Frost Radar 2026: Enterprise Risk and Path to Preemptive Security

Introduction

Frost & Sullivan’s Frost Radar™: Enterprise Risk Mitigation and Management Platforms, 2026 dropped recently. It named Group-IB a Visionary Leader and highlighted our innovation leadership in ERMM, intelligence origination, Cyber-Fraud Fusion, and the direction we are taking toward predictive prevention.

This recognition belongs to the Group-IB team, and I am proud of the work behind it.

It is independent validation of an approach we have held for a long time – understand the adversary behind the attack: what they are preparing to do, predict their next actions, intervene before the impact and then also verify that the intervention worked. That is predictive security, and it is what we have built  Group-IB Unified Risk Platform  to deliver.

Everything here explains how we built it and what it changes for our customers.

What stands in the way of predictive defenses?

Attackers leave evidence as they prepare, creating opportunities to intervene before an attack begins. This is well documented operationally: domains get registered, phishing kits get staged, credentials get traded, infrastructure gets tested. All of that leaves traces in dark web forums, DNS records, certificate transparency logs, malware sandboxes.

The challenge is finding that evidence and understanding what it means for a particular organization in time to act.

Threat intelligence sees the adversary, the infrastructure, the malware, the compromised credentials. The fraud team sees the victim, the account, the transaction. Another team sees brand violations and impersonations. But the team still has to reconstruct the operation across those findings, and that reconstruction takes time away from intervention.

You cannot anticipate an operation you can only see in fragments. The blind spot sits between the systems and closing that gap falls to the security team through building the integration, reconciling the findings, carrying the evidence from one system to the next. Every additional tool adds coverage and more of that work.

So, the move towards ERMM isn’t just a category chase, it’s a correction in how the industry reads modern cybercrime which has grown complex, multi-domain, and pointed straight at the business.

Enterprise risk mitigation and management, ERMM, in one line

Group-IB Unified Risk Platform brings Threat Intelligence, Digital Risk Protection, Attack Surface Management, and Cloud Security Posture Management into one shared intelligence foundation. In practice, that means:

• Fewer blind spots between domains: What we learn in one discipline informs the others, so teams can investigate the relationships between an exposure, an adversary, and activity inside the environment.
• Prediction instead of reaction: Reactive means detecting a threat and waiting for the attacker’s first move. That is the model we are moving away from and towards predictive defenses: learn about a problem in advance, act in advance, and stop the operation before the attacker’s first step.
• Less work to make findings useful: Teams investigate a threat without rebuilding its context in each tool or engineering another connection between systems.
• Time back:  Automation handles the assembly work. Supported research tasks that used to take hours, and sometimes days, are completed in minutes, with analysts reviewing the evidence and the conclusions rather than collecting them.
• Earlier intervention, and lower downstream cost: An operation disrupted before it causes damage avoids the far larger burden of response, recovery, and business interruption. Less time assembling evidence also lowers the cost of the investigation itself.
• Protection that reaches you and your customers:  Phishing, scams, malware, and fraud can target a company’s customers in its name, without ever entering its network. That activity still belongs in the company’s risk picture.

What predictive security means at Group-IB

We use evidence of an adversary’s preparations, together with what we know about the customer’s environment, to anticipate the attacker’s next actions. 

The foundation is the connection between what we see outside an organization and what is happening inside it: a leaked dataset, a new phishing site or activity in a criminal community, connected to the customer’s accounts, infrastructure and defenses. That connection tells us which organization is at risk, how the attacker could proceed and where we can intervene.

We already apply this approach today:

• A third-party leak exposes customer data: We identify the affected accounts and assess how the stolen information could be used to take them over. We work with the customer to secure access and apply additional checks before fraudsters use it.
• Phishing infrastructure is being prepared under a customer’s brand: We identify it during preparation and initiate takedown before the campaign reaches its intended victims, protecting both the organization and its customers.
• An attacker is preparing to target an organization: We connect the signals of preparation to the customer’s environment, identify the likely attack path and work with the security team to put blocking measures in place before the attack.
• An exposed asset has a vulnerability: We establish the risk to the customer, support remediation and verify that the exposure has been closed.

