In this Channel Partners TV interview, I spoke with Cynet VP of threat intelligence strategy MacKenzie Brown about Cynet’s 2026 ECHO (Examination of Cyber Hostility & Operations) Report. The report, titled: Survival of the Fastest, shows how threat actors are moving faster and more efficiently thanks in part to AI.
“The threats have shifted, but not entirely the way that people think they've shifted,” she said. “Identity is still the front door. I would say over 80% of our host breaches begin with a socially engineered or somehow compromised identity and credential. The biggest ones that we've seen too is the shift in social engineering. The shift in general has been less around fear of clicking a link or some sort of macro malicious attachment and more around impersonation.”
She mentioned Microsoft Teams phishing as one example related to credential compromise that has popped up. Attackers are able to socially engineer the end user and impersonate IT support and help desk support.
“Whether it's going to be the fake CAPTCHA campaign or the click-fix fake IT support campaign, all of these are creating a semblance of trust to the end user with the goals of getting that identity compromised because it is so valuable,” Brown said. “Alerts that are generated through identity are extremely noisy.”
Another theme of the report was weaponization of trusted tools.
“Everyone has seen it in the media,” she said. “And this hits home for MSPs especially because top of the list includes not just tools that are used by system administrators that allow the adversary to blend into the environment. It's also remote access tools. They're leveraging trusted tools that are known. If you pair that with identity and with privileged administrative levels being compromised, you have the perfect storm of blending in.”
One thing that hasn’t changed is the vulnerability of the edge.
“The edge is still kind of the easiest way to get in,” Brown said. “They're focusing on VPN or SSL VPN compromise, which was one of the larger campaigns we saw last year and has still one of the top campaigns of the first half of 2026. But they leverage VPN from the edge to get in.”
She said these attacks “hit home for MSPs” because they are entrusted to defend against them.
“They're the ones managing the tool stacks,” Brown said. “They're the ones ensuring that vulnerabilities are also being managed and remediated. They're the ones who are working with their MDR to ensure they have 24-7 monitoring and detection to look for the accumulation of these bad alerts that alone wouldn't necessarily trigger some sort of high fidelity or critical alert because it would just look like a normal system administrator.”
Brown also emphasized the role of AI in cybersecurity defense and attacks.
“We like to say that AI is really the doer and humans are the validators,” she said. “Attacks are increasing thanks to AI-accelerated attacks from threat actors as we've seen in the news. Threat actors know the benefits of AI as well. And so when we think about humans in the loop, we still need human analysts to be upskilled and to become more threat hunters, to be able to look for novel attack techniques. You can reverse engineer through AI, but you still need a human to do the analysis to an extent.”
There’s much more in the video at the top of the page.