Q3 2026 Threat Review

An AI agent ran a ransomware intrusion from first access to encryption with no human at the controls. A stolen developer credential became full administrative control of a cloud environment in about three hours. State-linked operators reached US water utilities across a dozen states, a Polish power grid, and the telecom backbone that carries everyone else's traffic.

Attackers at every level now have access to the same capability. Subscription tools sell AI-written phishing lures and deepfake identity kits for less than a streaming service, and a Russia-linked espionage operation used AI to rebuild detected malware on its own. Polished phishing copy and clean code no longer mark a serious attacker, and clumsy grammar no longer marks a minor one.

Conflicts reach well past their theaters, so sector relevance to a named conflict is a weak basis for prioritizing risk. Phishing kits intercept one-time passcodes in real time, and an impersonated help desk caller on Microsoft Teams can turn one approved remote session into enterprise-wide access.

This report covers AI-driven threats, geopolitical conflict, and social engineering, maps each to MITRE ATT&CK and ATLAS, and closes with the detection, verification, and hygiene priorities to bring into your next planning cycle.