Human hackers drive attacks as AI use stays limited

Rapid7's quarterly threat report shows that human operators remain responsible for most tracked cyberattacks, with AI appearing as an operational component in 8% of tracked reporting.

It also found that attackers exploit high-severity vulnerabilities within an average of three days, narrowing the window for organisations to respond.

Across the data reviewed by the Cybersecurity Company, 71% of tracked vulnerability exploitation took place within seven days of disclosure and 90% within 30 days. The findings point to a faster pace of attacks as security teams face a rise in newly disclosed flaws and more publicly available exploits.

High-severity vulnerabilities increased 133% year on year, while the number with publicly available proof-of-concept exploits rose 86%. Some 79% of exploited high-severity vulnerabilities required no authentication or user interaction, making them easier to use against exposed systems.

Authentication bypass flaws recorded the highest exploitation rate at 1.57%, compared with 0.62% for remote code execution vulnerabilities. These patterns suggest attackers favour weaknesses that offer direct access with fewer barriers.

Attack patterns

Cybercriminals are commercialising known vulnerabilities quickly, with underground marketplaces largely repackaging recently disclosed flaws rather than relying on new zero-day exploits. Compromised access also remained a central feature of criminal activity in monitored underground forums.

Of 63 monitored underground posts cited in the report, 41 advertised Remote Desktop Protocol or network access. Across espionage and cybercrime campaigns, the main methods remained consistent, including command and scripting interpreters, credential theft, and remote-access exploitation.

Ransomware activity was concentrated in several sectors. Business services accounted for 17% of tracked ransomware activity, followed by manufacturing at 16.1% and healthcare at 14.9%.

US organisations accounted for the largest volume of ransomware leak-site listings. Rapid7 recorded 1,112 US ransomware listings, about eight times the total for Germany, with The Gentlemen, Qilin, and INC Ransom leading group activity.

AI uptake

Rapid7 said concerns about autonomous AI-driven attacks have outpaced evidence of broad operational use in tracked incidents. It distinguished between AI-assisted vulnerability discovery and the use of AI in live attack operations.

"Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation, which hasn't materialised. Only 8% of tracked reporting cites AI as an operational component," said Christiaan Beek, Vice President of Rapid7 Intelligence.

Beek added that current figures may not reflect the long-term direction of attacker behaviour. "But that's a snapshot of adoption, not a ceiling. Agentic capabilities are advancing faster than any organisation, attackers included, can rework its processes around them. The question is when, not if, agentic exploitation scales. Defenders need to move past reactive patching and start grounding their risk appetite in concrete days of exposure," he said.

The report draws on managed detection and response operations, vulnerability intelligence platforms, and threat research telemetry. Its findings suggest organisations should focus less on headline fears about autonomous attacks and more on exposures already being exploited at speed.

One of the clearest themes in the data is the shrinking period between disclosure and exploitation. With most activity taking place in the first week after disclosure, routine patching cycles may leave many organisations exposed for too long.

The findings also highlight the operational strain on defenders. More high-severity vulnerabilities, more proof-of-concept exploits, and faster exploitation timelines increase the burden on security teams deciding which weaknesses to address first.

This makes prioritisation more important than volume-based patching, especially where flaws are remotely exploitable and require neither authentication nor user interaction. The report also suggests the core tactics used by threat groups may change little even as new tools emerge, including AI.