Inside the Threat Landscape: 2026 Cybersecurity Briefing

Join WatchGuard CISO Corey Nachreiner and Director of Security Operations Marc Laliberte as they unpack key findings from the WatchGuard Threat Lab’s H1 2026 Internet Security Report. During the lead half of the year, nearly every measure of attack volume fell while nearly every measure of attack variety rose.

They’ll explain why 95.72% of the malware blocked on endpoints last quarter appeared on exactly one machine, how malware-as-a-service builders and large language models made per-victim payloads cheaper than a mass campaign, and why the exploits reaching networks are ancient; the median vulnerability under attack being first disclosed in 2014. Along the way, they will also cover the generic web shell detection that became the most widespread network attack on Earth, and how ransomware extortion groups grew.

In this webinar, you’ll learn:

• Why the falling attack volume in H1 2026 did not mean falling risk
• How attackers build a unique payload per victim, and what still catches them
• Why decade-old flaws and plain SQL injection still do most of the damage
• How stolen credentials and Windows living-off-the-land (LotL) binaries get attackers around your controls
• Defensive priorities you should act on first