As cybersecurity teams race to keep up with AI-driven threats, some of the most significant risks remain hidden in the internet’s foundational infrastructure. According to CSC’s CISO Outlook 2026 report, domain and domain name system (DNS) hijacking and subdomain takeover attacks ranked as the top cybersecurity threats experienced by organizations in 2025. What does that mean for CISOs and their priorities going forward?
When internet infrastructure becomes an attack surface
For years, a large-scale cloud-based operation quietly hijacked abandoned and expired domains and paired them with cloned websites from global brands using a tactic called “hidden cloaking.” The scheme operated undetected for years, demonstrating how attackers can use overlooked domain and domain name system (DNS) assets to impersonate trusted brands and redirect unsuspecting customers.
This example captures a growing reality—that some of the most damaging cyber risks don’t begin with malware or ransomware. They begin with the internet infrastructure that organizations depend on every day. And CSC’s research bears this out.
For our CISO Outlook 2026 report, we surveyed 300 chief information security officers (CISOs) and other senior C-level executives to understand what cybersecurity risks worry them most.
We found that 72% of executives described the cybersecurity threat environment in 2025 as either “critical” or “very critical.” And among all threats evaluated, they ranked “domain and DNS hijacking and subdomain takeover attacks” at the very top, even ahead of ransomware and malware.
The reason becomes clear when you consider what domains and DNS actually do.
Domains, subdomains, and DNS are the plumbing behind customer-facing websites, email, online services, and digital brands. When attackers compromise these fundamental assets, the consequences can extend far beyond technical disruptions. Organizations can face business interruption, customer confusion, reputational damage, regulatory scrutiny, and fraud-related losses.
Despite recognizing the risk, relatively few security leaders feel prepared to address it. Just 14% say they’re “very confident” in their organization’s ability to mitigate domain attacks, while just 34% say they’re “very protected” against DNS outages.
Our research also found that “domain and DNS hijacking and subdomain takeover attacks” are expected to remain among the top cyber threats over the next three years. Meanwhile, AI-enabled phishing, impersonation, and domain generation techniques are accelerating the scale and speed of these attacks.
Why attackers target domains, DNS, and subdomains
While these three foundational threats are often discussed together, attackers use them in different ways and for different purposes.
What’s domain hijacking?
Domain hijacking, also known as domain theft, occurs when a threat actor gains unauthorized control of a domain name or its administration. This can happen through compromised credentials, unauthorized deletions or transfers, weak domain governance, or other failures in domain management.
Once attackers gain control, they can redirect traffic to fake websites, impersonate brands, launch phishing campaigns, send fraudulent emails, steal credentials, or even sell the domain on the black market. Because domains underpin an organization’s digital identity, a successful domain hijacking incident can affect multiple business functions at once, lead to service disruptions, and erode long-term customer trust.
What’s DNS hijacking?
DNS hijacking occurs when an attacker alters DNS configurations to redirect visitors unknowingly from a legitimate website to a fraudulent one. Unlike domain hijacking, where an attacker steals control of the domain itself, DNS hijacking can succeed without ever taking ownership of the domain, making it harder to detect.
With this stealth method, attackers can still intercept communications, deliver malware, enact phishing schemes, steal credentials, and disrupt access to legitimate services. Plus, because the browser continues to display the legitimate URL, visitors rarely recognize the threat.
What’s a subdomain takeover?
A subdomain takeover occurs when an attacker gains control of content served from a legitimate subdomain that’s been abandoned, decommissioned, or misconfigured. It occurs when DNS still points to a cloud service, platform, or third-party environment the organization no longer controls, allowing an attacker to claim the abandoned resource and serve content from a trusted subdomain.
As organizations expand their digital footprint, their sprawl can include campaign microsites, old landing pages, decommissioned software as a service (SaaS) tools, and abandoned cloud resources. Often, ownership of these assets becomes fragmented across IT, marketing, product, and regional teams, as well as third-party providers. The result is a growing number of overlooked assets that attackers can exploit.
Once compromised, trusted subdomains can be used to host phishing pages, malicious content, credential-harvesting sites, or other impersonation campaigns that appear legitimate to users.
Why DNS monitoring matters
Many organizations already invest heavily in firewalls, endpoint protection, and identity management. But DNS often receives less attention than other parts of the security stack—even though it’s one of the first places attackers look to exploit.
That’s because DNS sits at the center of web traffic, email delivery, cloud services, and digital identity. Without visibility into DNS activity, organizations may not realize anything’s wrong until customers start landing on fake websites, emails stop reaching their destinations, or critical services become unavailable.
DNS monitoring helps close that visibility gap by detecting unauthorized DNS record changes, unexpected subdomains, suspicious traffic redirection, and other indicators of compromise before they disrupt services or affect customers.
CISO priorities for 2026 and beyond
For CISOs, one of the biggest challenges is translating infrastructure risk into business risk. A compromised DNS record or forgotten subdomain may seem like a technical issue. But the downstream consequences can affect customer trust, regulatory compliance, operational resilience, executive decision-making, and even revenue.
That’s one reason why concerns about domain and DNS threats have moved beyond the IT department. They’re now part of broader conversations around enterprise risk management and business continuity.
Focusing on fundamentals—such as maintaining visibility into domains and subdomains, removing abandoned assets, strengthening DNS governance, and monitoring for unauthorized changes or suspicious activity—can help organizations reduce exposure and maintain control over an increasingly complex digital ecosystem.
Looking ahead
The findings from CISO Outlook 2026 highlight an important reality: Domain hijacking, DNS hijacking, and subdomain takeover are no longer niche technical concerns. They’re real business risks that can affect customer trust, brand reputation, operational continuity, and revenue.
The challenge for security leaders is no longer recognizing these fundamental infrastructure risks—it’s reducing them. Closing the gap between awareness and action through stronger governance, better visibility, and continuous monitoring will remain a defining cybersecurity priority in 2026 and beyond.
To learn more about the trends shaping cybersecurity strategy today, download The CISO Outlook 2026 report.
