The global digital landscape is witnessing a radical shift in how cyberattacks are planned and executed. These attacks are no longer scattered individual efforts, but have transformed into organized industrial-scale operations. In this context, HPE has revealed the findings of its first comprehensive cyber threat research report for 2026, titled “In the Wild.” The report highlights how modern adversaries operate on a large scale, targeting various global industries and critical public sectors with sophisticated methods.
Large-scale offensive infrastructure
The report is based on a precise analysis of actual threat activities observed globally throughout 2025. The findings show that cybercrime is now managed much like major corporations, with attackers utilizing automation and exploiting known security vulnerabilities to execute large-scale campaigns. Approximately 1,186 active campaigns were tracked worldwide, reflecting a rapidly evolving ecosystem characterized by professionalism and precise strategic targeting of high-value sectors.
Statistics show that government institutions were the most targeted sector globally, recording 274 attack campaigns targeting federal and regional bodies, followed by the financial sector with 211 campaigns, and technology with approximately 179 campaigns. This sustained focus by hackers on valuable data and financial gains underscores that no sector is immune to these attacks, including defense institutions, manufacturing, healthcare, and education.
Artificial intelligence in the service of attackers
One of the most prominent topics addressed in the report is hackers’ resort to advanced techniques to increase the speed and impact of their attacks. Some groups have adopted automated workflows resembling industrial “assembly lines” via communication and instant messaging platforms to extract stolen data in real time. More dangerously, there is widespread exploitation of generative artificial intelligence technologies.
These uses include producing synthetic voices and deepfake video clips to be used in phishing attacks and impersonating senior executives. The report also tracked digital extortion gangs conducting advanced market research on virtual private network (VPN) vulnerabilities to improve breach strategies and raise the efficiency of their operations for maximum financial return.
Cybersecurity experts’ vision
Commenting on these in-depth findings, Mounir Hahad, head of the HPE Cyber Threat Labs, explained that this report reflects the harsh daily reality organizations face. He emphasized that the research is based on actual, field-based threat activities rather than theoretical tests in controlled environments, allowing for a clear understanding of how attackers adapt and why they succeed.
“These direct observations help enhance detection and defense capabilities, giving clients a clearer view of potential cyber threats affecting their data and operations, which means stronger security and faster response when facing organized attacks.”
Practical steps to enhance security resilience
The report asserts that effective defense against these cyber threats is not achieved merely by purchasing new security tools, but by improving coordination and visibility across the entire network. To improve security posture, the report recommends taking the following steps:
- Breaking down silos: Sharing threat intelligence among teams and clients, and applying a Secure Access Service Edge (SASE) approach to unify networks and security.
- Fixing common entry points: Securing virtual private networks and endpoints to close the paths frequently exploited by attackers.
- Applying Zero Trust principles: Enhancing continuous user and device authentication and verification before granting access rights to limit lateral movement within the network.
- Enhancing visibility using artificial intelligence: Adopting advanced detection systems that assist in discovering, analyzing, and responding to attacks with extreme precision and speed.
Establishing new labs to face challenges
In response to these escalating challenges, the company announced the launch of a new lab to unify security research expertise and intelligence for both HPE and Juniper Networks. This integration aims to provide products with real-time intelligence to detect and effectively repel attacks.
David Hughes, senior vice president and general manager of networking security, stated that the goal of creating this new entity is to bridge the gap between advanced research and actual security outcomes, pointing out that countering attackers who operate with the efficiency of global enterprises requires an identical level of strategy and operational precision. Notably, the report is now available to leaders and decision-makers, and will be discussed extensively during the specialized RSA Conference in San Francisco between March 23 and 26, 2026.
FAQs
What is the most prominent conclusion in the 2026 cyber threat report?
The report revealed that digital adversaries are now adopting institutional business models resembling major corporations, using automation and specialized teams to execute large-scale attacks on critical sectors.
How do attackers exploit artificial intelligence technologies?
Hackers use generative AI to produce deepfake videos and synthetic voices to impersonate executives and execute sophisticated phishing attacks.
What are the most heavily targeted sectors according to the report?
Government institutions topped the list of targets, followed by the financial and technology sectors, confirming the attackers’ focus on targeting national infrastructure and sensitive financial data.
How can organizations protect themselves from these sophisticated attacks?
Organizations can enhance their protection by applying the “Zero Trust” principle, securing entry points such as VPNs, utilizing AI-backed detection systems, and enhancing security intelligence sharing among teams.
