AI drives 36% surge in disclosed vulnerabilities; yet two-thirds of ransomware deployments still start with compromised credentials

Beazley Security's Q2 2026 Quarterly Threat Report finds agentic AI reshaping vulnerability research far faster than it is changing how attackers break in.

• Disclosed vulnerabilities increased 36% in Q2, while confirmed exploitations in the wild only grew 10%
• Compromised credentials remained the leading initial access vector, accounting for 67% of ransomware intrusions investigated by Beazley Security
• Beazley Security Labs issued 40% more critical zero-day advisories to clients than in the previous quarter

WEST HARTFORD, Conn., Aug. 18, 2026 /PRNewswire/ -- Beazley Security today releases its Quarterly Threat Report for Q2 2026, finding that the widespread adoption of agentic AI in vulnerability research drove a 36% quarter-over-quarter increase in newly disclosed vulnerabilities while the methods attackers used to breach organizations remained almost entirely unchanged.

Vulnerabilities confirmed as actively exploited and added to the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities catalog rose only 10% over the same period, a gap that further amplifies an already difficult prioritization challenge facing security teams. Read the full report at: https://beazley.security/insights/quarterly-threat-report-second-quarter-2026.

AI reshapes vulnerability research faster than exploitation

Disclosure volume has historically moved within a 10% band from quarter to quarter. That pattern broke in 2026, rising 18.5% in Q1 and another 36% in Q2.  Beazley Security Labs (BSL) attributes the surge to the rapid operationalization of agentic AI across research programs. The strain of the higher volumes is visible industry-wide: NIST no longer enriches every new CVE; HackerOne's Internet Bug Bounty paused submissions citing AI-assisted research; Pwn2Own issued applicant rejections for the first time; and Cisco restructured its disclosure model outright.

Attackers experiment with AI, but still succeed with credentials

Threat group TeamPCP compromised the TanStack developer package suite in an incident that produced more than 500 million downloads of infected packages within hours, then published its worm's vibe coded source code on a criminal forum alongside a cash-prize competition for the most damaging supply chain compromise. Sysdig separately documented JADEPUFFER, assessed as the first ransomware campaign driven end to end by a large language model.

While dramatic, these headlines did not change how most intrusions actually started. Compromised credentials used against internet-facing VPN and remote desktop services accounted for 67% of ransomware intrusions investigated by Beazley Security. This is down from 74% in Q1 but is still dominant by a wide margin.

Law enforcement efforts to disrupt infostealer families have had success but are proving to be short-lived. Within four days of an Operation ENDGAME takedown, StealC malware authors shipped a new version of the malware and offered the previous source code for $60,000. Public ransomware leak-site postings fell slightly to 2,268 but remained nearly 60% above Q2 2025.

Identity attacks evolve past multifactor authentication

Business email compromise (BEC) remained among the most common incident types, with attackers increasingly abusing Microsoft's device code authentication flow to capture session tokens. Because the victim completes a legitimate sign-in and satisfies any organizational MFA requirement, the attacker never needs to intercept a code.

Alton Kizziah, CEO of Beazley Security, said:

"The headline this quarter is that AI made the security industry's job noisier without making the attacker's job fundamentally different. But AI assisted attacks are gaining in both frequency and effectiveness, and we seem to be watching the attackers learn in real time. As AI adoption in the enterprise increases, and as attackers continue to evolve tactics, clients need to remain vigilant and attend to cybersecurity basics. We also recommend organizations consider AI assessments to monitor what AI capabilities are in use across the organization, how these tools are being used, and what is needed to improve management and control frameworks."

About the Beazley Security Labs Quarterly Threat Report

Beazley Security Labs synthesizes global threat intelligence, incident response data and MDR telemetry to identify trends shaping the cyber risk landscape. The Q2 2026 Threat Report covers all of the above, along with emerging ransomware operators and extortion models, high-profile zero-day exploitation, and MDR detection trends. Access the full Q2 2026 Quarterly Threat Report at: https://beazley.security/insights/quarterly-threat-report-second-quarter-2026.  

About Beazley Security

Beazley Security is a global cybersecurity services firm offering managed detection and response, incident response, exposure management, and advisory services to organizations of all sizes. Beazley Security combines decades of cyber security protection, detection, response, and recovery expertise with the actuarial precision and risk mitigation capability of our parent company, Beazley.

SOURCE Beazley Security