Cyber Threat Intelligence Market Statistics 2026: Growth & Trends

The cyber threat intelligence market is expanding as organizations face faster attacks, growing vulnerability volumes, identity-based threats, and increasingly sophisticated cybercrime. Threat intelligence helps security teams identify adversaries, understand attack techniques, prioritize vulnerabilities, and turn large volumes of security data into actionable risk information. Financial institutions use it to detect credential theft, fraud, and emerging attack campaigns, while manufacturers and critical infrastructure operators rely on intelligence to monitor ransomware, exposed systems, supply-chain risks, and threats against operational technology.

The market is also changing as AI, cloud adoption and automation reshape both offensive and defensive cybersecurity. Organizations increasingly need intelligence that combines external threat data with internal information about assets, identities and vulnerabilities rather than relying on standalone threat feeds. Although published market estimates differ because researchers define threat intelligence products and services differently, current forecasts consistently indicate continued expansion. The statistics below examine the market’s size, segmentation, regional performance, competitive environment, investment activity, and major trends shaping cyber threat intelligence.

Editor’s Choice

• $17.2 billion: One cyber threat intelligence study estimates the market will reach this value in 2026, compared with $14.11 billion in 2025.
• 22%: The same study estimates year-over-year market growth from 2025 to 2026 at this rate.
• $34.02 billion: The cyber threat intelligence market could reach this level by 2030 under the same forecast, representing an 18.6% CAGR from 2026 through 2030.
• 32%: Exploits accounted for nearly one-third of investigated intrusions during 2025 and remained the leading initial infection vector.
• 90 zero-days: Researchers tracked 90 vulnerabilities exploited in the wild as zero-days during 2025, up from 78 in 2024.
• 48%: Enterprise technologies accounted for 43 of the zero-days exploited in 2025, representing almost half of the year’s total.
• 87%: In a 2026 global cybersecurity survey, 87% of respondents identified AI-related vulnerabilities as the fastest-growing cyber risk during 2025.
• 64%: The share of surveyed organizations assessing the security of AI tools reached 64% in 2026, compared with 37% in 2025.
• 44%: Ransomware appeared in 44% of breaches analyzed in a major 2025 breach dataset, keeping extortion-focused intelligence central to security operations.

Recent Developments

• Researchers recorded 90 zero-day vulnerabilities exploited in the wild in 2025, compared with 78 in 2024 and 100 in the record-setting 2023 period.
• Enterprise technology became a larger zero-day target: 43 vulnerabilities, or 48% of the 2025 total, affected enterprise products.
• Vulnerability disclosure accelerated sharply in 2026. Monthly disclosures increased from 5,045 in January to 10,740 in August, more than doubling within seven months.
• Meanwhile, the average number of vulnerabilities exploited each month increased from 10.5 in 2025 to 18 during January-August 2026, illustrating the growing workload facing threat intelligence and vulnerability teams.
• Highly interactive voice phishing represented 11% of initial infection vectors in 2025, making it the second-most commonly observed route in one major incident-response dataset.
• Email phishing moved in the opposite direction, falling from 14% of observed initial infection vectors in 2024 to 6% in 2025. The shift gives intelligence teams a broader set of social engineering channels to monitor.
• Public-facing application exploitation increased 44% year over year in 2025 incident investigations, reinforcing demand for intelligence that connects vulnerabilities with active attacker behavior.
• Third-party involvement appeared in 30% of breaches analyzed in a major 2025 dataset, twice the previous year’s level. Supply-chain and vendor intelligence have consequently become more relevant to enterprise risk programs.
• Ransomware, banking trojans and infostealers collectively represented 87.3% of identified malicious-code intrusions in a European threat dataset covering July 2024 through June 2025.
• In 2026, 64% of surveyed organizations said they account for geopolitically motivated cyberattacks in their risk mitigation strategies, linking threat intelligence more closely with geopolitical monitoring and executive risk management.

