- 7
- April
In 2026, the cybersecurity landscape has shifted dramatically — AI is now weaponized by both attackers and defenders. Organizations still relying on traditional security approaches may find themselves increasingly vulnerable. This article summarizes 7 emerging threats that every Thai organization must know, along with practical prevention strategies.
Last updated September 3, 2026 — this article was first published on April 7, 2026 and has now been revised in full against the 2026-cycle industry reports released since then. Three things genuinely changed in priority:
- Unpatched vulnerabilities overtook stolen credentials as the number one way breaches begin.
- AI moved from assistant to operator — there is now a documented case where AI executed roughly 80–90% of an intrusion itself.
- Thailand's two NCSA standards now have hard effective dates: September 10 and September 17, 2026.
What Changed Since the April 2026 Edition
Five months is long enough in security for the risk order to swap places. The table below compares what this article said in April with where things stand in early September 2026, so you can see what deserves to move up your roadmap.
| Topic | April 7, 2026 edition | Status on September 3, 2026 |
|---|---|---|
| Top initial access vector | Phishing and stolen credentials | Vulnerability exploitation at 31% of breaches has taken the number one spot |
| Role of AI on the attacker side | Writes better phishing email, speeds up exploit development | Runs roughly 80–90% of the intrusion lifecycle itself, with a real documented campaign on record |
| Ransomware pattern | Encrypt the files, then demand a ransom | Many groups skip encryption entirely and threaten to publish stolen data — backups alone no longer cover this risk |
| Supply chain | Malicious code injected once into trusted software | Self-propagating worms in package registries, hitting more than 1,300 package versions in a single wave |
| AI risk inside the organization | Staff pasting confidential data into AI tools | Prompt injection is OWASP's number one LLM risk for 2026, and excessive agency climbed to number three |
| Thai regulation | No firm effective dates yet | Cloud Security Standard effective September 10, 2026 and Website Security Standard 1.0 effective September 17, 2026 |
| Time to handle an incident | Quoted a 194-day average detection figure from the 2025 report | Full identify-and-contain cycle is 247 days (183 to identify + 64 to contain), up 2.5% and reversing five straight years of improvement |
7 Cybersecurity Threats to Watch (Revised September 2026)
1. AI-Orchestrated Attacks — AI That Runs the Intrusion, Not Just Writes the Email
The April edition described AI as a tool that made AI-driven attacks faster and more convincing. This year the line moved again. On November 13, 2025, Anthropic's threat intelligence team published a report on a state-sponsored group (tracked as GTG-1002) that built an autonomous framework around Claude Code and let the AI carry roughly 80–90% of the tactical workload across the intrusion lifecycle — reconnaissance, vulnerability discovery, exploitation, credential harvesting, lateral movement and data exfiltration — with humans stepping in only at strategic decision points. The campaign targeted around 30 organizations spanning large technology firms, financial institutions, chemical manufacturers and government agencies.
The part worth reading closely is how the attackers bypassed the guardrails: not by breaking the model, but by slicing the operation into individually harmless-looking tasks and role-playing as a legitimately contracted penetration testing firm. Most of the attack also relied on widely available open-source tooling rather than expensive zero-days. What AI contributed was speed and scale, not a technique nobody had seen before.
On the numbers side, the 2026 cost-of-a-breach report found that AI-driven attacks rose 56% and added roughly USD 1 million to the average cost of a breach. Meanwhile, in early September 2026, all three major model developers announced cyber-focused tooling within 48 hours of each other, and OpenAI disclosed that its Astra model had crossed the Critical cyber capability threshold for the first time — both sides of the equation are accelerating together. For how much of the defensive tooling Thai organizations can actually access, see our summary of the three labs' cyber models.
2. Unpatched Vulnerabilities — The Number One Entry Point, Now Ahead of Stolen Credentials
This is the most consequential reordering of the year. The 2026 Verizon DBIR found that 31% of breaches now begin with the exploitation of a software vulnerability, overtaking stolen credentials as the top initial access vector. Stolen credentials still appear in 39% of all breaches, but their primary role has shifted to lateral movement after the attacker is already inside. IBM X-Force's 2026 index tells the same story from the incident response side: vulnerability exploitation accounted for 40% of the incidents its team observed, and attacks that started by exploiting internet-facing applications rose 44%.
