Rapid7, Inc. finds human operators drive most cyber threats
2 companies named across 3 categories, one of 39 articles referencing Rapid7. Previous coverage: Rapid7 launches Rapid7 Intelligence combining threat intelligence and vulnerability research (Oct 2026).
Companies mentioned
Best suited for
- Seniority
- Director
- Job function
- Cybersecurity / Security Operations
- Persona
- Security Operations Leader
- Buyer role
- Decision Maker / Budget Holder
- Decision stage
- How to start
- Adoption curve
- Early Majority
- Technology maturity
- Accelerated Attention
- Industry
- Information Technology / Cybersecurity / Security Operations / Threat Intelligence & Digital Risk Protection
Our classification, not the publisher's statement. Best suited for, not only for.
Rapid7, Inc. published its Q3 2026 Threat Landscape Report, which concludes that human operators continue to drive most tracked cyber threats despite widespread warnings about autonomous AI attacks. The findings bear on how defenders weigh adversary speed against patching schedules.
The report found AI used as an operational component in 8% of tracked incidents. Automation increasingly handles tactical execution, while people still select most targets and set attack intent. Adversaries exploit high-severity vulnerabilities within an average of three days, and 71% of those exploits occur in the first week, which shortens the window for remediation through conventional patch cycles.
The analysis combines vulnerability research, frontline incident response, and underground monitoring. Rapid7 Intelligence links those inputs to show how adversary operations unfold. Seventy-nine percent of exploited flaws required no authentication and no user interaction, giving adversaries direct remote access into enterprise environments. Of 63 monitored underground posts, 41 advertised Remote Desktop Protocol or network access.
Ransomware leak-site tracking recorded 1,112 listings tied to U.S. organizations, roughly eight times Germany's total. The Gentlemen, Qilin, and INC Ransom led group activity with 342, 339, and 99 listings respectively. Across espionage and cybercrime campaigns, threat groups change while core tactics, including command and scripting interpreters, credential theft, and remote-access exploitation, persist.
Christiaan Beek, Vice President of Rapid7 Intelligence, said: “Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation, which hasn’t materialized. Only 8% of tracked reporting cites AI as an operational component.”
“But that’s a snapshot of adoption, not a ceiling. Agentic capabilities are advancing faster than any organization, attackers included, can rework its processes around them. The question is when, not if, agentic exploitation scales. Defenders need to move past reactive patching and start grounding their risk appetite in concrete days of exposure.”
The report identifies three priorities for security teams: identifying exposed assets, assessing what attackers can exploit, and ranking fixes by business impact. It also points to rapidly patching remotely exploitable vulnerabilities rather than waiting for scheduled updates, along with behavioral detection and response over static lists of known groups.
Press release, provided by Globe Newswire on behalf of Rapid7. Read the original.