Cyber Threat Intelligence Market Size and Growth Forecast

• The global cyber threat intelligence market reached $14.11 billion in 2025 and is projected to increase to $17.2 billion in 2026.
• The market is expected to grow at a strong 18.6% CAGR between 2026 and 2030.
• By 2030, the cyber threat intelligence market is forecast to reach approximately $34.02 billion.
• Based on the stated CAGR, the market could rise to around $20.4 billion in 2027 and $24.19 billion in 2028.
• The market is estimated to expand further to about $28.69 billion in 2029, before crossing the $34 billion mark in 2030.
• From 2026 to 2030, the market is expected to nearly double in size, adding roughly $16.82 billion in market value.
• The projected growth indicates sustained demand for threat detection, intelligence platforms, cybersecurity analytics, and proactive defense solutions across enterprises.

Cyber Threat Intelligence Market Segmentation by Type

• Strategic intelligence represented 33.6% of 2025 threat intelligence revenue in one current market assessment, making it the largest intelligence-type segment in that study.
• Another 2026 market assessment places strategic intelligence at approximately 34.7% of 2025 revenue, supporting the finding that executive and long-term risk intelligence holds a substantial market position.
• A separate segmentation model estimates strategic intelligence at an even higher 36% share in 2025, indicating that roughly one-third of spending may center on long-range threat and business-risk analysis.
• Operational intelligence is forecast to grow at a 16.35% CAGR through 2031 in one study, faster than the overall market covered by that research.
• Another forecast puts operational intelligence growth at a 15% CAGR from 2026 through 2035, supported by demand for campaign tracking and adversary attribution.
• Tactical intelligence remains central to security controls because teams use adversary tactics, techniques, and procedures to refine detection rules, hunting strategies, and defensive priorities. One market assessment values the segment at approximately $1.87 billion in 2025.
• Technical intelligence, which includes indicators such as malicious IP addresses, domains, file hashes, and malware artifacts, represented approximately $1.42 billion in 2025 in one segmentation model.
• Current incident data helps explain rising operational demand: exploits accounted for 32% of initial infection vectors in 2025, requiring teams to connect vulnerability intelligence with active campaigns quickly.
• Likewise, the cybercriminal access-handoff window fell to only 22 seconds in 2025 in observed cases, increasing the practical value of machine-readable operational and tactical intelligence that can trigger rapid defensive action.

Cyber Threat Intelligence Market Segmentation by Component

• Solutions captured 55.4% of global threat intelligence revenue in 2025 in one 2026 assessment, giving software and platforms the larger component share.
• The same research projects threat intelligence services to expand at a 14.12% CAGR through 2031, as organizations supplement internal teams with managed and professional expertise.
• Another market assessment estimates that solutions represented 59.4% of component revenue in 2025, again placing technology products ahead of services.
• A separate 2026 forecast expects solutions to account for 53.85% of market revenue in 2026, supported by adoption of security analytics, vulnerability management, incident forensics and behavior-analysis capabilities.
• One 2025 market study reported that the solution segment generated $8.89 billion in 2024, illustrating the already substantial installed base entering the 2025-2026 period.
• Managed and professional services are growing as enterprises face staffing constraints and increasingly complex threat environments. In one current model, services grow faster than the overall 12.7% market CAGR projected for 2026-2031.
• Platform demand also reflects the volume of security data that organizations must process. The 2025 breach dataset examined more than 22,000 security incidents and 12,195 confirmed breaches, demonstrating why automated correlation and enrichment have become important SOC functions.
• The services opportunity extends beyond monitoring. Rising AI risk creates demand for advisory, assessment, and managed security capabilities: the proportion of surveyed organizations assessing AI-tool security rose from 37% in 2025 to 64% in 2026.
• Faster exploitation also strengthens demand for both components. Average observed vulnerability exploitation increased from 10.5 vulnerabilities per month in 2025 to 18 per month during January-August 2026, creating pressure for automated platforms backed by expert analysis.

