Figures show a steady rise in incidents: the CCB urges enterprises to act immediately

The CCB’s latest update on cyber threats highlights trends in system breaches, hacked accounts and ransomware. The conclusion is clear: enterprises and organisations must strengthen their basic security measures without delay.

The Centre for Cybersecurity Belgium (CCB) received 588 reports between 1 January and 28 September 2026, which already exceeds the 556 recorded throughout 2025. With vulnerability disclosures rising globally and attacks becoming ever faster, the CCB urges enterprises and organisations to adopt basic protective measures immediately.

In its third-quarter update ( the Quarterly Cyber Threat Report Q3 2026 , evocatively titled ‘Stormy Weather ’), the CCB identifies system compromise as the most frequently reported type of incident, with reports tripling compared with the second quarter. Vulnerabilities in widely used software and incidents affecting suppliers ( supply chain ) can expose several organisations to the same threat.

More vulnerabilities, less time to respond

According to the latest available figures, global security vulnerability disclosures surged in the third quarter of 2026. The practical challenge for organisations is to identify the vulnerabilities affecting their systems and to patch the most urgent ones quickly.

Artificial intelligence is adding to the pressure: it helps attackers discover vulnerabilities, draft convincing fraudulent messages and automate certain stages of an attack. Equally, it can help defenders identify and fix vulnerabilities.

The CCB urges business leaders to designate, without delay, the people responsible for implementing and verifying the following measures:

Protect accounts : enable multi-factor authentication (giving priority to methods resistant to phishing), particularly for email, administrator accounts and remote access.

Fix exposed vulnerabilities : identify systems exposed to the internet and prioritise updates that address actively exploited vulnerabilities (and verify that the updates have actually been deployed).

Reduce internet exposure : identify and catalogue internet-accessible systems and services, and reduce their exposure to the bare minimum.

Detect attacks and respond quickly : put in place monitoring and detection capabilities for security incidents, and establish an incident response capability that allows immediate action in the event of a breach.

Verify recovery capability : protect essential backups and ensure that data can be restored.

Prepare staff : train staff to recognise suspicious emails and messages, and to independently verify unusual payment requests.

Prepare for an incident : decide who will make decisions, who to and how essential operations will continue.

Assess the need for cyber insurance : consider taking out insurance that covers the financial and operational consequences of a cyber incident, and check the cover, exclusions and support services offered. Cyber insurance complements cybersecurity measures, but does not replace them.

‘Protection from cybercriminals 24/7’: practical guidance to get you started

Organisations can use the Safeonweb at Work online assessment to identify their initial priorities, then draw on the CyberFundamentals framework (which is available free of charge) to structure their security measures.

Registering with Safeonweb at Work enables organisations, among other things, to receive alerts threats and vulnerabilities that could affect their network.

The CCB’s Frontier AI Hub promotes knowledge-sharing with operators of essential services on emerging risks and opportunities related to AI. The resulting recommendations will be published before the end of 2026.