Key findings and security
implications
Cyberattacks are evolving in ways that increase both the
speed and reach of an intrusion. Threat actors are using AI agents to automate
attack workflows, exploiting stolen identities to move between connected
services and targeting security controls to reduce detection and recovery
capabilities.
The inaugural Acronis TRU Cyber Pulse Report brings together investigations conducted by the
Acronis Threat Research Unit (TRU) into emerging attack techniques, espionage
activity and cybercrime. The findings reveal a common pattern: An initial
compromise can provide access far beyond the affected device or account.
For managed service providers (MSPs), this creates
particular risks. A compromised administrative identity, remote management tool
or shared service can expose multiple client environments. Organizations must
therefore understand not only how attackers gain access, but also how far that
access can extend.
6 key findings from the Acronis TRU Cyber Pulse 2026 report:
- AI agents are expanding the scale of cyberattacks: Threat actors are moving beyond using AI for individual tasks, such as writing phishing messages or analyzing vulnerabilities.
- Stolen identities are becoming a primary route to wider compromise: Infostealers and identity-focused attacks increasingly target credentials, authentication tokens, browser sessions and cloud access.
- Attackers are deliberately weakening security and recovery controls: Disabling security tools has become an important part of modern intrusion activity.
- Trusted services and software are being exploited to conceal attacks: Cybercriminals and espionage operators increasingly use familiar platforms, including GitHub, Telegram and cloud storage services, to distribute malware or maintain communication with compromised systems.
- Ransomware operations are adapting to disruption and expanding beyond Windows: Law enforcement operations can disrupt cybercriminal infrastructure, but the tools and expertise behind those operations may remain available.
- Vulnerability exploitation and trusted relationships are increasing the reach of intrusions: Attackers are exploiting newly disclosed vulnerabilities quickly, reducing the time available for organizations to deploy security updates.
Read the Executive Summary for the key findings and security implications from the Acronis TRU Cyber Pulse Report 2026.