The 2026 Lumen Threatscape Report explores how attackers use infrastructure, automation, and artificial intelligence to scale cyber operations long before intrusion.

Drawing on Black Lotus Labs® research and visibility across 200B+ daily network flows, this report explains why threat detection can no longer rely on endpoints alone, and how AI-driven infrastructure, proxy networks, and edge exposure are redefining risk in 2026.

For Australian organisations operating across distributed environments, critical infrastructure, and complex supply chains, this shift means risk is forming upstream, outside traditional visibility, well before an incident is detected.

Inside the Report:

• Risk landscape: What security leaders need to know about upstream risk and exposure 

• Threats deconstructed: Deep dives into real-world attack campaigns such as Kimwolf, Rhadamanthys, DanaBot, and NSOCKS botnets 

• Predictions: 2026 threat predictions including opportunity targeting, AI-driven acceleration, network signals, and infrastructure disguises 

• Visibility: Insights into Lumen's global backbone visibility and how threat intelligence is derived 

• Defence guidance: Actionable steps to detect earlier, disrupt faster, and reduce exposure before it's exploited