2026 Cybersecurity Top 10 Predictions

Cybersecurity is always a challenging endeavor. Every year we look towards new risks and new challenges, but we do have an opportunity. If we can see where the problems are arising, where the attackers are going, what we're going to be weak at so that we can strengthen it, we get an advantage. And so every year we look towards the next 12 to 18 months to to see what will change and how we can adapt. Looking at 2026, it will be a significant challenge, greater than past years from a relative perspective, and we're going to have to adapt. Now, I've been doing cybersecurity predictions for over 15 years, and I look at a number of different aspects as part of that methodology. I look at changes in capabilities of the attackers. I look at how the tooling knowledge and practices of cybersecurity are evolving. I take a look at the disruptive technology, essentially the technology battlefield that we all work and play in, to see how that's going to change. I also look at the business of cybersecurity itself. What are the expectations? What are the budgets? How are they communicating the reporting structure? Are they building trust? Where are they faltering? Where are they moving to? And never in those 15 years have I had a single aspect drive all 4 of those different areas until this year. In 2026, AI changes everything. So if we look at it from an executive perspective, AI impacts all those different areas. Attackers are using AI, defenders will be using AI, the targets themselves are all embracing AI. So if we break it all down and from a high level, really what we have to look at is how AI will be affecting the digital global ecosystem in 2026. The attackers, they're gonna love AI. In fact, they're already diving into it. It will allow them to attack better, more effective ways and scale. Now, this is normally a trade-off they have to worry about. They can either attack a lot or they can attack less but very well. This removes that barrier and really opens the floodgates for them. And they're going to see successes as they adopt AI effectively. Now, when we look at who they're using that against, they're using that against every country and business and individual and organization out there. And they're also using AI. They're rapidly embracing this disruptive technology, this technology that provides tremendous potential value, which is a great lure to rapidly move into this space. And in doing so, it bypasses a lot of the traditional practices of evaluating whether something is secure, whether you should do something versus whether you can do something. And in that rush, security tends to get bypassed because companies and businesses just simply want to use AI. They want to get the value. They may even be competing with others for that and they don't want to be left behind. And in doing so, they're going to be connecting to AI services. They're going to be implementing AI technology and instances within their own environment. And they're going to be integrating legacy tools and services offerings and products to make them AI-enabled. All of that is predicated on the value proposition that AI needs to be connected to more sensitive, private, and, and back-office systems to really drive value. Well, that undermines security. So defenders have to now move into this space where attackers can attack more. The landscape is no longer as friendly, and many many of their traditional longstanding security controls are no longer effective. So the defenders must adapt. And the biggest way they can adapt is actually to embrace AI themselves. Only through AI will they be able to keep pace with the attackers, with the number of attacks and that dynamic capabilities that AI provides those attacks. So this is where the defenders have to go. And they also have to embrace AI from the organization's organizations that they're defending, because those organizations demand AI to be integrated, the defenders need to move in lockstep, not holding them back, but moving with them, preferably at their speed, their desire to integrate, and building security as it goes. That's a massive challenge. So the net result, what we're going to look at here and go through, is in 2026, there is a distinct advantage going to the attackers. This is gonna be their heyday, especially probably for the first half of the year, maybe for the first three quarters. They are gonna be able to run amok and be able to innovate very fast to develop lots of attacks and then quickly iterate to improve the effectiveness. And we're gonna go into areas and how they're going to do that. But let it be known, this is their moment. Now, the defenders, they have to play catch-up. They have to try and slow down the attackers, adopt their own technology to be able to mitigate some of those evolving risks, and work from a governance perspective to understand what AI systems are being used, connected to, how they're going to gain access, what data is going to flow through them, how users are going to use them, and how policies really need to wrap their arms around these new use cases, new information, new data, and new risks. That's what we have to do in 2026. So let's cover the top 10 cybersecurity predictions. Now, I will go through each one of these in more detail, but I wanted to highlight these 10 and showcase how pervasive AI really is in all these different areas. And some of them sound very, very similar. When in fact they are completely different challenges and problems and we have to address them differently and understand the scope. So very quickly, number 1, AI supercharges social engineering. This is a perfect use case for attackers to use AI. Number 2, AI accelerates vulnerability exploitation. These are the cyber attackers that look for technical