The 2026 Cybersecurity Trends Outlook

1 - >

Speaker 1: Hi, everyone, Happy New Year, and welcome back to the 2 - > Digital Dcode, brought to you by Presidio and our partners 3 - > over at Cisco. Once again, I'm your host, Alec Brust, 4 - > and before I jump into our first topic of twenty 5 - > twenty six, I do have one little announcement, and that 6 - > is that The Digital Dcode is now on YouTube. If 7 - > you are interested in watching us decode all things tech, 8 - > you can head over to the Presidio YouTube account for 9 - > all of our episodes moving forward, including this one. So 10 - > now to jump into our first topic of twenty twenty six. 11 - > With the new year, there is always come in these 12 - > new opportunities in the tech industry, but there are also 13 - > a ton of challenges that come along with those opportunities, 14 - > especially in the cybersecurity space. And that's why today I'm 15 - > joined by return guest persidioc so Dan Lorman, as well 16 - > as new guests to the show, persidioc So Mike Brown, 17 - > to talk about the twenty twenty six cybersecurity outlook. There's 18 - > a ton on the horizon, so Dan, I'll hand it 19 - > over to you to kick us off. But first of all, 20 - > I just just talk to our audience for a little bit. 21 - > Why is this so important we do these predictions. Everyone's 22 - > doing these predictions. We see these predictions and reports every 23 - > year about this outlook. But why is it so important 24 - > to our audience? 25 - >

Speaker 2: Yeah, I mean, thanks Ax, great to be back with you. 26 - > It's good to be with Michael again. I just really 27 - > think every year, you know, it is around the holidays, 28 - > in the in January, people say, you know, it's the 29 - > same as last year, same, only worse, and that kind 30 - > of a thing. But the reality is we make predictions 31 - > in every area of life, you know, whether it be weather, 32 - > financial forecast. I'm sure people out there listening care about 33 - > their stock market portfolio and what they're investing in and 34 - > not investing in, and with our careers and so many 35 - > different areas of life. And cybersecurity has become front and 36 - > central for every type of cyber of technology. Now, you know, 37 - > AI of course is huge with the big theme in 38 - > twenty six we're gonna be talking a lot about that. 39 - > But really I would just say that, you know, with 40 - > cybersecurity becoming so important, it is like something that can 41 - > help listeners and I every year I have an opportunity. 42 - > I've been doing this now for twelve years and really 43 - > looking at across the industry, not just presidios predictions, but 44 - > what are all the top vendors saying. And this year 45 - > we looked at one hundred and twenty five reports from 46 - > all around the world, top vendors, we rank them, We 47 - > looked at them. You know what are the trend of 48 - > the trends if you will, and then what's the most important? 49 - > And then you know this can help people with their careers, 50 - > with their This isn't just about marketing. It really is 51 - > you know what's happening next, Because if you know what's 52 - > gonna happen next, just like with your stock portfolio, it's 53 - > going to help you invest, it's going to make good decisions. 54 - > And for security leaders, for technology leaders, help you build 55 - > your roadmap for planning twenty twenty six And what are 56 - > you going to invest in? What are you going to 57 - > put spend your time on? What should you not be 58 - > spending your time on? And when you look across the industry, 59 - > there really are some important trends that everyone should be 60 - > paying attention to. So use this. You're not going to 61 - > agree with everything. You're gonna disagree with some, but use 62 - > this to help your career personally and your company and 63 - > your business. 64 - >

Speaker 1: Absolutely, you know, it hits people when we talk about cybersecurity. 65 - > It's hitting these large enterprises, but then it also trickles 66 - > down all the way to the individuals. So it's important 67 - > from an individual aspect in business and across the tech industry, 68 - > but in a ton of different industries as well. So 69 - > you did talk about what you've been seeing across all 70 - > of these reports. Do you have a top twenty, a 71 - > top ten that you're looking at right now? 72 - >

