Fortinet's 2026 Global Threat Landscape Report Links AI to 389% Rise in Ransomware Victims
Fortinet Report: AI-Enabled Attacks Fuel 389% Surge in Ransomware Victims
Related Entities(initial)
Organizations
Other
Full Report(when first published)
Executive Summary
Fortinet's FortiGuard Labs has released its 2026 Global Threat Landscape Report, highlighting a dramatic escalation in the cyber threat environment driven by the adoption of Artificial Intelligence by malicious actors. The report's most striking statistic is a 389% year-over-year increase in the number of confirmed ransomware victims in 2025, totaling 7,831 incidents. This surge is linked to the rise of crime-as-a-service offerings like WormGPT and FraudGPT, which use AI to enhance attack sophistication and scale. The research also reveals that the attack lifecycle is compressing, with the average time-to-exploit (TTE) for critical vulnerabilities now as low as 24-48 hours. This new velocity requires defenders to adopt an 'industrialized defense' posture, leveraging their own AI-enabled tools to keep pace.
Threat Overview
The report describes a cybercrime ecosystem that is becoming more interconnected and efficient, operating like a cohesive system. Key findings include:
- AI as a Force Multiplier: Threat actors are using 'agentic AI' to automate and execute more complex attacks. This includes generating polymorphic malware, creating highly convincing phishing content, and optimizing target selection. This has led to a decrease in noisy, brute-force attempts in favor of more intelligent, successful attacks.
- Compressed Attack Timelines: The average time from a vulnerability's disclosure to its widespread exploitation has shrunk from 4.76 days to just 24-48 hours. This leaves defenders with a dangerously small window to apply patches and implement mitigations.
- Surge in Ransomware: The 389% increase in ransomware victims points to a highly successful and profitable criminal enterprise. The top targeted sectors include hospitals/physician clinics and retail.
- Rise of Infostealers: The report notes a 79% increase in logs available from infostealer malware in 2026. This indicates a strategic shift towards comprehensive data theft, which fuels further attacks like ransomware and identity theft.
Technical Analysis
The report analyzes how AI is being integrated into the cybercrime lifecycle:
- Reconnaissance: AI tools are used to scan the internet for vulnerable systems and identify high-value targets based on industry, revenue, and technology stack.
- Weaponization: AI-powered tools like WormGPT and FraudGPT help criminals craft sophisticated phishing emails and social media lures at scale, bypassing traditional spam filters.
- Exploitation: 'Agentic AI' can potentially automate the process of chaining vulnerabilities together to achieve initial access and escalate privileges.
- Post-Exploitation: AI can assist in analyzing exfiltrated data to find the most valuable information for extortion or sale, and can help automate lateral movement within a compromised network.
Impact Assessment
The trends outlined by Fortinet have profound implications for organizational security:
- Increased Pressure on Security Teams: The shrinking time-to-exploit means that traditional weekly or monthly patching cycles are no longer adequate. Security operations must be able to respond to critical threats within hours.
- Higher Likelihood of Successful Attacks: AI-enhanced targeting and social engineering increase the probability that attacks will succeed, making preventative controls and user awareness more critical than ever.
- Need for AI in Defense: The report concludes that human-led security operations alone cannot match the speed and scale of AI-driven attacks. Organizations must invest in AI- and ML-powered security tools for detection, analysis, and response to create an 'industrialized defense'.
- Economic Impact: The massive increase in successful ransomware attacks translates directly to higher costs from ransom payments, business interruption, recovery efforts, and reputational damage.
Detection & Response
- AI-Driven XDR/SIEM: Deploy security platforms that use machine learning and AI to analyze telemetry from across the enterprise (endpoints, network, cloud) to detect subtle anomalies and complex attack patterns that signature-based tools would miss.
- Automated Threat Hunting: Use security tools that can automatically hunt for indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with new threats as soon as they are identified by threat intelligence feeds.
- SOAR (Security Orchestration, Automation, and Response): Implement SOAR playbooks to automate initial response actions, such as isolating an infected endpoint or blocking a malicious IP address, to contain threats at machine speed.
Mitigation
- Risk-Based Vulnerability Management: Prioritize patching based on real-time threat intelligence. Focus on vulnerabilities that are actively being exploited in the wild (i.e., those in the CISA KEV catalog) and apply patches within 24-48 hours.
- Advanced Endpoint Protection: Use next-generation antivirus (NGAV) and endpoint detection and response (EDR) solutions that employ behavioral analysis to stop ransomware and other advanced threats.
- Zero Trust Architecture: Implement a Zero Trust strategy to limit the blast radius of a successful attack. Assume breach and enforce strict access controls and network segmentation to prevent lateral movement.
Timeline of Events
Article Updates
May 1, 2026
New details from Fortinet's report explicitly map AI's role in cyberattacks to MITRE ATT&CK tactics and techniques, and refine targeted sectors.
Update Sources:
MITRE ATT&CK Mitigations
Behavior Prevention on Endpoint
Deploying security solutions that use AI/ML to detect anomalous behaviors is essential to counter AI-driven attacks.
Update Software
With time-to-exploit shrinking, organizations need a highly agile, risk-based patching program to address critical vulnerabilities within 48 hours.
User Training
Ongoing user training is necessary to build resilience against increasingly sophisticated, AI-generated social engineering attacks.
D3FEND Defensive Countermeasures
To combat the surge in ransomware described by Fortinet, organizations must leverage advanced endpoint protection (EDR/XDR) that performs behavioral process analysis. These systems monitor the sequences of actions taken by processes, rather than just their signatures. By baselining normal behavior, they can detect and block the characteristic TTPs of ransomware, such as disabling shadow copies, killing backup processes, and performing mass file encryption. This behavioral approach is crucial for stopping novel or AI-generated malware variants that traditional antivirus would miss.
The report's finding that time-to-exploit has shrunk to 24-48 hours renders traditional patching cycles obsolete. Organizations must adopt an aggressive, threat-informed vulnerability management policy. This involves integrating real-time threat intelligence feeds (like the CISA KEV list) into the vulnerability management process. When a critical, actively exploited vulnerability is announced, it must trigger an emergency change protocol to patch all affected systems within a 48-hour window. This requires automated asset inventory, vulnerability scanning, and patch deployment capabilities.
Timeline of Events
The year 2025 saw a 389% year-over-year increase in confirmed ransomware victims compared to 2024.
Fortinet releases its 2026 Global Threat Landscape Report.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.