Comcast Business 2026 Cybersecurity Threat Report: 79.3 Billion Events Show AI Pressurizing the Threat Landscape
Comcast (CMCSA) has released its fourth annual Comcast Business Cybersecurity Threat Report, analyzing 79.3 billion cybersecurity events.
Sentiment and the balance of points
Rhea-AI Sentiment reads the wording of the document, how positive or negative its language is on a 1 to 5 scale. The balance of points shown with the takes weighs what the document actually discloses, so the two can disagree, for example when a trial that missed its main goal is described in upbeat language.
Fourth annual report finds attackers operating at machine speed, identity under pressure from AI agents and non-human accounts, and a growing share of attack traffic routed through devices no organization owns
KEY TAKEAWAYS:
- Phishing at 25.4 billion events and drive-by compromise at 21.9 billion were the two highest-volume techniques Comcast Business observed
- Comcast blocks an average of 30 million cyber threats daily across more than 1.2 billion connected devices
The window between exposure and impact has narrowed. AI coding tools let attackers develop new exploits before patches are available, while the underlying techniques stay familiar. Phishing and drive-by compromise attacks still lead by volume. What shifted is the speed and cost of running them at scale.
Findings from 79.3 Billion Cybersecurity Events
- 47.9 billion initial access events and 5.2 billion resource development events, showing the volume of automated attacks probing the perimeter and the infrastructure attackers built to run them
- 288.9 million active scans, evidence of adversaries constantly hunting vulnerable devices
- 25.4 billion phishing events and 21.9 billion drive-by compromise events the two highest-volume techniques in the data set
- 5.8 million attempts to gain covert access to employee browsers through malicious extensions, browser sync, and session theft
- 57,000 DDoS events driven by botnets seeking to interrupt digital business services with hyper-volumetric traffic
The total means an average of roughly 2,514 cybersecurity events every second.
Identity is Where the Pressure Lands
Stolen credentials, hijacked sessions, and an explosion of non-human identities have made identity the focal point of defense. AI agents and APIs open new inroads into the enterprise, each one carrying permissions no employee would be granted. Defending against this requires identity management paired with ongoing behavioral analysis rather than a one-time verification.
"Attackers have stopped needing to break in," said Noopur Davis, Chief Information Security and Product Privacy Officer, Comcast Corporation. "They get in with stolen credentials, then move through the network the way an employee would. The hard part is no longer just keeping them out. It is also seeing them once they are in and preventing their lateral movement."
The Unmapped Edge
A growing share of the corporate attack surface consists of devices nobody in the organization owns, manages, or monitors. Attackers compromise devices in employees’ homes and businesses such as routers, cameras, streaming devices, and point-of-sale terminals, conscript them into residential proxy networks, and rent the traffic to buyers who want their activity to look ordinary. Researchers at the Comcast Threat Research Lab traced this infrastructure and identified large groupings of infected devices forwarding traffic for outsiders. Perimeter controls do not account for these devices, because no one has mapped them.
“Many cybersecurity programs are designed around organizational boundaries, but cyber risk does not respect those boundaries,” said Amit Verma, Chief Technology Officer, Comcast Business. “Today’s threats often emerge from remote employees’ home offices, supplier networks, other third-party networks, and unmanaged devices. Effective defense requires visibility into network activity across that broader environment, so organizations can identify and respond to risk wherever it originates.”
Security Built into the Network
When threats move at machine speed, the advantage belongs to organizations that can act on intelligence in real-time. Comcast Business delivers secure SD-WAN and SASE, DDoS mitigation, and AI-powered Managed Detection and Response (MDR), backed by a 24/7 security operations center. For small businesses, Comcast Business SecurityEdge® helps block known malicious domains using threat intelligence that refreshes every five minutes, and SecurityEdge™ Preferred adds a next-generation firewall inside the Comcast network that inspects traffic in both directions.
More than 1.2 billion devices connect across the Comcast network, where the company identifies, filters, and blocks an average of 30 million cyber threats every day. That work spans the home and the business. Xfinity Shield, launched in August, turns home WiFi into a layer of protection through the Xfinity Gateway. Comcast Business applies a network-level approach to organizations of every size.
About the 2026 Data
The 2026 report draws on an expanded telemetry set analyzed through a new threat analytics platform. The figures represent that expanded data set and the updated methodology and are not comparable to totals published in prior reports.
To download the full 2026 Comcast Business Cybersecurity Threat Report, visit: https://business.comcast.com/resources/enterprise/reports/2026-comcast-business-cybersecurity-threat-report
About Comcast Business
Comcast Business offers leading global businesses the technology solutions and forward-thinking partnership they need. With a full suite of solutions including fast, reliable connectivity, secure networking solutions and advanced cybersecurity and a range of managed service options, Comcast Business is ready to meet the needs of businesses of all sizes. Comcast Business has been recognized by leading analyst firms for its continued growth, innovation, and leadership, and is committed to partnering with customers to help them drive their businesses forward.
For more information, call 800-501-6000. Follow @ComcastBusiness on social media networks at http://business.comcast.com/social.
About Comcast Corporation
Comcast Corporation (Nasdaq: CMCSA) is a global media and technology company. From the connectivity and platforms we provide, to the content and experiences we create, our businesses reach hundreds of millions of customers, viewers, and guests worldwide. We deliver world-class broadband, wireless, and video through Xfinity, Comcast Business, and Sky; produce, distribute, and stream leading entertainment, sports, and news through brands including NBC, Telemundo, Universal, Peacock, and Sky; and bring incredible theme parks and attractions to life through Universal Destinations & Experiences. Visit www.comcastcorporation.com for more information.
View source version on businesswire.com: https://www.businesswire.com/news/home/20261005724314/en/
Media Contacts:
Matt Helmke
215.286.8666
Matt_Helmke@comcast.com
Source: Comcast Corporation