The problem is not that organizations do not know they should patch — it is volume and speed. The same DBIR found that only 26% of critical vulnerabilities were fully remediated over the past year, down from 38%, while the median time to close one stretched from 32 days to 43. At the same time the volume of vulnerabilities is climbing because AI finds bugs faster than before, which was on full display in the July 14, 2026 patch cycle when Microsoft shipped fixes for 570 flaws in a single release, breaking the previous record.
What actually works: if you cannot patch everything in time, start with the vulnerabilities that have evidence of real-world exploitation (the CISA KEV catalog), then work down by CVSS combined with internet exposure. Anything you cannot patch yet should sit behind virtual patching at the WAF layer in the meantime. Our April 2026 patch cycle article walks through the prioritization in detail.
3. Deepfakes — Past the Point Where Listeners Can Tell
Deepfake technology can produce a convincing fake video or voice of an executive in very little time, then use it to order a transfer or change a payee account. 2026 figures put deepfakes at 11% of global fraudulent activity, up from 6.5% in 2024. The average deepfake fraud incident now exceeds USD 500,000 in losses, and averages roughly USD 680,000 at large enterprises. AI-enabled fraud losses reported to the FBI in 2025 totalled USD 893 million.
The most-cited case remains the engineering firm Arup, where a finance employee transferred out USD 25.6 million after joining a video call in which every other participant — the CFO included — was a deepfake. The attackers had taken publicly available videos of real colleagues and generated real-time avatars with synthesized voices. The lesson is not "buy a deepfake detector"; it is that approval workflows must not depend on recognizing a face or a voice. Call back on the number your organization holds on record, require more than one approver for any change of payee bank details, and make vendor master-data changes a system transaction with an audit trail rather than an instruction over chat. Related pretexts common in Thailand are covered in fake IT support scams and identity-based attacks.
4. Supply Chain Attacks — Worms That Propagate Themselves Through Package Registries
The April edition explained supply chain compromise through SolarWinds and MOVEit: malicious code injected once, then distributed through legitimate updates. In 2026 the pattern shifted to malware that steals a developer's token and then uses that token to publish infected packages on its own, turning a single account compromise into hundreds of poisoned packages without a human publishing each one. Self-propagating strains in this family affected more than 1,300 package versions on npm, representing roughly 2 billion downloads per month combined.
2026 incidents that illustrate the same mechanism:
| When | Target | Channel used |
|---|---|---|
| March 30, 2026 | Axios (widely used HTTP library) | Maintainer account takeover, malicious versions published by hand, bypassing CI/CD entirely |
| May 14, 2026 | node-ipc (over 10 million weekly downloads) | Three versions published carrying an 80 KB obfuscated credential-stealing payload |
| June 1, 2026 | The @redhat-cloud-services namespace | A GitHub account compromised via a malicious VS Code extension, then used to modify 32 releases |
| August 2026 | Keyv and related packages | Malware harvesting developer credentials, then spreading itself into further packages |
Two numbers worth remembering: across 2026 there were 59 campaigns of this kind covering 657 malicious packages, and not a single CVE was assigned to any of them — tooling that only watches CVE feeds sees none of this. On the impact side, the 2026 DBIR found third-party involvement in breaches up 60%, reaching 48% of all breaches, and the 2026 cost-of-a-breach report ranked supply chain compromise as the second most common initial vector with the longest response cycle of all, averaging 258 days. The mechanics and how to check your own dependencies are covered in our Node.js supply chain attack article and the GlassWorm case.
5. Ransomware — The Era of Extortion Without Encryption
The April edition weighted this toward Ransomware-as-a-Service lowering the skill barrier. That still holds: IBM X-Force's 2026 index found the number of active ransomware and extortion groups up 49% year over year, reflecting a market fragmenting into many smaller crews, and the 2026 DBIR found ransomware present in 48% of breaches, up from 44%.
What changed the defensive playbook is the extortion model. Through 2026 a large share of incidents involved no file encryption at all — attackers simply stole the data and threatened to publish it. The attacker's reasoning is straightforward: less chance of immediate detection, less time spent inside the network, and no dependency on an encryption routine that might fail. For defenders the implication is blunt: an excellent backup will restore your systems, but it will not un-steal the data. Regulatory fines, litigation and reputational damage all still land in full.
