Rapid7, a leader in AI-powered managed cybersecurity operations, has released its Quarterly Threat Landscape Report, revealing that human operators remain the primary drivers of modern cyber threats despite widespread warnings about autonomous AI attacks. The report shows AI is used as an operational component in just 8% of tracked incidents.
Rapid7's Q3 report finds AI is used as an operational component in just 8% of tracked incidents.
Attackers exploit high-severity vulnerabilities within an average of just three days, with 71% occurring in the first week.
Rapid7 recorded 1,112 U.S. ransomware leak-site listings, roughly eight times Germany's total, led by The Gentlemen (342), Qilin (339) and INC Ransom (99).
79% of exploited flaws required no authentication and no user interaction, giving adversaries direct remote access.
Of 63 monitored underground posts, 41 advertised Remote Desktop Protocol or network access.
The newly announced Rapid7 Intelligence connects vulnerability research, frontline incident response and underground monitoring.
"Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation, which hasn't materialized. Only 8% of tracked reporting cites AI as an operational component," said Christiaan Beek, Vice President of Rapid7 Intelligence. "But that's a snapshot of adoption, not a ceiling. Agentic capabilities are advancing faster than any organization, attackers included, can rework its processes around them. The question is when, not if, agentic exploitation scales. Defenders need to move past reactive patching and start grounding their risk appetite in concrete days of exposure."
Vulnerability exploitation continues to accelerate: Attackers exploit high-severity vulnerabilities within an average of just three days, with 71% occurring in the first week, underscoring the urgent need to address critical exposures faster than traditional patching cycles allow.
U.S. organizations accounted for the largest volume of ransomware listings. Rapid7 recorded 1,112 U.S. ransomware leak-site listings, roughly eight times Germany's total, with The Gentlemen (342), Qilin (339), and INC Ransom (99) leading group activity.
"Holy Grail" vulnerabilities drive attacks. 79% of exploited flaws required no authentication and no user interaction, giving adversaries direct, remote access into enterprise environments.
Compromised access drove underground market activity. Of 63 monitored posts, 41 advertised Remote Desktop Protocol or network access.
Across espionage and cybercrime campaigns, threat groups change, but core tactics persist, including command and scripting interpreters, credential theft, and remote-access exploitation. These patterns underscore the need for behavioral detection and response, not static lists of known groups.
The findings from the third quarter of 2026 point to clear priorities for security teams: identify exposed assets, assess what attackers can exploit, and prioritize fixes by business impact. While the report findings show cyber threats remain human-driven, attackers are still leveraging AI to accelerate campaigns, making it critical for defenders to rapidly patch remotely exploitable vulnerabilities rather than wait for scheduled updates.
About the Rapid7 Quarterly Threat Landscape Report
The Rapid7 Threat Landscape Report is a quarterly analysis of global adversary behavior drawn from the company's managed detection and response operations, vulnerability intelligence platforms, and threat research telemetry. The Q3 2026 edition examines vulnerability exploitation, state-aligned and cybercrime activity, ransomware trends, and underground markets.
About Rapid7
Rapid7, Inc. is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers. As a recognized leader in preemptive managed detection and response, Rapid7 unifies exposure and detection to transform the cybersecurity operations of more than 11,500 customers worldwide.
