EMEA & Ireland · DORA · NIS2 · EU AI Act · ISO 42001

Threat Radar — Top 10 Cyber Threats

Strategic post-mortem intelligence on the Top 10 cyber threats — each analysed through a governance failure lens with doctrine-mapped remediation.

Major Incidents & Threat Intelligence

Threat Radar — Top 10 Cyber Threats (2025–2026)

Strategic post-mortem intelligence — not news. Each threat is analysed through a governance failure lens with doctrine-mapped remediation and board-level implications.

01
Agentic AI & Autonomous Malware
CRITICAL
CrowdStrike 2026: 89% YoY increase in AI-enabled attacks; eCrime breakout time 29 minutes (fastest: 27 seconds). 48% of security professionals identify agentic AI as top 2026 attack vector (Dark Reading poll). Microsoft April 2026: threat actor abuse of AI accelerating from tool to full cyberattack surface — adversaries weaponising agentic frameworks for autonomous recon, credential testing, and infrastructure rotation. First documented fully autonomous AI-orchestrated attack (Sep 2025): AI agent handled 80–90% of attack lifecycle without human control. Cascading multi-agent failure case: compromised procurement agent approved $3.2M in fraudulent orders before detection (Galileo AI/Barracuda, Apr 2026).
Attack Vector
LLM-orchestrated attack chains with autonomous decision trees, polymorphic payload generation, self-modifying C2 infrastructure; AI-led tool orchestration coordinating simultaneous multi-target intrusions (GTG-1002 model, Nov 2025)
Governance Failure
No AI-specific threat model in risk registers; SOC playbooks assume human-speed adversaries; board risk appetite statements do not account for autonomous threat escalation at 27-second breakout velocity
Doctrine Remedy
AI Accountability Stack™ — deploy adversarial AI red-team cadence, mandate AI-aware detection layers, update risk appetite to include autonomous threat velocity
Board Implication
Directors face personal liability if AI threat modelling is absent from enterprise risk framework — SEC/DOJ precedent applies to negligent oversight of emerging technology threats
02
AI-Powered Deepfake Fraud
CRITICAL
US deepfake-related fraud losses tripled to $1.1B in 2025 (from $360M in 2024); projected $40B by 2027 (Deloitte). 72% of business leaders cite AI-enabled fraud as top operational challenge (Experian 2026). Experian warns of AI-powered emotionally intelligent bots sustaining dozens of simultaneous scam relationships. $25.6M Arup deepfake video-call heist remains landmark case. WEF March 2026: AI-fuelled cyber fraud now a global roadmap priority.
Attack Vector
Real-time voice cloning, video synthesis of C-suite executives, BEC 2.0 with AI-generated contextual pretexting
Governance Failure
Single-factor executive authorisation for high-value transactions; no out-of-band verification mandate; identity assurance policies pre-date generative AI
Doctrine Remedy
Decision Rights Architecture™ — enforce multi-party authorisation with cryptographic verification for all transactions exceeding materiality thresholds
Board Implication
Fiduciary duty requires verification controls proportionate to fraud risk; absence constitutes negligent governance under corporate law
03
Software Supply Chain Hijacks
CRITICAL
Five major supply-chain attacks in Q1 2026. North Korean actors spread 1,700+ malicious packages across npm, PyPI, Go, and Rust ecosystems (Hacker News, Apr 2026). Axios npm (100M weekly downloads) compromised by UNC1069 — WAVESHAPER.V2 backdoor deployed (Google GTIG, Apr 2026). TeamPCP multi-phase campaign affected 60+ npm packages between Feb–Mar 2026, hitting LiteLLM (3.4M daily PyPI downloads), Trivy, KICS, Telnyx — harvesting cloud credentials and CI/CD secrets via incomplete credential rotation (Datadog, Mar 2026). 36+ malicious npm packages exploited Redis/PostgreSQL for persistent implants. Attackers gaining trusted maintainer accounts rather than typosquats (Zscaler ThreatLabz, Apr 2026).
Attack Vector
Trojanised updates via compromised build pipelines, malicious package injection (npm/PyPI), CI/CD credential theft, code-signing key compromise
Governance Failure
No SBOM mandate; third-party risk assessments evaluate compliance, not code integrity; vendor contracts lack breach notification and code audit clauses
Doctrine Remedy
Contract Control Matrix™ — mandate SBOMs, code-signing verification, build attestation, and continuous dependency scanning in all vendor agreements
Board Implication
NIS2 Art. 21 and DORA Art. 28 impose supply chain due diligence — board accountability for third-party ICT risk is now statutory
04
Hyper-Speed Ransomware
CRITICAL
