Name: No Room for Error: Navigating The 2026 Threat Landscape
Uploaded: 2026-04-14T06:26:04.574Z
Duration: 1 h 3 min 56 s
Description: No Room for Error: Navigating The 2026 Threat Landscape

Transcript for "No Room for Error: Navigating The 2026 Threat Landscape": Okay. Good morning. Good afternoon, everyone. So, thank you for joining our 2026, thread trends webinar. So we'll give it a minute, and, we'll we'll start. Right? So yeah. So, my name is Ajayesh Shikumar, and I'm a solutions engineer based in Bangalore, India. So, while we'll be featuring a prerecorded deep dive session today from CloudFlare threat intel team, Cloudforce one, I'm here with you live in the chat. Please drop in your questions in the window as we go, and I'll be answering them in real time. And, we'll also save a few for a live wrap up at the end. So, the threat landscape is shifting at an unprecedented pace. Attackers have industrialized using AI and SaaS complexity to exploit networks with record breaking speed. So to break this down, we are joined by Cloudflare's threat research team, Cloudforce one. So we have Juliet Cash, director of Cloudforce one, Trevor Linas, senior threat intelligence expert, Liz Morton, Phil Cecil at Cloudflare. So, so Cloudflare roughly protects, 20% of the web. So that's a big chunk of the Internet. So this gives us a vantage point like no one else in the industry. So today, we are sharing those insight to explore, number one, the identity crisis. So how infoscealers are turning ransomware into a simple login event. Second, SaaS weaponization, the surgical risk of multitenant breaches. Number three, the AI force multiplier, deepfakes, and real time network mapping. Number four, the new DDoS baseline, preparing for autonomous strikes exceeding 30 terabits per second. So let's, dive in, to the session and please, drop in your question as the session progress. And cool. Hello, everyone, and welcome to No Room for Error, Navigating the 2026 threat landscape. My name is Trevor Linus. I'm on the product marketing team with a specialization in threat intelligence, and I'm super excited to have this presentation for you here today. I'm joined by two really cool people who I'm going to let introduce themselves, starting with Liz. Hi, everybody. My name is Liz Morton. I'm a field CISO here at Cloudflare. I have about thirty years in, information technology, production engineering, cybersecurity, and I'm thrilled to be here to talk to Trevor and Juliet about threat intel today. And I'm Juliet Cash. I lead the threat research and intel analysis team within Cloudflare's, greater threat intel organization known as Cloudforce One. Welcome, everyone. Happy to have you. Awesome. So we're gonna get to the key findings for 2026 very quickly. But before we do, I wanna talk about how we're able to sort of make these predictions on what's going to happen. There's really two superpowers that Cloudflare has. And the first is really the reason I actually joined Cloudflare in the first place. I was super intrigued by Cloudflare's threat visibility. I find it super unique. If you're not familiar with Cloudflare, we operate one of the largest global networks in the world. And in fact, 20% of the web sits behind Cloudflare. That means we're processing an absolutely enormous volume of traffic on a daily basis, which means we're seeing a lot of, you know, normal Internet traffic, good things, but there's also a lot of bad things that happen on the Internet. And we have a really interesting early visibility into what threat actors are doing, what infrastructure they're building, what attacks they're launching. And that to me is super interesting, especially when paired with really smart people like Juliet and our Cloudforce one threat research team. This these are our experts that actually look at that visibility and harness it. They turn it into threat intelligence. They turn it into defensive strategies for organizations. They conduct incident response engagements for our clients, and they also go out and actively disrupt threat actor infrastructure and campaigns, which is really cool. In fact, their mission is to help defend the Internet, not just report on what threat actors are doing, but go out and stop them, cause them pain wherever possible. So the findings you're gonna see in this presentation today are all coming from a report that's actually publishing today. It's called the 2026 CloudFlare threat report. This is new research based on everything we see across the whole Internet on what are the latest, tactics, techniques, TTPs we're seeing from threat actors, what our nation states doing, what's changing in the world of cybercrime, what's happening on a regional perspective, you know, in America or in EMEA or in the APAC region, What threats are relevant to those areas specifically? And then, of course, most importantly, what should you do about it? Right? That's especially why we have Liz here today. It's not just to say here's what's happening, but, really, what should you and your organization go do with this information? So with that, I'm gonna pass it over to Juliet. Yes. Incredibly excited to walk you all through our Cloudflare's, you know, first ever annual threat report. Just to kind of double tap on what Trevor highlighted, As we all know, right, there's there's a lot of threat reports out there, but this one is different for a very specific reason, and that is Cloudflare's unique vantage point. As Trevor highlighted, right, Cloudflare sits in front of roughly 20% of the world's web traffic. That means we aren't just looking at one company's or maybe even several companies' security logs to stop attacks or just one sector or one industry's telemetry to identify actor trends. Right? We're seeing the pulse of the Internet in real time. So when Cloudforce one sat down to look at the data over the past year, we weren't just focused on right? We didn't just see more attacks. Right? We aim to identify global patterns and trends, signs of noteworthy adversary TTPs TTPs and any evolution of those TTPs. So the eight key trends we're about to discuss today represent a world where, you know, boundaries have basically dissolved in a lot of ways, all those old boundaries. We've moved from a world of breaking in to a world of logging in, from a world of manual attacks to these industrialized AI enabled offensive operations. And so, Liz, what what are your thoughts here before we start to delve into that first key trend? Well, you know, as you've mentioned, we have these eight key trends, and they're not just observations. Right? Having read through the report, I got an advanced copy. It's really good. These are very consistent with what I'm hearing from our customers also, I think they are really setting the stage for a new normal. This has been a very active year already. It's hard to believe I'm saying that in just the March. But I think we're looking at a world that's fundamentally shifted. So I'm excited to bring some pragmatic how tos to the discussion today, Juliette, because I think, what our security