Cyber Threat Intelligence Market Segmentation by Organization Size

• Large enterprises accounted for 67.2% of global threat intelligence market revenue in 2025, giving them more than twice the share of small and midsize enterprises.
• Consequently, small and midsize enterprises represented about 32.8% of 2025 revenue under the same market segmentation.
• Small and midsize enterprise demand is forecast to increase at a 14.95% CAGR through 2031, supported by cloud delivery, managed services and growing exposure to ransomware.
• Within threat intelligence security services specifically, large enterprises represented 63.18% of 2025 revenue, confirming their leading position in managed and professional intelligence spending.
• Small and midsize businesses are forecast to increase their spending on threat intelligence security services at a 17.32% CAGR through 2031, faster than large enterprises under that forecast.
• The threat exposure facing smaller organizations helps explain this growth. Ransomware appeared in 88% of breaches involving SMBs in a major 2025 breach dataset, compared with 39% of breaches at larger organizations.
• Across organizations of all sizes, ransomware appeared in 44% of analyzed breaches, up from 32% in the previous report, representing a 37% year-over-year increase.
• The same dataset found that 64% of ransomware victims did not pay attackers, compared with 50% two years earlier, emphasizing the role of detection, preparation, and response intelligence rather than relying on post-attack payment.
• Median ransomware payments declined from $150,000 to $115,000 in the 2025 dataset. Even so, the high prevalence of ransomware among smaller businesses creates a continuing market for affordable intelligence feeds and managed detection services.

Cyber Threat Intelligence Market Segmentation by Deployment Mode

• One current study estimates that on-premises deployments represented 54.3% of threat intelligence spending in 2025, reflecting continued demand from regulated industries and organizations that require direct control over sensitive intelligence data.
• In the same forecast, cloud threat intelligence is expected to expand at a 16.25% CAGR between 2026 and 2031, faster than the overall market.
• A different market assessment places cloud deployments at approximately 64.2% of 2025 revenue, showing how inclusion criteria can reverse the apparent cloud/on-premises split.
• Another 2025-focused analysis found that cloud-based deployments represented 53.82% of the market in 2024, already giving cloud a slight lead under that study’s methodology.
• A more cloud-focused threat intelligence solution estimate places cloud deployment at 62.3% in 2025, compared with 37.7% for on-premises systems.
• Within threat intelligence security services specifically, cloud delivery accounted for 57.35% of 2025 revenue and is forecast to grow at an 18.03% CAGR through 2031.
• On-premises deployment remains relevant for defense, government, financial services, and critical infrastructure organizations that need stronger control over data residency, classified information, or isolated networks. One broader market forecast expects cloud delivery to grow at approximately 17.5% annually through 2035, gradually narrowing the gap with locally deployed systems.
• The growth of cloud-based intelligence also reflects changing attacker behavior. Attackers increasingly target cloud identity systems and centralized authority stores, while stolen credentials represented 16% of initial infection vectors in 2024 investigations, making cloud-focused identity and credential intelligence more important.
• Hybrid adoption offers organizations a middle path: teams can retain sensitive analytics and existing security infrastructure locally while consuming rapidly updated external intelligence through cloud services and APIs. This approach matters as vulnerability disclosure volumes climbed to 10,740 in August 2026 alone, requiring intelligence pipelines that can absorb new data continuously.

Cyber Threat Intelligence Market Segmentation by End-User Industry

• IT and telecommunications generated 20.6% of global threat intelligence revenue in 2025, making it the largest end-user vertical in one current market assessment.
• BFSI is projected to become one of the fastest-growing verticals, with a 14.7% CAGR through 2031, as financial institutions increase investment in fraud, identity, and adversary intelligence.
• Within threat intelligence security services, banking and financial services represented 23.62% of 2025 revenue, making finance the largest vertical under that narrower market definition.
• Healthcare threat intelligence security services are projected to grow at an 18.02% CAGR through 2031, reflecting ransomware exposure, sensitive patient information, and increasingly connected clinical infrastructure.
• A separate security threat intelligence market assessment gives BFSI a 30.47% share in 2025, followed by IT and telecommunications at 24.64%. Differences from other estimates reflect variations in market definitions.
• Under that same segmentation, government and defense represented 19.87% of 2025 revenue, while healthcare accounted for 15%.
• U.S. threat intelligence spending by IT, IT-enabled services, and telecommunications is estimated to rise from $621.2 million in 2025 to $670.1 million in 2026.
• U.S. healthcare threat intelligence spending is projected to increase from $306.6 million in 2025 to $353.2 million in 2026, while government spending is projected to rise from $389.4 million to $442.5 million.
• Defense and intelligence represents a particularly fast-growing U.S. vertical, with spending forecast to increase from $251 million in 2025 to $552.8 million by 2030, equivalent to a 17.1% CAGR.
• Meanwhile, U.S. energy and industrial threat intelligence spending is forecast to climb from $429 million in 2025 to $795.6 million by 2030, highlighting the growing importance of intelligence for operational technology and critical infrastructure.

