowly.
The 2026 Global Threat Report is worth reading if you want to understand the threat landscape as it actually is rather than how vendors tend to describe it. CrowdStrike sells products that address exactly these problems, and that’s worth keeping in mind when reading their analysis. But the data is specific, and the trends hold up across independent sources. I find it credible, even if the picture it paints isn’t a comfortable one.