For 31 October 2026 to 30 April 2027, we rate two threats as the most likely and two as the most damaging. Identity and SaaS compromise and the exploitation of exposed systems are the most likely. Ransomware and data extortion that attack recovery, and intrusion into operational technology (OT), cost the most when they land. Likelihood and impact are different questions, and this cyber threat landscape outlook keeps them apart.
The ratings are our judgment, built on seven primary sources. They are Google Cloud’s Threat Horizons report for H1 2026, Mandiant’s M-Trends 2026 and a Microsoft Security Research post of 9 September 2026. The rest are two FBI alerts, a CISA alert and a joint US agency advisory of 7 April 2026.
Our earlier post on threat intelligence priorities for 2027 reads agency outlooks on AI and exploitation speed. This one covers only the next six months and what responders and agencies have already observed.
Four Threats Compared: Likely Versus Damaging
Read the second column as our rating and the third as what the sources report. The percentages describe Google’s and Mandiant’s own observed incidents, not every organization.
| Threat. | Our rating. | What the sources report. |
|---|---|---|
| Identity and SaaS compromise. | Most likely. | Mandiant found that identity issues gave initial access in 83% of the H2 2025 incidents it handled in major cloud and SaaS environments. Data theft was the goal in 73% of Google’s cloud-related incidents. |
| Exploitation of exposed systems. | Most likely. | M-Trends 2026 lists exploits as the top initial infection vector for the sixth year running, at 32% in 2025. CISA added two PHP flaws to its Known Exploited Vulnerabilities catalog on 26 October 2026. |
| Ransomware and data extortion that block recovery. | Most damaging. | M-Trends 2026 says adversaries systematically target backups, identity services and virtualization layers to deny recovery. |
| OT intrusion. | Most damaging where exposed. | On 7 April 2026 US agencies reported disruption in several critical infrastructure sectors after Iran-affiliated actors exploited internet-facing controllers. |
Why Do Identity and Exposed Software Lead on Likelihood?
Microsoft Security Research reported on 9 September 2026 that it has seen a help desk impersonation campaign since May 2026. A caller says a passkey, MFA or SSO setting needs an urgent update and sends the victim to a fake sign-in page. The page captures credentials and session tokens, through adversary-in-the-middle phishing or device code phishing. The attacker then registers their own sign-in method, maps the tenant through Microsoft Graph and downloads SharePoint, OneDrive and mail.
Voice is part of the trend. M-Trends 2026 puts voice phishing at 11% of initial vectors, the second most common, while email phishing fell from 14% in 2024 to 6% in 2025.
The FBI warned on 21 May 2026 about Kali365, a phishing-as-a-service kit. It tricks users into typing a device code on a real Microsoft page, which gives the attacker OAuth tokens without a password. Our look at SaaS extortion that starts with OAuth consent shows the same pattern.
Google’s Threat Horizons report adds a twist. In the Google Cloud incidents it observed in H2 2025, entry through third-party software (44.5%) overtook weak or absent credentials (27.2%) for the first time. The two figures come from different datasets, so we do not merge them. Our reading: attackers use whichever door is open.
The window to react is short. Google says the time from disclosure to mass exploitation fell from weeks to days, and it saw crypto miners deployed about 48 hours after CVE-2025-55182 was disclosed. The PHP flaws CVE-2026-109618 and CVE-2026-109619 are the current example, covered in our PHP2Shell explainer. CISA lists fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Why Do Recovery Attacks and OT Intrusion Cost the Most?
M-Trends 2026 says the systematic targeting of backups, identity services and virtualization layers puts pressure on victims to pay or lose the ability to recover. In ransomware-related incidents, prior compromise was the most frequent initial vector, at 30%. Mandiant also describes groups that gain a foothold and then sell or hand off the access, the role often called an initial access broker.
The April advisory (AA26-097A) says Iran-affiliated advanced persistent threat actors exploited internet-facing programmable logic controllers from Rockwell Automation and Allen-Bradley. The agencies assess the aim is disruptive effects. Victims in several US critical infrastructure sectors saw disruption through malicious interactions with project files and manipulated HMI and SCADA displays. In a few cases this meant operational disruption and financial loss.
Agencies earlier reported similar controller attacks by CyberAv3ngers. We rate OT intrusion lower on likelihood than the first two threats, because the sources describe a narrow set of targets. It ranks high on impact because a controller change can stop a physical process. The advisory is about US sectors, and the exposure pattern applies wherever a controller is reachable from the internet.
Which Early Warning Signs Should You Watch?
The signs below come from the sources, except the recovery row, which is our reading of M-Trends. Each one needs a log you already collect or can switch on.
| Threat. | Early warning sign. | Where to look. |
|---|---|---|
| Identity and SaaS. | A new authentication method after an unusual sign-in, high-volume Graph activity, or paced SharePoint and OneDrive downloads. | Identity provider sign-in and audit logs, Graph activity logs, mailbox audit log. |
| Exposed systems. | PHP processes unexpectedly launching command shells or downloading files. | Web server process monitoring and your list of internet-facing assets. |
| Recovery attacks. | Changes to backup retention or replication, new administrators on virtualization or directory systems, disabled security tools. In 44% of Mandiant’s 2025 ransomware cases the adversary told the victim first, against 41% found internally. | Backup console, hypervisor and directory audit logs, endpoint tool health. |
| OT intrusion. | Traffic on ports 44818, 2222, 102 and 502, especially from overseas hosting providers, and a controller mode switch left outside the run position. | Firewall and OT network logs, controller configuration. |
What Are the Five Defenses to Put in Place First?
The order follows the table, so the steps that cover the most likely threats come first. Each step names the source it rests on, and step 3 is our own recommendation.
- Harden resets and sign-in methods. Verify identity before any help desk MFA or credential reset, and alert on every reset. Require phishing-resistant MFA through Conditional Access, and block device code flow unless you have a business need. Our post on where passkey attacks actually land explains why the reset path matters.
- Inventory and patch what faces the internet. Start with PHP and its fixed versions. The FBI says to take a system offline if an immediate update is not feasible. Our guide on how to defend against PHP2Shell has the checks.
- Separate recovery and prove it works. This one is our recommendation, drawn from M-Trends: keep backup, hypervisor and directory administration apart from daily administration, protect the copies, and restore one business-critical service as a test. The ransomware response playbook gives the decision order.
- Log the cloud control plane. Microsoft advises enabling Graph activity logs and mailbox auditing, restricting user consent and reviewing high-privilege service principals.
- Take OT off the internet. The agencies advise removing controllers from direct internet exposure through a secure gateway, and placing the physical mode switch in run position where the controller has one.
Where Does Brandefense Fit?
Steps 1 and 2 begin with seeing what an outsider sees. Atlas, our free external scan, returns a result for a domain in about 30 seconds, and its free breach monitoring check works at domain level. Stolen logins from infected devices are a separate route to a valid identity, and we compared free ways to check infostealer logs. For a continuous inventory, external attack surface management at Brandefense scans internet-facing assets within minutes.
What Does This Outlook Not Claim?
The sources are incident-response data, threat intelligence and public advisories, not a census of attacks. We do not predict a named actor, vulnerability, sector or victim for the period. The ratings above are our judgment, and a team with its own asset inventory, identity logs and recovery tests should adjust them to its own exposure. Start with steps 1 and 2 this week.