Cyber Threat Intelligence Market Regional Analysis

• North America represented 37.5% of global threat intelligence revenue in 2025 in one current assessment, making it the world’s largest regional market.
• Another market model gives North America an even larger 45.32% share in 2025, illustrating how differences in product and service coverage affect regional calculations.
• Europe represented approximately 24.81% of the security threat intelligence products and services market in 2025 under that model.
• Asia-Pacific followed with an estimated 19.74% share and approximately $2.07 billion in revenue during 2025 in the same assessment.
• Another 2026 market study estimates Asia-Pacific at 19.4% of global revenue in 2025, providing a similar regional share despite using a smaller absolute market size.
• Latin America represented approximately 5.2% of global demand in 2025 in that study, with revenue forecast to increase from $350 million in 2025 to $420 million in 2026.
• The Middle East and Africa represented approximately 7.5% of global revenue in 2025 under the same market model, with revenue projected to rise from $510 million to $620 million in 2026.
• The Middle East has one of the strongest regional growth outlooks, with one forecast projecting a 15.35% CAGR through 2031.
• Regional threat conditions support continued investment: cybercrime represented more than 30% of recorded crime in over half of the surveyed Asia and South Pacific countries covered by a 2026 international assessment.
• Meanwhile, cybercrime accounted for more than 30% of reported crime in Western and Eastern Africa, demonstrating that high cyber-risk exposure extends beyond the largest commercial threat intelligence markets.

North America Cyber Threat Intelligence Market

• North America generated 37.5% of global threat intelligence revenue in 2025 under one current market estimate.
• Within the threat intelligence security services segment, North America held a nearly identical 37.6% share in 2025, indicating strong demand for managed intelligence as well as software.
• A separate products-and-services model estimates North American 2025 revenue at $4.76 billion, equivalent to 45.32% of the market measured by that study.
• The U.S. threat intelligence market is forecast to increase from $3.37 billion in 2025 to $3.77 billion in 2026, representing an increase of roughly $400 million in one year.
• Under the same forecast, U.S. revenue could reach $6.14 billion by 2030, representing a 12.8% CAGR from 2025 through 2030.
• IT, IT-enabled services and telecommunications represent the largest U.S. vertical in that forecast, increasing from $621.2 million in 2025 to $944.1 million by 2030.
• U.S. BFSI spending is projected to grow from $476.1 million in 2025 to $516.5 million in 2026, keeping banks, insurers and financial service companies among the largest intelligence buyers.
• Healthcare represents a faster-growing U.S. opportunity, with threat intelligence revenue forecast to rise at a 16.1% CAGR through 2030, compared with 9.4% for BFSI.
• North American organizations also face a strongly external threat profile. Internal actors accounted for only 5% of breaches in the region in a major 2025 dataset, compared with 29% in EMEA, placing greater emphasis on external adversary monitoring.

