AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report

Unit 42’s 2026 Global IR analysis concludes that AI is primarily amplifying the speed and scale of existing cyberattacks rather than creating entirely new methods of compromise; examples discussed include AI-assisted malware development, agentic ransomware orchestration, and token jacking of cloud AI services. The report emphasizes that traditional TTPs—credential theft, phishing, exploitation of known vulnerabilities, and ransomware—remain central, while AI reduces operational friction and compresses attack timelines, stressing the need for prevention-focused defenses and AI-savvy defenders who can validate AI outputs and adapt controls accordingly.