Speaker 2: Yeah, we do. We have a top ten. And by 73 - > the way, you can get these alluremental on Cybersecurity Government 74 - > Technology magazine over a weekly blogomenone cyber You can go 75 - > out there. We'll put a link to that in the notes, 76 - > and so you can go out and you can read 77 - > these two reports. And you know, I'm just gonna quickly 78 - > run through what the trend of the trends are, So 79 - > what are all these vendors saying, and then we can 80 - > dive into some specific predictions. But number one, which may 81 - > may or may not be a surprise to the listeners, 82 - > rise of agentic AI attacks. Autonomous AI agents will execute 83 - > multi step operations and interact with real systems, turning compromise 84 - > agents in the powerful independent attack vectors so that's the 85 - > number one across all the vendors. Number two, AI powered 86 - > social engineering, so deep fake services and hyper personalized AI 87 - > will revolutionize business, email compromise and extortion scams. We saw 88 - > a lot of that in twenty five. We're gonna see 89 - > more than twenty six, making deception nearly impossible to detect. 90 - > So it's only gonna get worse. It's gonna be harder 91 - > to know what's real what's fake. Number three the shift 92 - > to post quantum security. There's been a lot to talk 93 - > about post quantum, but the organizations must accelerate the transition 94 - > to post quantum cryptography to defend against harvest now decrypt 95 - > later strategies and sophisticated adversaries. So you're gonna start seeing 96 - > more and more quantum projects showing up in companies around 97 - > the globe, and that's really got to be a priority. 98 - > Number four, not surprising gets back for another round ransomware. 99 - > But ransomware will become fully automated in twenty twenty six, 100 - > and what will evolve in AI driven operations that scam, exploit, 101 - > and extort with minimal human input. Focusing on intelligent data 102 - > exploitation over encryption. A number of people say, a number 103 - > of reports will dive into that a little bit later, 104 - > but talk about they're getting rid of the encryption completely 105 - > with ransom, where it's just really just jumping straight to extortion, 106 - > which is pretty scary, but you're seeing a lot of that. 107 - > Number five AI insider threats. Autonomous AI agents with privileged 108 - > access will become the new insiders, requiring specific AI firewalls 109 - > to prevent them from becoming vulnerability. So AI agents, you know, 110 - > doing functions, and we've got to make sure we're monitoring them. 111 - > Number six converge convergence of advanced persistent threats APTS and cybercrime. 112 - > Nation state actors and criminal gangs will share infrastructure and payloads, 113 - > blurring attribution and accelerating the scale of global cyber operations. 114 - > And go through four more here, three and then the 115 - > top ten will get Mike's view on these, but supply 116 - > chain infrastructure targeting attacks on global logistics, satellite communications, and 117 - > smart transportation systems will increase, turning outages into strategic weapons 118 - > for geopolitical influence. Number eight was browser based zero trust workspaces, 119 - > so more browser based attacks. As the browser becomes the 120 - > primary enterprise operating system, security will shift towards cloud native 121 - > models and enforce zero trust directly within the browser. And 122 - > then nine to ten Number nine atrophy of critical thinking. 123 - > Widespread GENAI usage will cause a surge of lazy thinking, 124 - > leading fifty percent of organizations to implement AI free risk 125 - > skills assessments for hiring. And then last, but not least, identity. 126 - > Identity is the new perimeter. With traditional VPNs collapsing, Identity 127 - > based secure and zero trust networks, ETNA will become the 128 - > primary defense against automated session hijacking. So those are the 129 - > top ten trends. 130 - >

Speaker 1: Dan, I'll let you catch your bread there for a second, 131 - > because that is a ton There's a ton of good 132 - > info there. But Mike, I'm really interested in kind of 133 - > what are your takes on those top ten. 134 - >

Speaker 3: It's definitely very broad. I'll zoom in on a couple. 135 - > Identity as huge because you have to know who has 136 - > access to what and you know what systems are on 137 - > your network. But the biggest theme overall on everything is AI. 138 - > It's not surprising for anyone over there. 139 - >

