University of Kwazulu-Natal

2026 Cybersecurity Predictions A Cto S View Of What Comes Next

Bonisiwe Shabane
-
2026 cybersecurity predictions a cto s view of what comes next

Looking Back, Looking Forward The past year was dominated by one theme: scale. Scale in data, in AI adoption, in the speed of attacks, and in the number of systems security teams must protect without additional resources. In 2025, organizations tried to understand how deeply AI systems touch their environments, how much of their data… The past year was dominated by one theme: scale. Scale in data, in AI adoption, in the speed of attacks, and in the number of systems security teams must protect without additional resources. In 2025, organizations tried to understand how deeply AI systems touch their environments, how much of their data is unnecessarily exposed, and where risk hides in third-party software and vendors.

At the same time, attackers quietly shifted to automation, using AI tools to increase impact while reducing manual effort. Supply chain compromises cascaded through dozens of organizations, credential theft became the most common breach vector, ransomware moved almost entirely to extortion models, and generative AI moved from experimental to production, creating new attack... 2026 won’t be a clean break. It will be the year these trends mature, intersect, and force long-term changes in how we secure data, identities, and systems. Here’s how the landscape looks from where I sit. Traditional ransomware (encryption followed by negotiation) continues to decline.

Attackers have learned that stealing data and threatening to publish it is faster, cheaper, and more profitable. More than 80% of ransomware incidents now involve exfiltration, and that number will approach universality in 2026. Enterprises Will Start Treating AI Systems as Insider Threats. Josh Taylor, Lead Security Analyst, Fortra As agents gain system-level permissions to act across email, file storage, and identity platforms, companies will need to monitor machine behavior for privilege misuse, data leakage, etc. The shift happens when organizations realize their AI assistants have broader access than most employees and operate outside traditional user behavior analytics.

The first time an AI agent gets compromised through prompt injection or a supply chain attack and starts quietly exfiltrating customer data under the guise of “helping users,” organizations will realize they built privileged... John Wilson, Senior Fellow, Threat Research, Fortra In what could be described as a banner year for technology advancements, 2025 showed how powerful—and dangerous—AI can be in the wrong hands. With bad actors automating complex attacks, using AI tools to engage in social engineering campaigns and manipulating the AI agent to expose sensitive information, it’s no surprise that the year was a game of... And while the global average of the cost of a data breach fell 9% to USD 4.44 million, the average cost in the US hit a record high of USD 10.22 million. The cybersecurity threats didn’t end with automated chatbots spamming inboxes and tricking AI agents.

This year, we saw what could happen when an organization is caught unprepared to deal with the consequences of integrating new tools like AI agents into their workflow: 13% of companies reported an AI-related... Last year’s cybersecurity predictions touched on AI’s increasingly important presence in the cybersecurity preparedness plan. This year, IBM’s predictions for 2026 center on how the integration of autonomous AI into enterprise environments can be both a boon and a burden, depending on whether the proper security measures are implemented—or... The agentic shift is no longer theoretical; it’s underway. Autonomous AI agents are reshaping enterprise risk, and legacy security models will crack under the pressure. To stay resilient, organizations must drive a new era of integrated governance and security, built to monitor, validate and control AI behavior at machine speed.

This transformation requires embedding security into the very fabric of AI development and governance—ensuring agents operate within ethical and operational boundaries from day one. Anything less risks fragmentation, blind spots and enterprise-wide exposure. AI is accelerating innovation—but also exposing enterprises to unprecedented risks of intellectual property (IP) loss. In 2026, we’ll see major security incidents where sensitive IP is compromised through shadow AI systems: unapproved tools deployed by employees without oversight. These systems often operate across multiple environments, making it easy for one unmonitored model to trigger widespread exposure. This mirrors the rise of shadow IT a decade ago, but with far higher stakes—AI tools now handle proprietary algorithms, confidential data and strategic decision-making.

Closing the gap will require security teams to move at the speed of innovation, delivering approved AI tools and governance frameworks that meet employee needs without sacrificing control. As organizations accelerate toward 2026, the cybersecurity landscape is becoming more complex, more unpredictable, and more heavily influenced by fast-evolving technologies like generative AI. Threat actors are moving with unprecedented speed, regulatory demands are increasing, and the tools and techniques needed to defend modern environments are shifting just as rapidly. To help security leaders navigate what’s ahead, WatchGuard’s Threat Lab has released its annual Cybersecurity Predictions for 2026, a forward-looking analysis of the key trends, threat evolutions, and industry shifts expected to define the... Below is a snapshot of several major insights identified in this year’s report. Traditional encryption-based ransomware is expected to decline as threat actors turn their focus toward pure extortion and data theft.

