More than 15,000 companies have adopted AI-driven security services in public clouds to identify attacks in real time, sort through alert volumes, and remediate vulnerabilities before security teams can review every notification. The findings come from Yandex Cloud's report on threats targeting cloud and hybrid infrastructures during the first half of 2026.
Attack patterns have shifted noticeably. Whereas stolen credentials once served as the primary entry point into corporate networks, adversaries now increasingly target vulnerabilities in publicly exposed applications. Russian cloud environments recorded exploitation attempts involving the critical React2Shell flaw as well as Linux kernel problems Copy Fail and Dirty Frag.
Manual patching of every discovered weakness is no longer feasible, prompting organizations to delegate routine operations to AI agents. These agents instantly prioritize issues, perform alert triage, gather incident information, and conduct preliminary investigations. Human specialists remain involved only for the remediation of critical vulnerabilities, as businesses continue to withhold full administrative access from automated systems.
Yandex Cloud analysts emphasize that contemporary corporate defenses require behavioral detectors, unified telemetry, and AI agents. The classic workflow of receiving an alert, opening a ticket, and reviewing it later is increasingly outpaced by attackers. Target priorities have also changed: retail now accounts for 39 percent of attacks, manufacturing follows at 29 percent, and the IT sector has fallen to 20 percent.