weaknesses and then go off and hack those. And again, AI is transforming to be a fantastic tool to give the attackers an advantage. Third, AI adoption. And we know this is happening so fast. Every company, every person is embracing AI without truly understanding the risks. Well, it's accompanied by significant risks and the attackers will find those. They'll find those areas to exploit. So we need to start understanding how that becomes a problem. Number 4, threat actor lineups. These are the threat agents. Think nation states, think data miners, think cyber criminals. This is gonna shift a little bit. We still have the two big, big archetypes, which are nation states, which bring tremendous skills and unfathomable amounts of research and funding in combination with the cyber criminals, who again are very motivated, and have a lot of resources and attack a lot of people in a lot of different ways. Those two still remain at the top, but we've got two others that were kind of way down on the list and they are moving up very, very quickly. And we're talking about data harvesters and vulnerability researchers. Again, both of these groups, they're going to be using AI to gather data to find those vulnerabilities. So the risks that they pose and the type of attacks that they're going to leverage and what they're going to do when they're successful. All plays out to what we're going to see in 2026. Number 5, ransomware. Our good old friend ransomware. It doesn't go away. It simply reinvents itself. There are certain opportunities and new limitations that these digital extortionists have to deal with, and they're not going to fold up shop. They are going to continue to expand even though a lot more victims are refusing to pay ransoms. So they will adapt to that, and we're going to see some interesting ways in which they're going to do that. Number 6, geopolitics. So we're talking nation-states here, we're talking foreign policies, things of that sort. They are really fueling and embracing offensive cybersecurity to be part of their foreign policy. So we're seeing offensive capabilities, and that includes the research and the operations and the infrastructure, play a big role in how the world is seeing attacks. And whatever they invest in eventually trickles down to those other threat agents like cyber criminals and, and data harvesters. Number 7, hybrid cyber warfare integration. This is the simple fact that these nations are willing to use offensive weapons as part of their foreign policy, as part of attacking other nations, as part of actual war and warfare with missiles and tanks. They're now integrating that in. They're integrating it in Cold War. They're integrating it into issues where you've got sanctions or avoiding sanctions. You've got political pressure on individual countries and maybe even trying to force regime changes. Cyber is now becoming an accepted integrated part in that. So every conflict in the world that you see out there, unless they're only fighting with sticks and stones, they're going to be using some element of cyber. And if not them, it's gonna be their proxies. That changes the dynamics of the world, and it also starts to broaden out who may be adversely affected by those attacks, unintentional potentially, but still affected. Number 8, we get to some good news. Defensive AI. This is the cybersecurity teams start to get good AI tools. They start to arrive. This isn't the end of the story. This is the beginning of this journey where effective tools actually start making a difference. They can get integrated. They start showing results. They start increasing the overall capacity, becoming a force multiplier for cybersecurity. It's not going to happen in the beginning of the year. It's going to come on probably, we're going to see it hit right in Q3 where we're, we're getting good traction at a sufficient layer. But that's the good news. Number 9, AI governance. This is a blind spot. Again, with all these companies and organizations and people embracing and integrating AI and transforming their current products and services to be AI enabled, There needs to be more governance to one, identify that shadow AI, those use cases and tools that are being used that security doesn't know about, that maybe IT doesn't know about. And then we need to start building policies to manage the risk around all those new usages, new data, new access, new partnerships, new collaborations around AI. The last is the CISO. The role of the CISO, again will transform. And every year we've seen it morph. Typically it grows in expectations, both in what the CISO should be covering from a risk management, but also an elevation of the role itself to the CEO, C-suite, and to the board and who they communicate with and who they directly are accountable to. And this is very, very important with CISOs now seeing time into the board, talking more with the CEO and the fellow C-suite, their role will change from a technical cyber expert to more of a business risk expert. And they will then be also responsible for many of these integrations around AI and the associated risks that will come into the organization because of it. So the role of the CISO does not become easier. It fundamentally transforms, including the language, the goals, the type of value that's being delivered. This is going to be a challenge for many of the current leaders out there that are primarily technically oriented and are not used to understanding business value nor communicating business value to the organization. Let's dive into each prediction and provide a little more context and color around what we're talking about. Prediction number 1: AI supercharges social engineering. The reality is social engineering— and think phishing in email or text messaging or in