Rapid7 Q1 2026 Threat Landscape Report Finds Vulnerability Exploitation Overtakes Social Engineering as the Top Initial Access Vector
Rapid7 released its Q1 2026 Threat Landscape Report, finding that vulnerability exploitation has overtaken social engineering as the top initial access vector for cyberattacks. Exploitation accounted for 38% of incident response cases, driven by AI-accelerated attacks on unpatched systems, while social engineering fell to 24%.
Key figures
- Customer count
- 11500
- Akira leak posts
- 174
- Qilin leak posts
- 357
- Gentlemen leak posts
- 206
- Clickfix activity share
- 18.8%
- Rmm tool activity share
- 22.9%
- Social engineering share
- 24%
- Compromised accounts share
- 14%
- Windows native scripts share
- 10.4%
- Zero click vulnerability share
- 50%
- Median time to kev catalog days
- 5
- Vulnerability exploitation share
- 38%
- Prior median time to kev catalog days
- 8.5
AI analysis
The rest of the AI analysis, red flags and sentiment are part of Signal8 Pro.
AI-generated analysis of a public disclosure. Not investment advice; verify against the original document.