2,270 attacks a week, and not one decision you can make with it

Event dated 30 June 2026 · Published 2 September 2026 · 3 sources

Reporting through June 2026 put global activity at an average of 2,270 weekly attacks per organisation, alongside ransomware incidents up 33% against June 2025. The first figure will appear in board packs for the rest of the year. It counts blocked events — overwhelmingly automated scanning that reached a device and was refused — so it measures how much of the internet is noisy, not how exposed any organisation is. It rises every year regardless of anybody's controls, and no decision changes if it is 2,270 or 4,000.

The number is not wrong, and the people publishing it are not misrepresenting anything. It is an accurate count of something. The difficulty is entirely in what happens after it is quoted, when a figure describing internet background noise is presented as a measure of threat.

Ask the test question this site keeps returning to: what would you do differently if the number were half, or double? Nothing, in either direction. A figure that cannot change any decision is not evidence — it is atmosphere.

Why it goes up every year

More devices are online, scanning is cheaper, and the sensors doing the counting are more numerous and better instrumented. Each of those pushes the figure up independently of whether anybody is more at risk. An organisation that improved every control it has would see the same rise.

Which makes the year-on-year comparison the least informative part of it, and the part most likely to be shown as a trend line with an arrow.

The second figure is different

Ransomware incidents up a third against the same month last year is a claim about outcomes rather than about noise. Somebody was compromised, and the count is of events that produced consequences. It is still subject to reporting effects — more disclosure obligations produce more visible incidents — but it is at least counting the thing people care about.

Placing the two side by side in the same summary invites the reader to treat them as the same kind of evidence. They are not, and the more alarming-sounding of the two is the one that means less.

What to put in the pack instead

Figures from your own estate that would change a decision if they moved: how many internet-facing systems exist and whether that count is falling, how long the oldest unpatched item on the critical list has been there, and how long it took to notice the most recent thing that mattered.

Those are harder to produce than a number from a report, which is exactly why the number from the report gets used. It is also why nobody in the room can act on it.