Radware H1 2026 Global Threat Report Shows Web DDoS Attacks Jump More Than 110% as Cyber Threats Accelerate

Radware reported that malicious web-application and API transactions surged 104% in H1 2026, signaling a sharp escalation in attacks across network and application layers. The company said AI is accelerating vulnerability discovery, enabling attackers to exploit flaws before public disclosure and increasing cybersecurity risk for multi-cloud enterprises.

Analysis

The investable implication is not simply higher cyber spending: it is a shift toward always-on application-layer protection as AI compresses the interval between vulnerability discovery and exploitation. That favors vendors with deployed inline controls, API discovery, bot management and DDoS mitigation over endpoint-centric platforms. RDWR can benefit at the margin, but the larger liquid beneficiaries are likely Cloudflare (NET), Akamai (AKAM), Palo Alto Networks (PANW) and Zscaler (ZS), where security attach rates can monetize existing traffic and cloud-control-plane distribution.

For RDWR, the report is marketing evidence rather than independently verified proof of incremental bookings. Its smaller scale means even modest enterprise wins could improve growth optics and support multiple expansion over the next 1-3 quarters, but it also faces a distribution disadvantage against hyperscalers and integrated security suites. The key confirmation is not threat-volume data; it is acceleration in application-security ARR, deferred revenue, net retention and large-enterprise deal count at the next results.

Consensus may underappreciate the margin pressure on digitally native customers that lack mature API governance. Successful attacks create demand for prevention, but they can simultaneously increase liability, downtime and insurance costs for e-commerce, fintech and SaaS operators. Over 6-18 months, this should favor security platforms that consolidate web application firewall, API protection and bot defense, while point solutions without a broad sales channel risk being acquired or competitively bundled away.

Near-term, broad cyber stocks may not rerate on another threat report; the catalyst requires disclosed breach events, regulatory enforcement, or guidance changes. A risk to the bullish security-spend view is budget substitution: CIOs could fund AI-security initiatives by reducing legacy network-security spend, which would make RDWR's revenue mix and renewal performance especially important.

Key Decisions for Investors

• Watch, do not chase RDWR on the report alone. Upgrade to a tactical 3-6 month long only if the next earnings release shows application-security growth accelerating and management raises full-year revenue or ARR expectations; exit on a guidance cut or material deterioration in renewal metrics.
• Express the structural theme through a 6-12 month basket long NET and PANW, sized against a short position in a broad software ETF such as IGV if market-beta neutrality is required. NET offers the clearest edge from traffic-scale data and security attach; PANW offers enterprise consolidation exposure. Reassess if enterprise security bookings decelerate for two consecutive quarters.
• Pair idea for the next 1-3 months: long AKAM / short RDWR only if RDWR materially outperforms into earnings without corresponding bookings evidence. AKAM's installed edge footprint and enterprise relationships provide greater ability to convert API/WAF demand; cover the short if RDWR reports a material large-customer win and raises forward guidance.
• Set an event-driven alert for a high-profile API-related breach or new disclosure rules requiring faster incident reporting. Such events can create a days-to-weeks demand and multiple catalyst for NET, AKAM and PANW, but take profits if the move exceeds fundamentals before bookings data validates it.