- Attack volumes rose almost linearly throughout the half-year, though there was one especially severe day in mid-February due to a pro-Russian hacktivist campaign
- Media and the public sector account for 75% of incidents, but pressure is growing far more sharply in B2B sectors
- Transparent Edge forecasts more malicious web activity in the second half of the year, particularly in August and October
Madrid, 21 July 2026: Transparent Edge, the Spanish web cybersecurity and performance company, has published the first edition of its Web Vector Cyberthreat Report, a half-yearly analysis based on proprietary data from a network supporting more than 20,000 sites and applications. The study, covering the period from January to June this year, finds that attacks blocked by its WAF grew by 31.6% compared with the same half-year last year, with malicious traffic density rising by close to 38% per million requests served.
“This means that the traffic crossing the network today carries more attack attempts than it did a year ago. Attackers have become more efficient: they automate more, test more and learn faster,” explained Natividad Gutiérrez, Head of Data Science at Transparent Edge.
16 February: the night of #OpSpain
Although attack volumes grew in an almost linear fashion throughout the half-year, one date stands out for its concentration of malicious activity. On Monday 16 February, Transparent Edge blocked 2.24 million attacks in 24 hours — 3.7 times the daily median for the period.
That day coincided with the coordinated denial-of-service campaign #OpSpain, attributed to the pro-Russian group NoName057(16) and supported by collectives such as Z-Pentest Alliance, Dark Storm Team and Server Killers. Threat intelligence sources monitoring the group’s own Telegram channel put precise figures on the episode, citing more than 8,000 attack entries against around 150 unique domains. The date also coincided with the official proclamation of candidacies for the regional elections to the Cortes of Castilla y León.
Media and public sector account for 75% of attacks, but B2B is growing faster
The report confirms that media outlets and public administrations account for more than 75% of the attacks blocked on the network. But the most significant finding lies further down, in sectors that had previously played a secondary role: technology and telecommunications saw blocked attacks multiply almost tenfold compared with the first half of 2025, manufacturing and industrial services more than doubled (+136%), and health and pharmaceuticals nearly doubled (+95%).
In the words of Transparent Edge’s Head of Data Science, “what sets this half-year apart is that B2B sectors — technology, manufacturing and health — are seeing pressure grow far faster than traditional sectors. It’s the clearest sign yet that the threat map is being redrawn in real time.”
Forecasts for the second half of the year
Applying the seasonal pattern observed in 2025 to the first-half 2026 baseline, Transparent Edge’s projection estimates that August could see double the annual average number of attacks, and October 1.73 times that average. The first-half baseline is already 32% above the equivalent months last year. The company recommends that security teams reinforce staffing in August and in the second half of October, and prepare for hacktivist campaigns coinciding with geopolitical and electoral milestones.
The full report, including methodology, month-by-month trends, sector analysis and forecasts, is available to download from the Transparent Edge website.
