Fortinet’s FortiGuard Labs Releases 2026 Global Threat Landscape Report

Fortinet released its 2026 Global Threat Landscape Report from FortiGuard Labs, using telemetry data to summarize the active threat landscape and trends observed during 2025. The report’s findings provide a consolidated view of how attackers operated across tactics and where activity shifted over time.

FortiGuard Labs said the report drew exclusively from FortiGuard Labs telemetry and analyzed the 2025 threat landscape using the MITRE ATT&CK framework. It described the threat environment as interconnected rather than a set of isolated campaigns, including end-to-end attack life cycles.

Among the report’s quantified points, FortiGuard Labs reported that time-to-exploit for critical outbreaks was 24–48 hours, compared with a 4.76-day time-to-exploit cited in earlier reports. It also cited FortiRecon adversary intelligence identifying 7,831 confirmed ransomware victims globally, up from approximately 1,600 in the Fortinet 2025 Global Threat Landscape Report. For cloud exposure, FortiCNAPP intelligence said most confirmed cloud incidents originated from stolen, exposed, or misused credentials.

The report also covered AI-enabled cybercriminal tooling and tactics, including claims based on FortiRecon dark web signals about AI-enabled offensive tooling advertised as services. Fortinet separately discussed disruption and reporting efforts tied to cybercrime, including a collaborative effort involving INTERPOL supported by Fortinet through the World Economic Forum Cybercrime Atlas that resulted in the takedown of a cybercriminal network, plus a partnership with Crime Stoppers International for the Cybercrime Bounty program. “Cybercrime is one of the world’s most pervasive and costly threats, and our latest Global Threat Landscape Report reveals how malicious actors are beginning to leverage agentic AI to execute more sophisticated attacks,” said Derek Manky, Chief Security Strategist and Global VP of Threat Intelligence, Fortinet FortiGuard Labs.