professionals, what our community needs is really some how tos to deal with some of these emerging threats. Fantastic. So let's, let's delve into that first key trend. So the security of corporate data, once heavily focused on and still in many ways focused on that traditional network perimeter. Right? But data is also now very significantly affected by third party integrations, what we call the connective tissue of the modern enterprise. Now we're seeing a single overprivileged SaaS to SaaS connection is now a prime means for, you know, massive multi tenant breaches. Right? This connective tissue can significantly increase the blast radius of an attack and in very short order. This is precisely what we observed, last year when Cloudforce one investigated the pervasive SalesLoft drift breach. The threat actor in this case, we call them Grub one, they didn't just kick down the front door, so to speak. Right? They targeted high value credentials, like OAuth tokens, using automated secret scanning tools, like Truffle Hog, to gain access to Salesforce customer instances. All Grubhub one had to do was focus on compromising a single integration between a SalesLoft drift between SalesLoft drift and Salesforce, right, which ended up affecting thousands of SalesLoft tenants worldwide. We even discovered that the actor used generative AI in real time during their operation to help them find what data to even target in Salesforce. Right? They didn't know what to look for. They were relatively unsophisticated threat actor but were incredibly effective. And what's worse is that later we discovered that not only was the sales integration impacted, but also other sales loft drift integrations with numerous additional SaaS providers. So this took an already massive breach and expanded it exponentially. So this SaaS to SaaS pivoting is is really a new frontier of risk, right, where where the security of our data is truly only as strong as the most overprivileged integration in our tech stack. So so, Liz, when when you see when you hear about these ripple effects through the trusted integrations, right, how do you even begin to monitor that? Right? When the connective tissue itself becomes the very weapon, how how does a security team begin to secure that? Yeah. It's a tough one. And I think it's one that I saw in my own practice and I continue to see today with our customers. I think there's a widely various approach to solving the problem, depending on the maturity of the program, depending on the perspective really of those involved. But you are quite correct. This is a massive blind spot. For the old model that a lot of teams are still working with, the focus is on the the edge of the perimeter. They look at user permissions. Everybody knows identity. You know, we've heard it a million times last year. Identity is the new perimeter. It it's not just human and nonhuman identity necessarily in in terms of how we think about of it. A human account belong to a human person. I think a lot of times when we think about nonhuman identity, we think about service counts. But there is a whole lot in the world of API permissions that goes, unobserved, as you've mentioned. And it the truth is most practices, most professionals are not auditing API permissions connecting to their clouds. This is a ubiquitous problem across the board. And really the the solution, my my advice would be to harden the SaaS, that SaaS to SaaS connect connective tissue you were talking about, Juliet. If everybody would just stop right now and just do an immediate audit of, their API permissions, that would be great. We have this wonderful premise that's been with us for forever, really, in cybersecurity and that is least privilege. Right? So least privilege applies to people. It applies to human accounts. We really need to look at our API, permissions and look for things like overprivileged rewrite tokens, in tools like Salesforce, or Slack or GitHub. These are tools that are used by everybody. And when you have over permission over permission tokens, you're you're leaving out, into the in the world, you're leaving a point of vulnerability out just through a lack of hygiene. Right? So if an integration doesn't need write access to the production database, it shouldn't have it. That should be pulled. So I would say that is an excellent place to start and maintain that, of course, has to do with visibility. So there are two links, that go along with that problem as well. Solid advice. Thank you. Thank you, Liz. Onto our next key trend. Right? The lead in to AI when we were talking about the Grubhub one breach brings us, to to this next interesting trend. You know, a primary metric for risk in 2026, is measure effectiveness. Right? Essentially, the ratio of attacker effort to their operational outcome or return on an investment of attack, if you will. And AI is helping tremendously in this area. It's significantly increasing threat actors measure of effectiveness. Right? No longer do they have to work harder to get better results. Right? They just have to work smarter with the tools that we've actually helped build. Right? Generative AI, I I we see that, right, as as the great equalizer. Right? It's lowering the barrier to entry so far that even, you know, relatively unsophisticated lone actors are now achieving success and scale in their operations. Right? What we would have previously expected to be the work of, say, a sophisticated nation state is now not necessarily off the table for less skilled adversaries. And then you have this agentic reconnaissance. Right? It it's it's not just about, you know, better writing better phishing emails anymore. Right? Attackers are using LLMs as autonomous navigators. Right? When an attacker hits a complex unfamiliar SaaS environment, they don't spend weeks mapping it anymore. Right? They use AI to interrogate the tenant. Right? Asking it to identify high value assets or over permission tokens or maybe sensitive data paths as we saw with the Grub one incident. Right? This the AI assisted navigation there is what turned a a simple entry point into a very high velocity, high impact reach across thousands of records in just minutes. And so, Liz, my question for you in this case is, right, if the barrier to entry has dropped this low, you know, does our current risk model, maybe we should call it a legacy risk model, even stand a chance? No. And it's funny. I was thinking earlier today, Julia. So much of stuff that I have considered legacy is stuff that, as of last year was still pretty, of the moment. Legacy is coming on us hard and fast, because no. The old, risk models, they don't, they don't stand a chance in this day and age. For one thing, we have had this assumption. For a long time, we focused on things like operational friction, like the idea that these attackers would have some amount of time that they would need to kind of, perform reconnaissance, get a foothold, get, inside your environment, and then they would have something called dwell time. I don't know about you, but I've heard a lot