social media platforms like Facebook or LinkedIn or Twitter— those types of engagements that can lead to spam that can lead to fraud or theft or manipulation to gain access or have somebody go to a malicious link or install malicious software. AI is perfectly suited to communicate in compelling ways to the victims to get them to act in ways that are counterproductive to their own security, safety, and privacy. So the attackers will be using this across all the platforms and everything from the high-end deep fake videos, audio calls, SMS text messaging. And if you're an attacker, being able to have an AI bot reach out and have a multitude of simultaneous conversations to convince victims to give up their cryptocurrency keys or their passwords or install something really empowers them. You have automation, and most importantly, we haven't seen it yet, but we will shortly, they will be able to configure the AIs to learn from their failures, go back, apply that, reiterate, automatically try again, and continuously improve until they get really good, either at a specific target or at a group. This is their advantage. And we will see phishing, for example, where the communication is weaving in other public information. It's gonna look at where you were last week or what you posted online about what restaurant or what food you like or someone's birthday. They're gonna weave all that together as part of the narrative to make it compelling, and it's gonna be tough to resist. They're also going to create supplementary resources. If they want to convince you that they're a professional, they may create a LinkedIn profile and fill it with articles and links and posts and comments. They may create a fictitious web page of their company with everything included so you can go and look and click through and see how professional and big and testimonials and pictures and services and all these things. To help drive that fake reality, that facade that they're putting in front of you to build trust so that you can be victimized. This will be a big impact. We will see success rates probably increase between 30% and 50% of what they were in 2025. And again, for phishing and so forth, the success rates are small, but as you start ramping that up, it becomes a bigger and bigger problem. The other thing these tools will be able to do is right now a lot of those social engineering attempts, believe it or not, are actually being filtered out from your web filters and your email filters and other rules through different social media and other platforms. There's a lot that gets stopped that you don't see, but these tools will be able to iterate to be able to get past a lot of those filters. So we're going to be seeing more in our inboxes, we're going to see more in the chats on the social media sites and posts. This is going to be a big problem for next year. Prediction number 2: AI accelerates vulnerability exploitation. And again, this is about the technical vulnerabilities that exist in services and software and products, even in firmware and hardware. We have a group of professionals out there that are always looking to find those vulnerabilities so that they can exploit them, so they can undermine them. And sometimes it's a total compromise, sometimes it's just a small compromise that can be chained together with other ones that can create a major compromise. But here's the thing, a lot of that work is done by highly specialized, proficient individuals and teams that are really good at this. AI can come in and do 80 or 85% of that work, which means the bar lowers. And so you have a lot more people able to do that kind of work. And the professionals can also use AI to be able to do that work faster and then automate the exploitation, which means writing the actual hacks. Finding a vulnerability is one thing. Writing the code or developing the processes and supporting infrastructure to take advantage Taking advantage of it is something entirely different and it comes with its own challenges. AI also helps with that generation of exploits. So that reduces the amount of time. And then on the last piece, once you have discovered the vulnerability and you've developed those exploits, now you actually have to conduct the attack. And normally that takes people very experienced, very patient, and it takes their focus. They can't attack many, many, many people and go in depth and, and move around in the victim. They're limited. But with AI tools, they can create automated attacks that can do all of that, that can get through the frontline barriers, then move laterally, target information, target systems, do whatever it needs to do and continue to iterate. It can also then automate the stealthiness and the ways that they can build in back doors to come in even if they're evicted and make, like, life difficult for security operations. This is going to be a challenge for everyone, but especially for the organizations who have and manage that software or the service or the product. They typically have monthly or quarterly patching cycles, and they have to have downtime, they have to allocate resources, and these are in many cases are the same resources who are developing the generation of products and code. So they have to go back and, you know, validate that there was a vulnerability in their product they already released and then figure out how to patch it and then send that out. That takes away development cycles for future products. There's always been tension in that system. But now with attackers going to be able to rapidly detect and rapidly exploit, those groups are going to have to move faster in validating what vulnerabilities there are, developing, testing the patches, and then getting them out there, potentially disrupting their customers or business