Threat Intelligence & Adversary Research

Breakout time, the gap between an attacker’s first foothold and their first lateral move, dropped to just 29 minutes in 2025. That single number, reported by CrowdStrike’s 2026 Global Threat Report, explains why threat intelligence and adversary research have become survival skills rather than optional extras for security teams.

This guide breaks down what modern threat intelligence and adversary research actually involve, why adversaries are moving faster than ever, and how security teams can build a research practice that keeps pace. Also, we will look at real case data from major vendors, examine how artificial intelligence (AI) is reshaping both sides of the fight, and walk through practical frameworks any team can adopt.

Because the threat landscape changes every quarter, this is not a theoretical exercise. Now, let’s start with what threat intelligence and adversary research mean in practice.

What Threat Intelligence and Adversary Research Actually Mean

Threat intelligence is the process of collecting, analyzing, and applying information about active or emerging cyber threats. Adversary research, a closely related discipline, focuses specifically on tracking named threat groups, their tools, their motives, and their habits.

Therefore, the two disciplines work together. Intelligence teams gather raw signals such as malware samples, leaked credentials, and chatter on criminal forums. Analysts then turn those signals into adversary profiles that defenders can actually use.

CrowdStrike now tracks more than 280 named adversary groups, according to its 2026 Global Threat Report press release, with 24 newly identified groups added in 2025 alone. This means the adversary landscape is not shrinking. It is expanding every year as new criminal crews, state-backed units, and hacktivist collectives enter the field.

Why Adversaries Are Moving Faster Than Defenders

The Shrinking Breakout Window

In practice, breakout time is the single best indicator of how the threat landscape has shifted. CrowdStrike measured a 65 percent acceleration in average eCrime breakout time during 2025, with the fastest recorded breakout hitting just 27 seconds, as detailed in the company’s 2026 Global Threat Report findings.

This means a security operations center that takes even ten minutes to triage an alert is already losing the race in many intrusions. The result is that detection engineering teams can no longer rely on manual review as a first line of defense.

Identity Has Replaced Malware as the Primary Weapon

Also, attackers increasingly skip malware altogether. CrowdStrike found that 82 percent of detections in 2025 involved no malware at all, relying instead on stolen credentials and legitimate remote access tools.

Flashpoint’s research reinforces this shift. Its 2026 Global Threat Intelligence Report documented 3.3 billion compromised credentials feeding identity-based attacks, with ransomware crews pivoting toward pure identity extortion instead of encryption.

• Attackers log in with stolen sessions rather than breaking in
• Multifactor authentication (MFA) prompts get bypassed through adversary-in-the-middle kits
• Cloud and software as a service (SaaS) accounts become the new perimeter

How AI Has Changed Adversary Research

Attackers Are Using AI as a Force Multiplier

However, the biggest structural change in 2025 was not a new exploit. It was the wholesale adoption of AI by criminal groups. CrowdStrike recorded an 89 percent year-over-year increase in attacks involving AI-enabled adversaries.

This is not abstract. CrowdStrike documented more than 90 organizations where legitimate generative AI tools were manipulated through malicious prompts to generate credential-stealing commands, according to the same CrowdStrike press release. Criminal forum chatter mentioning ChatGPT outpaced mentions of any other AI model by 550 percent.

In my own conversations with security analysts over the past year, the consistent theme is that AI has not invented new attack categories. Instead, it compresses timelines. A phishing kit that once took a skilled operator a day to build can now be assembled in minutes, and a less experienced criminal can produce output that once required real expertise.

IBM’s Findings on AI-Accelerated Exploitation

Additionally, IBM’s X-Force team observed similar acceleration from a different angle. Its 2026 X-Force Threat Intelligence Index found a 44 percent increase in attacks beginning with exploitation of public-facing applications, driven partly by AI tools that help attackers spot missing authentication controls faster than human researchers can.

The same report recorded a 49 percent jump in active ransomware groups year over year, largely because AI and leaked tooling have lowered the barrier to entry for smaller, less sophisticated crews. This means defenders now face more adversaries, not just faster ones.

Zero-Day Exploitation and the Rise of Edge Device Targeting

Now, let’s turn to vulnerability exploitation, which remains one of the clearest signals adversary researchers track. CrowdStrike reported a 42 percent year-over-year increase in zero-day vulnerabilities exploited before any public disclosure existed.

Because edge devices such as VPN appliances, firewalls, and gateways often sit outside standard endpoint monitoring, they have become a favorite target. CrowdStrike found that 40 percent of vulnerabilities exploited by China-nexus adversaries specifically targeted these edge devices, while 67 percent of exploited vulnerabilities from the same group provided immediate system access.