Speaker 2: And. 140 - >

Speaker 3: Multiple aspects at one theme. I definitely see what your 141 - > predictions is. The offensive side sets things like AI social engineering. 142 - > You have your eight augentic ai attacks and then ransomware, 143 - > you got the automated ransomware. I think it all leads 144 - > to a landscape where speed and scale are critical to 145 - > defend against these types of attacks. My background is financial services, 146 - > and you know everything near is about it was about 147 - > seconds than microsos and milliseconds, so you know, speed is critical, 148 - > and I think it's the same thing there. The the 149 - > attackers have speed at their side and they are more nimble. 150 - > And then defensively, you know, identity is a new perimeter. 151 - > That was that and I think was the browser zero 152 - > trust workspace. What that showing me is that security architecture 153 - > is becoming more abstract, so it's less netric, network centric 154 - > than we used to have. Cybercrime. That's it's very very 155 - > very broad theme, but I think automation is going to 156 - > help attackers with things like fraud. That's you know, they 157 - > can do it a lot quicker and everything. But I'm 158 - > also thinking about more sophisticated things like money laundering. You know, 159 - > we're seeing you know, mon new loundering campaigns are more 160 - > like a foreign exchange trading desk right now where they 161 - > convert currency to currency and smaller denominations and you know, 162 - > in different aspects just to kind of hide the money trail. 163 - > You can go from Bitcoin to ethereum and a different 164 - > done dominations make it harder to contextualize all of that 165 - > and then eventually to one of the lesser traceable currencies 166 - > like Manaro. That's things we're seeing a lot more right now. 167 - >

Speaker 2: Uh. 168 - >

Speaker 3: Final one, I'll just touch base on his supply chain. 169 - > So things like SAS and especially the third party integrations 170 - > there I seem as amplifiers. And what I mean by 171 - > that it gives attackers exponentially more targets to go after. 172 - > So it's not just the one company that has the 173 - > third party integration or the SaaS vulnerability, but think about 174 - > any company that uses a third party and has that vulnerability. 175 - > So attacks can become automated end to end, from like 176 - > reconnaissance all the way to execution. Think of an automation attack. 177 - > They'll get all the users that have a vulnerability out there, 178 - > can scan the network, scan the Internet and look for vulnerabilities, 179 - > but also deploying the attack simultaneously or you know, subsecond 180 - > or in a few seconds. So your probability for successful 181 - > attack it just went up significantly. 182 - >

Speaker 1: No, that's great, and you know, it's it seems like 183 - > cybersecurity attacks are going to be, like you said, a 184 - > lot quicker, We're going to have to react a lot more. 185 - > And I'm just curious out of those ten trends, and Dan, 186 - > keep me honest here, I want I don't want to 187 - > call these your favorite predictions that you're seeing for twenty 188 - > twenty six, but what are the are you seeing as 189 - > kind of I don't know, maybe the most top of mind, 190 - > the most important things that maybe you know, big organizations 191 - > should look after. 192 - >

