Threat Horizons 2026–2027: what we saw, and what comes next

Every year the world's largest incident response teams publish their reports on the year before, and every year the same phrase comes back: attackers are faster. 2026 was different, because the numbers stopped talking about days or hours and started talking about seconds. In this report we put together what JODOR sensors and deception systems saw inside Saudi Arabia over 56 days with what the most important global and regional studies found in 2026, and then asked the question that matters to any leader: what does this mean for 2027?

2026: the year attacks reached machine speed

CrowdStrike found that the fastest attacker in its 2025 data spread through a network just 27 seconds after breaking in, and that the average eCrime breakout had fallen to 29 minutes. Mandiant found that the hand-off of a victim from the first intruder to a second criminal group now takes a median of 22 seconds, compared with more than eight hours in 2022. On our own sensors, 146 of 173 attackers used a known exploit within ten seconds of arriving. Three organisations, three different datasets, one conclusion: a defence that waits for a person to read an alert will usually arrive after the attacker.

The old doors are still open

You might expect attackers to need new and clever flaws, but the opposite is true. Exploited vulnerabilities were the first step in 32% of the intrusions Mandiant investigated, the sixth year in a row they topped the list. In Verizon's 2026 report, roughly a third of breaches began with an exploited flaw, overtaking stolen passwords for the first time in the report's 19-year history. Worse, patching got slower: the median rose to 43 days from 32, and only 26% of the vulnerabilities on the US CISA list of known exploited flaws were fully fixed across the 13,000 organisations Verizon polled.

At the same time, exploitation began to arrive before the fix. Mandiant estimates that the mean time to exploit has fallen to minus seven days, meaning exploitation now routinely comes before the patch, and CrowdStrike found that 42% of exploited vulnerabilities were used before they were made public. Mandiant also tracked groups that deliberately target VPNs and routers, because those devices rarely carry endpoint detection tools.

Ransomware, suppliers and people

Verizon found ransomware in 48% of breaches and a third party in about half of them, after a 60% rise in a single year. Notably, 69% of ransomware victims did not pay, and payments kept falling. Microsoft found that 73.3% of initial access attempts relied on a user running something, valid accounts, social engineering or phishing. Voice phishing rose to 11% of intrusions in Mandiant's data, making it the second most common way in. In the Middle East specifically, phishing in all its forms, including calls and text messages, was the top attack vector in IBM's study. In short, a convincing phone call now opens more doors than malware does.

AI joined the attacker's toolkit

CrowdStrike reported that activity by AI-enabled adversaries rose 89% in a year. Google saw, for the first time in its own data, malware that asks a language model for its commands during a live attack, and saw an Iranian state-linked group use an AI model to help build its own malware. Even so, Mandiant was candid: 2025 was not the year in which breaches were the direct result of AI, and most intrusions still stem from human and systemic failures. In our view the shift has started but is not complete, and that is exactly what makes 2027 important.

Our region: a ransomware surge

CloudSEK recorded ransomware-related threat intelligence feeds about the region rising from 17 in April 2025 to a peak of 357 in June 2026, more than twenty times. Hacktivism was still the largest threat by volume, but the ransomware rise continued even after hacktivist activity fell sharply in April 2026. Positive Technologies found that Saudi Arabia was the second most targeted country in the region with 12% of attacks, that 44% of successful attacks ended in a data leak, and that government was the most targeted sector at 25%, followed by industry at 15%.

The cost here is not theoretical. IBM put the average cost of a breach in Saudi Arabia at SAR 27 million, and Saudi organisations took 226 days to find a breach and another 59 days to contain it. Financial services had the highest cost, averaging SAR 38 million. On the other hand, breaches cost about SAR 8.9 million less in organisations that used AI and automation widely, SAR 23.15 million against SAR 32.08 million. Speed has become a budget line, and every day an attacker stays hidden adds to the bill.

What JODOR sensors saw

Between 29 August and 23 October 2026, JODOR sensors and deception systems inside the Kingdom recorded 450,908 requests from 22,924 addresses, including 2,207 attackers from 84 countries. Half of them were on none of 34 public blocklists. Of the 220 attackers hosted inside Saudi Arabia, 194 were on no list at all. 76% were seen on a single day and then disappeared, and an attacker typically asked for passwords and keys 0.75 seconds after arriving. None of them matched a known state-linked group, and no match does not mean absence. The picture is clear: most attackers are automated and opportunistic, and half of them are new to every public list.

We tested the defence as well. Over 15 days of live operation, AI agents settled 82% of 6,168 alerts without a person, and 41% were settled by rules alone because a security control had already proven the attack. The typical time from an attacker's first request to a block was 20 minutes. 5% of blocks were later undone, most of them automatically by safety checks. Machines with clear rules, and a person in the loop, kept pace with the attacker without losing control.

The 2027 horizon: five things we expect

First, we expect AI to carry out more steps of an attack on its own, from scanning to writing the first exploit. That is why proven attacks should be blocked within seconds by rules, unclear cases should go to fast automated analysis, and people should be kept for the decisions that cannot be undone.

Second, we expect exploitation before a fix exists to become routine, especially on VPNs, firewalls and other edge devices. Patching remains essential, but it is no longer enough on its own. Start by listing every system exposed to the internet, patch edge devices first, and watch who is probing you so that you see a new exploit before it reaches a real system.

Third, we expect voice phishing, stolen sessions and supplier compromise to open more doors than malware. The attacker will sound like your colleague and arrive through your supplier. The answer is phishing-resistant multi-factor sign-in, checking any payment or access request through a second channel, and reviewing supplier access every quarter.

Fourth, we expect ransomware against Gulf organisations to keep rising, with waves of hacktivism that follow regional events. Local attackers are the least visible on global lists, so you need intelligence about your own attackers, real rehearsal of ransomware recovery, and tested, isolated backups.

Fifth, we expect the move to post-quantum cryptography to reach the board table. NIST's final transition plan, published in October 2026, deprecates today's common public-key algorithms after 2030 and disallows them after 2035. Long-lived data such as identities, contracts and financial or health records is already exposed to what is called "collect now, decrypt later". The start is simple: know where you use cryptography, and ask your suppliers about their plans.

Where to start

Every one of these steps starts with two things: knowing what you have, and knowing who is targeting it. That is why JODOR built Managed Deception, which gives you a list of your own attackers without installing anything. Book a 45-minute threat briefing, or start a free 30-day pilot.

Sources: JODOR sensors and deception systems in Saudi Arabia (29 August to 23 October 2026) and JODOR's 15-day AI agent test, collected by JODOR and not published in raw form. CrowdStrike 2026 Global Threat Report (February 2026), based on tracking more than 280 named adversaries. Mandiant M-Trends 2026 (March 2026), based on Mandiant's incident response work for its clients, so it leans towards serious incidents. Verizon 2026 Data Breach Investigations Report (May 2026), covering more than 22,000 confirmed breaches, as reported by GovInfoSecurity and Help Net Security. Microsoft Digital Defense Report 2026, covering July 2025 to June 2026. Google Threat Intelligence Group's tracker of attacker use of AI (November 2025). CloudSEK's Middle East Cyber Threat Landscape 2025–2026, as reported by Arabian Reseller. Positive Technologies' analysis of Middle East threats from Q2 2025 to Q1 2026. IBM Cost of a Data Breach 2026 findings for Saudi Arabia and the Middle East, a study of 602 organisations carried out by the Ponemon Institute. NIST IR 8547, Transition to Post-Quantum Cryptography Standards, final version published on 27 October 2026, the US standards body's official timeline for retiring today's public-key algorithms.