The Cyber Threat Landscape Has Shifted Under You

The cyberattack your organization planned for in 2024 is not the cyberattack you will face in 2026.

That is not hyperbole. It is what the data shows, and it is what we see in the resilience and crisis work we do with clients across financial services, healthcare, technology, and critical infrastructure.

The change is not a single new tactic. It is a structural shift in how cyber threats are constructed, delivered, and monetized. Programs built around the assumptions of even two years ago are now defending the wrong perimeter, against the wrong actor, for the wrong outcome.

This piece walks through what has changed across three threat fronts that matter most to executive leaders going into 2026: cyber extortion, insider risk, and AI-enabled identity attacks. Then it lays out where most resilience programs need to close the gap in the next 90 days.

Cyber extortion is no longer a ransomware problem

For most of the last decade, “ransomware” and “cyber extortion” were the same conversation. Encrypt the files. Demand payment for the key. Pay or restore from backup.

That model is on its way out.

In 2026, a growing share of extortion incidents do not involve encryption at all. Threat actors steal data, threaten to publish it, and skip the encryption step entirely. Backup-based recovery, the defense most business continuity programs were built around, no longer applies. There is nothing to recover from. The damage is the disclosure, not the outage.

Public reporting confirms the shift. Symantec and Carbon Black counted 4,737 encryption-based ransomware claims on leak sites in 2025, up just 0.8 percent from 2024. Count the attacks that skipped encryption and the 2025 total rises to 6,182 extortion attacks, a 23 percent increase. The growth is in extortion without encryption. Many Ransomware-as-a-Service operators also practice triple extortion: encrypt, exfiltrate, and contact the victim’s customers, partners, and regulators directly to amplify pressure.

Two changes follow for any organization reviewing its cyber response plan.

 

Old view	New view
A ransomware response is a recovery exercise.	A cyber extortion response is a disclosure decision under pressure.
Backups are the defense.	Decision speed and pre-approved disclosure language are the defense.
Restoration timelines are the metric.	Time to first verified external statement is the metric.

The first hour of a 2026 cyber extortion response is not about restoring systems. It is about deciding what to tell customers, regulators, and the press, often before the technical scope is fully understood. If your tabletop exercises are still focused on restoration timelines, you are practicing the wrong drill.

The third-party pressure layer is also new. Threat actors no longer wait for the victim organization to disclose. They contact your largest customers directly. They email your regulators.
They post your executives’ personal data on social media to escalate the news cycle. By the time your communications team is drafting an internal note, your CEO is already getting calls from reporters and from your top three accounts.

The second change is speed. The 2026 CrowdStrike Global Threat Report found that the average eCrime breakout time, from initial access to moving laterally to another system, fell to 29 minutes in 2025. The fastest it observed was 27 seconds. I talked about what that speed means for your response in Episode 316 of the Managing Uncertainty Podcast. Detection windows that were considered acceptable two years ago are now too slow to matter. Your incident response retainer needs to assume minutes to hours, not days, between initial access and broad compromise.

Insider risk has become an AI problem

The insider threat conversation used to be about a disgruntled employee with a USB drive.

That picture is now incomplete in two important ways.

First, the cost has climbed. The 2026 Cost of Insider Risks Global Report from DTEX and the Ponemon Institute puts the average annual cost of insider risk at $19.5 million per organization, up from $17.4 million in the prior report. The organizations studied averaged about 25 insider incidents a year.

Second, the nature of insider risk has changed. More than half of those incidents come from negligent employees, not malicious actors. And 73 percent of the organizations in the same report worry that unauthorized AI use is creating invisible data exfiltration paths. That is shadow AI: employees feeding sensitive corporate data into unauthorized AI tools, creating exfiltration channels that traditional DLP and monitoring tools were not built to detect.

The deliberate side is also evolving. Ransomware operators are now actively recruiting insiders. In 2025, someone claiming to represent the Medusa ransomware gang offered a BBC cyber correspondent a share of any ransom in exchange for access through his work laptop. He reported it to the BBC’s security team instead. Layoffs and workforce instability heading into 2026 are likely to widen the recruitment pool further.