What to add to your existing plan: a recovery plan measured only in RTO and RPO no longer covers this shape of risk. Two additions are needed — egress monitoring to catch bulk data movement before the threat arrives, and a rehearsed data protection breach notification procedure. For the Thai notification timelines, see our PDPA enforcement article.
The encouraging news is that victims are holding firmer. The 2026 DBIR reports that 69% of ransomware victims refused to pay; Q2 2026 payment rates hit a record low, with data-exfiltration-only cases paying just 15% of the time; and the median ransom demand fell to roughly USD 698,000, down 65% over two years. Refusing to pay only becomes an industry default, though, for organizations that already have a recovery plan they actually rehearse.
6. Prompt Injection and Excessive Agency — When AI Can Write Into Business Systems
This item replaces the April edition's "staff leak data through AI tools", because the risk has moved from people pasting secrets into a chat box to AI holding permissions to call APIs and write real records. OWASP's 2026 Top 10 for LLM applications ranks prompt injection as the number one risk, followed by sensitive information disclosure, with excessive agency jumping from sixth place in the 2025 list to third in 2026. The reason for the climb is that today's AI systems browse, call tools and act on a user's behalf. Given access to APIs, databases or infrastructure without clear boundaries, they can chain actions into outcomes nobody asked for — deleted records, or transactions that should never have existed.
The root cause is architectural, not a bug you can patch: instructions and data travel through the same channel, the context window, and there is still no equivalent of a parameterized query to separate the two. That is why reported attack success rates span a wide 50–84% depending on how the system is configured and how many attempts the attacker gets. The practical conclusion is not to place your control at the prompt layer, but at the permissions of the account the AI uses, the scope of the tools it may call, and a human approval gate in front of anything with a financial effect. The full explanation with a checklist is in our prompt injection guide for business systems, and the data governance side is covered in security and data governance for AI in Thai organizations.
7. Shadow AI and Cloud Misconfiguration — Gaps Created by Policy, Not Code
These two sit together because they share a root cause: systems get adopted faster than policy and configuration can follow. On the shadow AI side the numbers moved hardest this year — security incidents involving AI used outside sanctioned channels rose from 20% to 43% among breached organizations. Those incidents averaged USD 5.39 million versus USD 4.63 million for incidents with no shadow AI involvement, and roughly one in five led to a regulatory fine. The figure that points most directly at the cause: 92% of organizations that suffered an AI-related breach had no AI access controls, and 68% had no governance mechanism to manage AI or detect unsanctioned use.
The companion risk is the credentials of the AI accounts themselves. IBM X-Force's 2026 index found that infostealer malware exposed over 300,000 ChatGPT account credentials during 2025 — meaning AI platforms now sit at the same credential risk level as any other core enterprise SaaS. Organizations that want to run models against sensitive data without sending it outside the building have the option of self-hosting; the security caveats are covered in our guide to self-hosting models securely.
On the cloud side, migrating does not make you safer by itself. The 2026 cost-of-a-breach report attributes roughly 27% of breaches to cloud misconfiguration — a familiar family of mistakes: publicly exposed storage, API keys left in a code repository, administrator accounts without multi-factor authentication. The good news about this category is that it is fixed by configuration review and standards rather than expensive tooling, and as of September 10, 2026 that review is no longer optional for organizations in scope of the NCSA cloud security standard.