of things that sound a lot more like attackers just smashing and grabbing. And those attacks being so much faster, the dwell time I mean, I did I'm not saying we don't need to think about that. There's certainly all kinds of TTPs out there to be aware of. But for the most part, I think those that are able to come in quick, hard, and fast, and get in and out, those are the ones that are kind of winning the headlines. Those are the attacks that are winning the headlines lately. And I I attribute that all to the use of AI. And as you know, there's tons of toolkits available with AI capabilities that mean that you don't even have to be all that technically savvy to to leverage them and do quite a lot of damage. So, what to do? I, I think definitely, you want to move towards browser isolation for your Gen AI tools Gen AI tools. Excuse me. And then also, you know, to take it a step further, you want to implement some strict DLP that doesn't just look for, you know, the typical credit card, Social Security card or Social Security numbers rather. Like, that's the DLP of yesterday. It still has its place. It's still, you know, deployed everywhere, much to the chagrin of of many, a DLP administrator. But now what we really need are tools that do smarter analysis. Right? Semantic analysis to ensure that our employees aren't inadvertently or purposefully, frankly, giving away the keys to the kingdom by, you know, uploading diagrams, API documentation, business documents, anything that talks about the, you know, sort of trade secrets or technical secrets of our enterprises. We wanna make sure we're not allowing our, employees to feed those into public training sets where they can then be, of course, used against you. So that is a very interesting, development that we're seeing some some, we're seeing some cases where that's come to light where you are almost an article of your own demise, by telling your AI too much about your company. So that's just some some thoughts there. Absolutely. Yep. And and and just as AI just as much as AI is helping us, it is absolutely helping adversaries as well. Yes. Yes. Absolutely. So the next trend is, as if the previous one wasn't sobering enough, this is a bit more sobering. Right? We are witnessing an alarming change in adversary playbooks. For some nation states in particular, we're seeing a big shift in focus from that traditional espionage towards more of this, like, strategic pre positioning for future disruption and and other very, very pervasive long standing operations. So you take, for example, the typhoons. Right? Those like SALT Typhoon and Linnan Typhoon. They aren't just stealing email or other sensitive data. Right? They're embedding footholds within our critical infrastructure, anchoring their presence, you know, for for long term geopolitical leverage. We have things like telecom infiltrate infiltration. Right? So SALT typhoon, this is the the group actually that we call, wimpy toad. They successfully compromised major US telcos. Right? AT and T, Verizon, Lumen. And not only that, but they specifically target lawful intercept systems. Right? They knew exactly what they were doing. They they knew exactly what they were aiming for, and they weren't just eavesdropping. Right? They were mapping the core routing logic of our infrastructure, of our continent. Right? Then you also have persistent edge footholds. We saw this with a group we refer to as Puny Toad. They're also known publicly as as Warpanda. This group maintained access to f five systems for over a year where they managed, to exfiltrate big IP source code and find things like forever days. Right? These are those vulnerabilities that are acknowledged by software developers, but they're never gonna be fixed. Right? So they gathered a lot of these forever days just to have them in their back pocket ready to use whenever they need them. And then we also have collaboration platforms as a vector. Right? This past July, Linen Typhoon led a massive zero day campaign against on prem SharePoint servers. Right? They compromised over 400 organizations, including the Department of Energy. Right? And by stealing, in in particular, by stealing cryptographic machine keys, They made, sure that, you know, even after a patch was applied, they could still forge access tokens and get back in. So as you can see, right, nation state adversaries and beyond, right, they're not just breaking into your networks. They're becoming a part of our infrastructure that really is, in a lot of ways, essentially invisible to that to those standard perimeter defenses. And so, you know, this is a real tough one. I feel like we keep saying that with each with each trend, but, truly, this is a real tough tough one, Liz. And so, you know, what are your thoughts on how we can build resilience against an adversary that's already prepositioned, right, in the very core, right, in the bedrock of our communication systems. Yeah. It's, it's scary stuff. And, you know, big problems sometimes don't have to have hugely complex solutions. I think it's fairly obvious that to completely eradicate these threat actors, that's a fairly complex solution. What can you do, however, on an enterprise level? What can you do for your own practice? You know, really, I think, it's a bit of a mind shift a mind shift shift. Mindset shift. That's what I was trying to say. Sorry, guys. A mindset shift that's required. For years and years and years, we have had the mindset of defending the perimeter. Right? Remember that old saying? It was like pineapple, hard on the outside, soft on the inside. That's just first of all, maybe was never a great idea. It was the best thing we had at the time. Things have evolved quite a bit from there. So, obviously, mature programs are looking at not just the perimeter, but the inside of of your network, your core, and everything radiating out. You have things like observability and tooling. That's all great. I think the mindset that is going to be most useful going forward is the assume breach mindset. In my practice before, we had an assume breach position on every red team exercise we did because we realized that it was very, very difficult to actually breach our perimeter, because we had great controls on the on on the edge. But then so that was an interesting but most companies have areas of immense vulnerability from the inside. So, if you assume reach, you will ensure your survival. And this is not just a collection of technical activities. Right? Some of this gets into continuity from communications. So, you know, in the Assume Breach ensure survival model, you really are looking at your blast radius and controlling your blast radius, right, through things like segmentation, network segmentation, basic controls, architectural controls, and out of band integrity. Right? So how can you make sure that you are communicating in the event you have suspicion of or an actual confirmed intrusion. You wanna make sure you're taking your communications, for instance, offline. So use a separate hardened channel for critical