DURING the third quarter of 2026, Rapid7’s threat landscape analysis shows high‑severity flaws being exploited extremely quickly, with an average of three days from disclosure to exploitation. About 71% of these vulnerabilities were used within the first seven days, and 79% are classified as “holy grail” flaws, meaning they are remote, require neither credentials nor local user involvement. Ransomware remains the dominant threat globally, with business services, manufacturing and healthcare most targeted. The United States was the most attacked country, accounting for around 60% of incidents, followed by Germany, Italy and Canada.
The quarter saw notable ransomware operators and activity: The Gentlemen (342 incidents) and Qilin (339) led in success, with INC Ransom, DeadLock and Krybit following. Government entities experienced increased ransomware impact, up 15% versus the prior quarter and concentrating attacks in the US (rising from 33% to 45%).
In parallel, threat actors began incorporating AI as an operational component in some incidents (8%), though the data indicate human operators still predominantly drive attacks rather than fully autonomous AI. Rapid7 emphasises automation of the mid‑attack “tactical middle”—technique selection, target triage and recovery from failed steps—without requiring human intervention.
Defence guidance from Rapid7 urges monitoring of AI API usage patterns for unusual hosts or processes and watching for fragmented, multi‑session prompting to evade safeguards. The report also notes a continued presence of nation‑state activity, including Russia‑linked groups such as Energetic Bear, Void Blizzard and Sandworm, with C‑Major focusing on phishing and mobile spyware against Indian military and diplomatic staff.