Cybersecurity Threat Report — November 2026

Bottom line up front

Threat level: Elevated. Fewer ransomware attacks were posted in September, but each one cost more, and VPN and email-gateway flaws were exploited before patches existed. If you do only three things:

1. Patch remote access this week. Ivanti Connect Secure, FortiMail, Palo Alto PAN-OS and Cisco firewalls all have exploited flaws.
2. Close the fake-IT door. Block outside Microsoft Teams chats from unknown companies, and verify every caller before an MFA reset.
3. Verify payments by phone. Confirm any bank-detail change on a number you already have on file.

Ransomware

• 789 victims were claimed in September, down from a record 964 in August; the U.S. accounted for 41% and healthcare was the most-hit sector (Breachsense, September 2026). Brandefense counts 857 because it removes re-listings; we use Breachsense throughout.
• The median ransom paid reached $400,000 in Q3, up 167%; data was stolen in 71% of cases and nearly 80% of incidents ended without a payment (Coveware by Veeam, Q3 2026).
• Only 34% of firms with 100–250 staff stopped an attack before encryption (Sophos State of Ransomware 2026).
• Police took down the KillSec ransomware operation on October 1 (The Record).

AI-driven threats and wire fraud

• 40–56% of reported phishing that evaded filters was AI-written (Hoxhunt Phishing Trends Report 2026).
• The average wire amount requested in business email compromise rose to $61,732 in Q2 2026, up 45% (APWG Trends Report Q2 2026).
• The FBI warned that approving a fake app consent screen gives attackers access that survives a password reset (FBI IC3 PSA, Sep 1 2026).

Incidents worth learning from

• Phishing installed a signed remote-support tool, then a second as backup. Lesson: allow-list your RMM tools (The Hacker News).
• Attackers flooded inboxes, then called on Teams posing as IT and used Quick Assist; 400+ incidents tracked (Help Net Security, Arctic Wolf).
• Fake help-desk callers led to ransomware; phishing started 37% of Q3 cases (Help Net Security, Cisco Talos).

Patch these first

Source: CISA Known Exploited Vulnerabilities catalog. Median time from CVE publication to KEV listing fell from 120 days in 2025 to 80 in 1H 2026 (VulnCheck).

What changed

• CMMC Phase 2 remains paused with no new start date (Secureframe CMMC tracker).
• The CIRCIA incident-reporting rule went to the White House on October 1: 72 hours to report an incident, 24 for a ransom payment (Paubox).
• Global cyber insurance rates fell 4% in Q3, but U.S. cyber rates were flat (Marsh Global Insurance Market Index).

Eight-step action plan

1. Patch VPNs, firewalls and mail gateways now.
2. Lock down Teams external chat and Quick Assist.
3. Verify every payment change by phone.
4. Verify callers before any MFA reset.
5. Allow-list your remote-support tools.
6. Approve one AI tool for staff.
7. Review connected apps and consents.
8. Keep offline, tested backups.