CSO Online

The 2026 Global Incident Response Report by Palo Alto Networks highlights a significant shift in the landscape of cyber threats. Insights from 750 incidents spanning 50 countries reveal that the integration of artificial intelligence (AI) into cybercriminal strategies has significantly compressed attack timelines. Where attackers previously took nearly five hours in 2024, they can now execute data exfiltration from initial access in just 72 minutes.
Despite the alarming speed afforded by AI, the root of many cyber breaches can be traced to fundamental security oversights. Core issues include weak authentication protocols, misconfiguration errors, and the pervasive problem of excessive permissions. Identity-related vulnerabilities emerged as a critical concern, implicated in 90% of the incidents analyzed. Particularly troubling is the extensive misuse of cloud identities, where 99% of the 680,000 identities evaluated were found to have excessive permissions.
The report also underscores the expanding attack surfaces due to supply chain vulnerabilities and fragmented cloud and SaaS environments. Additional threats stemmed from machine identities, shadow accounts, and third-party SaaS exploitation, which featured in 23% of analyzed cases. These challenges present significant hurdles for traditional Security Operations Centers (SOCs), which are often ill-equipped to respond at the pace required by modern threats.
In response to these evolving threats, Palo Alto Networks has introduced its Unit 42 Managed XSIAM 2.0 SOC service. This service is tailored to facilitate machine-speed threat detection and response, aimed at bridging the gaps left by conventional security operations. Nonetheless, there is skepticism regarding whether advanced SOCs can truly address the underlying security flaws that persist in many organizations. Effective cybersecurity, as suggested by the report, will require a combination of advanced technology and meticulous attention to fundamental security practices.

Collections

The 2026 Global Incident Response Report from Palo Alto Networks, based on 750 incidents across 50 countries, reveals that AI-assisted attacks have compressed data exfiltration timelines from nearly five hours to just 72 minutes. Identity-related vulnerabilities were implicated in 90% of incidents, with 99% of 680,000 evaluated cloud identities carrying excessive permissions. Supply chain weaknesses, shadow accounts, and third-party SaaS exploitation compound the problem. Palo Alto Networks is promoting its Unit 42 Managed XSIAM 2.0 SOC service as a response, though the report emphasizes that advanced tooling alone cannot substitute for fixing foundational security hygiene issues like weak authentication and misconfiguration.

AI and Basic Security Failures Fuel Rapid Cyber Attacks