Semiannual Key Data
- 27,128 Voluntary FOCS Reports submitted in H1 2026 (+38% over the previous half-year).
- 31% of Initial Breaches resulted from direct exploitation of public software vulnerabilities, exceeding credential theft for the first time.
- Negative Time-to-Exploit (-7 Days): Attackers weaponize public vulnerabilities before official vendor patches can be deployed.
1. The Offensive Impact of Artificial Intelligence
In 2026, cyber syndicates deploy autonomous agents to conduct rapid patch diffing within minutes of a security advisory release, automatically synthesizing functional exploits. Annual point-in-time audits are no longer sufficient without continuous attack surface intelligence.