CSC's CISO Outlook 2026 report surveyed 300 senior technology and cybersecurity executives in the first quarter of 2026, split evenly across North America, Europe and the UK, and Asia-Pacific. When asked which cyber threats they had actually experienced in 2025, not which ones worried them but which ones happened, the answer at the top of the list was domain and DNS hijacking, and subdomain takeover. Ahead of ransomware. Ahead of malware.
Second on that list was cybersquatting, including typosquatting and counterfeit domains. Ransomware and malware came third.
And only 14% of those executives described themselves as "very confident" that they could mitigate an attack on their domains.
Two caveats before we build anything on those numbers. CSC sells domain security services, so this is a vendor survey and should be read as one. And 300 respondents is a survey, not a census. But the shape of the finding is consistent with what the DNS layer has looked like for several years, and the confidence gap is the part worth sitting with: the top two threats these people report experiencing are the two they are least equipped to see.
Why the confidence gap exists
Most of the security stack is instrumented. Endpoints have agents. Networks have flow logs. Applications have APM and error tracking. Identity has sign-in logs and anomaly detection.
DNS has a zone file that somebody edited in 2019.
That asymmetry is the whole problem. A domain hijack does not produce an alert on any of the systems above, because from their point of view nothing broke. The web server is up. The application is healthy. Authentication is working. What changed is the answer to a question asked elsewhere: the record a resolver hands back to somebody who was never your traffic in the first place, because your DNS sent them somewhere else.
The 2019 Sea Turtle campaign is the reference case: attackers compromised registrars and DNS providers to redirect the domains of government and energy organisations across more than a dozen countries, harvesting credentials through look-alike login portals that served valid certificates. In 2018, a BGP hijack against Amazon's Route 53 answered DNS queries for a cryptocurrency wallet service with forged records. In neither case were the victims' own servers breached. The DNS layer was.
We cover the mechanics of all four classes of hijack, registrar-level, zone-level, resolver cache poisoning, and local or router-level, in DNS Hijacking: How It Works and How to Detect It.
Prevention is well covered. Detection is not.
Search for domain hijacking and you will find the same advice on every result: turn on the registrar lock, consider a registry lock, enable two-factor authentication on the registrar account, keep the registrant email off a mailbox that also receives phishing, do not let the domain lapse. That advice is correct and you should follow all of it. Our own write-up of the layered controls is here.
But every item on that list is a control you set once and then assume is still in place. None of them tells you anything on the day it isn't.
The question the CSC survey exposes is not how do I prevent this. The industry has answered that repeatedly. It is how would I know. And the honest answer for most organisations is: when a customer emails to say the login page looks different.
What detection at the DNS layer actually means
Detection is unglamorous. It is four questions, asked continuously, from outside your network.
1. Did any record change, and did we mean it?
Every hijack ends in a record change. Not always to the A record. An MX swap that quietly copies inbound mail, a TXT change that adds a sending identity, a subdomain that starts pointing at somebody else's storage bucket. The control is a monitored, timestamped history of every record, so a change either matches a change you made or it does not. This is what DNS record history is for, and it is the difference between a five-minute answer and a two-week forensic reconstruction.
2. Are the nameservers still ours?
A registrar-level takeover usually shows up first as a nameserver delegation change. The domain still resolves, it just resolves from somewhere you do not control. Nameserver consistency between the registry's delegation and the zone's own NS records is one of the cheapest, highest-signal checks in DNS, and almost nobody watches it. See NS record consistency.
3. Did the zone change without the serial moving, or move without us touching it?
The SOA serial is the zone's own version number. When authoritative servers disagree on it, or it advances when no one on your team made a change, something edited the zone. See SOA serial sync.
4. Is anything pointing at infrastructure we no longer own?
Subdomain takeover, part of the top-ranked threat in the CSC survey and the quietest of them, is a CNAME left pointing at a decommissioned service that someone else can now claim. It requires no compromise of anything you control. See dangling CNAME records.
And underneath all four, DNSSEC is the one control that makes forged answers detectable by the resolver rather than by you. It is not a substitute for monitoring. A validly signed zone that an attacker now controls signs their records too. But its absence removes a whole class of defence.
What this looks like in practice
DNS Spy monitors the four questions above continuously. Every active monitored domain is re-resolved at least every ten minutes, from outside your network, and changes are queued for notification every minute. Nameserver state is re-checked every fifteen minutes. WHOIS and registrar data refreshes daily. That last one is worth stating precisely: a registrar transfer is visible to us within a day, not within a minute, and we would rather be exact about that than imply otherwise.
When something changes, the alert says which record, what it was, what it is now, and when. That is the form a change notification has to take if the person reading it at 2am is going to be able to act on it.
We are not going to claim this prevents a hijack. It does not. Registrar locks, registry locks and account hygiene prevent hijacks. Monitoring closes the window between the change and the discovery, which, in the incidents that become case studies, is where the entire cost lives.
If you want to check your own domain right now
DNS Spy's public scan reads a domain's live DNS, nameserver configuration, SSL certificates and email-authentication records and tells you what it finds. It requires no account and costs nothing.
If you would rather see the checks in a list first, the full Security Center check reference documents each one and what it detects.
Source: CSC, [CISO Outlook 2026](https://www.cscdbs.com/en/resources/ciso-outlook-2026-report/). Survey of 300 senior technology and cybersecurity executives, Q1 2026. Ranking and confidence figures as published by CSC.
