The 2026 Threat Landscape: Identity Is the New Perimeter

Multiple 2025–2026 vendor outlooks converge on a clear shift: from perimeter and device compromise toward identity and active-session compromise, fed by infostealers and edge-device exploitation, with ransomware and extortion still dominant and AI acting as a force multiplier rather than a wholly new threat class. These are vendor publications with commercial interests, so specific figures should be read as directional — but the direction of travel is consistent across sources.

Dominant Themes

• Identity & MFA bypass: attackers increasingly “attack the session” — stealing live session tokens to neutralise standard MFA — and use adversary-in-the-middle phishing to intercept cookies. T1539 T1078 T1557 See token theft and AiTM phishing.
• Infostealers at scale as the access feeder: vendor telemetry reported millions of newly infected hosts in 2025–2026, with families such as Vidar, StealC and Lumma prominent (figures are single-vendor estimates).
• Edge-device exploitation: VPN, firewall and managed-file-transfer zero-days remain a leading entry vector. T1190 See our edge-device deep-dives.
• Ransomware as a “login event”: valid-credential entry and lateral movement through fragmented identity estates, plus mass data-extortion via edge zero-days — exemplified by Clop’s campaigns against managed-file-transfer software (CVE-2024-50623) and, as reported in 2025, Oracle E-Business Suite (CVE-2025-61882).
• AI-enabled threats in phishing, deepfakes and scaled social engineering — see our AI threat landscape.
• Supply-chain and shared control surfaces: attacks unfolding across identity, cloud, edge and SaaS-to-SaaS trust relationships.

State-Nexus Espionage

• China: Volt Typhoon critical-infrastructure pre-positioning (CISA advisory AA24-038A) and Salt Typhoon telecom espionage (allied advisory AA25-239A), with Canada and allies named among those affected.
• Russia: pro-Russia hacktivist DDoS alongside state cyber-espionage.
• Iran: persistent espionage and influence activity.
• North Korea: revenue-driven — the 2025 Bybit theft attributed by the FBI to a DPRK cluster, plus fraudulent-IT-worker schemes. See Famous Chollima and TraderTraitor.

What to Prioritise in 2026

• Make identity the control plane: phishing-resistant MFA/passkeys, session-token binding and short lifetimes, and continuous re-authentication.
• Defend against infostealers: EDR, credential-exposure monitoring, and mandatory rotation of exposed credentials and tokens.
• Run an edge-device programme: inventory, rapid zero-day patching, config hardening and egress monitoring for VPN/firewall/MFT appliances.
• Assume-breach ransomware readiness (immutable backups, segmentation, least privilege, tested IR); audit SaaS-to-SaaS OAuth grants and MSP access; and add AI-aware fraud controls with out-of-band verification.