Q1. The H1 2026 data shows network attack volume fell 79% while novel endpoint malware rose 2,065%. On the surface that looks like good news on one front and a serious problem on another. What is happening in attacker behaviour that produces both numbers simultaneously?
Attackers have shifted from spraying to aiming. Mass campaigns generate big numbers because the same exploit is fired at thousands of networks at once, so when they wind down, overall volume falls with them. That is what our data shows, with network attack detections down 79%, from about five blocked per device per day to about one.
At the same time, attackers appear to be putting their effort into building malware that is harder to detect. Never-before-seen endpoint malware rose 2,065% year on year, and nearly 96% of endpoint alerts in Q2 appeared on exactly one machine, which points to custom payloads built for single victims and made cheap by malware-as-a-service and AI-assisted tooling.
Put together, the two numbers tell one story. Attackers are making fewer and quieter attempts, but putting far more effort into making each one hard to recognise. A drop in volume doesn’t mean a drop in risk, because attackers are becoming more targeted, adaptive and sophisticated, and AI is making that easier for them.
Q2. Novel endpoint malware rising 2,065% means attackers are building or customising tools to evade existing detection. What does that number tell you about how quickly signature-based and pattern-matching defences are being rendered obsolete?
I don’t think signature-based detection can be the primary control anymore, although it still has a role alongside newer approaches. Signature-based detection works much like a wanted poster, in that it can only identify a threat someone has already seen. Most new malware is now built for a single victim, which means there is no poster to match it against, so modern tools instead assess what a file does once it runs. In the sceond quarter, more than two-thirds of what we stopped on endpoints was caught that way, up from about 40% in the first quarter.
I would be careful with the word “obsolete”, because attackers still lean on old exploits, and known-threat detection still catches plenty. Evasive malware did account for nearly a third of detections overall, though, an organisation relying on signatures alone is defending against yesterday’s attacker.
Q3. APAC becoming the most-attacked region for network exploits is a significant shift in the global threat distribution. What is driving that concentration and how stable do you expect that regional targeting pattern to be over the next twelve months?
Per device, APAC networks faced the most exploit pressure in H1, at 38% of per-Firebox detections, up from 21% in the previous half. Two points of context. It is a smaller pool of reporting devices than other regions, so a few heavily targeted networks can move the average. And it is not new: APAC also led this measure in three quarters across 2024 and early 2025.
What drives it is largely economics. Automated scanning goes wherever exposed, unpatched systems are easiest to find, and our data shows attackers still rely on old flaws, with the median vulnerability under attack disclosed in 2014. The region has fast-growing digital businesses, many of them SMB and mid-market organisations with lean IT teams, and a lot of ageing edge infrastructure. Many of these businesses understand the risk, but they don’t have the people to keep on top of it, and that’s where managed service providers make a practical difference.
Over the next twelve months I expect APAC to stay at or near the top, with the exact ranking shifting as campaigns move, but planning on the assumption that the pressure will ease would be a mistake. For Australian businesses, the sensible first step is to close off the old, unpatched and unsupported systems that automated scanning goes looking for, and an MSP can make sure that work keeps happening rather than sliding down the to-do list.
Q4. AI-assisted attacks can adapt in real time, identifying the highest-value targets within a compromised environment. How does that adaptability change the defender’s problem and what does it require from detection and response capability?
It changes the problem from stopping a known attack to catching an unfamiliar one while it is under way. An adaptive attacker can look around, work out what matters and head for it, rather than following a script a defender can anticipate.
Our data points the same way. Credential access was the most-alerted tactic in our Q1 threat hunting data, and attackers are increasingly using trusted accounts and tools already in the environment. When an attacker looks like a legitimate user doing legitimate things, nothing appears wrong in any single system.
So detection has to be about behaviour and context, viewed across network, endpoint and identity together, and response has to be fast enough to matter, because every hour an attacker goes unnoticed brings the business closer to disrupted operations. For most organisations that means monitoring around the clock with the authority to act, such as isolating a system or locking an account, not just better alerts.
Q5. There is a direct arms race between AI-assisted attack tooling and AI-assisted defence capability. Where is that race currently and what does a defender need to be doing to stay competitive against an attacker who is using the same AI infrastructure?