Open-source package repositories may begin implementing automated, AI-driven defenses to help identify and mitigate malicious activity in software supply chains. Emerging regulations, including the EU Cyber Resilience Act, are accelerating the industry’s adoption of secure-by-design development principles—making proactive security a requirement rather than an option. Visibility and context on the threats that matter most. Every November, we make it our mission to equip organizations with the knowledge needed to stay ahead of threats we anticipate in the coming year. The Cybersecurity Forecast 2026 report, released today, provides comprehensive insights to help security leaders and teams prepare for those challenges. This report does not contain "crystal ball" predictions.

Instead, our forecasts are built on real-world trends and data we are observing right now. The information contained in the report comes directly from Google Cloud security leaders, and dozens of experts, analysts, researchers, and responders directly on the frontlines. The year ahead in cybersecurity will be defined by rapid evolution and refinement by adversaries and defenders. Read the report to learn about the threat and other cybersecurity trends we anticipate seeing in the year ahead. Cybersecurity in the year ahead will be defined by rapid evolution and refinement by adversaries and defenders. Defenders will leverage artificial intelligence and agentic AI to protect against increasingly sophisticated and disruptive cybercrime operations, nation-state actors persisting on networks for long periods of time to conduct espionage and achieve other strategic...

2026 is already on the horizon, and if you haven’t already been thinking about how cybersecurity will shift next year, now is the time to start. Earlier this year, I had the opportunity to hear security leaders reflect on 2025’s cyber trends. Now, five experts share their predictions for 2026 below. The explosive growth in AI usage represents the single greatest operational threat to organizations, putting intellectual property (IP) and customer data at serious risk. While AI adoption is growing rapidly, enterprises are increasingly exposed to risks related to data security, third‑party AI tools, shadow AI usage, and governance issues. When sensitive IP or Personally Identifiable Information (PII) is entered into unsanctioned AI systems, the data may be used for model training, stored externally, or exposed in unexpected ways, leading to compliance, IP, and...

Organizations must monitor not only sanctioned AI tools but also the growing ecosystem of “micro‑AI” extensions and plugins that can quietly extract or transmit data. A global KPMG and University of Melbourne survey of 48,340 individuals across 47 countries found that 48% of employees admitted uploading company data into public AI tools, and only 47% received formal AI training,... In 2026, three regulatory shifts will dominate the compliance and security agenda. The EU AI Act’s full release in August will require organizations to classify systems by risk, complete conformity assessments, and maintain documentation that reshapes how AI is deployed. As cyberthreats grow more intelligent, automated and persistent, 2026 will challenge organisations to rethink how they defend people, platforms and critical data in an era defined by Artificial Intelligence-driven attacks and relentless digital change. We hear from leading experts who outline what they think 2026 will hold.

Cybersecurity in 2026 will be shaped by a collision of accelerating innovation, expanding attack surfaces and a threat landscape that is evolving faster than most organisations can comfortably track. As Artificial Intelligence becomes deeply embedded across business operations and Digital Transformation initiatives push data and workloads further into cloud and Edge Computing environments, adversaries are adapting just as quickly. From more automated cyberattacks and highly targeted social engineering to growing pressure on critical infrastructure and software supply chains, the year ahead is expected to test the resilience of security teams at every level. Against this backdrop, industry leaders are rethinking strategies, investments and operating models to stay ahead of emerging cyberthreats while balancing risk, regulation and business growth. With cybersecurity, the only constant is change. The speed of that change is accelerating exponentially.

The security perimeter, once defined by a firewall, has dissolved into a complex lattice of cloud environments, hybrid workforces, and rapidly integrated technologies like Operational Technology (OT) and Artificial Intelligence (AI). This year, we've witnessed the commoditization of sophisticated attack techniques, the relentless pressure of supply chain vulnerabilities, and a clear shift in adversary focus from data theft to systemic disruption. For practitioners and enterprise leaders, keeping pace is no longer enough; anticipating the next wave of threats and regulatory demands is essential to building a resilient security posture, not just a reactive one. As the calendar turns, it's critical to cut through the noise and identify the strategic shifts that will define the battleground for the next 12 months. To help you navigate this period of heightened uncertainty, we have assembled commentary from leading subject matter experts (SMEs)—from frontline security practitioners at major enterprises to researchers and solution architects from top vendor firms. This collective intelligence moves beyond generalized fear, uncertainty, and doubt (FUD) to offer targeted insights on everything from the evolution of phishing campaigns powered by Large Language Models to the strategic pivot toward "Secure...