Therefore, organizations that focus vulnerability management purely on laptops and servers are leaving an entire category of infrastructure exposed. Edge device patching deserves the same urgency as endpoint patching.

Supply Chain Compromise as an Adversary Research Priority

This is one of the fastest-growing areas in adversary research. IBM’s X-Force team identified nearly a 4x increase in large supply chain or third-party compromises since 2020, driven by attackers exploiting trust in continuous integration and continuous delivery (CI/CD) pipelines and SaaS integrations.

A detection engineering analysis from CardinalOps put it plainly in its breakdown of the CrowdStrike 2026 report: many organizations assume they have supply chain detection coverage, yet very few can actually prove it through testing.

In practice, this gap is where adversary research earns its value. Knowing that a specific group abuses OAuth token theft or malicious open-source packages lets a detection team build and validate rules before an incident, not after one.

Phishing Tradecraft Is Getting Harder to Spot

Also worth noting, classic phishing advice is losing relevance. Research from Hoxhunt’s 2026 Threat Intelligence Report, based on millions of user-reported emails that bypassed filters in 2025, found that phishing messages are now frequently polished and grammatically clean.

This means the old guidance of “look for typos” no longer protects users reliably. Attackers also abuse trusted third-party platforms, such as legitimate invoicing or scheduling tools, to slip past spam filters and build false credibility.

• Adversary-in-the-middle kits now steal session tokens, not just passwords
• Fake job listings and account-suspension threats target social media managers specifically
• Phishing-resistant MFA, not SMS codes, is becoming the baseline expectation

State-Nexus Threats and the Bigger Strategic Picture

Beyond criminal activity, nation-state threat research remains a core pillar of intelligence work. The 2026 Annual Threat Assessment from the U.S. Office of the Director of National Intelligence notes that emerging technologies, including AI and quantum computing, are expected to significantly affect national security, alongside intensifying competition over supply chains and technology primacy.

Because state-nexus groups often have different goals than financially motivated criminals, intelligence teams typically track them separately. CrowdStrike, for example, documented a 266 percent increase in state-nexus cloud intrusions aimed at long-term intelligence collection rather than quick financial gain.

Building a Practical Adversary Research Program

Start With Frameworks, Not Tools

Finally, teams that succeed at adversary research usually start with a structured framework before buying a platform. The MITRE ATT&CK framework, maintained by MITRE, remains the industry standard for mapping adversary tactics and techniques to real detection logic.

This means a small team can begin with three steps: pick a handful of relevant adversary groups, map their known techniques to your existing detections, and test those detections against simulated activity. The goal is proof of coverage, not a long list of theoretical rules.

Treat AI as Both a Tool and a Target

Because attackers now target AI systems directly, defenders need to monitor their own AI deployments the same way they monitor servers. CrowdStrike’s report specifically called out malicious AI servers built to impersonate trusted services and intercept sensitive data.

In my view, this is the most underrated risk for 2026. Many organizations rushed to deploy AI assistants and agents without applying the same access controls and logging they would demand from a new database. That gap is exactly what adversary researchers are now documenting in real intrusions.

Frequently Asked Questions

What is the difference between threat intelligence and adversary research?

Threat intelligence is the broader practice of collecting and analyzing data about cyber threats. Adversary research is a focused subset that tracks specific named groups, their tools, and their behavior patterns over time.

How fast do modern attackers move after gaining initial access?

The average eCrime breakout time fell to 29 minutes in 2025, with the fastest recorded case at just 27 seconds, according to CrowdStrike’s 2026 Global Threat Report.

Why is malware no longer the main concern for security teams?

Attackers increasingly use stolen credentials and legitimate remote access tools instead of malware. CrowdStrike found that 82 percent of detections in 2025 were malware-free.

Is AI making cyberattacks more dangerous?

AI mainly accelerates existing attack techniques rather than creating brand-new attack categories. Even so, that acceleration lets less skilled attackers run more convincing and faster campaigns.

What framework should a small security team use to start adversary research?

The MITRE ATT&CK framework is the most widely adopted starting point. It maps known adversary techniques to detection logic so teams can test their coverage against real-world tactics.

Are edge devices like VPNs and firewalls a major target now?

Yes. Edge devices often lack the same monitoring as endpoints, and CrowdStrike found that 40 percent of vulnerabilities exploited by China-nexus adversaries specifically targeted this category of infrastructure.