Defending football’s biggest tournament - Ctrl Alt Lead podcast

'You can’t do this as a standalone organisation’

While most of the focus of the World Cup 2026 is on the pitch (or politics), security teams are bracing for a surge of activity. Each match, broadcast and ticket sale creates fresh targets, and attackers are already moving

Speaking on an audio-only bonus episode of Ctrl Alt Lead, Darren Anstee, CTO for security at NetScout, says the World Cup has always experienced hacktivist pressure, but Fifa’s banning of Russia and the US invasion of Iran have put a target on this year’s tournament.

Anstee has spent over 20 years working on DDoS threats, and he and his team have supported service providers through every major international sporting event. He’s seen attack volumes surge around every single one, and they continue to grow.

“There are spikes,” he says. “Every single one of them … has attracted a spike in activity.”

Those spikes follow a rhythm. Early probes start months before kick-off as attackers test defences. Activity then builds during the event and often runs for days after it ends.

The targets go far beyond the stadiums hosting matches; media platforms, transport systems, ticketing services and payment systems are all in scope. Service providers play a central role because most of that traffic passes through their networks.

Recent attacks have also shifted in focus. Rather than hit well-defended front-ends, threat groups now look for weaker links. Suppliers and supporting systems can offer easier entry points, with knock-on effects for core services.

The 2026 World Cup adds additional layers of risk. Its location across three countries expands the attack surface and raises the need for coordination. And, of course, geopolitics plays a part. Hacktivist groups often align attacks with current events or specific matches to make a point, and Darren warned that any matches involving Middle Eastern teams – or Team USA – are likely targets.

Security teams should have been preparing for the attack spike months ago. Now a strong defence, like a free kick wall, relies on teamwork and awareness.

“It is all about the preparation … and keeping all of the channels open,” says Darren.

To access the full podcast use the web player or find Ctrl Alt Lead now on Spotify and Apple Podcasts.

Despite being assigned the USA in our office sweepstake, Tom is of course supporting England in the World Cup.

As Wales didn’t qualify, Darren will be supporting his wife’s team: Scotland.