X-Force Threat Intelligence Index 2026

IBM X-Force is a threat-centric team of hackers, responders, researchers and analysts. The X-Force portfolio includes offensive and defensive products and services, fueled by a 360-degree view of threats.

In an age of relentless cyberattacks, a connected everything and increasing regulatory mandates, organizations need a focused security approach. X-Force believes the threat should be the focal point. Through penetration testing, vulnerability management and adversary simulation services, the IBM X-Force Red team of hackers assumes the role of threat actors to find security vulnerabilities—exposing your most important assets.

Through incident preparedness, detection and response and crisis management services, the IBM X-Force Incident Response team knows where threats may hide and how to stop them. X-Force researchers create offensive techniques for detecting and preventing threats, while X-Force analysts collect and translate threat data into actionable information for reducing risk.

With a deep understanding of how threat actors think, strategize and strike, X-Force can help you prevent, detect, respond to and recover from incidents and focus on business priorities.

If your organization would like support strengthening your security posture, schedule a one-on-one briefing with an IBM X-Force expert.

© Copyright IBM Corporation 2026

IBM Corporation
New Orchard Road
Armonk, NY 10504

Produced in the United States of America | February 2026

IBM, the IBM logo, IBM Security, and X-Force are trademarks or registered trademarks of International Business Machines Corporation, in the United States and/or other countries. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on ibm.com/trademark.

Amazon is a trademark or registered trademark of Amazon.com, Inc. or its affiliates in the United States and other countries.

Anthropic and Claude AI are trademarks or registered trademarks of Anthropic PBC in the United States and other countries.

AnyDesk is a trademark or registered trademark of AnyDesk Software GmbH in Germany and other countries.

Apple is a trademark or registered trademark of Apple Inc. in the United States and other countries.

ASUS is a trademark or registered trademark of ASUSTeK Computer Inc. in Taiwan and other countries

Cisco and Duo are trademarks or registered trademarks of Cisco Systems, Inc. in the United States and other countries.

Codecov is a trademark or registered trademark of Codecov, LLC in the United States and other countries.

ConnectWise is a trademark or registered trademark of ConnectWise, LLC in the United States and other countries.

Docker is a trademark or registered trademark of Docker, Inc. in the United States and other countries.

Fortra GoAnywhere is a trademark or registered trademark of Fortra, LLC in the United States and other countries.

Gainsight is a trademark of Gainsight, Inc. in the United States and other countries.

GITHUB is a registered trademark owned by GitHub, Inc. It is registered in the United States and other countries,

GitLab is a registered trademark owned by GitLab Inc.

Google and Gemini are trademarks of Google LLC.

Kaseya is a trademark or registered trademark of Kaseya Limited in the United States and other countries.

Kiteworks is a trademark or registered trademark of Kiteworks, Inc. in the United States and other countries.

LastPass is a trademark or registered trademark of GoTo Group, Inc. in the United States and other countries.

“npm” is a registered trademark of npm, Inc.

Okta is a trademark or registered trademark of Okta, Inc. in the United States and other countries.

OpenAI and ChatGPT are trademarks or registered trademarks of OpenAI OpCo, LLC in the United States and other countries.

Oracle is a trademark or registered trademark of Oracle Corporation and/or its affiliates in the United States and other countries.

Perplexity is a trademark of Perplexity AI, Inc.

Progress MOVEit is a trademark or registered trademark of Progress Software Corporation in the United States and other countries.

Python and PyPI are trademarks of the Python Software Foundation in the United States and other countries.

Salesforce is a trademark or registered trademark of Salesforce, Inc.

Salesloft is a trademark or registered trademark of Salesloft, Inc.

Snowflake is a trademark or registered trademark of Snowflake Inc. in the United States and other countries.

SolarWinds is a trademark or registered trademark of SolarWinds Worldwide, LLC in the United States and other countries.

SonicWall is a trademark or registered trademark of SonicWall Inc. in the United States and other countries.

Tyler Technologies is a trademark or registered trademark of Tyler Technologies, Inc. in the United States and other countries.

Wipro is a trademark or registered trademark of Wipro Limited in India and other countries.

3CX is a trademark or registered trademark of 3CX Ltd. in Cyprus and other countries

This document is current as of the initial date of publication and may be changed by IBM at any time. Not all offerings are available in every country in which IBM operates.

It is the user’s responsibility to evaluate and verify the operation of any other products or programs with IBM products and programs. THE INFORMATION IN THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING WITHOUT ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OR CONDITION OF NON-INFRINGEMENT. IBM products are warranted according to the terms and conditions of the agreements under which they are provided.

Statement of Good Security Practices: No IT system or product should be considered completely secure, and no single product, service or security measure can be completely effective in preventing improper use or access. IBM does not warrant that any systems, products or services are immune from, or will make your enterprise immune from, the malicious or illegal conduct of any party.

The client is responsible for ensuring compliance with laws and regulations applicable to it. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the client is in compliance with any law or regulation.