For years, cybersecurity teams have worked to detect threats faster and respond more efficiently. But what happens when the attackers are no longer operating at human speed?

The 2026 Lumen Defender threatscape report: CISO update shows an environment where familiar threat vectors are becoming faster, broader and more persistent. AI and automation are helping compress the path from vulnerability discovery to scanning, exploitation, bot enrollment and monetization—all while attackers continue to rotate, replenish and rebuild the infrastructure supporting those operations.

Cyberattacks can now be developed, adapted and executed at a speed and scale that puts greater pressure on reactive security operations. In several of the campaigns Black Lotus Labs® tracked during 2026, the earliest warning signs appeared in the network before they became conventional endpoint or detection alerts.

Here’s what we saw.

AI is helping familiar attacks move at machine speed

The FortiBleed campaign provides one of the clearest examples of this evolving threatscape.

On April 13, 2026, Black Lotus Labs detected a cluster of IP addresses repeatedly targeting the same Fortinet endpoints. The activity continued for more than a month, with one Lumen customer receiving more than 480,000 login attempts against its VPN management interface—all of which were automatically blocked by Lumen Defender℠.

On June 12, the same actor infrastructure began another wave involving more than 100 new IP addresses. A day later, a security researcher reported more than 80,000 compromised Fortinet credentials, with the activity later linked to INC/Lynx ransomware operators. Subsequent research found that the attackers had used Cursor, an AI-based code editor, along with the agentic penetration-testing framework CyberStrike to develop custom tooling and automate intrusion activity.

At a broader level, Black Lotus Labs observed the FortiBleed operation targeting more than 10,000 Fortinet endpoints and generating more than 65 million attacks over a three-week period.

FortiBleed illustrates an important shift for security leaders: AI does not require attackers to invent an entirely new playbook. Instead, it can make existing attack mechanics cheaper to develop, easier to automate and faster to adapt.

That makes the time available for defenders to recognize and interrupt a campaign increasingly valuable.

The decisive signal can appear before the endpoint alert

Speed of the attack is only one side of the equation. The other is where defenders are looking for the earliest signal.

Traditional detection and response remains essential for identifying malicious activity on managed systems. However, network-level intelligence can reveal a different, more proactive signal, such as coordinated communication patterns, infrastructure clusters and behavioral changes as attackers test services and converge on targets. Turning those raw signals into actionable threat intelligence gives security teams the context to determine which threats matter and what action to take next.

Black Lotus Labs saw that advantage during a campaign targeting CheckPoint VPN services.

On May 13, 2026, automated detection identified 38.54.107[.]167 communicating with CheckPoint VPN services. The IP was immediately blocked for Lumen Defender customers. On June 4, 2026, CheckPoint identified a vulnerability in its own systems and retroactively tied 38.54.107[.]167 to a small exploitation cluster. Four days later, the vendor published indicators that included the same IP and linked the activity to Qilin ransomware deployment.

In other words, the network behavior provided a defensive signal more than three weeks before vendor identification.

Why internet backbone visibility changes the field of view

Early detection depends on visibility beyond any single enterprise environment.

The Lumen global internet backbone gives Black Lotus Labs a broad view into how malicious infrastructure navigates the public internet, including visibility into 99% of public IPv4 space, over 315 billion NetFlow sessions and 2.9 million unique threats tracked daily.

Combined with threat intelligence research, machine learning and automation, that telemetry helps researchers distinguish ordinary internet noise from coordinated behavior by examining signals such as source and destination relationships, connection timing and volume, DNS activity, routing changes and NetFlow session records. We also leverage behavior-based analytics to help identify malicious infrastructure as it forms and block suspicious traffic upstream—43,000 C2s on average daily.

That is the proactive opportunity for CISOs.

Instead of waiting until malicious activity produces an internal alert, security teams can use network infrastructure intelligence alongside endpoint, identity, cloud, perimeter and exposure-management controls to identify and block developing campaigns earlier in their lifecycle.

Shift defensive action earlier in the attack lifecycle

Attacks are becoming faster, broader and more persistent: the time from vulnerability disclosure to exploitation is shrinking, automated scanning is maintaining continuous pressure, and malicious infrastructure is rebuilding after disruption.

Trying to counter that change solely by asking the SOC to react faster creates a difficult contest against increasingly automated adversaries. Instead, CISOs must look for opportunities to shift more defensive action upstream.

That starts with continuous posture and exposure management. Security teams need to understand which systems attackers can reach, restrict management interfaces, remove unnecessary services, patch high-risk vulnerabilities quickly and retire unsupported edge devices.

Network infrastructure intelligence adds another important layer. It can show how attacker infrastructure is behaving outside the enterprise, reveal when seemingly independent activity is part of a coordinated campaign, and create opportunities to block high-confidence threats before they successfully reach or exploit critical systems.

The objective is not to replace detection and response. Instead, network infrastructure intelligence gives those investments a strong first line of defense.

As AI makes established attack techniques faster and easier to scale, the organizations best positioned for the next phase of the threat landscape will be those that combine strong security fundamentals with continuous exposure management, proactive threat intelligence and automated network-level protection.

Download the full Lumen Defender Threatscape Report: CISO Update to explore Black Lotus Labs research further, including brute force and botnet trends—plus access the full defense posture checklist for priorities security leaders should consider heading into 2027.

_{This content is provided for informational purposes only and may require additional research and substantiation by the end user. In addition, the information is provided "as is" without any warranty or condition of any kind, either express or implied. Use of this information is at the end user's own risk. Lumen does not warrant that the information will meet the end user's requirements or that the implementation or usage of this information will result in the desired outcome of the end user. All third-party company and product or service names referenced in this article are for identification purposes only and do not imply endorsement or affiliation with Lumen. This document represents Lumen products and offerings as of the date of issue. Services not available everywhere. Lumen may change or cancel products and services or substitute similar products and services at its sole discretion without notice. © 2026 Lumen Technologies. All Rights Reserved.}