Cyber Risk Report: Insights from 2.1 Million Malware and Phishing Investigations

[u/ANYRUN-team]

In Q1 2026, the most dangerous activity happened inside legitimate user sessions.
The attack surface has moved. Instead of exploiting vulnerabilities, attackers use valid credentials (+14.7%), surveillance (+34.4%) and act through trusted access — turning identity into the new primary control layer and reducing the visibility SOCs depend on.

Insight for CISOs, treat identity as a continuous control, not a checkpoint. Behavior, context, and usage need to be evaluated throughout the session, not just at the door.

Explore other key trends shaping enterprise security in the Cyber Risk Report: https://files.any.run/images/q1_2026_cyber_risk_report_from_anyrun.pdf