alerting. Make sure I would recommend also you have a very well practiced crisis management program that includes com comms with entities like regulators and, you know, local, local and federal governments, for instance. And all that should be conducted, on trusted channels. You also need to have some ways of validating and verifying identities that does not require, you know, sort of primary infrastructure in the event that you are compromised. Right? Another thing, after any major, infrastructure event, you can't just patch. You have to go a step further these days. You have to rotate all root secrets and machine keys. If you don't reset the keys to the kingdom, the attacker will likely still have a copy. Just looking at sort of the future of cryptography in general, Juliet, I'm sure you've you're aware of this post quantum concern that everyone has. And what's the, what's the, the saying? Steal it now. Decrypt it later. In in those cases, you can't just do the bare minimum. You have to sort of run out to your solutioning after a major incident. Alright. That is, as you mentioned. Right? Sometimes those complex problems don't necessarily always require those complex solutions, and I think all of those are very reasonable, things to to achieve. Right? Yeah. I think so. They just require a little bit of extra effort. Awesome. So moving on to our next trend. We we are most definitely, entering an era we call or have been on our way to this era called living off the anything as a service. Right? Adversaries no longer have to rely on building their own dark infrastructure, if you will. Right? They're weaponizing the very tools we used to run our businesses. Right? Software as a service, infrastructure as a service, platform as a service, right, to camouflage their activity within that white noise of legitimate enterprise traffic. It's it's exploiting that reputation shield. Right? Taking take for example, the group pathetic slug. We refer to them as pathetic slug. They're known, publicly as Kim Sookie, among other names. They have perfected what I like to call the triple threat cloud chain. Right? They host lures on Google Drive, and then they deliver their payloads via Dropbox. And then they use GitHub as a covert c two channel for their malware. And, of course, because our developers are using GitHub all day every day, a firewall might see this traffic as productive rather than malicious. Then we have other interesting things, like what we call a calendar loop. In this case, this is one of the more creative, if not stealthy examples we've seen in some time. Frumpy toad, also known as APT 41, this threat actor did something very novel with their tough progress malware. A key part of their operation actually didn't involve any connections back to the actor's server for command and control or stolen victim data. The malware would simply read and write to Google Calendar. Right? Commands for the malware, so the commands the malware was to run, were actually hidden in calendar event descriptions that were set in a future date. And then any stolen data, any victim exfiltration was uploaded by being written into past event descriptions. So you can see here. Right? To a traditional security sack, all of this, it's not a breach. Right? It it's just a busy Tuesday on a Google Workspace. Right? The traffic's encrypted. The domain is high reputation, and the activity mimics normal behavior. And so, Liz, your your thoughts here. Right? If the destination, you know, is a gold standard domain like Google or GitHub, how does this, you know, standard security model even begin to to detect that needle in a haystack? I mean, it it doesn't. If your security relies on, reputation based filtering, ask the losing proposition. I've seen a lot of this in, in both my practice and I definitely discussed it with customers. It is infuriating to have the, these threat actors. You just really use our SaaS products against us. Basically, it's so hard to detect, and it's just, it's also super super hard to train employees, on what's safe and what isn't safe. So the phishing vector becomes even more of a problem, even in I I feel like we will save this forever in 2020 x and 2040 x. Email is still, like, the vector of greatest concern before entry for threat actors, because of stuff like this. When your threat actor is kind of living off the land, and using, you know, top tier services, they look like you. They look like everybody else. Their reputation is perfect. It's really, really difficult to identify their traffic, to filter it out. So I'm gonna say this is one of those those tough problems that maybe doesn't have a complex solution. I will talk about segmentation again. I would say we would call this maybe, a move from filtering to structural isolation. Right? So you can't stop Google from talking to Google, but you can stop, a compromised segment from talking to the rest of your the rest of your network, the rest of your enterprise. Right? So, if you treat your subsidiaries, your lab environments, you know, any kind of, new acquisition, certainly, I would include in that as well. If you treat them like separate entities, you can potentially, implement dedicated ASNs and unique IP egress for different business units, different entities, etcetera, which helps identify who is who. Right? So if a state actor angers themselves into a subsidiary's Google tenant for instance, you need a clean break in the network fabric to prevent them from pivoting into your primary corporate environment. You do that through architecture. Right? So you are able to segment, block, etcetera using IP. You are able to use potentially tenant IDs as well to hold those hold those entities separate and be able to couple and decouple from them easily. In '26, the the network is just a transport layer. Right? The real perimeter is identity. We we alluded to that before. We really still need to use things like browser isolation to render SaaS apps, in a sand sandbox. So, for instance, your calendar loop, if that's active, the malware can't see the underlying OS or move laterally into the, local network. So those are a couple different ideas about how you can combat this issue. Again, not complex solutions, but use consistently. You're you're you're doing yourself a big favor when it comes to at least making the the world easier to contain when you know there's a a problem. Right? You may it makes it easier to contain that part of the world, for instance, you know, that subsidiary, that dev tenant, whatever your structure is. If you are able to isolate and keep separate your various workspaces, directories, etcetera, you're gonna be way ahead of the game. I love it. I love it. Alright. Moving on to our next trend. This sounds like more of a spy novel, but I would say for HR and IT teams, it it it is a nightmare for sure. We're, you know, we're seeing state sponsored operatives primarily from the DPRK, but there are numerous others as well, you know, basically embedding themselves into Western payrolls. Right? And they're doing this at industrial scale. This