2026 Intelligence Report: When Advertising Entered the Cyber Conversation
New findings reveal 2025 as the inflection point when advertising infrastructure became a frontline cyber risk — and 2026 as the year of accountability for publishers, platforms, and brands.
6 min read
The Media Trust (TMT), a global leader in digital trust and safety with over two decades of experience, has released its 2026 Intelligence Report — titled When Advertising Entered the Cyber Conversation: A Look Back at 2025 and the Digital Safety Imperative for 2026. Drawing on proprietary, real-time threat detection data from TMT's global infrastructure, which analyses more than 200 billion ads monthly across 100,000+ digital properties, the report documents a defining shift: in 2025, advertising infrastructure stopped being viewed solely as a revenue engine and became formally recognised as part of the cyber risk landscape.
The Inflection Point: Advertising Infrastructure as a Cyber Attack Surface
The report identifies a structural reality that security teams, regulators, and major publishers are increasingly being forced to confront: modern advertising systems operate as high-speed execution environments for third-party code. Every ad impression is, in effect, a code execution event at scale — making advertising infrastructure an efficient pathway for malware deployment, fraud, and surveillance when exploited. Malvertising, malicious redirects, cloaked landing pages, and AI-enabled manipulation tactics are now actively exploiting these systems as scalable attack surfaces.
High-profile enforcement actions, evolving government policy initiatives, and increased scrutiny of platform accountability — including measures undertaken by major publishers and global technology companies — signal that this recognition has crossed from theoretical risk into regulatory and legal reality. For publishers, platforms, and brands, ignoring malicious activity within advertising systems now carries measurable consequences: reputational damage, regulatory exposure, lost revenue, and growing legal liability. As the report frames it, neutrality is no longer viable.
"Advertising has always been part of the digital media function. What has changed is the scale and sophistication with which threat actors exploit that infrastructure. The advertising supply chain now represents both economic opportunity and systemic risk. The organizations that recognize this and invest in prevention will protect both their consumers and their revenue."
— Chris Olson, CEO, The Media Trust
Six Key Findings from the 2026 Intelligence Report
1. Advertising as Infrastructure
Advertising systems now function as high-speed execution environments for third-party code, making them efficient delivery mechanisms for malware, fraud, and surveillance when exploited — a designation that reframes them from commercial tools into critical infrastructure requiring security-grade controls.
2. AI Is Accelerating Both Attack and Defence
Artificial intelligence is reshaping the threat landscape from both directions. Attackers are using AI to scale evasion techniques and automate malicious campaigns at volumes that outpace human detection capacity. At the same time, real-time defensive AI has become essential to detecting and blocking harmful activity before it reaches users — making AI investment no longer optional for organisations serious about digital safety.
3. Digital Crime Is Local
TMT's data shows that threat activity is no longer diffuse or uniformly distributed. State-by-state and global analysis reveals that digital attacks concentrate geographically, targeting specific regions and communities with disproportionate intensity. Digital crime within the ad ecosystem is structured, repeatable, and increasingly automated — following monetisation pathways designed to extract economic value at scale from particular user populations.
4. The Human Cost Is Measurable
Malicious advertising produces direct financial loss, brand damage, and revenue disruption for the organisations that host it. Beyond the economic impact, manipulation campaigns and scams increasingly affect vulnerable populations with real-world consequences — elevating the stakes of inaction from a business risk question to a consumer protection obligation.
5. Cybersecurity vs. Digital Safety
The report draws a deliberate distinction between system-level security and human-level safety, arguing that compliance alone is insufficient in today's data-driven advertising ecosystem. Meeting regulatory checkboxes does not address the active exploitation of advertising systems as harm vectors targeting real people — a distinction with significant implications for how organisations approach governance and enforcement.
6. Accountability Is Becoming Enforceable
Regulatory scrutiny, advertiser expectations, and governance standards are converging. Organisations that fail to address malicious activity within monetisation systems face mounting reputational, financial, and regulatory risk. The report frames 2026 as a year of enforceable accountability — not a warning of future consequences but a description of consequences already materialising.
The Guardian Imperative: Protection and Profit Are Operationally Linked
The report concludes with what TMT calls The Guardian Imperative — the argument that protecting people and protecting profit are not competing priorities but operationally interconnected ones. When malicious creatives degrade user trust, traffic declines. Fraud diverts advertiser spend. Weak enforcement increases regulatory exposure. Diminished user trust impacts long-term monetisation. The structural linkage means that organisations investing in proactive threat detection, real-time enforcement, and shared intelligence do more than reduce risk — they strengthen long-term monetisation resilience.
"The risk is not whether digital threats exist. The risk is assuming they can be tolerated without consequence. The companies that take responsibility for prevention will protect their brands, their balance sheets, and their audiences. Those that do not will absorb the cost."
— Chris Olson, CEO, The Media Trust
The full 2026 Intelligence Report — When Advertising Entered the Cyber Conversation — is available now. More information about TMT's digital trust and safety platform is available at mediatrust.com.
Key Takeaways
- The 2026 Intelligence Report, based on analysis of over 200 billion ads monthly across 100,000+ digital properties, identifies 2025 as the year advertising infrastructure became formally recognised as a frontline cyber risk — and 2026 as the year of enforceable accountability
- Advertising systems now function as high-speed code execution environments, making them efficient attack vectors for malvertising, malicious redirects, cloaked landing pages, and AI-enabled manipulation at scale
- AI is a double-edged force: attackers use it to scale evasion and automate campaigns, while real-time defensive AI has become essential to detecting harm before it reaches users
- Threat activity is geographically concentrated and structurally organised — digital crime in the ad ecosystem follows monetisation pathways, targeting specific regions and vulnerable communities with measurable human and financial consequences
- The Guardian Imperative frames consumer protection and revenue performance as structurally linked — organisations that invest in proactive threat detection and real-time enforcement protect both their audiences and their long-term monetisation resilience