CYBER SECURITY REPORT 2026

The Repurposed Perimeter

TRENDS RESHAPING WORKFORCE SECURITY

In 2025, malicious actors thoroughly weaponized the perimeter by targeting unmonitored or low-visibility infrastructure such as routers, VPN appliances, and virtualization solutions. Using these devices as launch pads, they would blend into legitimate traffic to harvest credentials and access sensitive internal data often long before defenders had enough visibility to respond.

At the same time, AI effectively dissolved the line between internal work and external services, creating new data paths that traditional controls often do not see in time.

Whether a threat enters through an unmonitored edge device or data leaves through an AI prompt, the underlying failure is the same: organizations cannot protect what they cannot see. Zero Trust principles and continuous verification are now essential for authenticating identity, enforcing policy, and maintaining unified visibility across access to the web, SaaS, and private applications.

This report extracts five trends from Check Point's Cyber Security Report 2026 that are driving this shift. Together, they make the case for a fundamental rethinking of how organizations secure hybrid workforces.

The pattern starts at the edge.

A NEW ATTACK BASE

The network perimeter continued a concerning transformation in 2025: from protective barrier to attack platform. Attackers weaponized corporate infrastructure (sometimes via unpatched vulnerabilities, sometimes via misconfiguration) by targeting devices that are unlikely to have robust monitoring such as VPN appliances.

Some of these devices sit at the intersection of identity and traffic, yet many organizations treat them as operational infrastructure rather than security endpoints. They rarely have endpoint detection and response (EDR) capabilities, with sparse logs and short retention windows.

This visibility gap creates an asymmetric advantage. Once attackers establish persistence on these devices, they operate from inside the trust boundary with access to credential flows, routing decisions, and legitimate traffic patterns. The pattern is consistent across a number of significant campaigns in 2025: initial access through unmonitored infrastructure, credential harvesting from privileged positions, lateral movement using valid access.

The Takeaway:

Eliminating blind spots is a crucial first step. Moving remote access from a handful of VPN appliances to cloud-delivered security architecture lets you manage enforcement centrally, closing a visibility gap that attackers depend on.

UNMONITORED DEVICES HAVE BECOME A CRITICAL AND INCREASINGLY ATTRACTIVE ATTACK SURFACE FOR SOPHISTICATED THREAT ACTORS, PROVIDING A LOW- FRICTION PATH TO STEALTHY ACCESS, CREDENTIAL THEFT, AND LONG-TERM OPERATIONAL PERSISTENCE.

Check Point Cyber Security Report 2026, p. 47

SELF-CHECK:

How quickly can you revoke access to specific applications when a credential is compromised?

If an attacker established persistence on a network edge device today, how long would it take you to discover it?

CHECK POINT SOFTWARE | THE REPURPOSED PERIMETER 3

THE COLLAPSE OF PERIMETER-BASED TRUST

The problems with implicit trust have been apparent for years and only accelerated after rapid cloud adoption and the shift to remote work. Traditional network security assumed that users inside the perimeter could be trusted and those outside could not. That perimeter-based model was already failing but recent events exposed just how untenable it is.

When attackers compromise edge infrastructure, they operate from inside the trust boundary. When credentials are harvested from unmonitored devices, attackers authenticate as legitimate users. When lateral movement uses valid access tokens, security tools see normal activity. The perimeter no longer separates trusted from untrusted; it simply marks where visibility ends.

ENTERPRISES MUST CONTINUOUSLY VERIFY IDENTITY, CONTEXT, AND INTENT ACROSS EVERY INTERACTION.

The pattern is consistent: initial access appears legitimate, movement follows authorized paths, and detection comes too late.

The Takeaway:

The network perimeter as a security boundary is now obsolete. Organizations must shift their security architecture toward zero trust with continuous verification, and context-based access decisions for every user, session, and application.

Self-Check:

Check Point Cyber Security Report 2026, p. 80

Can you apply consistent access policies across on-premises, cloud, and SaaS applications from a single management platform?

Do your security decisions consider identity, device posture, and other contextual clues before granting access to applications and data?

CHECK POINT SOFTWARE | THE REPURPOSED PERIMETER 4

WHEN EYES AND EARS CAN NO LONGER BE TRUSTED

The same trust assumptions that fail at the network level are now failing at the human level. AI-powered deepfakes using voice cloning, real-time video manipulation, and adaptive conversational techniques have made it impossible to trust what we see and hear.

In 2025, voice-based impersonation became a preferred technique for sophisticated threat groups targeting major enterprises. Attackers conducted in-depth reconnaissance, then used rehearsed scripts delivered via phone calls to pressure help desk staff into resetting credentials, changing MFA configurations, or granting network access. Several of the year's most damaging breaches began with a convincing phone call or social engineering operation targeting support teams.

The threat extends beyond voice. Real-time face- swapping tools now operate with high fidelity on consumer hardware, enabling attackers to alter their appearance during live video calls. AI-generated identities and deepfake KYC (Know Your Customer) submissions have become preferred methods for bypassing verification. Automated, multilingual phone-fraud platforms reached operational maturity, replacing human scammers with systems that can scale across languages and time zones. According to FBI reporting, voice-enabled fraud and account takeover incidents in 2025 resulted in losses exceeding $250 million.

