Record Cyber Incidents in 2026; Early Signs of 'Agentic Hacking'

The Clusit 2026 Report shows a record number of cyber incidents in the first half of 2026 and points to early signs of agentic hacking, with implications for companies and citizens connected to Italy and Europe.

Meta description: Clusit records 4,911 cyber incidents in the first half of 2026, a new peak; in Italy the total fell, but severity rose and AI use grows.

Clusit 2026 Report Summary — Clusit, cyber incidents 2026

The Clusit semiannual report was presented in Verona during the Rapporto Clusit 2026, an entity representing more than 700 organizations and maintaining collaborations with Italian and international ministries and institutions. According to the presentation and the Clusit press release, the document maps highly severe incidents that occurred in the period, technical trends and the most affected sectors, offering a panorama used by authorities and companies to shape digital policies and defenses.

Global incident data (H1 2026) — cyber incidents 2026

Clusit recorded 4,911 highly severe cyber incidents in the first half of 2026, the largest total ever recorded by the association for a single semester. According to the report cited by ANSA, this number represents a 105% increase from the previous semester, which logged 2,392 incidents, and is 71% higher than H1 2025. In six months, 93% of the incidents recorded in all of 2025 were reached, resulting in an average of 819 incidents per month.

These data indicate not only higher attack frequency, but also a trajectory of escalation that concerns cybersecurity authorities, who monitor both quantity and the severity of events, as more sophisticated and disruptive incidents increase economic and social impact.

Italy scenario — cybersecurity Italy

In Italy, the number of known incidents in H1 2026 was 245, below the peak of 280 registered in H1 2025. Italy’s share of the global total fell to 5%. However, the report notes that while the absolute number declined, the average severity of incidents in Italy registered a slight worsening, with higher incidence of attacks affecting availability and integrity of critical systems.

The combination of lower volume but higher severity poses distinct challenges for Italian companies and public bodies: the need to prioritize high-impact incident responses and strengthen resilience, rather than focusing solely on reducing the total number of intrusions. For readers interested in Italian current events and local implications, see our coverage in Notícias da Itália and analyses on life and work in the country in Vida na Itália.

Trends: agentic hacking, hacktivism and AI use — agentic hacking, hacktivism

One of the central points of the Clusit 2026 Report is the alert about early signs of agentic hacking — automated attacks powered by artificial intelligence that act as force multipliers, performing complex tasks without constant human supervision. According to the report (per ANSA coverage), these tools can accelerate vulnerability discovery, automate exploitation phases and make large-scale attacks easier to orchestrate.

Meanwhile, Clusit notes a reduction in hacktivism actions both in Italy and worldwide, while attacks on companies become more sophisticated and prevalent, focused on extortion, theft of intellectual property, and industrial espionage. The growth of AI use in malicious operations is highlighted as a factor that can increase speed, scale, and adaptability of attacks, demanding new detection and response strategies.

Relevance for Brazilian readers and descendants of Italians

For Brazilians with commercial, technological, or family ties in Italy and Europe, the trends pointed to by Clusit have practical impact. Greater automation and evolving attack tools raise risk for Brazilian companies with digital integrations, supply chains, or services in Europe. Startups, digital service providers and infrastructure managers working with Italian partners should strengthen security governance, incident response plans and vendor assessments.

Descendants of Italians running businesses or digital services should therefore:

• review contracts and security clauses with European partners;
• prioritize backups, network segmentation, and penetration testing;
• train teams for early detection and response to automated incidents.

For context on mobility and citizenship processes involving interaction with Italian institutions, also consult our section on Cidadania Italiana, where we cover news and procedures relevant to those connected with Italy.

Conclusion

The Clusit 2026 Report records a record-breaking semester in global cyber incidents and draws attention to the emergence of agentic hacking and the growing use of AI in attacks. In Italy, volume fell but severity rose, requiring a focus on resilience and response to high-impact incidents. Companies and citizens with ties to the country should update defenses and contingency plans in the face of an increasingly automated and rapid landscape.

Source: ANSA