PHILADELPHIA, PA — Comcast Business detected 79.3 billion cybersecurity events over a 12-month period ending February 28, 2026, as automated attacks, stolen credentials and compromised consumer devices expanded the risks facing corporate networks, according to the company’s fourth annual Cybersecurity Threat Report.
The findings, drawn from activity across Comcast Business cybersecurity customers between March 1, 2025, and February 28, 2026, represent an average of approximately 2,514 security events per second.
Phishing accounted for 25.4 billion events, while drive-by compromise attempts, which seek to exploit vulnerabilities when users encounter malicious online content, totaled 21.9 billion.
Together, the two techniques represented nearly 60% of the cybersecurity events analyzed, underscoring the continued reliance on established attack methods even as artificial intelligence makes them faster and less expensive to deploy.
The report identified 47.9 billion initial-access events, reflecting attempts to penetrate networks and systems, along with 5.2 billion resource-development events associated with infrastructure used to support attacks.
Comcast researchers also recorded 288.9 million active scanning events, indicating extensive automated efforts to identify vulnerable devices and exposed services.
The findings point to a shift in cybersecurity risks as attackers increasingly exploit legitimate user credentials and authenticated sessions rather than relying exclusively on technical vulnerabilities to enter corporate networks.
“Attackers have stopped needing to break in,” said Noopur Davis, Comcast Corporation’s chief information security and product privacy officer. “They get in with stolen credentials, then move through the network the way an employee would.”
The report identified 5.8 million attempts to gain covert access to employee browsers through malicious extensions, browser synchronization and session theft.
These techniques can allow attackers to access authenticated sessions and potentially bypass security measures designed to prevent unauthorized logins.
Comcast also identified artificial intelligence agents, application programming interfaces and other non-human accounts as emerging sources of identity-related risk.
Such systems can operate with extensive permissions and automated access to corporate resources, increasing the importance of monitoring how accounts behave after authentication.
The company said organizations increasingly need continuous behavioral analysis alongside traditional identity and access management controls.
Another significant finding involved the use of compromised devices outside corporate ownership and management.
Researchers identified networks of infected residential routers, cameras, streaming devices and point-of-sale terminals being used to route malicious traffic through ordinary internet connections.
These residential proxy networks can conceal the origins of cyberattacks by making traffic appear to come from legitimate consumer or business devices.
The infrastructure creates security challenges for organizations whose defenses focus primarily on company-owned equipment and networks.
“Many cybersecurity programs are designed around organizational boundaries, but cyber risk does not respect those boundaries,” said Amit Verma, chief technology officer of Comcast Business.
Verma said threats increasingly originate from remote employees’ home offices, supplier networks, third-party systems and unmanaged devices.
The report also documented 57,000 distributed denial-of-service events, in which networks of compromised devices generate traffic intended to overwhelm websites, applications or other digital services.
Comcast said artificial intelligence is accelerating the development and deployment of cyberattacks, including efforts to exploit vulnerabilities before software patches become available.
The resulting reduction in the time between vulnerability exposure and potential compromise increases pressure on organizations to identify and respond to threats more quickly.
Across Comcast’s broader network, more than 1.2 billion devices connect to its infrastructure, where the company said it identifies, filters and blocks an average of 30 million cyber threats daily.
Comcast Business provides network-based cybersecurity services, including secure software-defined wide-area networking, secure access service edge technology, distributed denial-of-service mitigation and managed detection and response.
Its SecurityEdge service for small businesses blocks access to known malicious domains using threat intelligence updated every five minutes, while SecurityEdge Preferred adds firewall inspection within Comcast’s network.
The company’s Xfinity Shield service, introduced in August, extends network-level security protections to residential WiFi connections through the Xfinity Gateway.
Comcast cautioned that the 2026 report uses an expanded telemetry data set and a new threat analytics platform.
As a result, the 79.3 billion-event total and other findings are not directly comparable with figures published in previous editions of the report.
Support the local news that supports Chester County. MyChesCo delivers reliable, fact-based reporting and essential community resources—free for everyone. If you value that, click here to become a patron today.