ZeroFox releases 2026 Threat Forecast Report

ZeroFox released its 2026 Threat Forecast Report, an annual assessment that outlined key predictions and recommended actions for organizations responding to an evolving cyber threat landscape.

The report framed ransomware and digital extortion as an ongoing risk and reported that 2025 had been a record year for R&DE victims; it also said the first quarter of 2026 would likely show elevated activity tempo compared with other quarters.

ZeroFox Intelligence presented an in-depth assessment across six external threat trends: generative Artificial Intelligence (AI), geopolitical and cyber convergence, deep and dark web activity, ransomware and digital extortion, social engineering, and initial access brokers. The report noted that threat actors trialed operational integration of Generative AI (GenAI) in 2025 and that the Integrated Access and Backhaul (IAB) marketplace maintained steady growth that year.

The report drew on a range of inputs and described ZeroFox Intelligence as being derived from curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels; it also outlined recommended actions organizations could take to address the identified threats.

“In 2026, attacks are expected to become more coordinated, and controlled, which will make it increasingly difficult for standard security tools to detect them. Organizations will also be facing a volatile threat landscape shaped by rapid technological change and geopolitical shifts,” said Robeson Jennings, SVP, Global Services and Intelligence, ZeroFox.

The report projected that in 2026 threat actors would upskill and diversify tactics, expand use of GenAI, operate with targeted political partisanship linked to geopolitical disputes, continue to use deep and dark web marketplaces to share TTPs and recruit affiliates, sustain ransomware and digital extortion activity with a likely peak tempo in Q1, and see initial access broker marketplaces become more sophisticated, specialized, and automated.