doesn't just involve fake resumes. Right? Operatives are using real time AI face swapping to pass live video interviews, and then we have what we call the residency illusion. Right? If they manage to get hired, they can stay invisible to IT by using these laptop farms. Right? Physical apartments or homes in The US run by domestic facilitators. Right? Those aiding and abetting. Right? The the company, in this case, that's hiring, right, ships a MacBook to a home in the suburbs of, say, Nashville or Arizona, but the operative is actually located in Pyongyang and connects to it via remote management software. Right? To the corporate dashboard, that laptop never left the ZIP code. And it's no longer just about, you know, funneling wages to the regime as well in in this particular case at DPRK. You know, we have groups like BlueNoroff, which we we track, internally as Putrid Slug. They are pivoting from, you know, passive work, if you will, to more active exploitation. We've seen in recent campaigns, they use deep fake audio and video during Zoom calls to impersonate senior leadership. They'd invite a developer to a sync and then claim the audio was broken, and then they would drop a link in the chat for a Zoom fix or a security extension. And in reality, it was actually a macOS backdoor that gave the actor full access to the company's GitHub repositories. So, you know, when when you think about the these types of operations, right, you know, how do you how do you trust but verify, right, in a world of of deep fakes, right, especially in terms of the hiring and onboarding process. What are your thoughts here, Liz? This is such an awful problem. I don't mean to I don't mean to laugh, but it's like, it's like truth being stranger than fiction or something. Like, it's just such a, gosh, hate this problem. And it's something that happens all the time. It started I wanna say I started noticing it about four or five years ago when we started seeing, you know, we did a lot of remote hiring. And this was where we saw it. We saw a lot of resumes that were identical. We saw a lot of people showing up to interview for more than one job. When it started, it was consumable. Now with AI, especially with how cheap and fast deepfakes are, like, this problem, you know, like, remote onboarding is officially a bad idea. It's officially compromised. It's officially compromised forever, because, essentially, if you are trusting a 100% digital verification process, I I think you're pretty much just trusting that you're not accepting attacker, AI as as truth, unfortunately. So what can we do? This sounds like a very old school solution, but we could just not do digital onboarding. We could do in person, interviews. We could do in person, onboarding, tasks, things like that. The thing is there's so much expense in that, and it's not really a, it's not really gonna happen, I I suspect. As much as we have the, never ending debate about the return to office, the the truth is that remote work is here to stay. And these are these are enduring issues that we're gonna have to address, by the way, not just at onboarding, but throughout potentially the life of the employee. If somebody is compromised post post hiring, which happens, it becomes a see something, say something for other employees. So there are some, like, basic societal stuff. Like, if someone is acting strange, please do say something. If you suspect that someone is not working in the best interest of your team or company, maybe you should say something. For the onboarding and hiring process, the interviews are gonna have to be just, I think, a little bit more formally overseen, frankly. And we may have to ask candidates to do stuff like perform various things on screen that are spontaneous instead of having them just sit and sit and looked at on at a screen. Maybe we ask them to stand up, maybe make a jumping jack or something. I don't we don't need to, like, make it silly and and humiliating, but we certainly do need to ask ask for some spontaneous actions from the human on that screen. The reason is that deepfakes don't do that spontaneously very well. So it would be easier to see a deepfake if you ask for them to do something unexpected. I still really do like the idea that that we would move away from totally digital, onboarding and hiring simply because I think there is some value in in that. There are some other things you can do post hire as well, which is enforce things like MSP block lists. So if you have a corporate device that has been being accessed by an AnyDesk, TeamViewer, or any other, you know, sort of unauthorized RMM tools, you should be able to auto quarantine that device if you see that activity. Right? So then you're getting some, observability type things. There are many there are many, many options when it comes to quarantining a device. Ideally, you find one that will allow you to unquarantine in the event you do you have false positive. But in a perfect world, those kinds of things are automated. You see something, you automatically initiate either a quarantine or a disruption to the user's function until you've talked to that person in real life. That's just a very kind of low tech process that is pretty effective. And then finally, from an onboarding perspective, if you enforce enforce rather, a day zero biometric enrollment, so, like, right when you start right away, you enroll the user in, you know, in your in in their in your biometrics, program where the user's physical identity is cryptographically cryptographically sorry about that. I'm cryptographically paired to the TPM of their laptop. So, if the employee doesn't match the biometric hash at login, then they can't get in. That keeps them off of your endpoints. So some simple solutions, it certainly doesn't address the entire problem, but it is a way to to be both reactive and proactive. Solid solutions for a truth is stranger than fiction, scenario. No doubt. Moving on to our sixth, interesting trend here. You know, for years, we've treated MFA kind of as the the silver bullet of identity security. Right? But in in 2026, the battle, right, is shifting from attacking the box to attacking the session. Right? Attackers have realized that it's much easier and more effective to steal, you know, say, a valid session than it is to steal a password. This past May, Cloudforce One, actually participated in a global operation to dismantle LUMA c two or LUMA stealer. This was our at the time and and probably still still arguably one of the world's most prolific info stealers. Right? At its peak, I think Luma had infected around 10,000,000 devices, operating as a highly efficient malware as a service criminal enterprise. And its primary goal, right, was exfiltrating live session tokens and active active browser cookies. And so by capturing these tokens, an attacker can clone your basically, your already authenticated state, if you will. Right? So they don't need to phish your password or trigger trigger an MFA push. They simply inject in, your session into their browser and they're