The Comcast Business 2026 Cybersecurity Threat Report analyzed 79.3 billion cybersecurity events detected across its cybersecurity customers between March 1, 2025, and February 28, 2026.The report found that the window between exposure and impact has narrowed. AI coding tools let attackers develop new exploits before patches are available, while the underlying techniques stay familiar. Phishing and drive-by compromise attacks still lead by volume. What shifted is the speed and cost of running them at scale.
- 47.9 billion initial access events and 5.2 billion resource development events, showing the volume of automated attacks probing the perimeter and the infrastructure attackers built to run them.
- 288.9 million active scans, evidence of adversaries constantly hunting vulnerable devices.
- 25.4 billion phishing events and 21.9 billion resource development events, showing the volume of automated attacks probing the perimeter and the infrastructure attackers built to run them.
- 5.8 million attempts to gain covert access to employee browsers through malicious extensions, browser sync, and session theft.
- 57,000 DDoS events driven by botnets seeking to interrupt digital business services with hyper-volumetric traffic.
The total means an average of roughly 2,514 cybersecurity events every second.
Stolen credentials, hijacked sessions, and an explosion of non-human identities have made identity the focal point of defense. AI agents and APIs open new inroads into the enterprise, each one carrying permissions no employee would be granted. Defending against this requires identity management paired with ongoing behavioral analysis rather than a one-time verification.
A growing share of the corporate attack surface consists of devices nobody in the organization owns, manages, or monitors. Attackers compromise devices in employees’ homes and businesses such as routers, cameras, streaming devices, and point-of-sale terminals, conscript them into residential proxy networks, and rent the traffic to buyers who want their activity to look ordinary. Researchers traced this infrastructure and identified large groupings of infected devices forwarding traffic for outsiders. Perimeter controls do not account for these devices, because no one has mapped them.
Download the report.