partners in doing so at a completely different cadence. And that's going to take away from engineering cycles for the next generation products and other commitments. It's going to be a nightmare for them. Security operations are also going to have a challenge because again, Once those vulnerabilities are exploited, the time to get in and start moving around, it's very quick. These tools are going to get better and better. That window shrinks, and therefore the security operation has to move from rapidly detecting and validating it, doing the investigation, figuring out what's going on, trying to interdict that, trying to block, trying to evict very, very quickly. And again, if you're doing that manually against an AI adversary or an AI enabled adversary, you're probably going to lose big. So this will be a major challenge. Prediction number 3: AI adoption expands the attack surface. So every time an organization implements a new tool, connects sensitive data to a new service, provides new capabilities to its employees or environment, You're expanding the attack surface and cybersecurity needs to understand what that means. What's at risk? Will the current security tools and processes and training and behaviors compensate for that to an acceptable level, or will they not? And then if they won't, they need to figure out a plan and they may have to go ask through justification. So they have to articulate justification as why they need more resources or they need more friction in the environment to be able to manage those new risks. Well, AI is one of the fastest growing technologies in all of mankind. So we have got already a vast increase in the attack surface that we don't even yet comprehend. In 2026, the attackers will comprehend that. And they're going to find vulnerabilities using the previous tools and capabilities we've talked about, and then they're going to exploit them and attack them. Now, in the same sense of people bringing in AI and using it, there's another aspect here. You have traditional or longstanding mature products and services that are out there, SaaS services especially, And in their mind, they want the next generation of AI tools out there, like agentic tools, to be able to interface with their products. So they're rapidly moving down a path to enable their products to be able to be directly accessed by agentic AI systems to increase the value. And this keeps them competitive. Because their competitors are going to do that. So we see APIs, which are the traditional way of connecting software to software, we're seeing those implemented, but they don't quite cut it. And so we have a new form, a new generation of APIs, if you will, that are called MCPs, Model Context Protocols, that are the next layer of API that are, that specifically designed for AI integration. This will allow Agentic systems to communicate with your tools and software and services. The problem is the MCP protocol, when it was designed, it was originally designed for functionality. It really didn't have concepts of security or privacy or trust. Or worries about data sensitivity or auditability or tracking, security, safety, none of those things. It was simply designed to allow the functional connection of agentic AIs as a standard to a piece of software. That is a huge vulnerability. We don't even comprehend how big and vulnerable that is or how big it will become. But that's one of the areas, just as an example, that we have to understand and comprehend this growth of the potential surface area that can be attacked. There's a couple other things here. Shadow AI. This is where everybody's adopting things and not registering them, not telling anybody about them, simply using them, and they may be connecting them automatically. And again, probably for, legitimate business reasons, but it still creates a risk. And they're thinking, how do I get the job done better and faster and cheaper? And they're not comprehending the accompanying cybersecurity risk that can compromise the integrity, the privacy or confidentiality, and the availability of the systems that are now connected. Prediction number 4, the threat actors. And I have a whole list of threat agent archetypes. There's 26 right now, and they they continue to grow and shift. But think again, nation states, cyber criminals, data miners, vulnerability researchers. These are 4 of them. Now, nation states and cyber criminals are always at the top of the list from an impact perspective because they have the most money, they have the most motivation, they have the widest reach and potential damage. And cybercrime, for example, is greater than— collectively greater than all the illicit drug trading around the world, drug sales around the world. So there's a lot of money, a lot of power behind those two, right? Nation states can throw billions of dollars in research to identify vulnerabilities and develop exploits. So the number one and number two seed are remaining the same. They're simply being enabled by AI. We're talking about that. But we've got two other classes, two other archetypes that tend to be much further down the list. And because of all the different AI capabilities we've been talking about, they're going to rapidly rise in the rankings. They're not going to displace cybercriminals or nation states, but they're going to move up. And that means their success, as it were, will have profound ramifications to the victimization and the types of impacts we're going to see in 2026. The first one is data miners. With all these AI systems out there that are harvesting data and learning and grabbing and getting access to new databases and sensitive information and new tools, AI-enabled, that's going to be used for training, there will be a vast amount of new data out there and a regurgitation