in. Right? This has, in many ways, effectively turned ransomware in in particular into kind of like a simple login event, right, where the perimeter is bypassed without, you know, a single alarm bell ringing, if you will. And so, you know, the the big question is, if an attacker can simply inherit a trusted session, does MFA even matter anymore? Liz, what what do you think the next evolution of identity in light of these types of criminal enterprises is? Yeah. Yeah. This was probably my least favorite of our of our of our eight trends. I, man, an MFA, I trust. But at the same time, session hijacking is not new. It's been around for a long time. And, you know, I I still I can't say it doesn't matter. MFA matters. Please keep putting MFA on things. Please don't not put MFA on things, world. We need MFA. PSA complete. So what should we do to make it better? You know, we have to move from static it's a static versus continuous authentication. Right? So, static authentication is you, you know, you MFA in once. You you see it again in thirty days or you see it again in seven days or you see it again in twenty four hours. That's better than nothing. It's not fantastic, especially when you work in a, kind of remote first, cloud for cloud first environment. You definitely wanna have a continuous assessment going of who's using your systems. So mandating things like FIDO2 and passkeys, those are bound to specific origin URL. Meaning if an invostealer grabs a credential, it can't be replayed on a different domain. That is something that is hardbound to a piece of hardware. It is also, while it's not a continuous validation of a of an identity, it is hardbound to a piece of equipment that cannot be replicated. Right? So I use passkeys all the time. I use it on my phone for personal my personal use. I have I have my, YubiKey for work. These things are physical. They are with me. If they are lost or compromised, my job is to tell CloudFlare, hey. This is an issue or, yeah, show myself. I'm my own IT person in my personal life. I have to solve that problem. But there's no there's no continuing on with system access until that's resolved. I also really and I really like, using YubiKey for things like one time password, for continuous authentication through production systems as well that is used, pretty, ubiquitously across more mature practices. I recommend that. So, you know, really modern zero trust platforms. So I'm talking about stuff like like ours, frankly. We'll look for things like inorganic activity. So, if a session is active but, there is a repetitive, like, pixel perfect patterns generated by, like, a mouse jiggler program, or an unauthorized RMM tool, this session can be automatic automatically terminated. Like, we have the intelligence in our systems now to detect things that are not human. Leveraging those to end a session. If you suspect there is a session hijacking going on or you suspect that there's a non human actor in that session, that's something that can be fairly well automated even through your tooling. You just can't assume that any trusted session is going to kind of endure in a trusted state without verifying throughout the course of x amount of time, x amount of system activities. You can really bind your authentication, your reoff your reverification rather. You can bind that to really any activity. So that's a bit of an architectural decision, but a few ideas about that. But we still need MFA. Don't not put MFA on things. It's still really important. Yes. Still relevant. Absolutely. But definitely as much as we can focus on that continuous kind of identity of zero trust. Love it. Yes. Great. Onto our next trend. This one highlights a a critical weakness in how we route email. We call we call this the MX gap, which is actually isn't a new technique, but we are seeing it leverage with dangerous frequency across various email borne threats, especially phishing as a service platforms, like two Tycoon to Buffet, for example. With this trend, threat actors are exploiting complex routing scenarios, things like misconfigured email protections to basically perform kind of intra domain spoofing. Right? Effectively, they're making external phishing emails appear as if they're sent by a trusted colleague from within your organization. And this happens when a tenant's mail exchanger or their MX records are not pointed directly to, say, Office three sixty five if you're an o three sixty five shop. Instead, they route through, right, a complex chain of third party connectors like gateways and other security appliances. If any of those connectors are misconfigured or if that tenant hasn't properly configured or strictly enforced different spoof protections like SPF, DKIM, DMARC, then it creates a massive blind spot. Right? The destination mail server sees the traffic coming from a trusted relay and incorrectly assumes the message is safe. In fact, Cloudflare's, email security telemetry provides a very sobering look at this reality. After analyzing 450,000,000 emails, we identified a staggering gap, that actors are now very much ruthlessly exploiting. 43% of emails failed SPF. Right? So this means, the sender was not authorized to use that sender domain. Similarly, 44% lacked valid DKIM signatures. So this is proving that the content could have been tampered with. And a whopping 46 failed DMARC. 46%, nearly half failed DMARC. So that means they're not checking SPF and DKIM and not quarantining or rejecting those phishing messages that fail, these these different protections. So this lethal combination is exactly what allows phishing as a service bots to bypass standard protections and basically deliver very high trust brand, you know, impersonations that look like legit internal, notifications. And so if if if we're seeing, right, near nearly half of the mail, that that we're looking at is failing basic authentication. From your perspective, Liz, how how do we close this gap and regain trust even in our own domain? I mean, I talked to those 46% and have just a little counsel about good high hygiene basic practices. Right? It's I thought this one was very interesting to me that this is, like, a big enough phenomena still that it made our trends list, because a lot of these technologies have been around forever. So it's almost like we're using we're innovating with legacy technology on the other side here. Isn't that nice? But a very basic problem, that can be solved in a number of ways. To close so you called it the MX gap. To close that, it really requires moving away from, passive defense to a policy first and sort of AI focused architecture. And authentication, it should be said, should be standard. It's not optional. In this day and age, you should not be operating things like open relays just because your configurations are not very good. And DMARC and DKIM are certainly, to me, table stakes for especially any enterprise grade mail system. So a couple of ideas. Organizations have to move to DMARC, reject, and SPF hard fail. I think there's a lot of anxiety that comes on the email