Quorum Cyber has published its 2026 Global Cyber Risk Outlook report, warning that cyber crime has entered what it describes as an industrial phase, driven by advances in AI and the continued expansion of ransomware-as-a-service platforms.

The report paints a picture of a rapidly evolving threats in which automation, scale and professionalisation are reshaping how attacks are conducted.

According to Quorum Cyber, AI automation and Ransomware-as-a-Service have fundamentally altered attacker capabilities, enabling some nation-state actors to automate up to 90% of intrusion activity. At the same time, global vulnerability disclosures surpassed 35,000 for the first time last year.

The report claims that attackers are increasingly abandoning slower encryption-based ransomware techniques in favour of faster, lower-cost data exfiltration attacks.

This shift has coincided with sharp increases in ransom demands across multiple sectors, most notably a 179% rise in financial services and a 97% increase in manufacturing. The report also notes that detection windows are shrinking and barriers to entry are collapsing, allowing less skilled criminals to deploy capabilities that were previously the preserve of elite operators.

The findings are based on incidents and investigations observed across more than 350 organisations globally during calendar year 2025, spanning businesses with between 10 and 10,000 staff.

Over that period, the number of newly formed ransomware groups rose by 30% in the year to October 2025, while global vulnerability disclosures increased by 21%.

Nation States Leaning on Agentic AI for Attacks

The report highlights early evidence of a nation-state group using AI agents to automate the majority of an intrusion, alongside the emergence of new white-label ransomware platforms that enable the rapid launch of branded criminal operations.

Nation-state activity continues to feature prominently in the outlook. Threat actors associated with Russia, China and Iran are identified as the most significant risks to the public sector, while North Korea-linked groups are estimated to have earned more than $2 billion from cyber crime during 2025.

Commenting on the findings, Federico Charosky, Quorum Cyber’s chief executive officer, said: “Over the past year, we have witnessed a marked acceleration in the capability and ambition of threat actors. The proliferation of AI-enabled tooling, combined with an increasingly professionalised cybercriminal economy, has lowered barriers to entry and expanded the reach of even modestly skilled actors.”

Recommended reading

• Cyber-attacks Forcing Enterprises Offline Up to Two Weeks
• Major Banks Hit by Vendor Cyber-attack
• UK Firms Warned to Prepare Now for Russian DoS Attacks

He added: “This report distills the most significant developments observed across our intelligence, incident response, and counter extortion work, offering practical guidance to help organizations anticipate and mitigate emerging risks.”

Alongside the main report, Quorum Cyber has released a series of industry sector companion reports covering nine areas, including energy, financial services and insurance, healthcare and pharmaceuticals, higher education, housing and construction, legal and professional services, manufacturing, the public sector and retail.

Each companion report focuses on sector-specific threat dynamics and outlines practical considerations aimed at strengthening cyber resilience as organisations prepare for 2026.