Halfway through 2026, the threat landscape has done the usual thing of mutating faster than the people defending it expected. The first half gave us three patterns worth noticing: supply chain attacks still lead, identity attacks crossed a threshold, and AI became both a weapon and a target. None of those three are new. All three accelerated in ways the industry did not fully price in at the start of the year.
What follows serves as a short version of the mid year review. The full report runs longer. The shorter version is what the working defender actually has time to read.
What broke in the first half
Three patterns, in roughly that order of damage. The first runs as the supply chain compromise, with three named incidents in six months, each one of which used a different vector (the managed service provider, the software update, the open source package), and all of which produced downstream breaches that outlasted the original compromise by months. The second runs as the identity driven breach, with the dominant entry point for the first half being the session token, the OAuth refresh, the federated identity, the identity perimeter that the traditional MFA does not cover. The third runs as the AI assisted attack, with the threat actors using AI to scale the social engineering, the reconnaissance, the phishing, the deepfake voice, the work that used to require a team of humans now requiring a single operator with a good prompt.
What worked in the first half
Three patterns, in roughly that order of how much the defender can claim credit. The first runs as the network segmentation that contained the lateral movement. The breaches that hit segmented environments in the first half showed a markedly lower blast radius than the breaches that hit flat networks. The second runs as the immutable backup that actually restored. The ransomware variants that did the worst damage in the first half hit the backup first, which means the immutable backup, the one that writes once and cannot be modified, ran as the difference between recovery and ransom payment. The third runs as the threat intelligence that arrived in time. The defenders who subscribed to the right feeds, who shared indicators with the right communities, who automated the enrichment, ran ahead of the attacker more often than the defenders who tried to do the analysis in house.
What to watch in the second half
Three patterns, in roughly that order of how likely each one runs as a defining story of the back half. The first runs as the post quantum cryptography migration hitting the wall. The federal deadlines are here, the enterprise migration sits behind, the gap sits widening. The second runs as the AI agent compromise. The agents that enterprises deployed in the first half sit on a thinner security model than the human users, with the permissions that the human users would not have, the audit trail that the enterprise cannot easily reconstruct. The third runs as the deepfake assisted fraud hitting the wire transfer. The first half produced a handful of high profile cases. The second half will produce more, with smaller targets and lower profile, which means the case will be harder to detect before the money moves.
The bottom line
The first half of 2026 confirmed the trend the industry has been watching for three years. The defender who segments, who backs up immutably, who consumes threat intelligence in real time holds the line. The defender who runs flat, who relies on the backup that the ransomware can touch, who tries to do the analysis in house, does not. The second half will test the same pattern in three new ways.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