of data and an aggregation of data that will be valuable to data miners. You can take several non-sensitive databases and independently they're not very sensitive. But when you get an AI system that can look in all of them and start aggregating and making connections and deriving insights between them, the result can be a very sensitive database. And that's where data miners are going to make their money. That's where they're going to go after and they're going to have a lot more based on the type of attacks that are out there to be able to harvest. The last area, the vulnerability researchers. Again, we're going to see the vulnerabilities go up significantly because AI is such a powerful tool in being able to identify those rapidly. So the vulnerability researchers, they're going to have a big win here. And we're talking both what we can call ethical vulnerability researchers as well as unethical. And it's important to know the difference. The ethical researchers, when they find a vulnerability, They actually go back to the company of that product and typically they'll work with them and hopefully there's a bug bounty or a vulnerability bounty program. So they'll get rewarded with some monetary or recognition from that company and they don't release it to the wild. The company then validates it, has the time to then develop a patch for it and deploy it. Then they announce it to the world and that vulnerability researcher gets their reward, gets the fame and the credibility of doing a good job. And the world doesn't really experience much of a risk as long as they've patched with the new patch. This is the ethical way and the ethical vulnerability researchers who will also benefit from AI in doing what they do. Now, on the other side of that coin is the unethical researchers. These are sometimes referred to as the black hat researchers. They are the ones who are also identifying vulnerabilities, but instead of ethically reporting it to that product developer, they put it out on the market. Anybody wants to pay for it, I will give it to the highest bidder. These tend to end up on black markets or even gray markets where companies, the company can bid for it. But a lot of times it's the cybercriminals and nation states who have a lot of money, who have a plan, that vulnerability fits nicely in their objectives, they're the ones willing to pay the most. And those unethical vulnerability researchers don't care. They're just looking at the biggest dollar signs, and that's who they're going to give it to, or sell it to, if it, uh, more accurately. Those tend to become what are called zero days. The recipient of those has the vulnerability nobody else knows about. They quickly develop exploits and are able to deploy it out to the world. And it's not until the security teams realize something's going on and start doing the investigation and figuring out, hey, there's a new vulnerability, didn't know that, let's figure out what it's doing. And so they are way behind the curve in trying to contain and protect. This is where you get chained attacks that go down multiple tiers. One company will be attacked and then from there, that's a launchpad to all their customers or partners. It's, it just cascades down and can have a massive impact on everybody everywhere. But these researchers, both ethical and unethical, will continue to rise in the rankings and we're going to see them play in to a lot of different news stories, a lot of different attacks in 2026. Prediction number 5, ransomware. Our good old friend, digital extortion. It's gone by many names. It uses many different tactics over the last two decades, but it's about to reinvent itself again. And here's the reason why it has to reinvent itself. Victims of ransomware are starting to get smart. We've been telling them this for decades. Don't pay, don't pay, don't pay. Because if you pay, you're basically encouraging them to do it again and you're funding them to attack you again or other people. They get more powerful, you get weaker. Ransomware has to reinvent itself again because the victims are now realizing that and more and more are declining to pay the ransom. Even when it costs more to recover from the incident, they're still not giving the satisfaction and the financial reward to the attackers. And this is what motivates them. The attackers are motivated by personal financial gain. So this creates tension and this escalates the situation. So we will see the ransomware attackers try and put more and more pressure on victims to give them the money. That's what they want. Pay the ransom. So we're going to see them shift tactics. We've already seen some threats and we're going to see it more that threats that if you don't pay the ransom, I'm going to take your data and put it out there and let AI tools train off of it. So it will become public to everybody and AI systems. If you don't pay the ransom, attackers may start going down directly to your suppliers, your partners, your downstream groups that you work with to hack them using your access, your credentials, your reputation, your email domains, things of that sort to impact them so that they put pressure on you to pay. We're going to see that ransomware attackers have no shame. And so if they attack you and they're negotiating with you and they know for a fact you're in a regulated field, or that there are regulations that require you to report it to, let's say, the FTC or some other governmental body, they will rat you out and say, hey, if you do not pay us the money, we're going to file a report with these regulatory bodies because now you're past the date that you should have told them you were hacked. Pretty nasty, but not as nasty as either reaching out directly to the victim's customers and communicating with them