2026 Cybersecurity Predictions Revisited: What Held Up, What Changed, and What Comes Next

Authors: Shaun Bertrand, Ken Lewis, Dan Gregory

Every year brings no shortage of cybersecurity predictions, but few are revisited once the year is underway. We see that as a missed opportunity. Looking back at what held up, what changed, and what was overlooked can be just as valuable as making the predictions in the first place.

At the beginning of 2026, we identified five areas likely to shape the year (https://astrodefend.com/2026-cybersecurity-projections/): AI-enabled attacks, identity abuse, ransomware evolution, supply-chain compromise, and SaaS-to-SaaS attack paths. As we are just about through the first half of the year, the available evidence suggests that each was directionally correct, but several of them developed differently, or faster, than the industry expected. The important question is not whether the predictions were right. It is what security leaders should do now that the patterns are becoming clearer.

We’re taking a three-part approach to this series. Part 1 will look at which of our 2026 predictions have held up thus far. Part 2 will examine the developments the forecasts underweighted or missed. And Part 3 will focus on what security leaders should prioritize for the remainder of the year. We’ll release one installment each week.

Part 1: Which 2026 Cybersecurity Predictions Held Up?
Part 2: What the Forecasts Underweighted
Part 3: What Security Leaders Should Prioritize for the Rest of 2026

Part 1: Which 2026 Cybersecurity Predictions Held Up?

What we will discuss throughout this section is what we, and others, projected, what the evidence says, what changed, and what it means for you.

1. AI Will Dominate Both Offense and Defense

The Projection:

Our projection was directionally strong, and certainly wasn’t something that was hard to forecast. Almost everyone in cybersecurity could see this coming. Attackers are clearly using AI to increase speed, scale, research capacity, social-engineering quality, malware development, and evasion. The qualification is that AI has not replaced traditional intrusion methodologies. It is making familiar methods better, faster, and stronger.

The Evidence:

In April, Microsoft reported a widespread AI-enabled device-code phishing campaign that used generative AI to create highly targeted lures based on the victim’s role. The attackers also automated the generation of device codes, reconnaissance, and post-compromise activity. Many accounts were compromised, with stolen authentication tokens used for persistence and email exfiltration. *1
In May, Google Threat Intelligence reported the first case in which it identified a threat actor using a zero-day exploit that it believes was developed with AI. Google also documented AI-assisted polymorphic malware and PROMPTSPY, malware capable of using AI to interpret a compromised system and dynamically generate commands. *2
The defensive use of AI accelerated as well. In April, Mozilla reported that its Firefox releases included fixes for hundreds of AI-assisted security findings, including 271 issues specifically tied to Anthropic’s Claude Mythos Preview.. *3

The Takeaway:

The prediction certainly held up, but the support evidence and story is more around acceleration rather than complete autonomy.

2. Identity & Trust Become Critical Vulnerability Focus Areas

The Projection:

This was another projection that was widely anticipated, and the evidence has clearly supported it. But the real story is not simply that identity attacks increased. It’s more about how identity now connects nearly every major attack surface: cloud, SaaS, remote access, service accounts, API tokens, OAuth grants, and NHI’s (AI agents and machine identities).

The Evidence:

Google Cloud’s H1 2026 Threat Horizons Report found that identity compromise underpinned 83% of the cloud compromises it analyzed. The report also noted an increase in vishing and the theft of SaaS tokens to quietly access and exfiltrate data from cloud environments. *4
In January, Google tracked ShinyHunters-linked campaigns that used phone calls and company-branded credential harvesting sites to steal SSO credentials and MFA codes. Once inside, attackers used the compromised SSO session to access whatever SaaS platforms and data the victim was authorized to use, including SharePoint, OneDrive, Salesforce, and potentially Slack. *5

The Takeaway:

This was one of the clearest validations of the January forecast, but the attack is moving beyond passwords into sessions, tokens, permissions, help-desk processes, and machine identities.

3. Continued Ransomware Attack Evolution

The Projection:

As organizations have significantly increased their resiliency against data encryption based ransomware attacks, we projected that attackers will increasingly prioritize the theft of sensitive and confidential data and push towards an exfiltration first strategy.

