67.3% of the 832 malicious accounts banned between March 2025 and March 2026 used AI to write malware.

6.5% of the 832 malicious accounts banned between March 2025 and March 2026 used AI to assist with lateral movement.

The share of actors classified as medium risk or higher increased from 33% in the first six-month period to 56% in the second six-month period, a roughly 1.7-fold increase.

Across the period studied, the use of AI for account discovery rose 8.9% while AI-assisted phishing falls 8.6%.

Least-skilled threat actors used about 16 distinct techniques on average, while the most skilled used about 20.

In November 2025, a disrupted state-sponsored cyber espionage operation used 30 techniques across 13 tactics.

80% of ransomware groups use AI, automation, or both in their attacks.

Threat actors utilizing AI and automation tools can achieve lateral movement within an organization in as little as 4 minutes, 85% faster than the previous year.