Europe Cyber Threat Intelligence Market

• Europe generated approximately $1.6 billion in threat intelligence revenue in 2025, equal to 23.2% of the global market under one 2026 assessment.
• European market revenue is projected to increase to approximately $1.91 billion in 2026, an annual gain of roughly 19%.
• Another market model places Europe’s 2025 revenue at $2.60 billion, or 24.81% of the security threat intelligence products and services market.
• The U.K. threat intelligence market is forecast to increase from $1 billion in 2025 to $1.13 billion in 2026, before reaching approximately $1.86 billion by 2030.
• A 2026 European threat assessment found that 73% of targeted organizations qualified as essential entities under the NIS2 definition, showing how cyber threats overlap with regulated and critical services.
• Public administration represented 32% of recorded European incidents in 2025, making it the most targeted sector, followed by business services and transport at 8% each.
• Manufacturing accounted for 7% of incidents, while finance and banking represented 6%, maintaining demand for sector-specific intelligence across industrial and financial organizations.
• Ideologically motivated DDoS attacks accounted for 82% of recorded events against public administrations in the 2026 European assessment, emphasizing the role of geopolitical and hacktivist intelligence.
• Separately, 174 distinct threat actors were identified targeting EU entities or their ecosystems during 2025, up from 110 in 2024. Cyberespionage and prepositioning accounted for 38% of observed activity, while cybercrime represented 30%.

Asia Pacific Cyber Threat Intelligence Market

• Asia-Pacific generated approximately $1.29 billion in threat intelligence revenue in 2025, representing 19.4% of global revenue under one current market assessment.
• Regional revenue is projected to reach approximately $1.59 billion in 2026, an increase of about $300 million from the previous year.
• A separate security threat intelligence products and services assessment estimates Asia-Pacific’s 2025 revenue at $2.07 billion, equivalent to a 19.74% global share.
• Asia-Pacific threat intelligence security services are forecast to expand at an 18.55% CAGR through 2031, making the region the fastest-growing geography under that services-focused forecast.
• India’s threat intelligence market is forecast to grow from $447.9 million in 2025 to $536 million in 2026, representing annual growth of nearly 20%.
• By 2030, India’s market could reach approximately $1.14 billion, corresponding to a 20.6% CAGR between 2025 and 2030.
• India’s defense and intelligence segment is forecast to expand at a particularly strong 25.3% CAGR through 2030, while healthcare is projected to grow at 24.2%.
• Singapore’s threat intelligence market is forecast to rise from $157.7 million in 2025 to $186.9 million in 2026, before reaching $384.2 million in 2030.
• Cybercrime now accounts for more than 30% of recorded crime in over half of surveyed countries across Asia and the South Pacific. In addition, 33% of surveyed countries reported more than 10,000 cyber-scam cases, underscoring the need for regional fraud and adversary intelligence.

Latin America and Middle East & Africa Cyber Threat Intelligence Market

• Latin America’s threat intelligence market reached approximately $350 million in 2025 and is projected to grow to $420 million in 2026 under one current market assessment.
• That estimate gives Latin America approximately 5.2% of global threat intelligence demand in 2025, while another security threat intelligence model estimates a similar 5.07% share.
• The Middle East and Africa market reached approximately $510 million in 2025 and is projected to increase to $620 million in 2026.
• The Middle East alone is forecast to record a 15.35% CAGR through 2031 in one current market study, giving it the fastest regional growth rate in that forecast.
• Latin American organizations experienced an average of 3,065 cyberattacks per week in December 2025, a 26% year-over-year increase and the sharpest regional rise measured during the month.
• Publicly observed ransomware incidents affecting Latin America and the Caribbean reached 452 in 2025, representing just over 6% of 7,346 recorded ransomware victims worldwide.
• Brazil accounted for roughly 30% of Latin American ransomware victims in 2025, followed by Mexico at approximately 14% and Argentina at around 13%. More than 200 initial-access offers affecting 17 regional countries were also observed.
• In Africa, cybercrime represented more than 30% of all reported crimes in Western and Eastern Africa, while two-thirds of surveyed member countries classified cyber-related offenses as a medium-to-high share of overall crime.
• By 2026, AI was linked to 55% of reported cybercrimes across Africa, according to data collected from 36 countries. The region also surpassed 1.1 billion mobile subscribers in 2025, expanding both digital access and the potential attack surface.
• A coordinated operation across 19 African countries in late 2025 resulted in 574 arrests, the removal of more than 6,000 malicious links and the recovery of approximately $3 million. Investigated cases were linked to more than $21 million in estimated losses, illustrating the financial scale of regional cybercrime.

