Cyberattacks in Spain have reached historic highs. In 2025, the National Cybersecurity Institute (INCIBE) managed a total of 122,223 incidentsa 26% more than 97,348 in 2024 and the highest figure recorded by the organization. In parallel, it detected 237,028 vulnerable systems that could be exploited by cybercriminals.
For Miguel Ortega Haro, director of Processes and Security of cdmonthe data on exposed systems is more worrying than the data on incidents: “Each of those 237,000 systems is an open door that someone will find sooner or later. Most do not require a large investment to close, just update, review configurations and remove what is no longer used”.
Malware was the main threat, with 55,411 incidents. Online fraud followed, with 45,445 cases (four out of ten), in which phishing was the predominant technique with 25,133 episodes. INCIBE also counted 3,849 information thefts and 401 incidents in essential and important operatorsentities subject to the European NIS2 directive.
Sergio García Estradera, manager of the technology consulting firm i3eemphasizes that phishing continues to work because it targets people: “A well-written email that impersonates a supplier or a bank deceives more easily today than two years ago, because artificial intelligence has eliminated the mistakes and errors that previously gave it away. Without continuous training of the workforce, the best technology falls short”.
The trend continues upwards in 2026
This year’s data confirms the escalation. According to Check Point Research, Spanish companies suffered an average of 2,192 weekly cyber attacksa 8% more than in the same month of 2025. All over the world, 1,042 ransomware attacksalmost double that of a year before. INCIBE’s cybersecurity helpline 017, for its part, received 95,064 queries In the first semester, a 92% more than in the same period of the previous year.
SMEs are the most exposed target. A Kaspersky report published in September reveals that the 86% of Spanish small and medium-sized companies suffered at least one cyber incident in the last year, and that phishing affected 27% of them, above the world average. The i3e manager explains it like this: “Today an SME has the same exposure as a large company, but rarely the same resources. A ransomware attack can leave it down for weeks, and many do not have a backup outside of their network that allows them to start again”.
Faster and more expensive attacks
Artificial intelligence is accelerating the phenomenon. CrowdStrike’s Global Threat Report 2026 records an increase in 89% in AI-based attacks. The average time it takes an attacker to move through a network after an intrusion was reduced to 29 minutes65% faster than in 2024, with a record case of 27 seconds.
The director of Processes and Security at cdmon focuses on that speed: “When an attacker can move through a network in less than half an hour, the company that depends on detecting and reacting manually is already late: the response has to be automatic, detecting patterns. In addition, the network must be segmented, with a minimum access and privilege system, and double factor authentication in the systems, to mitigate these attacks as much as possible”.
The economic impact is also growing. IBM’s Cost of a Data Breach 2026 report puts the global average cost of a data breach at 4.99 million dollars. One in four Malicious breaches already use artificial intelligence, and in those cases the cost rises to around 6 million.
Sergio García adds that AI also opens up risks within companies themselves: “Giving an AI agent the ability to act on systems without clear boundaries opens up a new attack surface. Before automating, you must define what it can do, with what data and who supervises it”.
