WatchGuard Report: AI-Driven Cyberattacks Shift to Precision Over…

Event summary

WatchGuard's 1H 2026 threat report shows a 79% drop in network attack volume but a 2,000% increase in novel malware on endpoints.
96% of endpoint threats were unique to a single machine, indicating highly targeted attacks.
Credential access, persistence, and defense evasion emerged as top threat hunting themes.
95% of malware was delivered over TLS, but only 20% of devices inspected encrypted traffic.
41 new ransomware groups appeared in 1H 2026, with the top eight accounting for over half of public extortion claims.

The big picture

WatchGuard's findings highlight a broader industry trend where cybercriminals are leveraging AI to make attacks more targeted and evasive. This shift necessitates a move from volume-based detection to behavior-based monitoring, particularly as attackers exploit older vulnerabilities and encrypted channels. The ransomware economy's dual dynamics of consolidation and new entrants suggest a competitive landscape where scale and specialization will determine success.

What we're watching

AI Tooling Impact: How AI-assisted malware development will affect detection and response strategies for MSPs.
Credential-Based Attacks: Whether the shift to credential-based access will force enterprises to accelerate zero-trust adoption.
Ransomware Consolidation: The pace at which the ransomware ecosystem consolidates while still attracting new entrants.