CrowdStrike’s 2026 Global Threat Report, subtitled “Year of the Evasive Adversary,” argues that attackers in 2025 did not need to smash defences. Instead, they walked through trusted doors. The numbers, drawn from the security firm’s own telemetry, are stark.
Speed is the new weapon
The average time a cybercriminal takes to move from first access to other systems fell to 29 minutes, 65% faster than the year before. The quickest took 27 seconds. In one case, data theft began within four minutes of entry.
Attacks without malware
Some 82% of detections were malware-free, up from 51% in 2020. Intruders increasingly use stolen passwords, legitimate remote-access tools and ordinary admin functions, so they look like employees. As a result, fake CAPTCHA lures, which trick users into running malicious commands, rose 563%.
AI on both sides
Attacks by AI-enabled adversaries jumped 89%. The report says AI mostly sharpens old tricks, such as phishing, fake personas and scripting, rather than inventing new ones. Even so, there were warning signs. In one npm supply-chain attack, malicious code hijacked victims’ own AI command-line tools, including Claude and Gemini, to hunt for credentials, and CrowdStrike responded to more than 90 affected customers. Criminals also published a fake MCP server that quietly forwarded users’ emails. AI systems, the report says, are now part of the attack surface.
Edge devices under siege
China-nexus activity rose 38%, with logistics targeting up 85%. These groups favour VPNs, firewalls and gateways, which often lack monitoring, and they weaponised new flaws within days. For example, two groups exploited the React2Shell flaw just two days after disclosure. Zero-day flaws exploited before public disclosure rose 42%.
Trust turned against firms
Cloud-conscious intrusions rose 37%, and by 266% among state-linked actors. Valid-account abuse caused 35% of cloud incidents. In these attacks, ransomware crews such as Scattered Spider and Blockade Spider chained together identity systems, SaaS apps and unmanaged virtual machines that security tools never see.
Supply chains were hit hard too. North Korea’s Pressure Chollima stole $1.46 billion in cryptocurrency from Bybit through a compromised wallet provider, the largest crypto theft on record. Then a self-spreading npm worm called Shai-Hulud compromised 690 packages.
What defenders should do
The report’s seven recommendations are practical:
- Secure AI tools and track employees’ use of them.
- Treat identity and SaaS as primary targets, with phishing-resistant multifactor authentication.
- Remove blind spots between security tools.
- Harden developer workflows and dependencies.
- Patch edge devices quickly, within 72 hours for critical flaws.
- Hunt for threats proactively.
- Train people and rehearse incident response.
The takeaway
The report comes from a vendor that sells many of the products it recommends, so readers should weigh its framing accordingly. Still, the pattern is hard to dismiss: attackers move in minutes, hide in legitimate activity and target the trust that modern business runs on. For leaders, the lesson is that defence now depends on visibility across identity, cloud, SaaS, edge devices and AI, not just endpoints.