On tooling, it is close to level, and defenders are not starting from behind, with defensive AI already doing most of the heavy lifting. Where defenders lose ground is coverage and follow-through. Some 95% of malware in our data arrived over encrypted connections, yet only 20% of deployed devices inspect that traffic. AI cannot detect what it cannot see, and it does not help if no one acts on what it finds.
To stay competitive, a defender needs AI-driven detection switched on and tuned across the whole environment; strong identity controls, such as phishing-resistant MFA, because stolen credentials are a favoured way in; and a clear process for acting when something is flagged. For most SMB and mid-market organisations, the practical route is a managed service provider.
Q6. Unified visibility is the capability that determines whether an organisation can detect and respond to a precision attack before it reaches its objective. What does unified visibility require that most APAC organisations don’t have, and what is the realistic starting point?
It requires seeing network, endpoint, identity and cloud activity together, with someone able to act on it. Most organisations have the individual tools but not the connection between them. Each product raises its own alerts and no one sees the pattern. A precision attack is built for exactly that gap, with a stolen credential here, a trusted tool there, and nothing alarming on its own.
What is usually missing is more basic than people expect: inspection of encrypted traffic, which only 20% of deployed Fireboxes do; identity data feeding the same view as network and endpoint data; and a team with the time and skills to watch it.
The realistic starting point is not a large programme. It’s switching on what you already own, particularly encrypted traffic inspection and MFA on every remote access path, and then working with an MSP or managed detection and response provider to bring network, endpoint and identity into one view, monitored around the clock. Many SMB and mid-market organisations understand the risk but do not have that team in-house.
Q7. The gap between the threat environment the H1 2026 data describes and the security investments most APAC organisations are making, how large is it and what would it take to close it at the organisational level?
It is significant, and I think it is less about how much organisations spend than where. Many have invested in perimeter and signature-based tools designed for the attacker of a few years ago, while the data describes attackers using custom payloads, valid credentials and ecrypted channels. Most of these gaps are basic ones that haven’t been closed.
Closing it takes three shifts. First, fix the basics that have been left open, such as old systems, unsupported edge devices and weak access controls. Second, move from individual products to unified visibility with fast detection and response. Third, treat security as business resilience, owned by leadership and tested. That means having a plan for the day something gets through, covering who makes decisions, how customers are told and how the business keeps operating.
None of that requires a bigger internal team, just clear ownership at leadership level and an honest view of what needs to come from outside.
Q8. As Managing Director, what is the one conversation you are having with Australian security leaders right now that the H1 2026 data have made more urgent?
It is a resilience conversation rather than a technology one: if a targeted attack got in tomorrow, how quickly would you know, and who would act?
The H1 data have made that more urgent because alert totals fell while the threat became harder to see. Many leaders still read their security through dashboards of blocked attacks, and those numbers have fallen sharply. That can create false comfort, because the attacks that matter now are designed not to show up there.
So I am asking leaders to measure different things: how fast they can detect and contain an incident, how much of their traffic and identity activity they can actually see, how long business could keep running if systems went down, and whether the answer depends on a team they do not have. If it does, a partner needs to be involved in the plan. This is a business continuity question, and one boards should be part of.
About Anthony Daniel
Managing Director – Australia, New Zealand and Pacific Islands
Anthony Daniel is the Managing Director for Australia, New Zealand, and the Pacific Islands at WatchGuard Technologies. With over 18 years of experience in cybersecurity, telecommunications, and IT across the Pacific region, Anthony leads the company’s regional strategy, overseeing direct sales growth, business expansion, and overall operations.
He is a results-driven leader with a strong track record of exceeding targets and scaling business performance. Prior to joining WatchGuard, Anthony held senior sales leadership roles at SolarWinds and Oracle, where he specialised in strategic sales management and enterprise engagement.
About WatchGuard Technologies, Inc.
WatchGuard Technologies is a global cybersecurity company purpose-built for managed service providers. Its AI-powered Unified Security Platform brings network, endpoint and identity security together so MSPs can reduce operational complexity, strengthen security outcomes and scale their businesses efficiently.
More than 25,000 MSPs use WatchGuard to help protect over 1.5 million customers worldwide. Learn more at WatchGuard.com, follow WatchGuard on LinkedIn, or visit the WatchGuard CyberSecurity Hub for real-time threat insights.
WatchGuard is a registered trademark of WatchGuard Technologies, Inc. All other marks are the property of their respective owners.
