Microsoft's 2026 Digital Defense Report says intrusions spanning identity, cloud and supply chains become clearer when defenders join separate signals. Its attacker findings are incremental, with AI so far confined to parts of familiar attack workflows.
Perspective Coverage
7 publishers
- Builder
- Builder 30%
- Operator
- Operator 56%
- Investor
- Investor 14%
Reality
- Evidence70
- Adoption58
- Hype gap+12
- Incentives72
- Confidence70
Sysdig says an LLM-driven operator it calls JADEPUFFER ran a database-extortion campaign on its own, entering through unpatched Langflow flaw CVE-2025-3248. It calls the operation the first documented ransomware run end to end by a model.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+25
- Incentives70
- Confidence50
The Cyber Resilience Act's vulnerability reporting duties are already in force, well before the December 2027 date that governs most of the regulation, and they sit alongside five other disclosure regimes whose clocks start differently.
Perspective Coverage
5 publishers
- Builder
- Builder 36%
- Operator
- Operator 50%
- Investor
- Investor 14%
Reality
- Evidence80
- Adoption
- Insufficient
- Hype gap+15
- Incentives55
- Confidence72
Microsoft says Storm-3168, also tracked as JADEPUFFER, used two stolen Azure service principals to try deleting more than 100 storage accounts. The deletions took about seven minutes, so the 17 hours of API reads before them were when anyone watching those identities had time to act.
Perspective Coverage
6 publishers
- Builder
- Builder 23%
- Operator
- Operator 70%
- Investor
- Investor 7%
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+25
- Incentives55
- Confidence70
CISA's red team breached two critical-sector organisations, and only the water-sector one contained it, isolating machines in up to 20 minutes. The gap traces to alert tuning and triage, so the first fix most SOCs need is analyst time.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+20
- Incentives55
- Confidence45
Google's Threat Intelligence Group counted 141 flaws exploited in the wild from January to August, while monthly disclosures doubled to 10,740. Patch teams do better sorting by that exploited set than by the total, though attackers now reach some public flaws within days.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives60
- Confidence50
Chainguard disclosed 14 Java vulnerabilities that were fixed upstream but never assigned a CVE, one rated critical and one high. Teams still on the affected versions got no scanner alert, some for years, because nobody announced the fixes when they landed at HEAD.
Publishers:chainguard.dev
Reality
- Evidence40
- Adoption25
- Hype gap+10
- Incentives75
- Confidence45
Sysdig's threat research team watched one operator work a marimo notebook host for nine hours with hand-written scripts, and the eight-second jump to a bastion host at the end ran on tooling already staged on disk.
Perspective Coverage
3 publishers
- Builder
- Builder 33%
- Operator
- Operator 60%
- Investor
- Investor 7%
Reality
- Evidence68
- Adoption66
- Hype gap+8
- Incentives72
- Confidence70
The federal cyber agency now recommends planting fake records, credentials and files across critical infrastructure networks, and its pitch to understaffed teams is that an alert on a decoy needs no analyst to interpret it.
Perspective Coverage
5 publishers
- Builder
- Builder 46%
- Operator
- Operator 47%
- Investor
- Investor 7%
Reality
- Evidence70
- Adoption
- Insufficient
- Hype gap+15
- Incentives30
- Confidence75
build1 publisherOne report FlashPoint pulled 555 AI-service tokens out of a single 44,791-token stealer dump, 24 of them still valid, and five dollars is the Telegram bulk price because a copied session leaves the victim's own login working.
Reality
- Evidence22
- Adoption30
- Hype gap+45
- Incentives55
- Confidence28
The Sysdig Threat Research Team says stolen cloud keys were checked against ten hosted model services and fronted to buyers, with the compromised tenant paying for every prompt at invocation prices.
Reality
- Evidence62
- Adoption30
- Hype gap+22
- Incentives72
- Confidence58
One HTTP request runs Python on an exposed Langflow server, and Sysdig's honeypots logged exploit attempts inside a day of the March 17 advisory, before any public proof-of-concept existed. The traffic identified itself as nuclei.
Reality
- Evidence58
- Adoption34
- Hype gap+30
- Incentives78
- Confidence52
Every number in the account traces to a single vendor blog post that lists no CVE identifiers and no disclosure dates. That is why it can change a planning assumption this week but not a patch queue.
Reality
- Evidence24
- Adoption18
- Hype gap+62
- Incentives82
- Confidence60
The vendor's threat-research figures arrive without CVE identifiers, dates or sample sizes, worth flagging because the operational consequence is a patch window attackers shut before any patch gets applied.
Reality
- Evidence34
- Adoption45
- Hype gap+42
- Incentives88
- Confidence38
build1 publisherOne report Anthropic, Sysdig, Unit 42 and GitGuardian describe the same shape of failure, which puts the interesting number on your side of the fence: how long an issued token keeps working after it leaves your control.
Reality
- Evidence27
- Adoption44
- Hype gap+37
- Incentives71
- Confidence57
Sysdig logged a pre-auth SQL injection probe against CVE-2026-42208 from an operator who already had the Prisma schema casing right, which is the argument for putting LLM gateways on the same patch clock as edge appliances.
Reality
- Evidence64
- Adoption38
- Hype gap+12
- Incentives66
- Confidence58
Sysdig counts 19 security-relevant changes in the release. The ones that arrive switched on, led by SELinuxMount at stable, are the ones that can break a running cluster.
Reality
- Evidence58
- Adoption30
- Hype gap+10
- Incentives68
- Confidence54
The AI Workforce Consortium says 28.5% of G7 cybersecurity postings required AI skills, up from 14.2% a year earlier. Senior postings grew 65% in six months; junior postings grew 5.9%.
Reality
- Evidence52
- Adoption58
- Hype gap+22
- Incentives74
- Confidence60