directly in talking about how bad this company is and how bad it was hacked, but also tampering with transactions. So it's one thing to steal data and to expose it. It's another thing to live within their system undetected. And begin tampering with transactions, causing chaos, customers getting charged for things that they never ordered, records being modified. Let's say healthcare records removing information such as allergy medication or things of that sort, right? What a patient might be allergic to, all these kinds of things. And it's one thing to simply back up or restore your data when you know it's been compromised. But if you don't know how long it's been compromised or what data fields have been modified, it becomes an absolute nightmare to be able to figure all of that out. And if you don't have just outstanding backups that exist from before data was being tampered with, then you're out of luck. And even if you have that, now you have to restore from way back, and then you have to add in all the new legitimate transactions and new data fields. It is an arduous, costly, time-consuming process. And ransomware— those attackers, they know this. They will figure out how to do that and make it more complex and more costly to recover beyond simply going to your backup tapes and restoring So there's many different— and this is just touching on a few— many different tactics that ransomware will begin to morph to compel victims to pay. It's going to be an ugly year. Predictions number 6 and 7, and I've bulked those in here a little bit because it's really around geopolitics. And the fact that these nation states, and whether it's simply their, uh, arms capability, right, offensive, especially AI offensive capabilities, it's a whole new layer. They're number one going to be investing in those. Now, most large countries and even most medium and small companies have been investing in some type of of offensive cyber for many years. But with AI, it's a whole new game. And one, they don't want to be victimized by their competitors who are doing it, so they have to keep up with them. And two, they see the opportunity of these AI-powered offensive tools to be able to do more with less and do greater impacts. Now, prediction number 7 is really around the willingness to use that. Not only in a passive sense, but also when aggression is being determined by these countries. So if it is embargoing a nation, or if it's putting up a blockade, or if it's waging conventional war, AI and offensive AI-powered cyber tools are now accepted. They're weaving, especially the big countries are weaving their current offensive cyber tools into their order of battle. So it's not just the tanks, it's not just a naval blockade. They are attacking the companies, the organizations, the critical infrastructures as part of that. And it's part of the overall plan. It's not an afterthought. It's not maybe we can do something. No, it is part of that order of battle. That they sit down and they plan, okay, what can we do? How do we coordinate this? How do we maximize kinetic and cyber, for example, human intelligence and cyber intelligence, all of these things together. And the primary targets for these nation states tends to be critical infrastructure. So energy, healthcare, shipping, and logistics supply, transportation, communications, governments, including the confidence in governments, including who's going to be in power, managing through disinformation expectations and reputations to get the right people elected in office that may be pro that country versus someone that might be opposed to the countries that that's attacking. This is a whole new capability. And with the investment, this will grow in ways that we simply cannot even map yet. But predictions 6 and 7 is around the investment in offensive and defensive cyber at the nation-state level and their now open willingness to use it as part of foreign policy, right, and warfare. It's a brave new world. Prediction number 8. This is the happy prediction. This is the fact that we're now going to have AI tools to help cybersecurity. They've been in development. We've seen betas. We've seen some features come out that are questionable. They're adding some value. They're going to mature. They're going to start getting better and better, and they're going to start getting value back to those organizations that embrace them. And I guess it's going to be right around Q3 that we're going to see enough of those tools in the hands of enough organizations that it makes a material difference. For those organizations that do embrace that in the right way and implement them effectively, this will help them offset those AI-generated and AI-supported attacks both in quantity and quality. And we're gonna see at this stage in 2026, 3 different areas. First off, in security operations, typically in Tier 1 SOC groups to be able to help analysts see the flood of attacks coming in, identify which ones are real, which ones are not, aggregate the information, then use basic research tools to start getting the information tied to those alerts to be able to validate, Yes, this is something and it's all kind of tied together, this whole group of alerts, and get it elevated to the right person to then disposition it. So from an effective and efficiency perspective, that will help because even right now, the number of alerts and issues that come in are far more than humans can handle. Even with the Boolean rules that they use and the tripwires and the standards and everything else. They are so far underwater that they can, they miss, they miss a lot. With AI on their side, an AI agent, an AI helper, this elevates what they can do, what they can process, what they can see, and how fast they can handle it. The second area is around