In Germany alone, cyberattacks caused damages of 289 billion euros in 2025. This trend will continue in 2026. Economic uncertainty, rising costs, and restrained investment are currently shaping the mood in many German companies. Investments in cybersecurity are often pushed to the background in order to save money.

However, savings are frequently made in the wrong place: cybercriminals do not experience recessions. Reduced IT budgets often offer cybercriminals particularly good opportunities to exploit attack surfaces.

In 2026, Ransomware-as-a-Service will remain one of the biggest threats. Over recent years, Ransomware-as-a-Service has established itself as a lucrative business model in which criminals provide malware to other attackers (so-called affiliates) as a Software-as-a-Service offering. These affiliates — often without significant technical knowledge — can then carry out large-scale attacks.

Artificial intelligence is not only an efficiency booster in everyday office work — cybercriminals are also using AI tools to target a broad mass of victims.

Autonomous AI agents independently search for vulnerabilities, select suitable attack paths, and improve their tactics as soon as countermeasures are implemented. These so-called agentic AIs execute tasks largely without human intervention, possess a very high degree of autonomy, and can therefore scale cyberattacks extremely effectively — attacking multiple systems or companies simultaneously.

Complex tasks can be carried out autonomously in the shortest possible time with the help of machine learning and decision logic, making the attacks increasingly better and more efficient.

For example, phishing attacks can be combined with near-perfect wording together with deepfake voices and videos to create deceptively realistic scenarios that serve as the entry point for compromising entire companies or complete supply chains. The human factor remains the biggest gateway.
Insecure cloud or hybrid infrastructures will continue to represent major threats in 2026.

The cloud has become the standard today, but is frequently misconfigured or insufficiently secured. Particularly over-privileged user accounts, missing access controls, lack of transparency in the use of cloud applications, and insufficient awareness of cyber threats open the door for attackers.

Very often, the cloud providers are not the problem — rather it is the lack of security concepts resulting from cost-cutting measures by the companies themselves or from a lack of security competence among decision-makers.