WatchGuard Technologies, a global leader in unified cybersecurity for managed service providers (MSPs), today announced the findings of its most recent Global Threat Report. The biannual report revealed that threat actors are leveraging AI-assisted tooling to quickly transition from noisy, high-volume campaigns to victim-specific malware, broader low-intensity probing and credential-based access.
Based on anonymized, aggregated threat intelligence from WatchGuard's network and endpoint security products, the report found that attackers are using increasingly sophisticated malware as overall network exploit activity declines. While total volume of network attacks dropped by 79%, novel malware increased by more than 2,000% year-over-year on the endpoint and nearly 96% of endpoint threats in the analyzed period appeared on exactly one machine. These diverging signals indicate threat actors are using Malware-as-a-Service, automation and AI to test a greater number of vulnerabilities across more networks, create unique payloads for specific victims at scale and bypass traditional controls.
"Attackers are not less dangerous because alert totals declined. They are using every tool at their disposal to become more selective and precise," said Corey Nachreiner, Chief Information Security Officer at WatchGuard. "The recent findings show a shift from reusable payloads and high-volume scanning to malware tailored for individual systems, broad low-and-slow probing and credential-based access that can go around perimeter defenses. For MSPs, that makes unified visibility, TLS inspection, AI-powered detection, strong identity controls and continuous response essential to protecting customers at scale."
In addition to the widening gap between attack volume and diversity, key findings from the report also include:
-
Shifts in initial-access techniques – The data showed threat actors are increasingly using trusted accounts and native tools to move around security layers. PowerShell detections declined sharply while credential access, persistence, remote access and defense evasion emerged as the most prominent threat hunting themes in the first half of the year.
-
Quieter networks are being probed more broadly – While average network attacks dropped, unique IPS signatures increased and the top 10 attacks accounted for a smaller share of activity. A generic web-shell signature became the world's most widespread network attack, reaching 75% of machines in Belgium and nearly 60% in Italy and the United States.
-
Attackers continue to profit from old vulnerabilities – The median vulnerability referenced by the report’s top 50 network-attack signatures was disclosed in 2014, and 31 of 44 CVE-referenced signatures targeted flaws that are at least a decade old. SQL injection alone accounted for more than 17% of network-attack detections.
-
Encryption remains the default delivery path – 95% of malware arrived over TLS, but only 20% of deployed devices inspect encrypted traffic. Evasive malware represented nearly one-third of detections overall and 36% of detections observed through TLS inspection on devices using advanced malware defenses.
- Ransomware remains an active and competitive economy – The ransomware ecosystem is simultaneously consolidating and attracting new entrants. Endpoint detections were down by more than 68% year-over-year despite public extortion activity reaching record levels. WatchGuard tracked 41 new ransomware groups in 1H 2026, and the top eight groups accounted for more than half of the nearly 5,000 public extortion claims.
The findings reinforce the need for layered defenses that combine intrusion prevention, advanced endpoint protection, identity security and continuous monitoring. Security teams and MSPs should also prioritize older vulnerabilities and unsupported edge devices, apply MFA and zero-trust access controls, and measure attack reach and diversity in addition to raw alert volume.
Download a copy of the WatchGuard Global Threat report or learn more about how WatchGuard helps MSPs defend against the latest attacks.