The Takeaway:

When human judgment can be fooled at scale, authentication architecture must compensate. No single verification event can be considered trustworthy, which is why device posture, behavioral signals, and contextual access controls become essential layers.

VOICE IMPERSONATION REMAINS A SIGNIFICANT FRAUD VECTOR BEYOND ENTERPRISE INTRUSIONS, PARTICULARLY IN FINANCIALLY MOTIVATED SCAMS TARGETING PRIVATE CITIZENS.

Check Point Cyber Security Report 2026, p. 13

SELF-CHECK:

If an attacker succeeded with a credential reset, would your access controls limit what that user can access, or would it unlock everything?

CHECK POINT SOFTWARE | THE REPURPOSED PERIMETER 5

ENDPOINTS OUTSIDE YOUR CONTROL

One of the most important trends of the last few years is the targeting of personal devices to gain corporate access.

Over 76% of infected machines were likely non- corporate devices such as personal laptops, home desktops, and BYOD endpoints, based on Check Point’s analysis—an increase from 70% the previous year. These devices can often connect to enterprise resources but sit outside of enterprise control.

The attack path is straightforward: infostealers distributed through gaming platforms, cracked software, and malvertising campaigns harvest credentials and session cookies. These credentials often include access to corporate VPNs, Microsoft 365 accounts, and collaboration platforms like Slack or Teams.

This creates an asymmetric problem. Organizations invest heavily in securing managed endpoints with EDR, device compliance policies, and application controls. But those controls are weakened when an employee checks work email from a personal laptop—especially if it’s running outdated software or a set of unknown browser extensions.

The Takeaway:

When users connect from devices you do not manage, traditional endpoint security provides no protection. Enterprise Browsers for agentless access provide greater visibility into user actions from unmanaged devices.

THIS NOTABLE INCREASE FURTHER HIGHLIGHTS THE GROWING USE OF THE “SPRAY AND PRAY” STRATEGY, IN WHICH ATTACKERS SEEK TO PENETRATE HIGHLY PROTECTED CORPORATE ENVIRONMENTS BY FIRST COMPROMISING LESS-SECURED ENDPOINTS.

Check Point Cyber Security Report 2026, p. 73

SELF-CHECK:

What percentage of your workforce accesses corporate resources from personal devices, and what visibility do you have into those sessions?

How much visibility do you have today into unmanaged devices accessing sensitive data?

CHECK POINT SOFTWARE | THE REPURPOSED PERIMETER 6

AI EVERYWHERE

Artificial intelligence is now embedded in daily work. AI assistants process emails, summarize documents, draft responses, and will soon regularly take actions on behalf of users. Check Point data shows that organizations interact with more than 14 different AI services in many cases. This adoption shows no sign of slowing, and it creates an increasingly attractive attack surface for malicious actors.

AI tools create new exfiltration pathways. When employees paste proprietary code into a coding assistant, share confidential documents with an AI summarization service, or use a chatbot to analyze sensitive data, that information leaves the controlled environment.

Unlike traditional data loss scenarios, these interactions are often indistinguishable from productive work. An engineer using a coding assistant or an analyst summarizing a document looks identical to legitimate activity until the content itself is examined. Without inspection at the prompt level, security teams have no way to distinguish routine use from material exposure.

The Takeaway:

Safe adoption of AI is a must for the modern workplace. Effective protection requires visibility into user prompts, DLP policies that understand AI interaction patterns, and the ability to enforce acceptable use policies for AI tools as part of a unified access architecture.

AS GENERATIVE AI BECOMES EMBEDDED IN DAILY WORKFLOWS, THE BOUNDARY BETWEEN INTERNAL CORPORATE DATA AND EXTERNAL AI PLATFORMS INCREASINGLY BLURS.

Check Point Cyber Security Report 2026, p. 53

SELF-CHECK:

Can you see what data employees share with external AI platforms?

Do you have visibility into user prompts inside the workplace?

CHECK POINT SOFTWARE | THE REPURPOSED PERIMETER 7

Worldwide Headquarters 5 Shlomo Kaplan Street, Tel Aviv 6789159, Israel | Tel: +972-3-753-4599 U.S. Headquarters 100 Oracle Parkway, Suite 800, Redwood City, CA 94065 | Tel: 1-800-429-4391 www.checkpoint.com

WHAT COMES NEXT? When attackers can operate from unmonitored footholds and blend into legitimate sessions— and when AI is popping up in every SaaS platform, browser, and desktop—security must follow the user with consistent controls. Taken together, these trends point to one conclusion: modern workforce security requires a cloud- delivered control plane built for continuous trust.

Check Point SASE unifies these capabilities into a single architecture: AI-driven threat protection, unified visibility across hybrid environments, device posture enforcement, safe adoption of generative AI, and on-device inspection designed to improve performance without sacrificing security.

Book a demo to see how Check Point SASE can help your hybrid environment.

Book a Demo

https://www.sase.checkpoint.com/demo https://www.checkpoint.com/