Rapid7 Report: Human Operators Still Drive Most of Tracked Cyberattacks, but Exploitation Windows Are Narrow
Rapid7 released its Q3 2026 Quarterly Threat Landscape Report and announced Rapid7 Intelligence, a new offering connecting vulnerability research, incident response, and underground monitoring into a unified threat-intelligence view. Key findings: AI appears as an operational component in only 8% of tracked incidents, attackers exploit high-severity vulnerabilities within an average of three days, and 79% of exploited flaws required no authentication or user interaction. The U.S. led ransomware leak-site listings with 1,112.
Key figures
- Customer count
- 11,500+
- Us ransomware listings
- 1112
- Exploits first week pct
- 71%
- Ai used in incidents pct
- 8%
- Monitored underground posts
- 63
- Rdp or network access posts
- 41
- Exploitation within days avg
- 3
- Exploits no auth no interaction pct
- 79%
AI analysis
The rest of the AI analysis, red flags and sentiment are part of Signal8 Pro.
AI-generated analysis of a public disclosure. Not investment advice; verify against the original document.