Cyber Threat Intelligence Market Challenges

• The global cybersecurity skills shortage stands at 4.8 million professionals, creating a major talent gap for organizations building and managing threat intelligence capabilities.
• Around 70% of organizations are affected by cybersecurity skills shortages, highlighting widespread difficulty in recruiting and retaining qualified security professionals.
• Nearly 40% of organizations struggle with fragmented security tools, which can complicate threat monitoring, data integration, and incident response.
• About 37% of organizations report budget constraints, limiting investments in advanced threat intelligence platforms, skilled personnel, and security infrastructure.
• Roughly 30% of organizations are concerned about false positives, which can increase analyst workload and reduce the efficiency of threat detection and response.

Cyber Threat Intelligence Market Drivers and Opportunities

• Vulnerability exploitation accounted for 20% of known initial access vectors in a major 2025 breach dataset, up 34% from the previous report. Credential abuse remained slightly higher at 22%.
• Only 54% of perimeter-device vulnerabilities covered by the same dataset were fully remediated during the year, while median remediation time reached 32 days. This gap creates an opportunity for intelligence-led vulnerability prioritization.
• Third-party involvement reached 30% of breaches in 2025, twice the previous level, increasing demand for supply-chain intelligence, external attack-surface monitoring, and vendor-risk data.
• Public-facing application exploitation increased 44% year over year in 2025 investigations, demonstrating the commercial value of connecting vulnerability intelligence with exposed-asset inventories.
• Meanwhile, 56% of disclosed vulnerabilities examined in another 2026 threat study required no authentication for successful exploitation. This creates demand for faster external exposure monitoring and prioritization.
• Identity represents another major opportunity. Identity weaknesses played a material role in almost 90% of major 2025 incident investigations, while 65% of initial access involved identity-based techniques.
• AI creates both risk and demand: 87% of surveyed respondents identified AI-related vulnerabilities as the fastest-growing cyber risk during 2025.
• Organizations are responding. The share with processes for assessing AI-tool security rose from 37% in 2025 to 64% in 2026, opening opportunities for AI threat intelligence, model monitoring and AI exposure management.
• Geopolitical intelligence is also moving closer to mainstream cybersecurity. In 2026, 64% of surveyed organizations considered geopolitically motivated cyberattacks in their risk mitigation strategies.
• Threat intelligence platforms also have an opportunity to reduce manual triage. Only 0.23% of disclosed vulnerabilities observed from January through August 2026 were exploited in the wild, or roughly one in 431. This makes threat-based prioritization more practical than treating every vulnerability as equally urgent.

Cyber Threat Intelligence Market Investment Statistics and Strategic Developments

• Cybersecurity companies raised approximately $13.97 billion across 392 funding rounds in 2025 under one industry analysis, up 47% from $9.5 billion across 300 rounds in 2024.
• A broader funding dataset estimates $18 billion went into seed-through-growth cybersecurity and privacy rounds in 2025, about 26% more than in 2024 and the third-highest annual total of the preceding decade.
• Under that broader dataset, at least seven cybersecurity funding rounds exceeded $400 million during 2025, showing how large financings contributed heavily to annual investment.
• U.S.-based cybersecurity startups raised $11.5 billion in 2025, their highest annual total since 2022. Investment reached another $4.6 billion through May 2026 across 203 deals.
• A separate 2026 tracker recorded $4.7 billion in cybersecurity funding during Q1 2026 and $4.3 billion during Q2, although differences in tracked companies and financing definitions make these figures unsuitable for direct comparison with narrower venture datasets.
• European cybersecurity companies raised approximately €1.1 billion across 131 funding rounds in 2025, involving 124 companies. The 10 largest rounds accounted for 58.6% of disclosed capital.
• Cybersecurity consolidation accelerated alongside venture investment. One 2026 analysis counted 426 M&A transactions during 2025, with financial terms disclosed for 74 deals totaling $92.5 billion.
• Of those transactions, 334 involved pure-play cybersecurity companies, with disclosed value reaching approximately $84 billion. Eleven cybersecurity transactions exceeded $1 billion under the same tracking methodology.
• Another M&A dataset puts 2025 cybersecurity acquisition value at $96 billion across roughly 400 transactions, up 270% in value and 22% in transaction volume year over year. It also recorded $20.7 billion in cybersecurity financing, up 52%.
• Threat intelligence itself participated directly in consolidation. A $290 million threat intelligence acquisition announced in October 2025 followed a $300 million financing by the buyer in September, illustrating investor interest in combining real-time external intelligence, internal telemetry, and agentic AI.

