CLOUD and Software-as-a-Service (SaaS) environments are now prime targets for cyber attackers, as revealed in a report by Darktrace. In the first half of 2026, a shift in tactics saw attackers move from exploiting malware to compromising identities, focusing on areas such as email authentication and cloud entitlements. Advanced phishing tactics have emerged, with many attacks featuring sophisticated social engineering and targeting VIPs.
AI's growing role in enterprises has also created new vulnerabilities, exemplified by AI-generated malware and ransomware campaigns, suggesting a shift towards quality attacks over quantity. Darktrace emphasizes that trust is becoming a critical attack surface as attackers leverage compromised identities and legitimate administration tools.