After the exploit, before the impact: A read of Gartner's 2026 threat landscape. by Lucie Cardiet

The report synthesizes Gartner's 2026–2027 ThreatScape and recent disclosures to argue that the most urgent risks are living‑in‑the‑environment threats—attackers with legitimate credentials and tools moving quietly across identity, cloud, network and SaaS. It cites concrete incidents (OAuth-based CRM exfiltration, passive FortiGate credential harvesting affecting large numbers of devices, a 26‑month APT presence via trojanized REDCap, and a QUIC‑over‑Teams C2 implant) and highlights AI as accelerating operator speed, concluding detection must correlate identity and network behavior in real time.