Leading Companies in the Cyber Threat Intelligence Market

• CrowdStrike leads among the listed vendors, with an estimated 8–11% market share in the cyber threat intelligence market in 2026.
• Recorded Future holds about 7–10%, positioning it closely behind CrowdStrike among major threat intelligence providers.
• Palo Alto Networks accounts for roughly 6–9% of the market, supported by its broader cybersecurity platform and threat intelligence offerings.
• IBM Security represents an estimated 5–8% share, maintaining a notable presence in enterprise-focused cyber threat intelligence.
• Other players collectively control around 54–74% of the market, highlighting a highly fragmented competitive landscape.
• The relatively modest individual shares of leading companies suggest that the market remains competitive and diversified, with numerous specialized and regional vendors operating alongside major cybersecurity firms.

Cyber Threat Intelligence Market Trends and Future Outlook

• Vulnerability disclosure volume more than doubled during 2026, rising from 5,045 vulnerabilities in January to 10,740 in August. The increase raises the value of intelligence systems that separate exploitable threats from background vulnerability volume.
• Observed exploitation increased from an average of 10.5 vulnerabilities per month in 2025 to 18 per month from January through August 2026.
• Researchers observed 141 distinct disclosed-and-exploited vulnerabilities during the first eight months of 2026, already exceeding the 127 recorded during all of 2025.
• Zero-day exploitation increased more moderately, from an average of 8 per month in 2025 to 11 per month in 2026 through August. This suggests that rapid weaponization of known vulnerabilities also deserves substantial intelligence resources.
• High-risk vulnerabilities exploited in the wild more than doubled from 28 during 2025 to 75 during January-August 2026, strengthening the case for risk-based threat intelligence.
• AI infrastructure is becoming its own attack surface. Agent orchestration frameworks represented 50% of AI-related flaws analyzed during January-August 2026, with disclosures in this category increasing 347%.
• Backend AI serving infrastructure recorded 212 vulnerabilities in 2026 through August, and 24% involved unauthenticated API endpoints or server-side request forgery.
• Identity-centric intelligence will remain another major trend. Identity appeared in 89% of investigated incidents in 2025, ahead of endpoints at 61%, networks at 50%, human factors at 45%, and cloud systems at 20%.
• Attack speed will continue pushing intelligence toward automation. The average eCrime breakout time reached 29 minutes in 2025, while the fastest observed incident moved beyond its initial foothold in just 27 seconds.
• Intelligence will also need to address a more diverse adversary mix. Financially motivated actors represented 41% of observed threat clusters in 2025, down from 55% in 2024, while cyberespionage groups doubled their share from 8% to 16%.

Frequently Asked Questions (FAQs)

Conclusion

Cyber threat intelligence enters the year as a growing part of enterprise cybersecurity rather than a standalone collection of threat feeds. Market estimates vary substantially, but the underlying demand signals remain consistent: exploits accounted for 32% of investigated intrusions in 2025, vulnerability disclosures reached 10,740 in August 2026, and identity-related weaknesses appeared in 89% of major 2025 investigations in one global dataset. AI-related vulnerabilities, faster attacker movement, and expanding third-party exposure are pushing organizations toward real-time, contextual, and automated intelligence that identifies the threats most relevant to their assets, identities, and operations.