The Evidence:

Our expectation that ransomware operators would increasingly adopt an exfiltration-first strategy has been reinforced by Arctic Wolf’s 2026 Threat Report. Data-only extortion incidents increased from 2% to 22% of the firm’s incident-response cases, an elevenfold increase. Arctic Wolf attributed the shift partly to organizations becoming more capable of recovering from encryption events, prompting some attackers to bypass encryption altogether and focus on stealing sensitive information and threatening its disclosure. *6
BlackFog’s Q1 2026 Ransomware Report found that data exfiltration occurred in 96% of the ransomware attacks it tracked. The average undisclosed incident involved 743 GB of stolen data, with victims given an average of only 7.7 days to meet the attackers’ demands. *7

The Takeaway:

The forecast held up, but the bigger takeaway is that ransomware continues to adapt. As organizations improve their ability to recover from encryption, attackers are shifting toward data theft, extortion, and other tactics designed to preserve their leverage.

4. Supply Chain Attacks Will Continue to Expand

The Projection:

Supply-chain risk appeared in so many annual forecasts, but much of the discussion remained centered on traditional vendors, 3^rd parties, and enterprise software. Our projection focused more specifically on the open-source ecosystem and the trust organizations place in shared packages, libraries, and software components.

During the first half of 2026, attackers repeatedly targeted npm packages, maintainer accounts, and the CI/CD pipelines used to publish trusted software. These were not simply cases of vulnerable code finding its way into an application. Attackers deliberately inserted malware into legitimate packages, knowing those packages would be downloaded automatically by developers and build systems across thousands of downstream environments.

The Evidence:

Axios. Attackers published two malicious versions of Axios, one of the most widely used JavaScript HTTP clients, with more than 100 million weekly downloads. The poisoned versions introduced a hidden dependency that installed a cross-platform remote-access trojan on Windows, macOS, and Linux. The malware could begin communicating with attacker infrastructure within seconds of installation and then erase evidence of its own presence. *8
Bitwarden CLI and Checkmarx distribution channels. A malicious package impersonating the Bitwarden CLI was distributed through npm as part of a broader compromise affecting Checkmarx controlled software delivery channels. The same campaign also poisoned Docker images, GitHub Actions, and VS Code extensions, demonstrating that attackers were not limiting themselves to one registry or package format. The payload stole cloud, CI/CD, and developer credentials and attempted to use them to compromise additional packages. *9
Red Hat Cloud Services packages. At least 32 packages in the @redhat-cloud-services npm namespace were compromised after an attacker gained access to a Red Hat employee’s GitHub account and manipulated the associated build pipeline. The affected packages averaged approximately 80,000 weekly downloads collectively. The malicious releases carried valid provenance because they were produced through the legitimate, yet compromised, pipeline. *10

The Takeaway:

This projection not only held up, the pace and sophistication exceeded our expectations. Attackers increasingly turned compromised npm maintainers, credentials, and build pipelines into scalable distribution channels capable of reaching hundreds of packages and thousands of downstream environments.

5. SaaS-to-SaaS Attack Paths Will Become an Initial Access Vector

The Projection:

Our forecast predicted that attackers will chain SaaS applications together compromising one low-risk or lightly monitored platform and using it as a launch point to access higher-value systems such as identity providers, collaboration tools, CRM platforms, code repositories, and cloud management portals. The projection was right about the risk, but early evidence suggests we were ahead of the volume. Trusted SaaS integrations have enabled serious downstream compromises, though the pattern has not yet become as widespread as we expected.

The Evidence:

Klue breach. According to Huntress, the attacker used a long-disused but still active credential created for an abandoned integration project to compromise Klue’s infrastructure. The attacker then inserted code designed to collect the OAuth tokens Klue customers had granted to connect Klue with other platforms. Those tokens were subsequently used to query customer CRM systems directly and exfiltrate data. *11
Anodot and Snowflake. A compromise of SaaS analytics provider Anodot reportedly exposed authentication tokens used to access customer environments. Attackers used those tokens to steal data primarily from Snowflake accounts and also attempted to pivot into Salesforce. Snowflake stated that its own systems had not been compromised; the access came through a trusted third-party integration. *12

The Takeaway:

The SaaS-to-SaaS projection held up because trusted automation has become both a business enabler and an attacker’s lateral-movement mechanism. The evidence suggests this threat is still emerging rather than fully mainstream and we suggest to keep a look out on it for H2 2026.

