Field Effect’s 2026 Cyber Threat Outlook paints a clear picture of how cyberattacks are changing. The biggest threat is no longer simply an unpatched computer or a sophisticated zero-day vulnerability. Increasingly, attackers are getting in by stealing legitimate credentials, abusing trusted software, exploiting human trust, and taking advantage of exposed internet-facing systems.

The report is based on Field Effect’s security telemetry, threat intelligence, and investigations of real-world incidents during 2025. Its findings suggest that organizations need to rethink where they believe their greatest cybersecurity risks lie.

Identity Has Become the New Attack Surface

The report’s most striking finding is that more than 80% of incident-related alerts investigated by Field Effect in 2025 involved compromised cloud identities.

In many cases, attackers did not need to exploit a software vulnerability. Instead, they obtained legitimate usernames, passwords, session tokens, or other authentication information and simply logged in.

Once inside, an attacker using a legitimate account can look much more like a normal employee than someone exploiting a technical vulnerability. This makes traditional perimeter defenses less effective and can allow attackers to move deeper into an organization without immediately triggering alarms.

Phishing and account takeover therefore remain extremely important—not because phishing is technically sophisticated, but because it provides attackers with something extremely valuable: legitimate access.

Attackers Are Abusing the Tools Organizations Already Trust

Field Effect observed increasing abuse of familiar collaboration and remote-support platforms, including Microsoft Teams, Zoom and Quick Assist.

These tools normally have legitimate business purposes. That is exactly what makes them attractive to attackers.

Rather than delivering obviously malicious software through an unfamiliar application, attackers can use trusted platforms and familiar workflows to persuade employees to reveal credentials, approve access, or execute malicious code.

This represents a broader shift in cybersecurity: trust itself has become something attackers can exploit.

The question is no longer simply whether a program is legitimate. Organizations must also determine whether legitimate tools are being used legitimately.

Artificial Intelligence Is Accelerating Cybercrime

Field Effect also identifies generative AI as an increasingly important force in cyberattacks.

AI is not necessarily creating entirely new categories of attacks. Instead, it is making existing techniques faster, cheaper and easier to scale.

Attackers can use AI to:

• Create more convincing phishing messages

• Conduct reconnaissance more quickly

• Generate or modify exploit code

• Automate portions of their operations

• Adapt attacks to specific targets

The practical consequence is important: defensive teams may have less time to recognize and respond to attacks because attackers can move more quickly.

AI therefore changes the economics and speed of cybercrime even when the underlying attack techniques remain familiar.

The Perimeter Is Disappearing

Another major theme of the report is the continuing importance of internet-facing infrastructure.

VPNs, firewalls, routers, remote-access systems and other edge devices remain attractive targets because compromising them can provide a direct path into an organization.

Field Effect documented a major 2025 campaign involving SonicWall SSL VPN and management interfaces. Attackers combined previously exposed credentials with vulnerabilities and inadequate credential rotation to gain access to high-privilege systems.

In some cases, attackers were able to authenticate directly into systems such as domain controllers without triggering the security alerts that would normally accompany a more obvious intrusion.

The lesson is straightforward: an organization's firewall or VPN is not merely a security appliance. It is a high-value target that should be protected like any other critical system.

The Bottom Line

The Field Effect report suggests that the modern cyberattack is increasingly less about breaking through a locked door and more about convincing someone to hand over the keys—or stealing keys that already work.

The most dangerous combination is therefore not necessarily an exotic zero-day vulnerability. It can be something much more ordinary:

A stolen credential + a trusted application + an exposed system + insufficient monitoring.

That combination can give an attacker everything they need to move from an apparently harmless login to complete organizational compromise.

The cybersecurity perimeter is becoming less defined, identities are becoming more valuable, and trusted technology is increasingly being turned against the organizations that rely on it.

For defenders, the implication is clear: cybersecurity must move beyond simply asking “Is this malicious?” and increasingly ask “Is this legitimate activity being performed by the right person, from the right place, for the right reason?”

That is where much of the modern battle for cybersecurity is now taking place.