“The threats are bigger and better resourced, and the risks are worse than they have ever been.” — CyberCX Executive Director, Hamish Krebs

That sets the tone for CyberCX’s 2026 Threat Report, a sobering look at how cybercriminal activity has evolved over the past year. The report reflects a landscape where attackers are more persistent, organisations are struggling to detect intrusions quickly, and extortion has become the dominant mode of attack.

Threats are escalating and becoming harder to detect

CyberCX highlights a continued deterioration in the global threat environment where attackers are embedding themselves deeper into networks and operating with growing boldness. Their shift from opportunistic data theft to aggressive, disruptive behaviour is unmistakable.

Detection timelines reflect this trend clearly. Financially motivated attacks now take an average of 68 days to detect, nearly triple the previous year’s average.

This widening detection gap gives attackers more time to move around, study systems, elevate their access, and prepare more damaging actions.

The report highlighted, “The time it takes to detect financially motivated cyber attacks almost tripled from 24 to 68 days…”

Cyber extortion has surged past Business Email Compromise

Extortion now sits firmly at the top of incident types CyberCX responded to, overtaking BEC for the first time. This shift shows a clear preference among threat actors for fast, high‑impact tactics like encrypting systems, stealing sensitive data, or doing both to maximise pressure.

This aligns with CyberCX’s observation that criminal groups have become increasingly organised and opportunistic in exploiting weaknesses.

Financial and Insurance Services are bearing the brunt

Almost one in five incidents CyberCX handled in 2025 affected the Financial and Insurance Services sector. This marks the first time in several years that Healthcare wasn’t the most targeted industry.

“Banks, insurance companies and other financial services are growing targets for cyber criminals…” according to the report.

This shift isn’t surprising. These organisations handle sensitive data, operate on time‑critical systems, and are known to face significant operational pressure during outages, making them high‑value, high‑leverage targets for attackers.

AI is amplifying both opportunity and risk

AI is now a regular part of the cybercriminal toolkit. CyberCX found attackers using generative AI to produce custom scripts and payloads to speed up their attacks.

But the most immediate AI‑related risk is internal: staff unintentionally leaking sensitive information into public AI tools. CyberCX notes “2025 was the first year that CyberCX’s DFIR team was engaged for these types of AI data spill incidents, and likely reflects the continued surge in AI adoption by many organisations and individuals.”

This highlights the need for businesses to set clear, practical AI‑use guidelines. Not to slow down innovation, but to prevent avoidable data exposure.

MFA isn’t enough, attackers are bypassing it

Multi‑factor authentication (MFA) remains one of the most effective controls organisations can put in place. For the vast majority of businesses, MFA significantly reduces the likelihood of account compromise by stopping attackers who rely on stolen passwords alone.

However, CyberCX’s report highlights a growing trend in more advanced attacks, particularly in large enterprise environments, where attackers are finding ways to work around traditional MFA rather than defeating it outright. One of the key techniques driving this shift is adversary‑in‑the‑middle (AITM) session hijacking.

Session hijacking occurs when an attacker tricks a user into signing in through a highly convincing phishing site. Instead of stealing the password, the attacker captures the active login session after MFA has already been completed. This allows access to systems as if they were the legitimate user without triggering additional MFA prompts. CyberCX observes this most often in large enterprises where MFA is already baseline, and attackers resort to session hijacking because simpler password‑based attacks no longer work.

For most SMBs, MFA remains a critical and highly effective defence. But the rise of session hijacking reinforces an important point: no single control is enough on its own. Strong identity security now requires a layered approach, combining MFA with user awareness, phishing‑resistant authentication where possible, and ongoing monitoring to detect unusual sign‑in behaviour early.

Stolen credentials remain the #1 attack entry point

Even with new techniques emerging, compromised credentials continue to be the most common initial access vector. Attackers often leverage passwords stolen via information stealers, phishing, or reuse across services.

CyberCX reports that valid accounts and remote access services are still the most abused entry paths, reinforcing that identity security remains the cornerstone of effective cybersecurity.

What this all means for 2026

CyberCX’s 2026 Cyber Threat report doesn’t just highlight the problems but shows patterns that organisations should treat as clear warning signs:

• Extortion is now the dominant threat.
• Detection timelines are increasing.
• AI misuse is creating new internal risks.
• Credentials remain the easiest way in.
• MFA is no longer a standalone defence.
• High‑value sectors are becoming more exposed.

The message is straightforward, attackers are moving faster, staying hidden longer, and exploiting predictable weaknesses. But this isn’t a losing battle, ith thoughtful controls around identity, AI use, monitoring, and defence in depth, organisations can significantly reduce exposure.

How Diamond IT Can Help

Understanding your cyber risk is the first step toward reducing it. Our Business Technology Consulting team help organisations uncover hidden vulnerabilities, assess real‑world attack paths, and identify priority areas for improvement through structured Cyber Risk Discovery. We translate technical findings into straightforward actions that make your business safer and more resilient. If you’d like to discuss your organisation’s cyber risk or get support from our team, reach us on 1300 307 907 or email us at enquiries@diamondit.com.au.