Threat Horizon Series

Published On : 2026-10-27

Threat Horizon Series

Q3 2026 CHECK-IN · THE ROAD TO DECEMBER

Infrastructure attribution will eclipse malware analysis

PREDICTION TRACKING: VALIDATED — ON TRACK
EXPECTED TO CLOSE: VALIDATED — ON TRACK

Then, now and next

WHAT WE SAID (JAN 2026)

<10–15% of cases need malware reverse-engineering
90%+ of attribution from identity, cloud and infrastructure telemetry
Malware becomes disposable loader logic

WHAT MID-YEAR SHOWED (JUN 2026)

79% of detections are malware-free (latest: 82%)
~90% of IR cases involve identity loopholes
Telemetry gaps doubled year over year

WHAT TO EXPECT BY DECEMBER

The log gap widens default retention windows remain the quiet failure point — missing logs stay a top-two forensic problem
Cases close without a binary a growing share of H2 IR cases resolved with no recoverable malware at all

Infrastructure reuse drives attribution campaign linkage from hosting, domains and identity patterns rather than samples

Mid-year evidence

79% of detections are malware-free, up from 40% in 2019
~90% of Unit 42 IR cases involved identity loopholes
67% of incidents began with identity compromise, not malware
2x increase in telemetry gaps — missing logs now #2 IR factor

Investigations have shifted decisively to identity, cloud and infrastructure telemetry. The binary is disposable; the evidence lives in logs.

OUR H2 OUTLOOK
We expect December to confirm telemetry-led attribution as the norm. The risk is not to the prediction but to defenders who are still deleting the only evidence they will get.

DECEMBER CONFIDENCE

Tracking the numbers — January forecast, mid-year evidence, latest published data

NEXT: END-OF-YEAR VERDICT — DECEMBER 2026
Final verdicts on all 10 predictions, plus the first look at the Threat Horizon Series 2027.

MID-YEAR 2026 UPDATE · ROAD TO DECEMBER

PREDICTION TRACKING: VALIDATED — ON TRACK

What we said vs. what 2026 is showing

WE PREDICTED (JAN 2026)
<10–15% of cases need malware RE 90%+ attribution from identity, cloud and infrastructure telemetry Malware becomes disposable loader logic

WHAT’S HAPPENING NOW
79% of detections are malware-free ~90% of IR cases involve identity loopholes Investigations hinge on identity/cloud logs Telemetry gaps doubled year over year

Mid-year evidence

79% of detections are malware-free, up from 40% in 2019
~90% of Unit 42 IR cases involved identity loopholes
67% of incidents began with identity compromise, not malware
2x increase in telemetry gaps — missing logs now #2 IR factor

OUR UPDATED POSITION
On track. Investigations have shifted decisively to identity, cloud and infrastructure telemetry, while binaries are increasingly disposable. Log retention, API/audit visibility and infrastructure correlation are now the core of attribution. Treat identity and cloud telemetry as tier-1 forensic evidence and extend retention well beyond default windows.

IN THIS INSTALMENT WE EXPLORE · ROAD TO DECEMBER

Analyzing past behaviour helps us assess Predictive Threat Intelligence