Howden Re Cyber Watch H1 2026 threat trend report: Cyber adversaries are moving into their AI-enabled era
Prefer us on Google
Cyber adversaries are entering their AI-enabled era. Howden Re’s latest cyber threat report explores the dynamic cyber threat environment that emerged in H1 2026 as technology and geopolitical tensions intersected. Focused on systemic exposures and potential implications for (re)insurers, the report examines AI, extortion trends, concentration risk, and state-backed disruptive cyber campaigns.
AI is analysed through three lenses: as a form of concentration risk, an enabling tool for both attackers and defenders, and as an accelerator of the attack surface via new code deployment. Despite growing concern around AI, the analysis suggests a more nuanced picture is emerging. While LLMs appear to be contributing to an increase in newly identified vulnerabilities, this has not yet translated into a comparable uptick in vulnerabilities known to be exploited in the wild.
From an extortion perspective, more than 4,500 organisations appeared on data leak sites. Ransom payment rates continued to trend down, although there were reports of several large extortion payments by law firms. Cybercriminals are increasingly targeting cloud services and SaaS integrations to support extortion campaigns. Alongside these developments, Howden Re explores the growing role of identity-based concentration risk. Identity artefacts obtained via open-source supply chain intrusions and third-party compromises created new pathways for systemic cyber events.
Among the key findings:
- AI through three lenses – how large language models (LLMs) are emerging as an exposure, an enabler for both attackers and defenders, and an accelerator of the attack surface.
- The extortion landscape – data extortion victims posted to leak sites increased, with a decline in extortion payments reported.
- Concentration risk – how open-source software and SaaS technologies are creating new systemic exposures.
- State-backed cyber activity – how cyber operations are being integrated into broader military campaigns.
- Looking ahead – the questions Howden Re will be monitoring through H2 2026, including focus on cyber incidents driven by agentic AI tooling.
To receive a copy of the report, along with exclusive, curated, data-driven reporting and alerts on emerging cyber threats, sign up for Howden Re Cyber Watch.