Comcast Business: 2,500 cybersecurity events occur every second
The emergence of leading-edge artificial intelligence capabilities is increasing the effectiveness of cyberattacks.
The 2026 Cybersecurity Threat Report from Comcast Business analyzes 79.3 billion threat events detected across its cybersecurity customers between Mar. 1, 2025, and Feb. 28, 2026 (an average of roughly 2,514 cybersecurity events every second), and finds they include the following incidents:
- 47.9 billion initial access events and 5.2 billion resource development events, which Comcast Business says shows the volume of automated attacks probing the perimeter and the infrastructure attackers built to run them.
- 288.9 million active scans (probing of end points to discover weak spots), which according to Comcast Business is evidence of bad actors constantly hunting vulnerable devices.
- 25.4 billion phishing events and 21.9 billion drive-by compromise events (malicious code injections from a “normal” site), which are subsets of initial access events and the two highest-volume techniques in the Comcast Business data set.
- 5.8 million attempts to gain covert access to employee browsers through malicious extensions, browser sync, and session theft.
- 57,000 DDoS events driven by botnets seeking to interrupt digital business services with hyper-volumetric distributed denial of service traffic.
[READ MORE: KPMG: Cybersecurity spending rises as attacks increase]
According to Comcast Business, cyberattackers are now leveraging AI to operate at machine speed with lower costs, putting identity verification efforts under pressure from AI agents and non-human accounts. In addition, AI coding tools are enabling criminals to develop new ways to exploit system vulnerabilities before patches are available, while the underlying techniques stay familiar.
Comcast Business analysis also finds that a growing share of the corporate attack surface consists of devices nobody in the organization owns, manages or monitors. Cybercriminals compromise devices in employees’ homes and businesses such as routers, cameras, streaming devices, and POS terminals, conscript them into residential proxy networks, and rent the traffic to threat actors who want their activity to look ordinary.
"Attackers have stopped needing to break in," said Noopur Davis, chief information security and product privacy officer, Comcast Corp. "They get in with stolen credentials, then move through the network the way an employee would. The hard part is no longer just keeping them out. It is also seeing them once they are in and preventing their lateral movement."
The 2026 Comcast Business Cybersecurity Threat Report draws on an expanded telemetry set analyzed through a new threat analytics platform. The figures represent that expanded data set and the updated methodology and are not comparable to totals published in prior Comcast Business reports.