administrator side when it when the thought that a person would not get an email. And that's from a business perspective very understandable. However, in this day and age there are so many ways to communicate and if you send an email to someone and they don't get it, you know life can certainly go on. Communication can happen in other ways. I'm not suggesting this is a mass solution. I'm simply suggesting that weighing that against the potential for your employee to click on a very well crafted piece of potential for your employee to click on a very well crafted piece of phishing mail and landing your organization in hot water is just as big a threat as missing an email. So failing hard and rejecting, you know, making sure that this mail that is not authenticated does not get delivered. I've worked in an organization for many years where we were very aggressive with this, and we managed to be very profitable and make a lot of money. And I'm not trying to be flip. I'm simply saying we need to weigh the risks, right, of missing something every once in a while versus the massive risk that not having authentication and not having, you know, sort of DMARC and DKIM and SPF in place properly. Can't say enough about that. Just from just don't receive the mail. If it's no good, if it doesn't pass DMARC, it won't get delivered and it stops being a problem. It's great problem avoidance. So moving on from that, you know, I think you said something about, phishing as a service bots. A lot of legacy stuff will not detect those bots at all. So you need something that is AI capable. There are several products on the market. I believe we have AI awareness in our mail product. So just suggestion, is quite good. But there are others. Let's see. Let's see. By utilizing signals outside of the traditional mail flow, such as behavioral biometrics and cross tenant telemetry, for instance, these systems can identify lateral threats and neutralize compromised internal accounts. Like so that's another feature that you'll find in a lot of these AI capable, email agents is that they'll actually be able to detect behavior that is anomalous, that is a little bit fishy so to speak. I don't mean that, no pun intended, but it would be funny. You need those signals to come from an AI aware system because they will be better at detecting AI phishing as a service or AI generated email generally, because that's what they do. And certainly, they will catch it way better than spoofs and and what have you. They'll they'll catch it much better than humans. Oh, and then another one. Third party connectors. These are like plugins and everything from a plugin that goes into your mail client to, you know, a connector you potentially install at the mail server level. They they have to be properly configured. That's a great way to have just a configuration mistake mean big problems for your organization. If your final mail tenant doesn't reverify, like, an original sender's identity, right, if you have a mail gateway in in in the loop in your in your hop, your trusted gateway is simply becoming trusted to deliver whatever that previous hop says is okay. You have to reverify on that last hop, if that makes sense. Because if not, you're just trusting that anything that made it through the previous hop was good. And the same thing with your plugins. If your plugins are not properly configured, you may undo some of the security measures that your mail server puts in by allowing things at the client level that perhaps over permissioned connectors will, will be able to accomplish. So you have to watch that and tightly control your configuration. Basic stuff. Lots of great great approaches here and and and to just reemphasize your port a point. Right? Basic stuff. Things that are highly achievable. You know, protections, security measures that have been play in in place for a long time, and we need to find ways to properly implement them. Awesome. Thanks, Liz. So last but not least, let's talk about the scale and progression of hypervolumetric attacks. In the last sixteen months, the world record for the largest attack was broken not once, not twice, but 19 times. Right? We've hit a new baseline. We are no longer in the era of gigabit threats, if you will. Right? Late last year, the server botnet, launched a staggering 31.4 terabit per second DDoS attack. That's almost 32 terabits per second. So to put that in perspective, that's the equivalent of streaming roughly 1,000,004 k videos simultaneously all aimed at a single entry point. Right? And this, of course, wasn't just a fluke. It was powered by an army of nearly 4,000,000 infected devices, many of which are things like unofficial Android TV boxes and poorly secured IoT gadgets and so forth. These attacks peak at a maximum volume in about thirty seconds. Right? And we call this the zero window because there is literally zero time for a human to intervene. Right? By the time an engineer's phone buzzes with an alert, the attacks already peaked, caused a total blackout, and often concluded. Right? So human intervention, you know, it isn't just slow. It is it is irrelevant in these scenarios. And so, you know, when we're talking about near 32 bit terabit per second attacks, you know, what what can organizations do? Right? You know, Liz, when we when we've learned that, you know, the old school scrubbing center strategy, right, if you will, How is that keeping up? Is it keeping up? Can we use those? What are what are some other things we can think about here with these massive hyper volumetric attacks? Yeah. I mean, I remember the scrubbing centers, before we moved to Magic Transit. I think it's okay if I mentioned Magic Transit. It is my favorite Cloudflare product, by the way, for this reason. You know, before we had Magic Transit, we would have to call our ISP and say, hey. We need to reroute. We're we're under DOS. At the time, it was more or less okay, I guess, because we weren't seeing 31 terabytes a second. But it is, not just intrusive. I mean, it it impacts your business. Anytime you're getting DOSed, ostensibly an application, a website, some something that matters to your enterprise is offline. Right? It's not great for business to have that happen. DDoS attacks now for companies that make use of, you know, anycast based edge networks like Magic Transit, are not that big of a deal assuming that you have the capacity. We have the capacity. I think we may be the only entity on the planet that has this kind of capacity right now. I'm not sure. But we I mean, 31 terabytes, we're we're still we're still going. Right? I think there's not another answer, frankly, for mitigating these kinds of these levels of attack. It has to be automated. A human cannot like we effectively are saying we need systems that can analyze and block 30 plus terabyte per second attacks in less than three seconds. I don't have any human powers like that. I don't know of anyone who does, and I don't know, that it's even, a thing that makes any sense to assume that there's any other solution except to automate