Comcast 2026 Cybersecurity Threat Report: A Houston SMB Reading

The two editions side by side, with what Comcast itself says about reading one against the other.

No. Comcast's October 5, 2026 release says the 2026 figures are "not comparable to totals published in prior reports." The 2026 edition draws on an expanded telemetry set and a new threat analytics platform, and its data window overlaps the 2025 edition's window by 3 months.

The table below compares the 2025 and 2026 Comcast Business Cybersecurity Threat Reports on edition, data window, headline counts and comparability.

Set side by side, the totals invite a headline. The count of 34.6 billion events became 79.3 billion, and phishing went from 4.7 billion to 25.4 billion. Neither jump measures a change in attacker activity. The 2026 report states that its total more than doubled because Comcast's security products now run across a larger customer base and new products were added to the analysis.

The windows matter too. The 2025 edition covered June 1, 2024 through May 31, 2025. The 2026 edition covers March 1, 2025 through February 28, 2026. March, April and May 2025 sit in both. Anyone in Houston who quotes a year-over-year growth rate from these two reports is comparing two different instruments over two overlapping periods.

Five figures from the report that map to a setting, a policy or a habit a small office controls.

The numbers that matter to a Houston office with no security team are the small ones. Comcast's report says its largest totals reflect broad automated activity, while findings that appear in small counts can mark the threats that deserve the closest attention. Five of those figures map directly to something a 25-person office can change.

Start with the big figures for context. Phishing produced 25.4 billion events and drive-by compromise 21.9 billion, which is 59% of everything Comcast recorded. Comcast also mitigated 57,000 DDoS attacks. A small office does not tune its defenses to those totals. It needs email filtering, web filtering and trained people, and most owners already know that.

The five figures below are different. Each one describes what happens after a lure works or a login is stolen.

• Remote desktop software drew 10.8 million events. The report describes a chain its analysts tracked repeatedly: an inbox flood, a fake help desk message over Microsoft Teams, then a remote session the employee grants. Decide who in the office may grant a remote session, and require a call-back to a known number first.
• Browser hijacking and extension abuse drew 5.8 million events, 95.1% of them malicious browser extensions. Set an approved list of extensions and block the rest. Turn off syncing of work browsers to personal accounts.
• Session cookie theft drew 316,000 events. Comcast counts these as attempts against authentication, not confirmed thefts. A stolen session token passes MFA because the login already happened. Shorter session lifetimes and conditional access make a replayed token fail.
• Account manipulation produced 62,500 alerts, the top post-access behavior among roughly 590,000 managed detection alerts. These are unauthorized password resets, inbox forwarding rules and backdoor accounts. Alert on every new forwarding rule and every new administrator account.
• Supply chain compromise produced 78 events in a full year. The count is small because a poisoned update is rarely visible at all. The report advises delaying non-critical updates by at least 24 hours and limiting what vendor tools and integrations can reach.

The report's Friday-night case study belongs on this list for Houston specifically. An attacker logged in to a company VPN with stolen credentials on a Friday evening and began staging for a weekend ransomware run, counting on a slow response. Houston has unscheduled weekends. Hurricane Beryl struck Texas on Monday, July 8, 2024, and the Supreme Court of Texas emergency order of July 12, 2024 cited difficulties with access, electricity, internet and travel. A storm week puts staff on home internet and personal phones while nobody watches the office. That is the condition the attacker in the case study was betting on. In 35+ years doing this, the pattern has held: the alert that matters arrives when the office is closed.

Houston's small engineering, construction and oilfield service firms sit on the other side of the supply chain finding. The Comcast report cites the World Economic Forum's Global Cybersecurity Outlook 2026: 65% of large companies rank third-party and supply chain vulnerabilities as their greatest challenge, and 33% map their supply chains in detail. When a large customer does that mapping, its smaller vendors receive the questionnaire. CinchOps covers that moment in 9 Things to Do After a Customer or Bank Sends You a Security Questionnaire.

The report's five case studies, sorted by the security layer that caught each one.

Security on the internet line covers part of what the Comcast 2026 report describes. Filtering at the line blocks known-bad domains and addresses for every device behind it. In the report's five SOC case studies, four intrusions were caught by behavior on a device or inside the network, and one was caught by cloud sign-in monitoring.

The report closes with a product section, and two of the products are built for small businesses. Comcast describes SecurityEdge as DNS filtering that helps block malware, phishing, ransomware and botnet activity across every connected device. SecurityEdge Preferred adds a next-generation firewall and IP-based threat blocking. Comcast's June 11, 2026 release prices SecurityEdge Preferred at $40 per month on connections below 1 Gbps and $60 per month for Gig+ customers, with no per-seat licenses.

That is a real layer at a fair price. The report itself recommends web and DNS filtering, firewall policy and upstream DDoS mitigation. A Houston office on a Comcast Business line that has not turned its filtering on should do that this week.

The case studies answer a separate question, which is where an intrusion gets caught once a person has clicked or a login has been stolen. This sorting is CinchOps' reading of the report's own accounts.

• ClickFix. An employee pasted a command that ran a decades-old Windows utility. A custom endpoint detection flagged the behavior.
• Tamperedchef infostealer. Users installed trojanized software themselves. Analysts linked endpoint detections across 4 customers before any alert rule existed.
• Compromised software dependency. An AI desktop application pulled in a poisoned package. The Comcast SOC matched the endpoint behavior to a known compromise.
• Device code phishing. A user approved a code on a legitimate Microsoft page, and the attacker received a valid token that bypassed MFA. Cloud identity monitoring caught it. The report notes that endpoint checks did not.
• Friday-night lateral movement. The entry was a valid VPN login. Behavioral detection flagged lateral movement and credential dumping the same evening.

None of the five was stopped by a block list at the internet line. In the device code case, the attacker's side of the intrusion never touched the customer's network: a valid token, used from a rented server, read a mailbox in Microsoft 365. This is where AI security for small business gets practical. The report's AI-related case looked like ordinary app activity to the user, and an analyst had to explain why it was malicious.

For a Houston owner the report turns into a coverage check across four layers: the line, the devices, the sign-ins and the people. A circuit add-on answers the first.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area. CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10 to 200 employees.

The Comcast report ends by asking whether a company should build an integrated defense in-house or work with a managed provider that already runs one. A business with 10 to 200 employees rarely has a night shift to give that work to. CinchOps covers the four layers as one service.

• Through cybersecurity services, CinchOps runs 24/7 threat monitoring on devices and sign-ins, the two layers where the report's case studies were caught.
• CinchOps managed IT support sets and keeps the patching, browser extension policy and remote-session rules, and answers help desk requests in under 15 minutes.
• Immutable offsite backup copies, part of business continuity and disaster recovery, give a recovery path if a weekend attack gets through.
• An office on SD-WAN across redundant service providers stays connected when a storm takes the primary line.
• CinchOps serves Houston, Katy, Sugar Land, Cypress and The Woodlands, including engineering, construction and oil and gas firms that answer to larger customers.

Comcast's report is worth an hour of a Houston owner's time, read for the case studies and the small numbers. An internet line with filtering turned on is one layer of four, and the report's own evidence shows the other three are where intrusions get caught. To see which layers your office has today, talk to CinchOps.