Preparing for 2027: Five Trends Shaping Enterprise Threat Intelligence

In the first half of 2026, Flashpoint tracked more than 22 million threat actor posts discussing, sharing, or advertising AI toolkits for criminal deployment. The figure reflects AI’s growing presence across the cybercriminal underground, where adversaries are using new capabilities to accelerate attacks and develop malicious tooling with fewer resources.

For enterprise defenders, these developments are adding pressure to threat intelligence programs already managing high alert volumes, limited analyst capacity, and expanding responsibilities.

During Flashpoint’s recent webinar, we examined the evolving threat landscape alongside findings from Flashpoint’s Global Threat Intelligence Report: 2026 Midyear Edition and new enterprise threat intelligence research.

Missed the live webinar? We’ve rounded up the key takeaways below, and the full session is now available to watch on demand.

AI Is Changing the Economics and Speed of Cybercrime

AI is helping threat actors develop capabilities and execute attacks faster, reducing the time and expertise required for activities that previously demanded greater resources.

Several developments illustrate the broader shift in cybercrime economics and attack velocity:

• Initial access costs have declined by approximately 69%, reflecting the continued commoditization of access to compromised environments.
• Attackers published 637 malicious package versions in just 22 minutes during a software supply chain compromise.
• Nearly one in five vulnerabilities disclosed during the first half of this year had public or functional exploit code available, narrowing the window for defenders to address exposed systems.

AI is primarily accelerating established techniques, particularly during the early stages of the attack chain, including reconnaissance, social engineering, vulnerability discovery, and exploitation.

For defenders, this creates an opportunity to identify and disrupt malicious activity during its preparation stages. However, it also raises expectations around how quickly intelligence teams can recognize emerging threats, prioritize relevant findings, and act before an attack progresses.

AI Is Changing How Cybercriminals Develop Tools and Share Knowledge

AI is also changing how threat actors acquire the skills and capabilities needed to carry out attacks, creating new challenges for intelligence collection.

Historically, underground communities enabled cybercriminals to collaborate, exchange expertise, and obtain specialized services. Increasingly, threat actors can use AI to troubleshoot code, develop malicious tooling, and learn unfamiliar techniques independently, reducing their reliance on public collaboration.

Reduced activity in underground communities does not necessarily mean cybercriminal activity is declining. While forums, encrypted messaging platforms, and other illicit communities remain important intelligence sources, collection strategies must account for changes in how and where adversaries develop and distribute their capabilities.

Threat Intelligence Teams Are Struggling to Keep Up with Growing Demands

As adversaries accelerate their operations, enterprise threat intelligence teams are contending with growing workloads and limited resources.

Independent research commissioned by Flashpoint surveying threat intelligence budget owners and influencers at large North American enterprises identified several leading operational challenges:

• 65% cited alert noise and false positives.
• 55% identified analyst bandwidth and effectiveness.
• 50% pointed to the evolving threat landscape.
• 50% cited tool integration and interoperability challenges.

Note: Respondents could select up to three challenges.

High alert volumes, disconnected systems, and manual investigations consume analyst time that could otherwise be spent addressing emerging threats.

As one healthcare threat intelligence leader explained:

“Good analysts take time to develop and train, and we can’t hire our way out of that problem.”

These challenges are prompting organizations to examine how they can improve existing workflows, reduce repetitive investigations, and make better use of analyst expertise.

Threat Intelligence Budgets Are Growing, with AI Threats Leading Investment Priorities

Despite operational pressures, organizations are continuing to invest in threat intelligence.

Flashpoint’s research found that 50% of respondents expect their threat intelligence budgets to increase over the next 12 months, including 35% anticipating increases of at least 10%. Another 40% expect budgets to remain essentially flat, while 0% anticipate a decrease.

AI-related threats emerged as the leading priority for expanded intelligence coverage, particularly:

• Deepfakes and synthetic media, including their use in impersonation, fraud, and social engineering.
• AI-accelerated vulnerability exploitation, as adversaries identify and exploit weaknesses more quickly.
• Emerging AI-enabled attack vectors, including changes in threat actor tactics, techniques, and procedures.

Organizations are also investing in additional intelligence feeds, expanded security use cases, and further development of their intelligence programs.

These priorities reinforce the importance of translating AI-related threats into specific intelligence requirements aligned with organizational risk.

Agentic AI Adoption Is Underway, but Trust and Measurable Value Remain Essential

Alongside investments in AI-related threat coverage, organizations are exploring how agentic AI can improve their own intelligence operations.

Flashpoint’s research found that:

• 25% are already using agentic AI in production.
• 20% are piloting agentic AI or conducting proofs of concept.
• 35% are planning adoption within the next 12 to 24 months.
• 20% are taking a wait-and-see approach.

Early implementations focus primarily on information retrieval, alert prioritization, contextual enrichment, intelligence platform queries, and MITRE ATT&CK mapping.

Organizations remain more cautious about granting agents autonomy over consequential actions, such as blocking IP addresses or changing security controls.

One research participant captured the concern:

“An agent that’s confidently wrong is worse than one that’s slow.”

Accuracy, data privacy, auditability, predictable costs, and human oversight remain central considerations. Organizations also expect AI investments to demonstrate measurable value through time savings, improved efficiency, and faster response.

Preparing Your Threat Intelligence Strategy for 2027

As organizations prepare for 2027, four priorities can help guide threat intelligence planning:

1. Plan for threats you cannot readily observe. Identify potential gaps in intelligence collection and examine emerging attack methods, including weaknesses in internal security processes.
2. Prepare for machine-speed attacks. Evaluate detection, prioritization, and response capabilities against increasingly compressed attack timelines.
3. Turn AI threats into actionable intelligence requirements. Map emerging techniques to relevant adversaries, established frameworks, defensive controls, and business risks.
4. Use agentic AI where it can extend analyst capacity. Prioritize repeatable workflows that deliver measurable value while maintaining appropriate data controls and human oversight.

Watch 22 Million Reasons to Rethink Your 2027 Threat Intelligence Strategy for a deeper look at the cybercriminal underground, enterprise threat intelligence investment trends, and practical considerations for agentic AI adoption.