Rapid7 report finds human operators still drive most cyberattacks
RPD•Rapid7's third-quarter 2026 cybersecurity report found human operators drove most tracked attacks. Attackers exploited high-severity vulnerabilities in an average of three days, and 71% were exploited in the first week.
1. Vulnerability exploitation
The report found that 79% of exploited flaws required neither authentication nor user interaction. AI was an operational component in 8% of tracked incidents, despite its use in accelerating campaigns.
2. Ransomware listings
U.S. ransomware leak-site listings totaled 1,112, roughly eight times Germany's total and the highest volume among countries tracked.
