Fortinet warns cybercrime will operate at industrial scale by 2026

Fortinet’s 2026 Cyberthreat Predictions Report forecasts cybercrime evolving into a fully industrialised ecosystem driven by AI, automation and specialised tools, where the speed of converting intelligence into action will determine the effectiveness of both attacks and defence.

Fortinet has released its 2026 Cyberthreat Predictions Report, warning that the coming year will mark a dramatic shift in the global cyber landscape. According to FortiGuard Labs, cybercrime is rapidly evolving into an organised, AI-driven industry where attackers will prioritise speed and throughput over novel techniques.

The report says that advances in automation, artificial intelligence and a maturing cybercrime supply chain will allow attackers to launch multiple campaigns simultaneously, drastically shrinking the time from intrusion to impact. Attackers are expected to use AI agents for reconnaissance, intrusion, credential theft and ransom negotiations, transforming cyber operations into high-volume, industrial-scale processes.

Rashish Pandey, Vice President – Marketing & Communications, APAC, Fortinet, said the findings show that “cybercrime is no longer an opportunistic activity, it is an industrialized system operating at machine speed. As automation, specialization, and AI redefine every stage of the attack lifecycle, the time between compromise and consequence continues to collapse.” He added that cybersecurity has become “a race of systems, not individuals,” requiring organisations to unify intelligence, validation and response capabilities.

AI to reshape offence as underground markets become structured

The report predicts the rise of specialised AI agents designed to support cybercriminal operations. These systems will automate key stages of an attack, from lateral movement to data monetisation. AI tools will also analyse stolen databases instantly, identify lucrative victims and craft customised extortion messages—turning data into currency faster than ever.

Fortinet expects underground marketplaces to become increasingly organised, offering tailored access bundles, automated escrow and customer service-like features. This shift signals the further industrialisation of cybercrime as attackers leverage automation to scale operations.

Defence must match machine-speed threats

FortiGuard Labs urges organisations to adopt “machine-speed defence,” integrating continuous validation, real-time intelligence and rapid containment. Frameworks such as CTEM and MITRE ATT&CK will be critical for mapping active threats and prioritising remediation.

Vivek Srivastava, Country Manager, India & SAARC, Fortinet, emphasized that “static configurations and periodic assessments can’t keep pace with an environment where attackers automate reconnaissance, privilege escalation, and extortion in minutes. What organizations need is a unified, adaptive security posture… into a continuous, AI-enabled workflow.”

He added that Fortinet’s focus is on helping customers strengthen resilience so they can “act at the same speed as the threats they face.”

Global collaboration and the road to 2027

The report highlights the growing need for coordinated global action, citing initiatives such as INTERPOL’s Operation Serengeti 2.0 and Fortinet’s Cybercrime Bounty program as examples of effective multi-stakeholder deterrence.

By 2027, cybercrime is expected to operate at a scale comparable to legitimate industries, powered by swarm-like agentic AI and more sophisticated supply-chain attacks. Fortinet notes that organisations combining predictive intelligence, automation and human expertise will be best positioned to withstand the next era of cyber risk.