Part 1 Closing Statement

Looking back at the first half of 2026, most of the projections we identified have held up, although not always in the way we expected. AI has accelerated familiar attack methods, ransomware tactics continue to evolve, identity remains central to compromise, and open-source supply-chain attacks have advanced faster than we anticipated, while SaaS-to-SaaS attacks have emerged more selectively.

The bigger story, however, is not only what held up. It is what moved faster than expected, what spread more widely, and what created new operational pressure for security teams. In Part 2, we’ll look at the developments the original forecasts underweighted or missed altogether and what they reveal about where the threat landscape is heading next, and why those shifts matter for security leaders now.

Part 2: What the Forecasts Underweighted

In Part 1, we looked back at our original 2026 projections and found that most of them held up decently, although not always at the pace or scale we expected. In Part 2, we’re turning our attention to the developments that were underweighted, overlooked, or simply moved faster than we expected, and what they tell us about how the threat landscape is changing.

1. Social Engineering is finally moving out of the inbox

We’ve been hearing it for years, vishing, smishing, and other social engineering attacks were going to move away from traditional email based vectors. While some social engineering attacks have certainly focused away from that traditional email vector, it never occurred at the alarming clip that we were told that it would. Until now.

What we’re seeing now through this overlooked projection is not simply “better phishing”, but the shift towards live, interactive manipulation through phone calls, text messages, device-code authentication and deepfakes. Organizations have spent years training employees to inspect email. And attackers are increasingly choosing channels where employees must make decisions in real time.

Mandiant found voice phishing rose to 11% of intrusions, while Verizon found simulated mobile based attacks produced 40% higher successful click rates than email-based attacks. *13

2. The vulnerability window effectively disappeared.

The speed in which adversaries can operate now, fueled by AI, is not just alarming, it’s becoming increasingly difficult for organizations to keep up. The other surprise is not that vulnerabilities are exploited, it’s how quick, and how often before patches are available.

Mandiant estimated an average time to exploitation of negative seven days, meaning exploitation was frequently occurring before a patch had been released. It also documented edge-device persistence approaching 400 days in some BRICKSTORM compromises. *14

Patch management based primarily on monthly cycles is absolutely disconnected from adversary timelines. The industry knows this, but is challenged with how to effectively address it.

3. AI became an attack surface, not just an attacker tool

Our January article anticipated attackers and defenders using AI. What deserves additional focus is that enterprise AI systems and agents now require their own security architecture.

NIST describes risks including indirect prompt injection, poisoned models, harmful autonomous actions, inadequate access constraints, and agents pursuing unintended objectives. In a large scale red teaming exercise involving more than 250,000 attack attempts against 13 frontier models, researchers found at least one successful hijacking attack against every model tested. *15

An AI agent with access to email, files, applications, code repositories, or financial systems is simultaneously an application, an identity, and a privileged automation platform. The attack surface is now wider than it ever has been leveraging AI technologies as a primary conduit.

4. Regulation and geopolitics became operational security inputs

While regulations and compliance mandates are not traditional vulnerabilities, they do increasingly determine security priorities. The EU AI Act’s transparency requirements are scheduled to apply beginning August 2, 2026, including requirements to disclose certain AI interactions and label defined categories of AI-generated or manipulated content. *16

On the geopolitical front, CrowdStrike reported China-nexus activity increased 38%, targeting of the logistics sector increased 85%, and DPRK-linked incidents rose more than 130%. The UK NCSC also warned in January that Russian-aligned hacktivist groups were continuing disruptive attacks against government and critical-infrastructure organizations. *17

Part 2 Closing Statement

The first half of 2026 has made one thing clear, the biggest risks are not always the ones receiving the most attention at the start of the year. Several developments accelerated faster, spread wider, or created more impact than many forecasts anticipated. In Part 3, we’ll bring everything together and focus on what security leaders should prioritize for the rest of 2026.

Part 3: What Security Leaders Should Prioritize for the Rest of 2026

Parts 1 and 2 told us a pretty consistent story. Attacks are moving faster, identity continues to sit at the center of most compromises, trusted software and integrations are being used against organizations, and AI is creating an entirely new layer of access and risk.

The answer is never to try to fix everything at once. Based on what the data is telling us, there are a handful of areas security leaders should prioritize for the rest of 2026.

1. Strengthen Identity Controls for People, Sessions, and AI Agents

What to focus on: Move beyond passwords and focus on the identities, sessions, tokens, and AI agents attackers are increasingly targeting.