We don’t stop at intervention; we continue investigating replacement infrastructure, changes in the attacker’s behavior and signs of renewed preparation. What we learn guides our next action.

This is where I believe ERMM is heading: visibility, context, prediction and preemption. Convergence provides the evidence and context needed to make prediction useful. Its value becomes clear when that prediction leads to protective action.

What makes it possible with Group-IB?

• Intelligence specific to the customer

Frost & Sullivan identified our intelligence origination as a core differentiator. Originating our own intelligence lets us investigate adversaries directly, follow new leads and update our understanding as their operations change.

Group-IB Digital Crime Resistance Centers (DCRCs) add local expertise, intel of the communities, methods, and targets that differ from one market to the next.

Our unique sensors analyze external signals and, just as importantly, signals from inside the customer’s own infrastructure. Correlating what we see inside with what we see outside is what makes the picture specific to one organization.

That is why I am a proponent of the shift toward adversary-centric intelligence. It is not enough to understand the infrastructure; we need to understand the adversary behind it: how they operate, who enables them, and how their operation is evolving.

We do not want to report industry averages, i.e. what is happening to everyone. We want to report what is happening to your.organization, which operation concerns it, how it is likely to develop, and where it can intervene.

• Cyber-Fraud Fusion

Following financially motivated cyber operations into fraud reveals how attackers turn access

and stolen data into money, evidence a purely technical investigation would miss. Those findings inform threat intelligence and digital risk protection; intelligence about criminal infrastructure and compromised access gives fraud teams earlier warning in return.

• Prevyn AI and earlier intervention

Prevyn AI is the cognitive core of the Unified Risk Platform, built on our Intelligence Data Lake, which brings together data, telemetry and analysis from our systems worldwide.

An analyst sets a research goal. Specialist agents, coordinated by an orchestrator, turn it into a multi-step investigation, follow leads and return findings with supporting sources. They work around the clock alongside our analysts and customers.

Teams stay in control: they can watch the investigation develop, inspect the sources and verify the conclusions. In our internal testing, research output quality improved by more than 20% across accuracy, completeness and analytical depth.

By accelerating investigation and returning findings with supporting evidence, Prevyn AI helps teams decide where to intervene sooner.

What this looks like in a real operation

Our recent research into card fraud in the GCC is the clearest example I can give.  One standout detail. 3D Secure wasn’t bypassed. The attackers had compromised the access needed to complete it. Viewed on its own, the payment looked authenticated, but the wider evidence revealed the account takeover behind it.

Each team saw siloed evidence: the brand team a phishing page, the SOC a new device, the fraud team a valid 3DS payment. Each exposed part of the crime. Connecting them revealed how the operation worked.

Digital Risk Protection and Graph analysis linked more than 400 phishing resources to common operators. Adversary-centric threat intelligence connected that infrastructure to takeover sessions traced to Jordan and mapped the Telegram cash-out market. Fraud Protection tied the “valid” 3DS payments to the signals that preceded them: new devices, eSIM swaps, GPS spoofing. More than USD 2 million was confirmed across 80 cards.

Connecting the evidence this way shows where the scheme could be interrupted far earlier, at the advertisement, before a victim ever reaches the phishing page. That is the point: alerting is half the job, and turning signals that belong to one operation into action is the tipping point we’re aiming at.

What I want our work to be measured by

In our customer conversations, three things come up again and again: intelligence they cannot get elsewhere, service they can rely on, and findings relevant enough to act on. Those expectations belong together. Intelligence needs to address the threats facing their organization, and our teams need to help them put it to work.

Frost & Sullivan’s recognition reflects the work behind our intelligence and our platform. In the customer’s environment, I want that work measured by what we anticipated, how early we acted and whether the intervention worked.

Read Frost & Sullivan’s assessment of the ERMM market and of Group-IB.

KEY TAKEAWAY

Group-IB’s predictive security approach connects proprietary intelligence with the customer’s environment to anticipate an attacker’s next actions, intervene before harm occurs and verify the result. Frost & Sullivan recognized Group-IB as a Visionary Leader in its 2026 Frost Radar for ERMM.