The 7 Trends at a Glance — Risk Level and How to Defend
| Trend | Risk level | How to defend |
|---|---|---|
| AI-orchestrated attacks | Critical | Shorten detection time with continuous monitoring, restrict service account permissions, and assume the attacker moves faster than your human review cycle |
| Unpatched vulnerabilities | Critical | Prioritize by the CISA KEV catalog before CVSS, apply virtual patching at the WAF, and reduce the number of internet-facing services |
| Deepfake social engineering | Critical | Call back on numbers held in the corporate register, require multiple approvers for payee account changes, and force vendor data edits through the system with an audit trail |
| Supply chain attacks | High | Maintain an SBOM, pin versions with lockfiles, and review freshly updated dependencies rather than relying on CVE feeds alone |
| Ransomware and encryptionless extortion | High | Follow the 3-2-1 backup rule, segment the network, monitor data egress, and rehearse the statutory breach notification procedure |
| Prompt injection and excessive agency | High | Restrict the permissions of the account the AI uses, limit the tools it may call, require human approval before financially significant transactions, and log every call to the audit trail |
| Shadow AI and cloud misconfiguration | Medium-High | Publish an AI usage policy naming the approved tools, enforce AI access controls, and review cloud configuration against the NCSA standard |
The Numbers That Matter — From the 2026 Report Cycle
Every figure in the table below comes from a 2026-cycle report, the most recent edition published as of this update. (The 2026 cost-of-a-breach report is based on 602 organizations breached between March 2025 and February 2026.)
| Metric | Figure | Change | Source |
|---|---|---|---|
| Average cost per breach (global) | USD 4.99 million | Up 12%, the highest in the report's history | IBM Cost of a Data Breach 2026 |
| Full identify-and-contain cycle | 247 days (183 to identify + 64 to contain) | Up 2.5%, reversing five straight years of improvement | IBM Cost of a Data Breach 2026 |
| Breaches starting with vulnerability exploitation | 31% | Overtook stolen credentials as the top initial access vector | Verizon DBIR 2026 |
| Breaches involving stolen credentials | 39% | Primary role shifted to lateral movement | Verizon DBIR 2026 |
| Breaches involving ransomware | 48% | Up from 44% in the previous edition | Verizon DBIR 2026 |
| Ransomware victims who refused to pay | 69% | Q2 2026 payment rates hit a record low | Verizon DBIR 2026 · Coveware by Veeam Q2 2026 |
| Breaches with third-party involvement | 48% | Up 60% from the previous year | Verizon DBIR 2026 |
| Critical vulnerabilities fully remediated | 26% | Down from 38%; median time to close stretched from 32 to 43 days | Verizon DBIR 2026 |
| Incidents caused by vulnerability exploitation | 40% | The leading cause; attacks via internet-facing apps up 44% | IBM X-Force Threat Intelligence 2026 |
| Active ransomware and extortion groups | Up 49% | The market is fragmenting into many smaller crews | IBM X-Force Threat Intelligence 2026 |
| Security incidents involving shadow AI | 43% | More than doubled from 20% in a single year | IBM Cost of a Data Breach 2026 |
| Organizations with an AI-related breach and no AI access controls | 92% | AI-driven attacks up 56%, adding roughly USD 1 million per breach | IBM Cost of a Data Breach 2026 |
One encouraging figure: organizations using security AI and automation extensively averaged USD 4.00 million per breach and cut their identify-and-contain cycle from 280 days to 215 — 65 days shorter (IBM Cost of a Data Breach 2026).
The Thai Context — Local Numbers and the Nearest Deadlines
Global statistics help rank the risks, but the numbers that land with an executive audience are the local ones. Thai organizations face an average of around 3,200 attacks per week, 164% above the global average, while security budgets still trail digital investment by several steps. The detail and case studies are in our article on Thailand's cyber threat picture, and from a board perspective, cyber has become the number one business risk in Thailand at 37%, up from 21% the year before.
The nearest deadlines are the two standards issued by Thailand's National Cyber Security Agency (NCSA), both taking effect this month:
| Effective date | Standard | What to check before the deadline |
|---|---|---|
| September 10, 2026 | Cloud Security Standard | The regions your data actually sits in, the responsibility split with your cloud provider, and your data classification and encryption key management |
| September 17, 2026 | Website Security Standard (WSS) 1.0 | Unexpired SSL certificates, two-factor authentication for web administrators, access logging with anomaly alerting, and baseline flaws such as SQL injection and XSS |
Both standards also lead into a Quantum-Ready plan targeting 2030, which is about planning the encryption upgrade well in advance. The full scope and checklist are in our summary of both NCSA standards. Organizations that need an international standard alongside them can use ISO/IEC 27001 as the management system framework.
