GLOBAL CYBERTHREAT OUTLOOK

2026 Lumen Defender Threatscape Report

Take an inside look at modern cyberthreats and what their trajectories signal for the future.

Get report

GLOBAL CYBERTHREAT OUTLOOK

2026 Lumen Defender Threatscape Report

Take an inside look at modern cyberthreats and what their trajectories signal for the future.

Exposing the setup before the breach

Access key insights to learn how to help stop cyberthreats before they start.

Get exec summary Get full report

Exposing the setup before the breach

Access key insights to learn how to help stop cyberthreats before they start.

Illustrated map of the continental U.S. with lines depicting network routes across the country.

Unmatched global network visibility

As the #1 globally peered network,¹ Lumen watches threat actors assemble their tools and map routes across the public internet—spotting the heist infrastructure long before the breach begins.

View maps

Unmatched global network visibility

As the #1 globally peered network,¹ Lumen watches threat actors assemble their tools and map routes across the public internet—spotting the heist infrastructure long before the breach begins.

200B+

NetFlow sessions monitored daily

200B+

NetFlow sessions monitored daily

14.8M

new malicious IPs and domains classified monthly

14.8M

new malicious IPs and domains classified monthly

2.3M

unique threats detected daily

2.3M

unique threats detected daily

99%

public IPv4 visibility

99%

public IPv4 visibility

Threat intel built for your industry

Explore reports specific to your industry or role to sharpen your security strategy with network-level threat visibility.

Threat intel built for your industry

Explore reports specific to your industry or role to sharpen your security strategy with network-level threat visibility.

Public Sector

From AI-accelerated environments to disguised proxy networks, infrastructure-level signals reveal emerging threats before agencies see impact.

Public Sector

From AI-accelerated environments to disguised proxy networks, infrastructure-level signals reveal emerging threats before agencies see impact.

Financial Services

Attackers follow opportunities across exposed services and credentials. Proactive intelligence helps you stay ahead.

Financial Services

Attackers follow opportunities across exposed services and credentials. Proactive intelligence helps you stay ahead.

Healthcare

Healthcare threats build upstream before systems show signs of compromise. Catching threats at the source shifts detection earlier, giving defenders time to act.

Healthcare

Healthcare threats build upstream before systems show signs of compromise. Catching threats at the source shifts detection earlier, giving defenders time to act.

Manufacturing

Exposed edge infrastructure opens a direct path to critical operational systems. Upstream threat signals can help identify that risk before it reaches the production environment.

Manufacturing

Exposed edge infrastructure opens a direct path to critical operational systems. Upstream threat signals can help identify that risk before it reaches the production environment.

Media and Entertainment

Edge-driven threats target the delivery paths that streaming platforms depend on. Threat intelligence from the backbone helps anticipate disruption before it reaches your audience.

Media and Entertainment

Edge-driven threats target the delivery paths that streaming platforms depend on. Threat intelligence from the backbone helps anticipate disruption before it reaches your audience.

Chief information security officers

Modern attacks build beyond the perimeter, where endpoint tools have no visibility. Infrastructure-level signals help security leaders detect and manage risk earlier in the attack chain.

Chief information security officers

Modern attacks build beyond the perimeter, where endpoint tools have no visibility. Infrastructure-level signals help security leaders detect and manage risk earlier in the attack chain.

Chief information officers

Attacks now move at machine speed, outpacing traditional monitoring across distributed infrastructure. Proactive threat intelligence helps technology leaders close blind spots before attackers exploit them.

Chief information officers

Resources

Customized security key for opening magnetic locks sitting on top of computer keyboard

2026 Threatscape Report infographic

Modern attacks are engineered long before impact, using exposed edge devices, proxy networks and rapidly rotating infrastructure. Download the infographic for the latest on 2026 threats.

2026 Threatscape Report infographic

Modern attacks are engineered long before impact, using exposed edge devices, proxy networks and rapidly rotating infrastructure. Download the infographic for the latest on 2026 threats.

Highly skilled computer analyst studies computer monitor with details reflected in their glasses.

Protection starts at the network

Lumen® Security Solutions deliver network-level threat intelligence leveraging unmatched network visibility from Black Lotus Labs to help safeguard your environments from edge to core.

Learn more

Protection starts at the network

Lumen® Security Solutions deliver network-level threat intelligence leveraging unmatched network visibility from Black Lotus Labs to help safeguard your environments from edge to core.

Security analyst sitting in front of monitors examining detailed threatscape data discusses action items with colleague.

Black Lotus Labs® blogs

Stay informed on the tactics shaping modern attacks. Black Lotus Labs publishes hands-on research on botnets, malware campaigns and threat actor infrastructure drawn from direct network analysis.

Black Lotus Labs® blogs

Stay informed on the tactics shaping modern attacks. Black Lotus Labs publishes hands-on research on botnets, malware campaigns and threat actor infrastructure drawn from direct network analysis.

FAQs

It’s a detailed analysis of the latest cyberthreats and emerging trends observed across the Lumen global network, compiled by the Black Lotus Labs research team.

Black Lotus Labs is the threat intelligence and research arm of Lumen Technologies. The team specializes in tracking, analyzing and disrupting advanced cyberthreats across the global internet.

Black Lotus Labs leverages one of the world's largest and most deeply peered fiber networks to observe malicious activity at scale, then performs advanced analytics and hands-on research to help you stay ahead of evolving threats.

Most threat reports analyze attacks after they hit an organization. This report focuses on how attacks are built upstream—before a single organization is targeted. That visibility differs the value of the report from a breach catalog to an early‑warning view of how modern attacks are staged.

The report is designed for security leaders and their operational team—from CISOs and SOC Directors to analysts and threat hunters—who need to understand how the threat landscape is changing, not just which malware families are popular.

The Lumen Threatscape Report helps security leaders move from reacting to breaches to disrupting attacks before they begin. The report reveals how threat actors use generative AI to build and rotate infrastructure—targeting edge devices, proxy networks and internet-based services long before impact.

Our global network visibility and advanced threat intelligence help you identify malicious infrastructure early and stop threats before they reach your environment. Block malicious traffic and mitigate attacks at the network edge with Lumen Defender℠, Lumen® DDoS Mitigation Service and other Lumen® Adaptive Network Security.