GLOBAL CYBERTHREAT OUTLOOK

2026 Lumen Defender Threatscape Report

Take an inside look at modern cyberthreats and what their trajectories signal for the future.

Get report

GLOBAL CYBERTHREAT OUTLOOK

2026 Lumen Defender Threatscape Report

Take an inside look at modern cyberthreats and what their trajectories signal for the future.

Exposing the setup before the breach

Access key insights to learn how to stop cyberthreats before they start.

Get exec summary Get full report

Exposing the setup before the breach

Access key insights to learn how to stop cyberthreats before they start.

Illustrated map of the continental US with lines depicting network routes across the county.

Unmatched global network visibility

As the #1 globally peered network,¹ Lumen watches threat actors assemble their tools and map routes across the public internet—spotting the heist infrastructure long before the breach begins.

View maps

Unmatched global network visibility

As the #1 globally peered network,¹ Lumen watches threat actors assemble their tools and map routes across the public internet—spotting the heist infrastructure long before the breach begins.

200B+

NetFlow sessions monitored daily

200B+

NetFlow sessions monitored daily

14.8M

new malicious IPs and domains classified monthly

14.8M

new malicious IPs and domains classified monthly

2.3M

unique threats detected daily

2.3M

unique threats detected daily

99%

public IPv4 visibility

99%

public IPv4 visibility

Resources

Customized security key for opening magnetic locks sitting on top of computer keyboard

2026 Threatscape Report infographic

Modern attacks are engineered long before impact, using exposed edge devices, proxy networks and rapidly rotating infrastructure. Download the infographic for the latest on 2026 threats.

2026 Threatscape Report infographic

Modern attacks are engineered long before impact, using exposed edge devices, proxy networks and rapidly rotating infrastructure. Download the infographic for the latest on 2026 threats.

Highly skilled computer analyst studies computer monitor with details reflected in their glasses.

Protection starts at the network

Lumen® Security Solutions deliver network-level threat intelligence leveraging unmatched network visibility from Black Lotus Labs to help safeguard your environments from edge to core.

Learn more

Protection starts at the network

Lumen® Security Solutions deliver network-level threat intelligence leveraging unmatched network visibility from Black Lotus Labs to help safeguard your environments from edge to core.

Security analyst sitting in front of monitors examining detailed threat scape data discusses action items with colleague.

Black Lotus Labs® blogs

Black Lotus Labs sees and disrupts threats others can’t. Leverage our network visibility to help protect your business.

Black Lotus Labs® blogs

Black Lotus Labs sees and disrupts threats others can’t. Leverage our network visibility to help protect your business.

FAQs

It’s a detailed analysis of the latest cyberthreats and emerging trends observed across the Lumen global network, compiled by the Black Lotus Labs research team.

Black Lotus Labs is the threat intelligence and research arm of Lumen Technologies. The team specializes in tracking, analyzing and disrupting advanced cyberthreats across the global internet.

Black Lotus Labs leverages one of the world's largest and most deeply peered networks to observe malicious activity at scale, then performs advanced analytics and hands-on research to help you stay ahead of evolving threats.

The Lumen Threatscape Report helps security leaders move from reacting to breaches to disrupting attacks before they begin. The report reveals how threat actors use generative AI to build and rotate infrastructure—targeting edge devices, proxy networks and internet-based services long before impact.

Our global network visibility and advanced threat intelligence help you identify malicious infrastructure early and stop threats before they reach your environment. Block malicious traffic and mitigate attacks at the network edge with Lumen® DDoS Mitigation Service and Lumen® Adaptive Network Security.