Speaker 2: Yeah, I actually did give awards at the end, so 193 - > I will I do have some favorite predictions. I will 194 - > jump to that in a moment, but I want to 195 - > make sure listeners know that this isn't just about individual predictions. 196 - > Those were trends. I do want to highlight kind of 197 - > the top reports from the top vendors. So we do 198 - > a ranking, and when we look at the ranking, it's 199 - > not just obviously we don't know what's going to happen 200 - > in the future, so can you you know, great maybe 201 - > at the end of the year. But it's also the 202 - > way that they put it in in formats. They do PDF, 203 - > they have graphics, you know, interactive formats, multiple channels, and 204 - > then they have references. So for example, the number one 205 - > report this year best report of the year was again 206 - > trend Micro. I think they've won four of the last 207 - > five years. They do a great reports, a thirty nine 208 - > page pdf. They have over one hundred references. So if 209 - > you want to say, well, back this up, where does 210 - > this come from? How do we connect the dots? You 211 - > can go and look at the stories. You can go 212 - > look at details and their top their top three where 213 - > AI will become a top attack vector executing multi step attacks, automating, fishing, 214 - > and social engineering. So again you heard that a lot 215 - > number two vibe coding will increase risk of insecure code 216 - > unless fully reviewed by humans. Interesting and then supply chain 217 - > and insider threat converge, with cloud remaining a prime target. 218 - > So you know those are their top trends. But again 219 - > they have web They have a lot of different material 220 - > that you can dive into in the report. All of 221 - > these are link to in the report. We're gonna give 222 - > you the link to number two. Second best report this 223 - > year was Google Cloud Mandate. They are five top areas 224 - > where adversaries fully embraced AI, prompt injection, manipulates AI, AI agents, 225 - > paradigm shifts supercharged security analysts, and enterprise virtualization is under threat. 226 - > So that's that's Google. There's a lot of really good 227 - > YouTube videos you could go to listen to their executives 228 - > on that as well. With Google. Number three was WatchGuard. 229 - > They were a smaller company, but they always do grant reports. 230 - > They're a lot of fun. They actually have a lot 231 - > of humor in THEIRS. But their five a little bit different. 232 - > Crypto ransomware goes extinct, which is interesting. OSS open source 233 - > software uses AI for supply chain protection, cr mandate, spark 234 - > Secure by Design, ZTNAS which is zero trust starts to 235 - > replace traditional VPNs, and AI literacy becomes core cyber skill 236 - > for many. So again we for all of us, we 237 - > got to learn AI. Four was for to Neet. Their 238 - > top five predictions were autonomous AI agents run cyber attacks, 239 - > attack life cycle shrinks two minutes, jen AI accelerates data extortion, 240 - > critical infrastructure, ransomware we'll expand, and identity becomes a primary 241 - > attack surface, which again you see that a lot. And 242 - > then I wanted to mention number five. I mentioned Gartner. 243 - > One of the things that people say, well, why aren't 244 - > Gartner in Forrester Forrest is number six higher up. Well, 245 - > this is also what we do in this analysis. This 246 - > is all free. This is all free material. You can 247 - > get all these reports online. You don't have to pay 248 - > for these. Obviously, Gardner and Forrester and IDC and a 249 - > lot of the others have great paid reports, but could 250 - > cost tens of thousands or even hundreds of thousands of 251 - > dollars for some of those. So this is free material 252 - > that Gardner made available. It's really good. A couple four here, 253 - > I want to mention that I'll give you my favorite 254 - > from Gardner. But geopolitical volatility increases cyber risk. We're seeing 255 - > that around the world right now with what just happened 256 - > in Venezuela. What's going on and I ran right now? 257 - > Poor security, fuel, ransomware and ato AI adoption introduces new 258 - > data and risks and incident response overload, weekends, resilience, which 259 - > is an interesting one because resilience is obviously front and center. 260 - > My favorite one overall, this mention I want to I 261 - > want to get Michael is actually Presidio is on the 262 - > list too, at like A twenty three or twenty three 263 - > twenty three. I want to hear Michael's predictions, which were 264 - > great by the way, I think he did a really 265 - > outstanding job. I want to hear those. But I will 266 - > say my favorite one of all the reports was from Gartner. 267 - > It was that AI is making us lazy, and it 268 - > kind of prompts you know, you, it gives you, It 269 - > gives you action, It gives you, like something to do 270 - > homework for, and not to be lazy. I mean, AI 271 - > is a great tool. We're obviously advocates of AI, but 272 - > you know, if you're just gonna rely on AI, you know, 273 - > hopefully it's not writing. It doesn't write any of my blocks, 274 - > but you know, writing writing material for you. Use it 275 - > as a tool. It can help, but don't let it 276 - > make you lazy. And you know the fact that fifty 277 - > percent of organizations will start actually doing you know, skills 278 - > assessments without any AI. I think that speaks volumes and 279 - > so I really like I like Gardner's predictions as well. 280 - > But Michael, watch you tell us what your predictions were 281 - > with it. They do show up in the list and 282 - > with Presidio, it's on the Pasidio website, I know, in 283 - > the block section, and what were your top predictions? 284 - >

