PHILADELPHIA, PA — Comcast Business detected 79.3 billion cybersecurity events across its business customers during 12 months ending February 28, 2026, as artificial intelligence accelerated attacks and compromised devices outside corporate networks created additional security risks for businesses.
The findings, published in the company’s fourth annual Cybersecurity Threat Report, cover activity recorded between March 1, 2025, and February 28, 2026. The data reflect approximately 2,514 cybersecurity events per second across the monitored environment.
Phishing accounted for 25.4 billion events, while drive-by compromise attempts, which exploit vulnerabilities as users encounter malicious online content, totaled 21.9 billion. The two techniques represented the largest categories identified in the report.
Comcast also recorded 47.9 billion initial-access events and 5.2 billion resource-development events, reflecting the scale of automated activity directed at business systems and the infrastructure used to conduct attacks.
The company identified 288.9 million active scanning events searching for vulnerable devices, along with 5.8 million attempts to covertly access employee browsers through malicious extensions, browser synchronization, and session theft.
Distributed denial-of-service attacks accounted for another 57,000 events, with botnets generating traffic intended to disrupt online business operations.
The findings point to a shift in how established cyberattack techniques are deployed. Comcast researchers reported that AI-assisted coding tools are allowing attackers to develop exploits more quickly, reducing the time organizations have to respond to emerging vulnerabilities.
The report also identified identity management as an increasingly important security concern as attackers exploit stolen credentials, hijacked sessions and non-human accounts associated with automated systems, application programming interfaces and AI agents.
“Attackers have stopped needing to break in,” said Noopur Davis, Comcast Corp.’s chief information security and product privacy officer. “They get in with stolen credentials, then move through the network the way an employee would.”
Davis said detecting unauthorized activity after an attacker gains access has become as important as preventing the initial intrusion.
Another concern involves devices operating beyond traditional corporate security controls.
Comcast researchers identified networks of compromised residential and commercial equipment, including routers, cameras, streaming devices and point-of-sale terminals, used to route internet traffic on behalf of outside parties.
These residential proxy networks can allow malicious activity to appear as ordinary traffic originating from legitimate consumer or business internet connections.
The company’s Threat Research Lab traced groups of infected devices forwarding traffic for third parties, illustrating how equipment outside an organization’s direct control can become part of the infrastructure supporting cyberattacks.
“Many cybersecurity programs are designed around organizational boundaries, but cyber risk does not respect those boundaries,” said Amit Verma, chief technology officer of Comcast Business.
Verma identified remote employees’ home networks, suppliers and unmanaged devices as potential sources of exposure that conventional perimeter-based security programs may not adequately monitor.
The findings have implications for businesses that depend on remote work arrangements, third-party technology providers and connected equipment operating outside centrally managed networks.
Comcast said more than 1.2 billion devices connect across its network, where it identifies, filters and blocks an average of 30 million cyber threats daily.
The company provides business security services including secure software-defined wide-area networking, secure access service edge technology, distributed denial-of-service mitigation and managed detection and response.
Its SecurityEdge service for small businesses uses threat intelligence refreshed every five minutes to block known malicious domains, while SecurityEdge Preferred adds network-based firewall inspection.
Comcast also introduced Xfinity Shield in August, extending network
Support the local news that supports Chester County. MyChesCo delivers reliable, fact-based reporting and essential community resources—free for everyone. If you value that, click here to become a patron today.