Lumen Technologies (Nasdaq: LUMN) today released its CISO Update to the 2026 Lumen Defender Threatscape Report, showing that trends identified earlier this year have accelerated: threat actors are moving faster, operating at greater scale and quickly rebuilding after disruption. In one example, attackers began targeting a newly disclosed vulnerability within 24 hours, and more than 100 attack servers were involved within 72 hours.

This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20261110372401/en/

Threatscape Report: Stop the attack before the alert.

Threatscape Report: Stop the attack before the alert.

The new report is based on intelligence from Black Lotus Labs, Lumen’s threat research and intelligence team, which monitors activity across Lumen’s internet backbone.

“Cybersecurity is a race without a finish line,” said Lumen Chief Security Officer Kim Keever. “Attackers are constantly probing internet-facing infrastructure, quickly shifting to new opportunities and rebuilding resources when they’re disrupted. For security leaders, the takeaway is clear: Reducing exposure and identifying malicious activity earlier in the attack cycle have never been more important.”

Among the report’s findings:

  • AI and automation reduce the time between vulnerability discovery and exploitation. Over three weeks, Black Lotus Labs observed a campaign launch more than 65 million attacks against more than 10,000 Fortinet devices using AI tools to automate the intrusions. With this persistent pace, even a temporary misconfiguration could lead to compromise.

  • Constant pressure has become the norm. In the first half of 2026, Black Lotus Labs detected nearly 4,000 brute force attacks and exploit scanners per day on average. They were aimed at firewalls, VPNs and other internet-connected equipment, showing attackers care more about whether a device is exposed than who owns it.

  • Criminal infrastructure is becoming regenerative. Activity linked to potential proxy-device recruitment quadrupled during the first half of the year, showing how home devices like phones and streaming boxes help replenish attackers’ stores. Additionally, IPIdea rebuilt its proxy network to nearly 112% of its previous size less than six months after a disruption effort.

  • Backbone visibility is designed to reveal attacker activity before public vulnerability disclosures. Black Lotus Labs observed infrastructure tied to a recent exploitation campaign more than three weeks before the vulnerability was publicly identified, helping researchers spot activity before traditional endpoint alerts or vendor disclosures.

These findings are part of a wider pattern: that established threats are becoming faster, broader and more persistent, as AI and automation shorten the path from finding a weakness to exploiting it.

Black Lotus Labs and Network Visibility

With visibility into 99% of public IPv4 addresses and hundreds of billions of daily network observations, Black Lotus Labs leverages Lumen’s position as the operator of the world’s most deeply peered network. With this, they can identify threats three to 21 days sooner than other threat feeds and help disrupt malicious activity before it reaches intended targets.

Black Lotus Labs combines network visibility with AI-powered analytics, automation, and industry expertise to turn internet-wide data into actionable threat intelligence that helps organizations stay ahead of rapidly evolving threats.

The full report is available at 2026 Threatscape Report | Lumen Technologies.

About Lumen Technologies

Lumen is unleashing the world’s AI potential. As the trusted network for AI, we ignite business growth by connecting people, data, and applications — quickly, securely, and effortlessly. Lumen’s physical infrastructure, programmable network, and connected ecosystem give enterprises a simpler way to move data from virtually anywhere to anywhere in real-time to support their AI needs. Together, Lumen’s owned fiber backbone and cloud-native control plane provide a differentiated platform for connecting, securing, and operating modern enterprise environments at global scale. From metro connectivity and long-haul data transport to cloud networking, security services, digital platform capabilities, and connectivity orchestration, Lumen meets customers’ needs today and as they build for tomorrow. Lumen and Lumen Technologies are registered trademarks of Lumen Technologies, Inc. in the United States.

Forward Looking Statement

This press release contains forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. All statements contained in this press release that do not relate to matters of historical fact should be considered forward-looking statements, including statements regarding Lumen Intelligent Internet, its expected availability, functionality, scalability, customer adoption, benefits, future enhancements, and market demand, as well as Lumen’s business, strategy, and operations as well as statements identified by words such as “estimates,” “expects,” “anticipates,” “believes,” “plans,” “intends,” “will,” and similar expressions. These forward-looking statements are not promises nor guarantees of future results, are based on our current expectations only and are subject to various risks and uncertainties that could cause actual results to differ materially from those expressed or implied, including those described in our most recent Annual Report on Form 10-K and Quarterly Report on Form 10-Q, as updated in our other filings with the U.S. Securities and Exchange Commission from time to time. Lumen undertakes no obligation to update any forward-looking statements except as required by law.

Media gallery

About The Author
Business Wire