Speaker 3: Yeah, thanks Dan, I was a little disappointed. I wasn't 285 - > in the top prediction, but the gardener one I absolutely sorry, 286 - > absolutely about that. They deserve first place. That was a 287 - > great one on there. So I'm going to stay away 288 - > from the AI predictions that I put in there as well. 289 - > One I'd focus on is the data chain of custody 290 - > tracking or cryptographic convidence. That's kind of a big thing 291 - > to take, but with AI and deep fakes, I think 292 - > the biggest problem, with one big problem is actually trust, 293 - > Like how do you know the data is real? So 294 - > data chain of custody is like a digital paper trail 295 - > for content and information. It can show where the data 296 - > came from. It shows who touched it and whether it 297 - > changed or not, and a whole history of changes on there. 298 - > So you can think of it kind of like blockchain, 299 - > where you have cryptographic proof of who the data is from. 300 - > It shows any edits and who access the data and why, 301 - > so instead of just trusting, companies can prove their data 302 - > as authentic. And the technology has been there for a while, 303 - > but it's not really a technology push. I feel this 304 - > and it's on my list because I think regulators cyber insurance, 305 - > reputational risk and you know, fear of manipulated data is 306 - > really pushing that at the top, and I feel over 307 - > time this is going to become slowly become a standard 308 - > feature behind the scenes for most stuff. Now, the second one, 309 - > it was on your top ten, it was on my 310 - > list as well, and it's it's passionary for me, is 311 - > quantum cryptogic. So my prediction is a little selfish because 312 - > I'm a financial services background, but quantum cryptography pilot and 313 - > financial services and why this made my list or what's 314 - > really pushing it is NIST finalized their post quantum encryption algorithms. 315 - > So you have the World Economic Forum, you have the 316 - > f S I sack and many of the other IS sacks. 317 - > They're highlighting that quantum is a top emerging risk. I 318 - > would argued, not emergent, it's a current risk now, and 319 - > I predict we're going to see control tests of quantum 320 - > key distribution and probably some post quantum encryption methods and 321 - > decryptions in financial services, and this test will test for 322 - > interoperability performance. And then finally what drives a lot is 323 - > regulatory compliance. So the large global banks that I know 324 - > a lot of them have teams of quantum researchers already. 325 - > They're on staff they're doing a lot of interest and stuff. 326 - > But with NIST, I think that's going to be a 327 - > catalyst and it's going to make twenty twenty six remembered 328 - > as a year that financial institutions and other critical infrastructures 329 - > start building defenses for the quantum error. 330 - >

Speaker 1: No, No, super interesting. Like Dan said, you can go 331 - > ahead and check out our blog that we have on 332 - > persidio dot com for all of our predictions and also 333 - > links to a ton of those reports that Dan mentioned, 334 - > and I will include that in the show notes for everyone. 335 - > You know, this is just a super interesting topic every 336 - > single year, you know, as I'm the social media manager 337 - > here at persidio and so I'm not very much in 338 - > tune to all the cybersecurity things that you guys deal 339 - > with every day, but it seems like it's getting more 340 - > and more, you know, ingrained with AI in in you know, 341 - > our society, and I see it on social media all 342 - > the time. You got to be more vigilant. These videos 343 - > are looking realer and realer every day, and so I 344 - > know that that trickles into the cybersecurity space as well. Dan, 345 - > do you have anything else that you want to say 346 - > before we tie off here? 347 - >