How to do it: Prioritize phishing-resistant MFA for critical systems, improve the ability to detect stolen sessions and tokens, and treat AI agents like any other privileged identity. They need defined ownership, limited permissions, and appropriate monitoring.

Identity weaknesses played a role in nearly 90% of Unit 42 investigations, while identity-based techniques drove 65% of initial access. *18 Google Cloud also found that identity compromise was involved in 83% of the cloud compromises it analyzed. *19

2. Manage Vulnerabilities Based on Active Risk

What to focus on: Reduce the amount of time between identifying a critical, exploitable vulnerability and fixing it.

How to do it: Use the CISA Known Exploited Vulnerabilities catalog and current threat intelligence to identify what actually needs to be fixed first. Automate the remediation of critical vulnerabilities where possible and continuously measure internet-facing exposure instead of relying on annual assessments and monthly patching cycles.

Verizon found that vulnerability exploitation became the leading initial-access vector, accounting for 31% of breaches. *20 Mandiant also reported an average time to exploitation of negative seven days, meaning attackers were often exploiting vulnerabilities before a patch was even available. *21

3. Secure the Trust Built Into Software and SaaS

What to focus on: Understand which software packages, vendors, integrations, and third parties have trusted access to your systems and data.

How to do it: Maintain an inventory of critical software dependencies and SaaS integrations, remove unused OAuth connections and credentials, and apply stronger controls to build pipelines, package publishing, and third-party access. The fact that something has been trusted in the past does not mean that trust should remain permanent.

Verizon found that third-party involvement increased 60% and was present in 48% of breaches. *22 Unit 42 also found that more than 60% of vulnerabilities in cloud-native applications existed in transitive libraries rather than direct dependencies. *23

4. Put Guardrails Around AI Agents

What to focus on: Control what AI agents can access, what they are allowed to do, and how those actions are monitored.

How to do it: Start by identifying which agents are being used and what access they have. Apply least privilege, require human approval for sensitive or irreversible actions, and make sure agent activity is logged in a way that can be monitored and investigated.

An AI agent with access to email, source code, files, financial systems, or cloud platforms should be treated as a privileged user, not just another application.

In a NIST-supported red-teaming exercise involving more than 250,000 attacks against 13 frontier models, researchers found at least one successful agent-hijacking attack against every model tested. *24

5. Prepare to Investigate Incidents Across Multiple Platforms

What to focus on: Make sure incident response can follow an attacker across identity, endpoints, cloud, SaaS, and third-party systems.

How to do it: Update response plans to include session and token revocation, OAuth access, SaaS audit logs, cloud activity, and third-party coordination. Exercises should include incidents that begin with a phone call, stolen token, or compromised integration, not just traditional malware and ransomware attacks.

Unit 42 found that 87% of intrusions crossed multiple attack surfaces. *25 Mandiant also reported that voice phishing grew to 11% of observed intrusions, making it the second-most common initial-access vector in its dataset. *26

Closing Statement

The data does not tell us that security leaders need to completely rethink their strategies for the second half of 2026. It does tell us that several familiar priorities need to move faster and account for a much wider attack surface.

Identity now includes sessions, tokens, machine identities, and AI agents. Vulnerability management needs to be driven by active exploitation rather than patching schedules. And the trust organizations place in software packages, SaaS integrations, and third parties needs to be continuously reviewed.

The organizations that are best prepared for the rest of 2026 will not be the ones trying to respond to every new emerging headline. They will be the ones using the available evidence to focus on where attackers are consistently finding leverage and making objectively measurable improvements in those areas.

*1 https://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/

*2 https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access

*3 https://www.securityweek.com/claude-mythos-finds-271-firefox-vulnerabilities/

*4 https://cloud.google.com/security/report/resources/cloud-threat-horizons-report-h1-2026

*5 https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft

*6 https://arcticwolf.com/resources/press-releases/arctic-wolf-threat-report-highlights-11x-growth-in-data-extortion-incidents-and-continued-dominance-of-ransomware/

*7 https://www.blackfog.com/blackfog-q1-2026-ransomware-report-press-release/

*8 https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan

*9 https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/

*10 https://www.stepsecurity.io/blog/multiple-redhat-cloud-services-npm-packages-compromised

*11 https://www.huntress.com/blog/klue-breach-investigation

*12 https://rhisac.org/threat-intelligence/active-data-theft-campaign-targeting-snowflake-customers-via-anodot-third-party-saas-integration-breach/