France & EU · DORA · NIS2 · EU AI Act · ISO 42001 · ANSSI

Threat Radar — Top 10 Cyber Threats

Strategic post-mortem intelligence on the Top 10 cyber threats — each analysed through a governance failure lens with doctrine-mapped remediation.

Major Incidents & Threat Intelligence

Threat Radar — Top 10 Cyber Threats (2025–2026)

Strategic post-mortem intelligence — not news. Each threat is analysed through a governance failure lens with doctrine-mapped remediation and board-level implications.

01
Agentic AI & Autonomous Malware
CRITICAL
CrowdStrike 2026 Global Threat Report: 89% YoY increase in AI-enabled attacks. Average eCrime breakout time now 29 minutes (65% faster than 2024); fastest observed: 27 seconds. Autonomous AI agents account for 1 in 8 reported AI breaches as enterprises shift from experimentation to production deployment.
Attack Vector
LLM-orchestrated attack chains with autonomous decision trees, polymorphic payload generation, self-modifying C2 infrastructure; AI-led tool orchestration coordinating simultaneous multi-target intrusions (GTG-1002 model, Nov 2025)
Governance Failure
No AI-specific threat model in risk registers; SOC playbooks assume human-speed adversaries; board risk appetite statements do not account for autonomous threat escalation at 27-second breakout velocity
Doctrine Remedy
AI Accountability Stack™ — deploy adversarial AI red-team cadence, mandate AI-aware detection layers, update risk appetite to include autonomous threat velocity
Board Implication
Directors face personal liability if AI threat modelling is absent from enterprise risk framework — SEC/DOJ precedent applies to negligent oversight of emerging technology threats
02
AI-Powered Deepfake Fraud
CRITICAL
Average deepfake fraud loss now exceeds $500,000 per incident ($680K for large enterprises). CEO fraud targets 400+ companies daily via deepfakes. Voice cloning achievable from 3 seconds of reference audio (OpenAI Voice Engine). 77% of targeted victims who engaged suffered financial loss. US internet fraud losses driven by AI-generated fraud projected to reach $40B by 2027.
Attack Vector
Real-time voice cloning, video synthesis of C-suite executives, BEC 2.0 with AI-generated contextual pretexting
Governance Failure
Single-factor executive authorisation for high-value transactions; no out-of-band verification mandate; identity assurance policies pre-date generative AI
Doctrine Remedy
Decision Rights Architecture™ — enforce multi-party authorisation with cryptographic verification for all transactions exceeding materiality thresholds
Board Implication
Fiduciary duty requires verification controls proportionate to fraud risk; absence constitutes negligent governance under corporate law
03
Software Supply Chain Hijacks
CRITICAL
TeamPCP campaign (March 2026): four major open-source projects compromised in 8 days — LiteLLM (3.4M daily PyPI downloads), Axios npm (100M weekly downloads), Trivy vulnerability scanner, and Telnyx. Malicious packages harvested AWS/GCP/Azure tokens, SSH keys, and Kubernetes credentials before quarantine. Supply chain attacks surged significantly in March 2026 alone.
Attack Vector
Trojanised updates via compromised build pipelines, malicious package injection (npm/PyPI), CI/CD credential theft, code-signing key compromise
Governance Failure
No SBOM mandate; third-party risk assessments evaluate compliance, not code integrity; vendor contracts lack breach notification and code audit clauses
Doctrine Remedy
Contract Control Matrix™ — mandate SBOMs, code-signing verification, build attestation, and continuous dependency scanning in all vendor agreements
Board Implication
NIS2 Art. 21 and DORA Art. 28 impose supply chain due diligence — board accountability for third-party ICT risk is now statutory
04
Hyper-Speed Ransomware
CRITICAL
95 active ransomware gangs now tracked globally (40% YoY increase). 87.6% of ransomware claims involve double extortion (encrypt + exfiltrate). Claimed victims jumped 58% in 2025. Emerging shift: many groups now skip encryption entirely, rendering backup-centric defences insufficient. Ransomware present in 44% of all data breaches (2026).
Attack Vector
Intermittent encryption for speed, EDR evasion via legitimate system tools, multi-stage extortion (encrypt + exfiltrate + DDoS threat)
Governance Failure
Recovery time objectives (RTO) assume hours/days, not minutes; backup isolation not validated; crisis communications untested; no board-approved ransom policy
Doctrine Remedy
Recoverability Mandate™ — enforce sub-4-hour RTO, immutable backup verification, automated isolation playbooks, and pre-approved crisis communication templates
Board Implication
Boards must pre-approve ransom decision framework and crisis authority delegation — post-incident improvisation constitutes governance failure
05
Identity-Centric Attacks (IAM Exploitation)
HIGH
AiTM attacks increased 146% YoY with ~40,000 incidents detected daily. SpyCloud 2026 report: 8.6 billion stolen session cookies recaptured. 84% of compromised accounts had MFA enabled — session token theft and cookie replay routinely bypass MFA. Tycoon 2FA phishing-as-a-service (dismantled early 2026) processed 30M+ fraudulent emails monthly before takedown.
Attack Vector
