Comcast, best known in the US as a pay TV operator but also, one of the top five business communications carriers in the United States, detected 79.3 billion cybersecurity events across its cybersecurity customers between March 1, 2025, and February 28, 2026.
According to Comcast findings, a growing share of the corporate attack surface consists of devices nobody in the organization owns, manages, or monitors. Attackers compromise devices in employees’ homes and businesses such as routers, cameras, streaming devices, and point-of-sale terminals, conscript them into residential proxy networks, and rent the traffic to buyers who want their activity to look ordinary.
Importantly, the report incorporates a variety of case study examples that illustrate the threats and how they are being mitigated.
Growth factors
For this analysis period, more than 1.2 billion devices connected across the Comcast network, where the company identified, filtered, and blocked an average of 30 million cyber threats daily. That work spanned both home and business.
Breakdown of Comcast cybersecurity events
- 47.9 billion initial access events and 5.2 billion resource development events, showing the volume of automated attacks probing the perimeter and the infrastructure attackers built to run them
- 288.9 million active scans, evidence of adversaries constantly hunting vulnerable devices
- 25.4 billion phishing events and 21.9 billion drive-by compromise events the two highest-volume techniques in the data set
- 5.8 million attempts to gain covert access to employee browsers through malicious extensions, browser sync, and session theft
- 57,000 DDoS events driven by botnets seeking to interrupt digital business services with hyper-volumetric traffic
This environment also demands a broader definition of cyber resilience. Preventing compromise remains essential, but no organization can assume that every attack will be stopped at the perimeter. Leaders must also prepare for what happens
after an attacker gains access. Business continuity, recovery, and operational resilience must become integral parts of the security strategy
Trends shaping the threat landscape
Comcast found six factors across which AI is a common thread:
- AI is accelerating attacks and making them easier to launch: The speed and scale of automated threats overwhelm manual processes
- Attackers put a new twist on traditional tactics: AI amplifies attack techniques that target gaps in basic security hygiene
- Enterprise AI use introduces new attack vectors: AI use by employees is increasing the attack surface and risks of data leakage
- Attackers are industrializing their tools: Residential proxies play a major role. Device code phishing bypasses multi-factor authentication
- Agentic AI is pressurizing identity management: Adversaries are now “logging in” rather than “breaking in.”
- Supply chain compromise is a growing threat: Attackers seek opportunities to exploit trusted relationships instead of attacking each organization directly
Methodology
Mapped directly to the MITRE ATT&CK® framework, this aggregated and anonymized log data came from security services including distributed denial of service (DDoS) mitigation, endpoint detection and response (EDR), vulnerability scanning, exposure management, managed detection and response (MDR), and unified threat management (UTM).
The total number of cybersecurity events analyzed for this report more than doubled since the previous year’s report. However, that growth reflected the expansion of Comcast’s telemetry, rather than direct evidence of a sudden surge in the threats themselves. More sensors in more environments offer an expanded view of the threat landscape.
Why this matters
Cybersecurity has entered a new operating environment. Artificial intelligence is changing both the velocity of threats and the economics of attacks.
Comcast found that AI has helped its cybersecurity experts identify vulnerabilities faster and strengthen the security of our products and services. But the same capabilities are also enabling adversaries to execute familiar tactics, including phishing, social engineering, and botnets, with greater speed, scale, and precision.
Most consequentially, AI is compressing the time between vulnerability discovery and exploitation. The advantage increasingly belongs to whoever can understand and act on a signal first.
Comcast warned that it is not sufficient to add AI to existing security practices. Meeting the challenges also require a defensive operating model built for machine-speed threats. Visibility remains the foundation, but visibility alone is not enough. Organizations must be able to analyze behavior, correlate signals across their environments, and contain attacks with far greater speed and coordination.
Further reading
Comcast Business 2026 Cybersecurity Threat Report: 79.3 billion events show AI pressurizing the threat landscape. Landing page with form, to download the report. October 5, 2026. Comcast Business