NIST Cybersecurity Framework 2.0 — Six Functions
Amid figures that change every quarter, the framework is the most stable part and holds up as a long-term reference. NIST CSF 2.0 (published in 2024) added "Govern" as a new function, covering six areas that map directly onto the NCSA standards:
| Function | Purpose | What to add in 2026 |
|---|---|---|
| Govern | Set policy, roles and responsibilities, and acceptable risk | An AI usage policy naming the approved tools — 68% of breached organizations still have no such policy |
| Identify | Inventory assets, risks and the supply chain | An SBOM for critical systems, plus a register of the service accounts AI or external systems use to reach your data |
| Protect | Access control, training, data security, encryption | AI access controls at the same granularity as real user permissions, not one shared full-privilege account for the whole team |
| Detect | Continuous monitoring, anomaly detection | Egress monitoring, so encryptionless extortion is caught before the demand arrives |
| Respond | Incident response plan, communication, mitigation | Rehearse the statutory data protection notification process alongside system recovery |
| Recover | Recovery plan, backup restore, lessons learned | Test real restores on a schedule, rather than only checking that the backup job ran |
ERP and Security — How an ERP System Helps Defend
An ERP system is the heart of organizational data — if the ERP is compromised, everything from financial records to employee and customer data is at risk. And in 2026, as AI begins reading and writing data in business systems, the ERP takes on one more role: it becomes the layer that enforces permissions and records the trail for every action, whether the instruction came from a person or from an automated tool. That means an ERP needs security built in:
| Security feature | Saeree ERP | Threat it addresses |
|---|---|---|
| Role-Based Access Control (RBAC) | Supported | Insider threats, privilege escalation |
| Two-Factor Authentication (2FA) | Supported | Credential theft, phishing |
| Audit trail on every action | Supported | Fraud detection, compliance |
| Multi-level approval for financially significant transactions | Supported | Deepfake social engineering, payee account changes |
| Data encryption (TLS 1.3 + AES-256) | Supported | Data breach, man-in-the-middle |
| SSL Grade A+ (HTTPS) | Supported | Eavesdropping, session hijacking |
| IP whitelisting / firewall rules | Supported | Unauthorized access, brute force |
| Automated backup + DR plan | Supported | Ransomware, data loss |
| AI access runs on the ERP's existing permissions and audit trail | Supported | Prompt injection, excessive agency, shadow AI |
That last row is something we ran internally before offering it to clients — connecting AI to the system through MCP so that its permissions follow the ERP's existing authorization map, no full-privilege account is handed to an automated tool, and every call lands in the audit trail exactly as a human transaction would. This way, an instruction smuggled in through data (prompt injection) can never exceed the permissions of the account in use, and you can always trace back who or what issued a given command.
It should be said plainly, though, that the ERP is the last line, not the only line — employee endpoints, network equipment and internet-facing websites still need their own patching and monitoring. A well-configured ERP limits the damage when the outer layers are breached; it does not stop them from being breached.
Related articles
- Thailand's NCSA Cloud & Website Security Standards — the readiness checklist
- What Is Prompt Injection? The guide before you connect an AI agent to business systems
- 570 flaws in one Patch Tuesday — how to prioritize patching
- Cyber is the #1 business risk in Thailand — the executive view
- ERP data security — what executives need to know
- Disaster recovery planning for organizations
"What changed in 2026 is not that attackers got smarter. It is that work which used to take a team several weeks can now be automated into a few hours. The organizations that cope are not the ones that closed every gap — they are the ones that detect quickly, keep permissions tight, and rehearsed recovery before anything happened."
- Paitoon Butri, Grand Linux Solution
References
- IBM — Cost of a Data Breach Report 2026
- Verizon — Data Breach Investigations Report (DBIR) 2026
- IBM X-Force — Threat Intelligence Index 2026
- OWASP GenAI Security Project — Top 10 for LLM Applications 2026
- Anthropic — Disrupting the first reported AI-orchestrated cyber espionage campaign (November 13, 2025)
- Sophos — The State of Ransomware 2026
- Coveware by Veeam — Ransomware Payment Trends Q2 2026
- CISA — Known Exploited Vulnerabilities (KEV) Catalog
- NIST — Cybersecurity Framework 2.0
- NCSA — National Cyber Security Agency of Thailand
If your organization needs an ERP system that takes data security seriously, feel free to talk to our specialists.