MFA fatigue/push bombing, adversary-in-the-middle (AitM) proxy attacks, OAuth/OIDC consent phishing, session cookie replay
Governance Failure
Over-reliance on MFA as single compensating control; no phishing-resistant authentication mandate; privilege access reviews are quarterly, not continuous
Doctrine Remedy
Evidence Chain Model™ — deploy FIDO2/passkeys, enforce continuous authentication, implement just-in-time privilege elevation with session binding
Board Implication
80%+ of breaches involve compromised credentials — IAM governance must be a board-level risk metric, not an IT operational concern
06
Cloud & SaaS Entitlement Abuse
HIGH
Misconfigured cloud IAM policies, over-permissioned service accounts, and shadow SaaS create lateral movement paths invisible to traditional security monitoring.
Attack Vector
Privilege escalation via misconfigured IAM roles, cross-tenant attacks, SSRF to cloud metadata endpoints, shadow IT SaaS token harvesting
Governance Failure
Cloud security posture management (CSPM) not integrated with GRC; entitlement reviews are manual and infrequent; shared responsibility model misunderstood at board level
Doctrine Remedy
Board-Survivable Cyber Architecture™ — enforce CSPM with continuous entitlement monitoring, CIEM integration, and cloud-native zero trust architecture
Board Implication
Cloud concentration risk is a board-level fiduciary concern — DORA ICT concentration provisions apply to critical cloud service dependencies
07
Post-Quantum Harvest-Now-Decrypt-Later
HIGH
Nation-state adversaries intercepting and storing encrypted communications today for future decryption when quantum computers become operationally viable (estimated 2028–2032).
Attack Vector
Bulk interception of TLS-encrypted traffic, VPN tunnel capture, exfiltration of encrypted databases for future quantum decryption
Governance Failure
No cryptographic inventory; quantum transition roadmap absent from strategic planning; data classification does not account for time-sensitivity of confidentiality
Doctrine Remedy
Evidence Chain Model™ — commission cryptographic asset inventory, implement NIST PQC migration roadmap, classify data by confidentiality time-horizon
Board Implication
Data harvested today may include M&A strategy, IP, and personal data — boards must govern cryptographic transition as a strategic programme
08
Zero-Day Edge & IoT Exploitation
ELEVATED
Zero-day vulnerabilities in edge devices, firewalls, and VPN appliances exploited before patches are available — Ivanti, Fortinet, and Palo Alto incidents demonstrate systemic exposure.
Attack Vector
Zero-day exploitation of network edge appliances, firmware implants persisting across reboots, OT/IoT lateral movement via unmanaged devices
Governance Failure
Edge devices excluded from vulnerability management programme; firmware patching not mandated; asset inventory incomplete for OT/IoT
Doctrine Remedy
Contract Control Matrix™ — enforce vendor SLA for zero-day response, mandate network segmentation for edge devices, require firmware integrity verification
Board Implication
UK PSTI Act and EU CRA impose security-by-design obligations for connected devices — boards must ensure procurement governance includes firmware lifecycle management
09
Geopolitical CNI Sabotage
ELEVATED
Salt Typhoon (PRC) confirmed to have compromised 200+ companies across 80 countries, targeting US telecoms and intercepting law enforcement data. Volt Typhoon maintained undiscovered persistence for 5+ years in US energy, transport, and water sectors using living-off-the-land techniques. US Congressional hearings (2026) examining systemic federal cybersecurity failures against persistent state-sponsored threats.
Attack Vector
Pre-positioned implants in SCADA/ICS, destructive wiper malware, coordinated multi-sector disruption timed to geopolitical flashpoints
Governance Failure
Geopolitical risk not integrated into cyber risk assessments; no threat-informed defence posture; cross-sector interdependencies unmapped
Doctrine Remedy
Board-Survivable Cyber Architecture™ — implement threat-informed risk assessment, model sector interdependencies, establish government liaison protocol
Board Implication
NIS2 essential entity obligations and national security directives require boards to demonstrate geopolitical threat awareness in risk governance
10
Insider Risk — AI-Amplified
ELEVATED
AI tools enabling insiders to exfiltrate data at unprecedented scale — LLM-assisted code theft, shadow AI data leakage, and AI-augmented social engineering of colleagues.
Attack Vector
LLM-assisted bulk data summarisation and exfiltration, shadow AI tool data leakage, AI-generated pretexting of internal targets
Governance Failure
Insider threat programme does not account for AI-augmented capabilities; DLP policies pre-date generative AI; AI acceptable use policy absent or unenforced
Doctrine Remedy
AI Accountability Stack™ — enforce AI usage monitoring, DLP modernisation for LLM interactions, and insider threat programme augmented with behavioural analytics
Board Implication
Directors must ensure AI governance includes insider risk dimension — failure to control AI-enabled data loss exposes personal liability under data protection law
THREAT INTELLIGENCE LAST REFRESHED: April 2026 · AUTO-UPDATED DAILY
Reserve Mandate Email Direct