Radware's H1 2026 Global Threat Analysis Report, based on cloud and managed security services telemetry, shows a significant increase in web DDoS attacks. Mitigations rose 110.6% compared to the same period last year and 36.3% compared to the second half of 2025. The first half of 2026 alone accounted for nearly 83% of all mitigations performed in 2025.
If current trends continue, Radware projects a 166% increase in attacks for the full year 2026 compared to 2025. North American infrastructure is expected to see the rise reach 190% by year-end. In contrast, projected growth in Europe, the Middle East, and Africa is 60%, while the Asia-Pacific region is expected to grow by 27%.
The technology sector is the primary target, absorbing 59.4% of network DDoS activity, with customers averaging 509 attacks per day. Financial services follow at 20.8%. Geographically, customers in the Middle East are the most targeted, facing an average of 520 attacks per day. Network-layer attacks averaged 110 per day per customer, a 36.6% increase over the 2025 baseline.
Attack patterns have shifted toward direct-path volumetric floods. Stateless UDP floods now account for 73% of mitigated packets, and over 80% when including fragmented UDP traffic. Meanwhile, the mean time to exploit vulnerabilities has dropped to negative eight hours as of July 23, based on Zero Day Clock project data. This is a sharp decline from 21.5 days in 2025 and 53 days in 2024.
Radware attributes this acceleration to frontier AI models, citing Claude Mythos by Anthropic PBC as an example of a model that uncovered a 27-year-old flaw in OpenBSD's TCP stack. The report also warns about local AI agents running on developer endpoints that can call APIs and install dependencies, increasing the risk of supply chain attacks, such as the Mini Shai-Hulud attacks on npm packages.
A survey of 377 organizations showed that 77% are deploying AI agents and autonomous workflows, but only 17.2% have full visibility into them. Additionally, 81.2% of organizations push production API updates at least weekly, while only 6.9% fully document their internal APIs. Hacktivist DDoS claims are tied to geopolitics, with Europe (48%) and Israel (16.9%) being the main targets. The pro-Russian group NoName057(16) was responsible for 40.5% of these claims in the first half of the year.