Rapid7 Report: Human Operators Still Drive Most of Tracked Cyberattacks, but Exploitation Windows Are Narrow
Key Highlights
- ➤AI operational component in just 8% of tracked incidents
- ➤High-severity vulnerabilities exploited within average three days
- ➤71% of vulnerability exploits occur during the first week
- ➤U.S. ransomware leak-site listings reached 1,112, roughly eight times Germany’s total
- ➤79% of exploited flaws required no authentication or user interaction
Expert Statements
Christiaan Beek, Vice President of Rapid7 Intelligence
“Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation, which hasn’t materialized. Only 8% of tracked reporting cites AI as an operational component”
Christiaan Beek, Vice President of Rapid7 Intelligence
“But that’s a snapshot of adoption, not a ceiling. Agentic capabilities are advancing faster than any organization, attackers included, can rework its processes around them. The question is when, not if, agentic exploitation scales. Defenders need to move past reactive patching and start grounding their risk appetite in concrete days of exposure.”
BOSTON, Oct. 21, 2026 (GLOBE NEWSWIRE) -- Rapid7, Inc. (NASDAQ: RPD), a leader in AI-powered managed cybersecurity operations, today released its Quarterly Threat Landscape Report, revealing that human operators remain the primary drivers of modern cyber threats despite widespread warnings about autonomous AI attacks.
The report shows AI is used as an operational component in just 8% of tracked incidents. While automation increasingly handles tactical execution, human actors still select most targets and dictate attack intent. Drawing from vulnerability research, frontline incident response, and underground monitoring, the newly announced Rapid7 Intelligence connects these insights to deliver a comprehensive view of adversary operations.
Get started
Create a free account to read the full story.