Cyber Threat Report Q1 2026: AI Governance Gap
The Growing AI Governance Gap
Ransomware activity remains at near-record highs, AI adoption is outpacing governance, and social engineering is evolving into multi-stage campaigns. Here’s what Irish organisations need to know now.
Download the 2026 Q1 Cyber Threat Report PDF
2,405
Ransomware victims posted to leak sites in Q1 2026 – the second highest quarter on record
84
Global trends show distinct ransomware groups active in Q1 – the most ever recorded in our dataset since 2020
20%
The use of AI by enterprises in Ireland more than doubled between 2023 and 2025, from 8% to 20%
Executive summary
The first quarter of 2026 confirmed a troubling pattern: ransomware is not retreating after its historic peak. Activity held near-record levels for a second consecutive quarter, the criminal ecosystem is more fragmented than ever, and AI adoption inside organisations is opening new exposure that governance frameworks have not yet caught up with.
This report covers three areas in depth: the state of global ransomware, the internal AI governance gap affecting Irish businesses, and the evolution of social engineering into coordinated multi vector attacks.
Below is a summary of the key findings from each.
Ransomware Trends 2026
A fragmented ecosystem is no less dangerous
Q1 2026 recorded 2,405 victims on leak sites - just 2% below the all-time high set in Q4 2025. Historically, activity has dropped after a peak quarter; this time it did not. Year-on-year, the figure is up 7%. The ecosystem has also fractured: 84 groups were active, up from 70 in Q1 2025, with 19 new groups making their first appearance. A fragmented threat landscape is harder to monitor and defend against, since disrupting any single group has proportionally less impact on total attack volume
Social Engineering
Attacks are becoming coordinated sequences
Social Engineering Fraud and Business Email Compromise together make up roughly 40–50% of all cyber claims at Travelers, with claim severity up more than 30% since 2023. What has changed is how tactics are being combined. Threat actors are now stitching together two, three or more techniques into coordinated campaigns — using techniques such as Mail Bomb and ClickFix together — that no single defensive control is likely to catch alone
