WatchGuard Reports Shift to Targeted Cyber Attacks Amid Declining Volume

• •Network attack volumes dropped 79%, but novel endpoint malware surged over 2,000%.
• •Attackers are increasingly using AI tools for targeted, precision attacks rather than high-volume campaigns.
• •96% of endpoint threats appeared on only one machine, indicating a shift to victim-specific malware.

WatchGuard's Global Threat Report reveals a significant 79% drop in network attack volumes during the first half of 2026, yet a staggering 2,000% increase in novel endpoint malware year-on-year. The report indicates that attackers are now employing AI-assisted tools to execute more targeted and sophisticated attacks, utilizing stolen credentials and legitimate administrative tools instead of traditional malware. Nearly 96% of endpoint threats were found on only a single machine, highlighting the precision of these attacks. The median vulnerability referenced in the report dates back to 2014, suggesting that attackers continue to exploit older vulnerabilities. The report emphasizes the importance of strong identity controls and continuous response for managed service providers (MSPs) to protect their clients effectively. WatchGuard's findings indicate a tactical shift towards low-intensity probing and credential-based access methods, making traditional defenses less effective.