Over 7,500 organisations listed on leak sites in 2025 (+58% YoY); US attacks up 50% to 5,010 incidents (Recorded Future/Verizon 2026). 80% of ransomware attacks now leverage AI tools in some capacity. 57 new ransomware groups and 27 new extortion groups emerged in 2025. Median ransom paid jumped from $12.7K to $59.6K; mean recovery cost $1.53M; 64% of organisations refuse to pay. 87.6% of claims involve double extortion (encryption + exfiltration). Ransomware in 44% of all data breaches; 88% of SMB breaches. Top groups: Qilin, Akira, Clop, DragonForce, LockBit 5.0. Pure data extortion without encryption accelerating (StationX/BlackFog/VikingCloud, Apr 2026).
Attack Vector
Intermittent encryption for speed, EDR evasion via legitimate system tools, multi-stage extortion (encrypt + exfiltrate + DDoS threat)
Governance Failure
Recovery time objectives (RTO) assume hours/days, not minutes; backup isolation not validated; crisis communications untested; no board-approved ransom policy
Doctrine Remedy
Recoverability Mandate™ — enforce sub-4-hour RTO, immutable backup verification, automated isolation playbooks, and pre-approved crisis communication templates
Board Implication
Boards must pre-approve ransom decision framework and crisis authority delegation — post-incident improvisation constitutes governance failure
05
Identity-Centric Attacks (IAM Exploitation)
HIGH
Unit 42 2026: identity loopholes drive nearly 90% of all investigations. AiTM attacks increased 146% YoY with ~40,000 incidents detected daily. Starkiller phishing suite (Mar 2026) proxies real login pages via headless Chrome to bypass MFA in real time. Tycoon 2FA dismantled by Microsoft/Europol (early 2026) but successor platforms continue — accounted for 62% of phishing volume before takedown (30M+ fraudulent emails/month). >90% of credential compromises expected to involve automated phishing kits by end of 2026. SpyCloud 2026: 8.6B stolen session cookies recaptured; 84% of compromised accounts had MFA enabled. Token theft now dominant identity vector — AI-powered kits run real-time session hijacking at human speed (WorkOS/Hacker News, Apr 2026).
Attack Vector
MFA fatigue/push bombing, adversary-in-the-middle (AitM) proxy attacks, OAuth/OIDC consent phishing, session cookie replay
Governance Failure
Over-reliance on MFA as single compensating control; no phishing-resistant authentication mandate; privilege access reviews are quarterly, not continuous
Doctrine Remedy
Evidence Chain Model™ — deploy FIDO2/passkeys, enforce continuous authentication, implement just-in-time privilege elevation with session binding
Board Implication
80%+ of breaches involve compromised credentials — IAM governance must be a board-level risk metric, not an IT operational concern
06
Cloud & SaaS Entitlement Abuse
HIGH
Cloud misconfigurations cause 99% of security failures — avg 43 misconfigurations per account; 490% YoY spike in public SaaS attacks (CheckRed 2026). 100% of analysed companies operate SaaS environments with embedded AI; 80% of incidents involve PII/customer data. IBM X-Force 2026: cloud risk defined by identity exposure, weak admin practices, insecure integrations, and limited telemetry. Google Cloud Threat Horizons H1 2026: attackers deploying cryptominers in GKE instances within 1 hour of creation. Shadow AI added $670K to average breach cost; 50% of companies experienced AI-related data exposure. SaaS-to-SaaS OAuth chains create lateral movement invisible to perimeter controls (CheckRed/IBM/Google, Apr 2026).
Attack Vector
Privilege escalation via misconfigured IAM roles, cross-tenant attacks, SSRF to cloud metadata endpoints, shadow IT SaaS token harvesting
Governance Failure
Cloud security posture management (CSPM) not integrated with GRC; entitlement reviews are manual and infrequent; shared responsibility model misunderstood at board level
Doctrine Remedy
Board-Survivable Cyber Architecture™ — enforce CSPM with continuous entitlement monitoring, CIEM integration, and cloud-native zero trust architecture
Board Implication
Cloud concentration risk is a board-level fiduciary concern — DORA ICT concentration provisions apply to critical cloud service dependencies
07
Post-Quantum Harvest-Now-Decrypt-Later
HIGH
Q-Day timeline accelerating sharply: three papers in three months have rewritten quantum resource estimates — what once required 20M qubits now potentially requires <100K under newer architectures (Quantum Insider, Mar 2026). Expert probability of cryptographically relevant QC in 10 years: 28–49% — highest ever recorded. 2026 designated "Year of Quantum Security" by FBI/NIST/CISA. Google sets 2029 internal PQC migration deadline; Pentagon 2030; UK NCSC three-phase: 2028/2031/2035; EU 18-nation statement targets CNI by 2030. >50% of web traffic through Cloudflare now uses PQ key agreement. NSA CNSA 2.0 mandates quantum-safe national security systems by Jan 2027. Canada mandates PQC plans from Apr 2026 (Quantum Insider/NCSC/NIST, Apr 2026).
Attack Vector
Bulk interception of TLS-encrypted traffic, VPN tunnel capture, exfiltration of encrypted databases for future quantum decryption
Governance Failure
No cryptographic inventory; quantum transition roadmap absent from strategic planning; data classification does not account for time-sensitivity of confidentiality
