Sophos AI Security 2026 Report

On July 22, 2026, Sophos released its AI Security 2026 Report, revealing that cybercriminals are operationalizing artificial intelligence to compress attack timelines from weeks to days. The report highlights a campaign tracked as STAC6994, where a threat actor used approximately 12 AI agents to develop nearly 80 modules and over 70 evasion techniques targeting endpoint products from Sophos, CrowdStrike, and Microsoft Defender. It also identifies enterprise AI identities, OAuth tokens, agents, and APIs as a growing attack surface, and notes that AI-assisted social engineering and deepfakes are now operational tools. The findings are based on data from over 625,000 customers and multiple Sophos research units.