The Speed of Cyber Threats Is Changing. Are We Keeping Up?

Introducing the Trellix November 2026 CyberThreat Report

By John Fokker and Ilya Kolmanovich · November 4, 2026

Cybersecurity has always been a race between attackers and defenders. But something fundamental is changing: the speed of that race.

Over the past six months, we’ve seen threat actors operate with greater autonomy, move faster across the attack lifecycle, and increasingly incorporate artificial intelligence into their operations. At the same time, many of the techniques they rely on remain remarkably familiar.

This is one of the central findings of our latest Trellix CyberThreat Report, covering April through September 2026.

The challenge for security leaders is not simply dealing with more threats. It is understanding which threats matter, recognizing how adversaries are changing, and ensuring that defensive capabilities can respond before an incident escalates.

This is where threat intelligence and detection engineering must come together.

The threat landscape: Familiar techniques, unprecedented speed

From a threat intelligence perspective, the reporting period revealed several important developments.

Ransomware activity continued to grow, with both the number of active groups and victim posts reaching record levels. New groups are entering the ecosystem at a remarkable pace, accounting for nearly a third of ransomware victim posts by August.

But while the names change, the underlying techniques often do not.

Threat actors continue to exploit known vulnerabilities, abuse legitimate tools, and take advantage of weaknesses in identity and access management. What is changing is how quickly these techniques can be combined and executed.

Geopolitical developments also continued to influence cyber operations. We observed increased Iran-aligned detections during the escalation of regional hostilities, while Russia continued its combination of cyber activity and gray-zone operations alongside the conflict in Ukraine. China-aligned activity showed a different pattern, reminding us that changes in detection volumes should never automatically be interpreted as changes in adversary intent.

For CISOs, the message is straightforward: Understanding the threat landscape requires more than tracking individual incidents or the latest ransomware group. It requires context, prioritization, and an understanding of adversary behavior.

AI is changing the economics of cyberattacks

Perhaps the most consequential development is the growing role of artificial intelligence.

We are moving beyond AI as a simple assistant toward systems capable of executing increasingly complex tasks with limited human intervention.

Our research highlights examples of AI supporting extortion operations, autonomous attack chains, and new forms of malware targeting AI environments themselves.

At the Trellix Advanced Research Center, we expect nearly every capable threat actor to leverage AI in some form. This does not mean every attack will become fully autonomous. Instead, we expect AI to become embedded throughout the attack lifecycle, from reconnaissance and social engineering to vulnerability research and malware development.

The April introduction of Anthropic's Claude Mythos Preview provided an important glimpse into what comes next. Its demonstrated ability to autonomously discover vulnerabilities and develop working exploits illustrates how AI could fundamentally accelerate vulnerability research and exploit development.

Although these particular capabilities have been deployed in a controlled defensive research environment, the implications extend far beyond it.

We should expect the time between vulnerability discovery and potential exploitation to become increasingly compressed.

For security organizations already struggling with vulnerability backlogs, limited resources, and complex technology environments, this creates an uncomfortable reality: traditional approaches to prioritization and remediation may not be fast enough.

From intelligence to detection: Closing the gap

This brings us to an equally important question: How should defenders respond?

The hard part is no longer seeing the activity; it's seeing it in time. When an exploit goes from disclosure to weaponization in hours, a correlation that surfaces tomorrow is just a well-documented breach. Speed has turned detection engineering from an accuracy problem into a latency problem. From a detection engineering perspective, the answer cannot simply be to create more detection rules or generate more alerts.

Security operations centers (SOCs) are already dealing with overwhelming amounts of telemetry. Adding additional detections without improving their quality, context, and operational value risks making the problem worse. Instead, we need to focus on understanding adversary behavior and connecting the signals that reveal it.

Individual events rarely tell the complete story. A suspicious process, unusual authentication event, or unexpected network connection may appear insignificant in isolation. But when correlated across an entire attack sequence, these activities can reveal a much more serious threat.

This is why detection engineering must be continuously informed by threat intelligence.

Intelligence identifies the adversaries, techniques, and emerging behaviors that matter. Detection engineering translates that knowledge into practical detection logic, meaningful correlations, and actionable signals for defenders.

Equally important, operational feedback from detections and investigations helps intelligence teams refine their understanding of the threat landscape.

The objective is not more intelligence or more alerts. It is better decisions, made faster.

Building defenses that operate at machine speed

For CISOs and SOC leaders, our latest findings reinforce several important priorities.

• First, vulnerability management needs to be driven by actual exploitation risk and business exposure, not vulnerability counts alone. As AI accelerates vulnerability discovery, effective prioritization becomes even more critical.
• Second, organizations must expand their security visibility to include AI agents, orchestration frameworks, and the credentials and infrastructure these systems access. AI adoption introduces new operational opportunities, but also new attack surfaces.
• Third, security teams should prioritize behavioral detection and correlation across the full attack lifecycle. Understanding the sequence of an intrusion is far more valuable than treating every suspicious event as an isolated problem.
• Finally, automation must become a fundamental part of defensive operations. Human expertise remains essential, but relying entirely on manual processes to counter increasingly automated adversaries is unsustainable.

Intelligence and detection engineering: Better together

Within the Trellix Advanced Research Center, we see threat intelligence and detection engineering as two sides of the same mission, built on unified pipelines designed for speed and accuracy.

Understanding what adversaries are doing is essential. Translating that understanding into effective protection is what ultimately makes a difference.

Our latest CyberThreat Report provides a detailed view of the threat landscape, the growing influence of AI, and the operational challenges facing defenders.

We encourage CISOs, security leaders, and SOC practitioners to explore the findings and consider what they mean for their own environments.

As the threat landscape evolves and adversaries experiment, automate, and adapt, our responsibility is to ensure defenders can do the same and faster.

Read the Trellix November 2026 CyberThreat Report.