Doctrine Remedy
Evidence Chain Model™ — commission cryptographic asset inventory, implement NIST PQC migration roadmap, classify data by confidentiality time-horizon
Board Implication
Data harvested today may include M&A strategy, IP, and personal data — boards must govern cryptographic transition as a strategic programme
08
Zero-Day Edge & IoT Exploitation
ELEVATED
Ivanti EPMM zero-days CVE-2026-1281/1340 (CVSS 9.8) exploited since July 2025 — state-linked exploitation confirmed 6 months before disclosure; widespread exploitation began immediately post-patch. Fortinet FortiClient EMS CVE-2026-35616 (CVSS 9.1) actively exploited from 31 Mar 2026 — watchTowr detected exploitation 4 days before Fortinet advisory; CISA KEV catalog added 6 Apr; 2,000+ exposed instances (Shadowserver). Enterprise edge and endpoint software confirmed as highest-risk zero-day battleground (CyberNewsCentre, 9 Apr 2026). Window between disclosure and mass exploitation collapsed to hours. Edge devices from Barracuda, Citrix, Fortinet, Ivanti, Palo Alto, SonicWall under sustained nation-state and eCrime campaigns (Unit42/watchTowr/Tenable, Apr 2026).
Attack Vector
Zero-day exploitation of network edge appliances, firmware implants persisting across reboots, OT/IoT lateral movement via unmanaged devices
Governance Failure
Edge devices excluded from vulnerability management programme; firmware patching not mandated; asset inventory incomplete for OT/IoT
Doctrine Remedy
Contract Control Matrix™ — enforce vendor SLA for zero-day response, mandate network segmentation for edge devices, require firmware integrity verification
Board Implication
UK PSTI Act and EU CRA impose security-by-design obligations for connected devices — boards must ensure procurement governance includes firmware lifecycle management
09
Geopolitical CNI Sabotage
ELEVATED
FBI confirms Salt Typhoon hacked 200+ companies across 80 countries (Aug 2025); Dec 2025: intrusions detected in US House committees. Volt Typhoon maintains 5+ year persistence in US energy, water, and transport CNI — rapidly rebuilt botnet after 2024 disruption. Feb 2026: Senator Cantwell demands AT&T/Verizon CEO testimony; Mandiant assessment reports still withheld. US House Oversight hearing concludes federal agencies need "proactive cybersecurity strategy" against state-sponsored threats. FBI IC3 2025 report: US cybercrime losses hit $21B — CNI threats intensifying. CISA counter-advisory AA25-239A targets Chinese actors worldwide. Finland flags Russian/Chinese cyber espionage targeting government and CNI. BRICKSTORM malware actively deployed against VMware vSphere (Congress.gov/CISA/FBI, Apr 2026).
Attack Vector
Pre-positioned implants in SCADA/ICS, destructive wiper malware, coordinated multi-sector disruption timed to geopolitical flashpoints
Governance Failure
Geopolitical risk not integrated into cyber risk assessments; no threat-informed defence posture; cross-sector interdependencies unmapped
Doctrine Remedy
Board-Survivable Cyber Architecture™ — implement threat-informed risk assessment, model sector interdependencies, establish government liaison protocol
Board Implication
NIS2 essential entity obligations and national security directives require boards to demonstrate geopolitical threat awareness in risk governance
10
Insider Risk — AI-Amplified
ELEVATED
Insider risk costs hit $19.5M per organisation annually — up 123% since 2018 (Proofpoint 2026). Only 10% report zero incidents (down from 17%); 20+ incidents per year doubled. 60% of organisations express high concern over AI-amplified insider risk; 73% of IT staff say AI creates invisible exfiltration paths. Fastest data exfiltration cases in 2026 occur 4× quicker than prior year — one intrusion achieved exfiltration within 4 minutes of access. 39.7% of all AI interactions involve sensitive data, often unintentionally (Cyberhaven Labs). Only 20% confident they can detect AI-related insider incident before significant damage. Gurucul 2026: "AI became an insider" — shadow AI added $670K to avg breach cost (IBM/Proofpoint/Cyberhaven, Apr 2026).
Attack Vector
LLM-assisted bulk data summarisation and exfiltration, shadow AI tool data leakage, AI-generated pretexting of internal targets
Governance Failure
Insider threat programme does not account for AI-augmented capabilities; DLP policies pre-date generative AI; AI acceptable use policy absent or unenforced
Doctrine Remedy
AI Accountability Stack™ — enforce AI usage monitoring, DLP modernisation for LLM interactions, and insider threat programme augmented with behavioural analytics
Board Implication
Directors must ensure AI governance includes insider risk dimension — failure to control AI-enabled data loss exposes personal liability under data protection law
THREAT INTELLIGENCE LAST REFRESHED: 9 April 2026 · AUTO-UPDATED DAILY
Reserve Mandate Email Direct