your mitigation as much as possible. So I've mentioned Cloudflare's position here. You know, realistically, I would say sometimes you see sometimes you see all kinds of well meaning, well intentioned things in place, like getting an approval for, for, mitigating a DDoS attack. Approval. No approval. Like, you have to go right to mitigation or you are going to be digging yourself out of a hole forever with an attack this size. So, autonomous mitigation, autonomous verification, all that stuff has to happen. What I'm hopeful for is that we will figure out a way, if we haven't already, to use AI to anticipate when these attacks are coming because signals are there. I mean, a botnet the size of the Isuru botnet that has millions and millions and millions of members, it doesn't make a little bit of noise. Because I had no idea, Julie, it was thirty seconds to activation, like, to full power. That's crazy fast. A human is never going to be able to, a human's never gonna be able to solve that. It's gonna have to come down to a technical solution, like Magic Transit and AI helping us out here. I don't have any better ideas on this one. Those are fabulous ideas, and thank you, Liz, for helping up helping us wrap up this last key trend. Moving on, we did want to, you know, cover as you saw here, right, we've covered a lot of ground today from attackers measure of effectiveness all the way to the industrialization of of the deep fake workforce. And as we covered each of these key trends, Liz did a fabulous dot job in in sharing the different ways that you can incorporate all the recommendations listed here. While the trends can sometimes become flex, we've learned. Right? Our recommendations don't necessarily have to be, and they can center in many ways on on one core principle, and that's kind of eliminating that implicit trust in our infrastructure. Right? And so I just wanna mention you you can find the full breakdown of the trends we've spoken about today as well as those recommendations along with other key intel in our 2026 annual threat report. Liz, before we hand off to Trevor, I I wanted to put you on the spot one last time. For those listening in, if there is only one strategic takeaway that they remember from today, what should it be? Well, I would say we we have talked about a lot of things. But I think the, I think the probably most important theme overall is that the old way of doing things is just not going to be able to keep pace. I I've been feeling this for several months. I know I've talked to many peers. There's something in the air, and it's definitely that we are now dealing with, like, almost modern, a modern legacy set of of systems. We have to move away from being reactive. We have to move away from an infrastructure, sort of center defense, right, to something that really takes that that expanded perimeter. Right? We've talked about identity, API. That's really where we need need to build our, you know, our defenses, our resilience. And that has a lot to do with proactivity. It has to do with, preventing the things that allow threat actors to log in instead of break in. Right? So that that has to do with, you know, moving beyond, you know, one time MFA, for instance, to a continuous verification model where every session, every token, and every packet is treated from a zero trust perspective. Right? The attackers have automated so much. They can move so fast. Really, the ways we can stop them are by being excellent when it comes to our sort of, practices of hygiene, our best our following of best practices, that example of just, handling MFA different. Right? It's it's not a huge shift. This is not heavy technical work. It is just a way of leveraging a technology like MFA in a continuous and, frankly, relentless fashion so that threat actors can't just easily get in, break into a session. They you know, it's like, twenty years ago when we started firewalling. We didn't want it to be easy for the attackers to just jump onto an open port. We wanted to make them we wanna slow them down. We wanted to get something to stop them. That's more or less what we're dealing with, but we're not dealing with that on static infrastructure. We're dealing with that on everything from human So alright. Thanks, thanks for everyone now who dialed you to the webinar. So, ma'am, I know, like, we covered a lot of ground today from surgical representation of self supply chain to the hyperrealistic of AI deep rigs. It easy to look at this, 2026 landscape and feel overwhelmed. However, the goal of cloud flight threat report isn't to induce cyber fatigue. It's to provide a road map for the new baseline of defenses. I mean, the era of Castle and Mode is officially over. In its place, we must build a mesh of autonomous, identity centric security that can withstand the speed of AI. And at Cloudflare, one, we see this pulse of Internet every second. We see attacks before they reach you. Our mission is to ensure that while attackers have industrialized, they haven't won. Let's build a fast and safer Internet together. And, one more thing from in the q and a, I got a very good question, saying that what, we can be doing right now to help with the post quantum, threats. Right? So, again, you know, at CloudFlare, they're, like, different type of traffic flowing. It can be your application security traffic. It can be, your zero trust traffic. Right? So, if if you're a CloudFlare applicant security CDN customer, your traffic is by default, PQC protected if you enable TLS one two three, on your zone. Right? So you don't want to do any any changes. So Cloudplay uses a hybrid of classical x five x two five five one nine and, post quantum MLKEM. Right? So it's automatically enabled. And let's say if you are a zero trust customer, so, you know, Cloudplay has different type of on ramps and off ramps. So it can be a Cloudplay one client, which formerly work client. So this is like a, software that you install on the end device. So that is by default PQC, enabled tunnels. Or if you're leveraging Cloudflare IPsec tunnel for site to site connectivity, again, that's also PQC enabled. Right? And last, we do have Cloudflare tunnel, which, using which you can create a outbound only tunnel from your private origin to Cloudflare, that's also PQC enabled. And, again, our traffic within Cloudflare network, which is, like, East West traffic for us is, by default PQC, enabled. So if if even though someone take a packet capture of this traffic, and in future when the, those, Quanta computers are available, no one will be able to decrypt it. Right? So any any further questions, from anyone? So I can, help answer that. So we'll give it a minute for any questions. Alright. Yeah. I think this Okay. Sure. We'll be accepting the LinkedIn request. So, any other questions, anyone in the audience? So, are we good to wrap up? So you'll be getting this recording, in forty s forty eight hour time. And, obviously, please download the twenty twenty six, threat report from the doc section so you can refer it. Alright. Thanks. Have a nice day.