Cybercrime is often framed in bombastic terms: an ever-escalating arms race between increasingly sophisticated attackers and ever more desperate defenders. But, according to Fortinet’s latest 2026 Global Threat Landscape Report, the more profound shift is not necessarily the emergence of entirely new forms of attack. Instead, it is the speed, scale and industrialisation with which familiar techniques can now be deployed.
The report paints a picture of a cybercrime ecosystem that increasingly resembles a mature industry. More than four billion stolen credential records were traded or shared on darknet forums in the past year, while ransomware operations continue to evolve into organised, scalable enterprises. Nearly half of suspicious activity observed by Fortinet involved the abuse of legitimate tools rather than bespoke malware, while attackers are exploiting newly disclosed vulnerabilities ever more quickly.
Artificial intelligence sits at the centre of this transformation. But, argues Kash Valji, VP of fabric CSE at Fortinet, AI is not creating an entirely new threat landscape. Rather, it is accelerating an industrialisation of cybercrime that has been underway for years.
Underground marketplaces have long allowed cybercriminals to buy tools, exploits, stolen credentials and even access to compromised systems without possessing advanced technical expertise themselves. What AI changes is the ability for a single actor to operate across far more of the attack chain.
“The big change is the level of automation that AI allows between the criminal function spaces,” says Valji. “You no longer have to pick and choose your areas of strength.” The result is a more efficient, more scalable cybercrime economy – with AI lowering the barriers to entry.
Traditionally, cybercriminals tended to specialise. One group might discover vulnerabilities, another conduct phishing campaigns, another broker stolen credentials or sell access to compromised systems. In effect, you needed a crew: the inside man, the safecracker, the getaway driver, and the fence – specialists operating at different points in the value chain. AI is increasingly collapsing those distinctions, allowing a single actor to operate across much more of the attack lifecycle.
That shift has implications beyond the cybercriminal underground. It also changes how organisations should think about defending themselves. One of the strongest themes running through Fortinet’s report is that the defining characteristics of today’s threat landscape may instead be speed and volume. Reconnaissance, phishing, credential theft and social engineering remain familiar techniques. AI is allowing them to be carried out at unprecedented scale.
Fortinet’s 2026 Global Threat Landscape Report cites a 45 per cent fall in reconnaissance events, with AI tools empowering threat actors to target vulnerabilities with far more focus and efficiency. The result is a surge in targeted attacks, rather than the scattergun approach previously employed.
“The immediate impact is the volume,” says Valji. “Threat actors are no longer wasting time and money on something that may not work.”
For defenders, the challenge is increasingly one of prioritisation. “It’s a case of being able to pick them out in all that increased volume,” Valji continues.
Counterintuitively, the report also suggests that the most capable attackers are not necessarily relying on increasingly sophisticated exploits. Instead, many are returning to one of the oldest routes into an organisation: identity.
With more than four billion stolen credentials circulating on darknet marketplaces, compromised usernames and passwords have become one of cybercrime’s most valuable commodities.
“What we found is that the most competent threat actors we have been tracking over the last few years have switched back to basics,” says Valji.
Rather than investing time developing complex exploits, many are exploiting valid credentials obtained through phishing, password reuse or social engineering. He points to several recent high-profile incidents where identity, rather than technical sophistication, proved decisive.
That shift is becoming even more significant as organisations continue moving workloads and critical services into cloud environments. Traditional network perimeters have become increasingly blurred as users, applications and data are distributed across hybrid and cloud-based systems.
“The boundary is impossible to draw,” says Valji. “15 years ago, you could point to a data centre and build a digital steel fence around it. Now that digital fence has dissipated.”
Despite the increasingly automated nature of cybercrime, however, Valji stresses that AI also affords greater scale to those playing defence.
While AI allows attackers to discover vulnerabilities more quickly, it is equally helping security teams analyse attacks, correlate intelligence and respond far faster than traditional manual investigation. As Valji points out, the same advances in AI are available to defenders as well as attackers, particularly organisations with access to the computing power needed to deploy them effectively.
That observation underpins another of the report’s central themes: the importance of what Fortinet describes as “defensive velocity”.
For many organisations, improving cyber resilience is less about replacing existing infrastructure than improving visibility and responding more quickly to emerging threats. One of Valji’s recommendations is that organisations spend more time understanding how they appear from an attacker’s perspective.
“You almost join the reconnaissance,” he explains. “See what you look like from the outside in.”
That means continuously monitoring external attack surfaces, leaked credentials and newly disclosed vulnerabilities, allowing organisations to distinguish genuine threats from the growing volume of automated background activity.
Responding to AI-driven threats does not necessarily require organisations to rip out and replace their existing security infrastructure. Many existing cyber solutions can be upgraded with AI-enhanced capabilities, Valji advises, although new technologies will also be needed to protect parts of the digital infrastructure that did not previously exist. These include AI gateways, alongside approaches such as continuous threat exposure management and deception technologies, which can help create “tripwires” against attacks involving increasingly capable AI models.
The existence of such solutions should provide enterprises with some solace, Valji concludes. The challenge is not about preparing for entirely new forms of attack, but ensuring that defensive capabilities evolve at the same pace as increasingly automated adversaries. These are threats that security teams are already fluent in; they just need to embrace the tools that empower the cyber function to battle them at ever greater scale and speed.