Unit 42 — 2026 IR report on AI-accelerated attacks
AI relevance: Unit 42 finds AI is now compressing the attack lifecycle (recon, phishing, scripting, execution), shrinking time-to-exfiltration for real-world intrusions.
- Unit 42 analyzed 750+ major incidents across 50+ countries to identify 2026 attack trends.
- AI is cited as a force multiplier that makes attacker operations faster and more scalable.
- In the fastest cases, attackers moved from initial access to exfiltration in ~72 minutes, a 4× speedup.
- Identity weaknesses featured in nearly 90% of investigations, reinforcing “log in, don’t break in.”
- Attackers leveraged third‑party SaaS integrations in 23% of cases, expanding supply‑chain risk.
- Multi‑surface intrusions dominated: 87% involved activity across endpoints, cloud, SaaS, and identity.
- The browser was involved in 48% of incidents, reflecting how routine workflows are now attack vectors.
- Extortion is shifting away from encryption toward data‑theft‑first pressure tactics.
Why it matters
- AI‑accelerated tradecraft shrinks defender reaction time, so slow detection becomes a breach amplifier.
- AI ops teams must treat identity and SaaS integrations as primary attack surfaces, not secondary risks.
What to do
- Harden identity: tighten MFA, session lifetimes, token scopes, and privileged access paths.
- Instrument AI pipelines with detection and response automation that can keep pace with sub‑hour attacks.
- Audit SaaS integrations and apply least‑privilege to connectors used by AI/agent workflows.
- Prioritize browser security (isolation, protections, telemetry) given its growing role in intrusions.