What follows is an indispensable guide to the challenges and opportunities ahead. Each prediction has been curated to inform your budget planning, refine your defensive strategies, and ensure your team is focused on the highest-impact threats. It's prediction time. And every year, hundreds of security experts send their predictions to journalists. This year was no different. Here, we picked the best of those that came in over the transom.

We stayed away from some of the more common predictions: quantum computing, AI-driven phishing and autonomous attacks, deepfakes rising, and so on. Everyone has those listed and we’ve all read them a dozen times. We picked these not because they are necessarily the most pressing, but because we found them unique, urgent, or somewhere in between. And we believe they will have significant impacts on security professionals in the year ahead. The AI regulatory hammer drops. One of the most significant regulatory shifts will be moving some AI regulations from nice-to-have to must-have.

Diana Kelley, CISO at Noma Security shares how the EU AI Act is entering its enforcement phase, requiring companies to classify AI systems by risk tiers and maintain auditable records of which model made... And in Asia, Japan's AI Promotion Act and South Korea's AI Framework Act both establish transparency and risk-based controls for AI. At the same time, Singapore's AI Verify framework provides a standardized, open-source framework for testing and demonstrating responsible AI. In the US, California enacted the "Transparency in Frontier Artificial Intelligence Act," establishing first-in-nation rules for high-power AI models, public disclosure of safety processes, and incident-reporting obligations. "While we don't yet have a sweeping federal AI regulation akin to the EU AI Act, the landscape is changing quickly. Together, these signal a shift toward traceable, accountable AI," Kelley says.

Attackers will accelerate their investments in cookie theft and MFA circumvention. The near-universal use of multi-factor authentication (MFA) means attackers will increasingly target ways to circumvent it. "This means threat actors will need to act swiftly from the time of theft, utilizing the stolen cookie before it expires to insert backdoors that then grant them persistent access. Online marketplaces will expand to enable this with rapid trading and exploitation," predicts Ian Pratt, HP global head of personal systems security. "Defenses against cookie and token theft are not mature and are inconvenient for users," he continues. Pratt adds that attacks involving such theft are becoming increasingly commonplace.

People Also Search

Looking Back, Looking Forward The Past Year Was Dominated By

Looking Back, Looking Forward The past year was dominated by one theme: scale. Scale in data, in AI adoption, in the speed of attacks, and in the number of systems security teams must protect without additional resources. In 2025, organizations tried to understand how deeply AI systems touch their environments, how much of their data… The past year was dominated by one theme: scale. Scale in data,...

At The Same Time, Attackers Quietly Shifted To Automation, Using

At the same time, attackers quietly shifted to automation, using AI tools to increase impact while reducing manual effort. Supply chain compromises cascaded through dozens of organizations, credential theft became the most common breach vector, ransomware moved almost entirely to extortion models, and generative AI moved from experimental to production, creating new attack... 2026 won’t be a clean...

Attackers Have Learned That Stealing Data And Threatening To Publish

Attackers have learned that stealing data and threatening to publish it is faster, cheaper, and more profitable. More than 80% of ransomware incidents now involve exfiltration, and that number will approach universality in 2026. Enterprises Will Start Treating AI Systems as Insider Threats. Josh Taylor, Lead Security Analyst, Fortra As agents gain system-level permissions to act across email, file...

The First Time An AI Agent Gets Compromised Through Prompt

The first time an AI agent gets compromised through prompt injection or a supply chain attack and starts quietly exfiltrating customer data under the guise of “helping users,” organizations will realize they built privileged... John Wilson, Senior Fellow, Threat Research, Fortra In what could be described as a banner year for technology advancements, 2025 showed how powerful—and dangerous—AI can b...

This Year, We Saw What Could Happen When An Organization

This year, we saw what could happen when an organization is caught unprepared to deal with the consequences of integrating new tools like AI agents into their workflow: 13% of companies reported an AI-related... Last year’s cybersecurity predictions touched on AI’s increasingly important presence in the cybersecurity preparedness plan. This year, IBM’s predictions for 2026 center on how the integr...