Speaker 2: Yeah, Yeah, like, I, uh, was a great job, Mike. 348 - > I thought those were great, great, great list, and it 349 - > is number twenty two I said twenty three earlier. So 350 - > it's right there. It's it's it's uh. We'll put the 351 - > links up to these to these reports and you can 352 - > see all the links to all of the different ones 353 - > that are free and are available online from all the 354 - > vendors across the industry globally. I did want to mention 355 - > one more that I thought was interesting, and this is 356 - > category was at the end I give awards for the 357 - > different ones and this was This was runner up in 358 - > the category of scariest but still believable, which I thought 359 - > was and practical as well. So this this is from 360 - > Nadil Israel, Israel co founder and CTO of Armis and 361 - > his his his prediction was AI powered financial system manipulation. 362 - > So let me read this real quickly. Autonomous trading bots 363 - > and AI driven deep bakes will manipulate stock markets, commodities, 364 - > and cryptocurrency ecosystems by impersonating regulators or company executives. AI 365 - > system triggers will fall well, as systems will trigger false 366 - > earnings reports, disseminate false corporate announcements, falsify investor briefings or 367 - > simulate market crashes. The result global financial instability with second 368 - > scale losses that human operators cannot contain. That's pretty scary. 369 - > Now he's not saying he's not saying a stock market 370 - > crash there. He's just saying, we're gonna have somewhere along 371 - > in twenty twenty six, we're gonna have a blip that's 372 - > gonna probably make the front page of the Wall Street 373 - > Journal or something that's gonna really cause a lot of turmoil, 374 - > to say the least. So I think the lesson from 375 - > that one whether that happens this year and some of these, 376 - > by the way, we always say some of these may 377 - > happen in twenty six, maybe it's twenty seven, maybe it's 378 - > twenty eight, but the trends are interesting. Is to always 379 - > check your facts, check your sources. And I tell people people, 380 - > there's a ton of great advice in these reports. We 381 - > don't get into a lot of the advice with the 382 - > predictions which come with a lot of these reports. Some 383 - > of it is marketing and sales, I'll admit that, but 384 - > some of it is really good advice. Is like, you know, 385 - > if something seems unbelievable. It probably is not true, So 386 - > make sure you're checking your sources, make sure that you're checking, 387 - > you know, from an identity perspective, who's really sending that. 388 - > It's probably not really your nephew or your niece suck 389 - > in London who needs you to wire money to them 390 - > because they're in jail. That's probably not really happening as 391 - > it could, I guess. But you know, those those fake 392 - > messages you know have that have that family word that 393 - > you know right that that that you know that you 394 - > can know that is this really? Is this really my 395 - > my niece who's asking me for money? So yeah, I 396 - > mean those are the kinds of things we all need 397 - > to be really careful of because deep fakes are getting 398 - > more and more powerful. I just wanted to close with that, 399 - > but really appreciate Alec you leading this in the time 400 - > to be able to share some of these predictions. Absolutely 401 - > and I love that. 402 - >

Speaker 1: I think that next time we do this, you know, 403 - > for twenty twenty seven, I'm I'm gonna need you to 404 - > do that award section again. 405 - >

Speaker 2: That's great. 406 - >

Speaker 1: That definitely is super scary. But no, thank you again 407 - > for coming onto the podcast. I always love having this conversation, 408 - > and we will make sure to keep tabs on all 409 - > of these trends that we discussed in today's episode throughout 410 - > the year and see you know how they play out, 411 - > how our predictions play out. And I'm sure I'll be 412 - > seeing you know, some more blogs from you Dan on 413 - > our website, and we will touch base again next year 414 - > to discuss the predictions in twenty twenty seven. But I 415 - > guess any other closing remarks before I close out the 416 - > podcast for today. 417 - >

Speaker 2: No nothing for me. 418 - >

Speaker 3: I want to thank you Alex for having me on, 419 - > thank you Dan for including me in the list, and 420 - > this has been a great time. Thank you awesome. 421 - >

Speaker 1: Yeah, it was great having both of you on. Michael 422 - > for your first time. Dan, I know we've done this 423 - > a couple of times, so it's always great having you on. 424 - > But thank you everyone so much for tuning in again 425 - > to the Digital Dcode. As I said earlier, please go 426 - > check out our presidio YouTube page. This episode and every 427 - > episode moving forward will now be available to watch on 428 - > our chain, and you can also explore our educational content 429 - > and case studies on our YouTube page. Please rate and 430 - > subscribe to The Digital Decode wherever you get your podcasts 431 - > and remember to follow prosidio on Instagram and LinkedIn for 432 - > the latest updates. 433 - >

Speaker 3: Thanks again, thank you, thank you.