Recorded Future’s latest State of Security Report finds cyber operations are now inseparable from physical conflict, coercion and espionage, with AI accelerating deception and instability across the global threat landscape.
Recorded Future has released its 2026 State of Security Report, showing that cyber operations are now inseparable from physical conflict, coercion and espionage.
The report emphasises that geopolitical fragmentation and the adoption of AI are creating an environment of instability, with persistent attacks becoming the norm in the global threat landscape.
Dr Christopher Ahlberg, Co-Founder of Recorded Future, shared the key findings and highlighted how cyber operations, intelligence and emerging technologies are reshaping geopolitical competition and national security during a panel discussion at the Munich Cyber Security Conference.
The State of Security Report identifies 2025 as a clear inflection point in which cyber activity became tightly intertwined with real-world geopolitical outcomes. The report finds that AI is contributing to this convergence by accelerating the scale of deception, identity abuse and uncertainty faster than institutions can adapt – contributing to heightened instability in 2026.
“Uncertainty is no longer episodic – it’s the operating environment,” said Levi Gundert, Chief Security and Intelligence Officer, Recorded Future. “As geopolitical norms weaken, state objectives, criminal capability and private-sector technology are increasingly reinforcing one another, compressing warning timelines and expanding plausible deniability. AI is accelerating that dynamic not through autonomous attacks, but by scaling deception and eroding trust inside decision-making processes. In 2026, cyber risk will be defined less by singular events and more by persistent, fragmented pressure that reshapes competition, escalation and stability over time.”
Key findings include:
• Cyber as coercion: Nation states are increasingly using cyber access – particularly at the edge of networks and connectivity infrastructure – as a form of strategic leverage that can be activated during crises.
• Identity as the new attack surface: Most serious intrusions now begin with stolen credentials rather than technical exploits, shifting the centre of gravity of security to identity and access.
• AI-driven verification failure: While fully autonomous AI cyber operations have not yet materialised, AI is already amplifying deception, social engineering and identity abuse at scale.
• Durable state-aligned ecosystems: From Russian influence operations backed by resilient criminal infrastructure to mercenary spyware and North Korean access-driven sanctions evasion, cyber capabilities are proving adaptive and difficult to dismantle through policy pressure alone.
The report predicts that in 2026, cyber threats will be defined by fragmented, constant pressure driven by persistent access, decentralised criminal ecosystems, influence operations and synthetic identities that will replace singular attacks with continuous, low-visibility disruption.
Key predictions include:
• 2026 will be defined by fragmented, always-on threats: Cyber risk will increasingly come from constant, overlapping activity by states, criminals and proxies rather than from singular, headline-grabbing attacks.
• State cyber operations will shift fully to persistent pressure: Nation-states will rely on quiet pre-positioning, credential theft and identity access to maintain continuous leverage and enable rapid escalation with little warning.
• Connectivity disruption will become the go-to tool of coercion: Instead of destructive cyberattacks, states will favour brief, reversible disruptions to cables, satellites and telecom infrastructure to signal power while staying below escalation thresholds.
• Cybercrime will grow smaller, faster and harder to disrupt: Ransomware and extortion groups will splinter into agile, modular crews that prioritise speed, persistence and visibility over large payouts.
• Influence operations will favour volume over credibility: Hacktivists and influence networks will use AI to flood the information environment with exaggerated or mixed-authenticity claims, sustaining confusion even when narratives lack credibility.
During his panel discussion, Dr Ahlberg discussed these key findings and how cyber activity has become a standing feature of strategic competition, no longer a separate domain but a persistent layer of pressure shaping crisis escalation, deterrence and instability.
“Cyber operations are no longer preparation for conflict – they are part of conflict,” said Dr Ahlberg. “What we’re seeing is that adversaries are logging in, not hacking in. This is a shift toward access, influence and leverage that can be activated at moments of political or military tension, often below the threshold of traditional response.”
