2026-ThreatDetectionReport_RedCanary.pdf

Red Canary's 2026 Threat Detection Report summarizes telemetry from 110,000+ confirmed threats across 4.5M endpoints and identities, highlighting large increases in identity-based attacks, widespread use of paste-and-run and browser-based lures, proliferation of stealers and RMM abuse, ransomware trends (including exfiltration-first extortion), supply-chain compromises (notably npm worm campaigns and Chrome extension supply-chain incidents), and threats to AI infrastructure. The report catalogs top threats and MITRE-mapped techniques, provides detailed analyses of representative families and incidents, and offers prioritized detection, prevention, and response guidance for defenders.