The implication for resilience leaders is uncomfortable. Insider risk is no longer a quarterly DLP review. It is a real-time governance problem that touches HR, legal, IT, and security at the same time. Programs that treat it as a security-only function continue to miss the most expensive incidents.

Identity is the new perimeter

The third shift is the one most leaders are still underestimating.

In 2026, deepfake tools are cheap and widely available. As far back as 2023, McAfee researchers found that three seconds of audio was enough to clone a voice with an 85 percent match. Real-time video impersonation is no longer a research demo. In 2024, an employee in engineering firm Arup’s Hong Kong office sent about US$25 million to fraudsters after a video call in which the CFO and other colleagues were deepfakes. That is the pattern: a known executive, on a video call, asking for an exception to standard process.

The Palo Alto Networks 2026 forecast frames this directly: identity is “poised to become the primary battleground of the AI Economy in 2026.” And 87 percent of respondents to the World Economic Forum’s Global Cybersecurity Outlook 2026 identified AI-related vulnerabilities as the fastest-growing cyber risk over 2025.

For business continuity and crisis management programs, this matters in a specific way. Identity attacks do not look like incidents on a SIEM dashboard. They look like a normal business transaction approved by a normal-sounding leader. By the time the incident is recognized, the money has moved or the data has left.

The defense is not technological alone. It is procedural. Out-of-band verification for any high-value action initiated by voice or video. Mandatory call-back protocols for wire transfers above a defined threshold. Tabletop exercises that include a deepfake injection. None of these are exotic. Most organizations have not updated their crisis playbooks to require them.

The connective tissue: speed and convergence

Step back from the three fronts and one pattern emerges across all of them.

The threat is not new actors. The same criminal ecosystems and nation-state groups are operating with new speed, new tools, and new monetization models. Ransomware operators are recruiting insiders. Insider events are amplified by shadow AI. Identity attacks are weaponized inside extortion campaigns. A single 2026 incident can include all three vectors at once.

The lines between these categories have collapsed. Your security operations center cannot solve this alone. Your business continuity team cannot solve it alone. Your communications team cannot solve it alone. The response that works is the one where all three of those functions, plus legal and the executive team, are operating from the same playbook, in the same room (physical or virtual), inside the first hour.

This is what I talked about in The Polycrisis Playbook episode of the podcast earlier this year. Cyber risk no longer travels alone. It overlaps with reputational risk, operational risk, regulatory risk, and stakeholder trust, often in the same incident, often inside the same first hour.

Programs that were built to handle one of these things at a time are not built for 2026.

What to do in the next 90 days

Three concrete moves, in order.

Run a tabletop in the next 60 days that tests a data-theft-only extortion scenario, not an encryption event. The decisions are different. The legal exposure is different. Most executive teams have never practiced this version of the call.

Bring HR, Legal, IT, and Security into a single insider risk review this quarter. Map your shadow AI exposure. Identify your detection gap. Define what insider recruitment outreach looks like in your environment and how it gets escalated. This work cannot live solely in the security organization.

Update your executive verification protocols this month. Mandatory call-back for any executive-initiated financial action above a set threshold. A safe word, agreed in person, for high-stakes voice or video requests. A standing rule that no leader is offended by a verification call. These are five-minute decisions that prevent seven-figure losses.

A closing note

The defense in 2026 is not new technology alone. It is faster decisions, integrated teams, and crisis playbooks that match the threats we are actually facing.

Resilience is not a binder. It is a capability. And it can be built.

If your program is still organized around 2023’s threat model, this is the year to close the gap.

Keep Going

A few ways to go deeper if this was useful.

• Read more. Resilience, crisis management, and continuity writing at Bryghtpath Insights, or the structured Ultimate Guide to Crisis Management.
• Run that tabletop. Exercise in a Day® is a fully designed executive tabletop, built and (optionally) facilitated in a single day. The data-theft-only scenario in this post is one we can stand up for you.
• Get a maturity score. Our Resiliency Diagnosis® is a standards-based review that produces a maturity score and a prioritized roadmap.
• Talk to us. Set up a call to think through your program with us.