Rapid7 Report: Human Operators Still Drive Most of Tracked Cyberattacks, but Exploitation Windows Are Narrow
Rapid7, Wednesday, October 21st, 2026
Rapid7's quarterly report finds AI plays an operational role in only 8% of incidents, while exploits arrive within days.
Rapid7 released its Quarterly Threat Landscape Report, finding that human operators remain the primary drivers of cyber threats despite warnings about autonomous AI attacks.
AI was used as an operational component in just 8% of tracked incidents, and humans still select most targets and set attack intent.
However, adversaries exploit high-severity vulnerabilities in an average of three days, leaving defenders a narrow window.
The report draws on vulnerability research, incident response and underground monitoring via the new Rapid7 Intelligence.