email and web filtering. And again, this is going to go back to the AI social engineering attacks that are going to come through these avenues. And right now, the filters for email and web filtering, they cannot keep up with the rapid innovation of these AI tools getting by and bypassing those filters. So security will get AI on their side to counter the AI on the attacker's side in this game of tug of war of trying to get to the end user to present bad information and manipulate them. This will be very, very important. Otherwise, we will not be able to hold back the tidal wave of attacks that'll be coming through the web and through email. The last area is for DevSecOps, and this goes back to the vulnerabilities. These are the people that are trying to make sure there aren't vulnerabilities in the products when it's released, and when vulnerabilities are found, they're the everyone's quickly responding to try and figure out, okay, is this a valid one? What does it actually mean? How do we fix this? How do we then patch the world? So using AI, just as the attackers are using AI to find the vulnerabilities and understand it and enumerate it, the defenders can use those same tools and technologies to do exactly the same thing, both in a proactive and a reactive manner. So they have to embrace AI tools to counter the AI tools that those vulnerability researchers are going to employ for their benefit. This is just an escalation back and forth, the tug of war across all these different groups. The attackers are using AI. This is where the defenders are now going to be implementing AI. But there's always a lag. The attackers get to haphazardly use AI to generate new attacks. And they don't care if it doesn't work or doesn't break. They just change it and try again. The defenders can't do that. They can't implement a tool that might break things, might bring the environment offline, might corrupt data. So they have to wait until these tools are fully vetted and trustworthy before they can then embrace them. So there's always that window of opportunity the attackers have.. And I'm guessing it's going to be 3 window or 3 quarters in 2026 that will be the window of opportunity, the primary window where the attackers will basically be able to run amok and do their very worst. But defensive tools are coming in 2026. Now, whether security teams will embrace them or have the funding or can justify the funding for them, them or have the capability to configure them, implement them, and use them properly in a highly efficient way, that's another story. But the tools should be there as an option. I'm thinking Q3 is where we'll see it really come to fruition. Prediction number 9: AI governance. And this is going to be huge because for security, we have to maintain security and trust even as the environment is rapidly adopting disruptive technology. In this case, our businesses and organizations and governments are rapidly adopting AI, not knowing the risks that are coming with it. And we have to adapt in lockstep. We can't tell the world, okay, just stop, stop implementing, stop using AI until I figure this out. We can't do that. We have to work with them. And so one of the first steps is building a governance structure that one can identify when new AI is being used or implemented or configured or enabled and what that really means from a risk perspective. What is it connecting to? What kind of access? What if you aggregate the access that it has to different systems or different data? What does that mean? How does that map? To our current accepted risk mitigations, controls, and posture. There's lots to be done here, but it starts with a good governance structure. Cybersecurity can't just handle or do it one at a time. They have to build a structure that the organization then can follow, and it all then comes together in a very cost-effective and timely way. At the end of the day, we want to embrace AI, but we want to do it with the proper guardrails so that we can manage the risks while still getting the benefits. It's going to come down to AI governance. The last of the predictions, this is around the toughest job in cybersecurity, arguably. This is around the chief information security officer. With AI being adopted and every organization out there seeing the value and rapidly racing to develop and integrate and connect AI, the chief information security officer will ultimately be on the hook if that undermines the security that already exists, if it exposes sensitive data, or if it aggregates data to become sensitive about the organization. All of this is going to fall on the shoulders of the CISO. Some of them right now are saying AI is not my problem, that's the developers, whoever integrates it, and it actually is their problem. They will be held accountable for the unacceptable outcomes if compromises or data breaches occur. So their role expands tremendously, which forces them to have to work with the different business units, and they have to do so in a collaborative way. Additionally, their elevation within organizations are collectively going up. We're seeing CISOs reporting to CIOs, to CEOs, to other C-suite officers, to have time with the board and be held accountable by the board and be held accountable by regulators. So there are many more expectations out there and there is a transformation, a CISO transformation that has been going on since last year. It will continue this year and it's a transformation from a technical risk expert to a cyber business risk expert. And there is a big difference. If somebody is only technically savvy and they can talk about threats and attacks and alerts and, you know, ACLs and controls, that person trying to talk to the C-suite members, to the C-suite members that own revenue-generating businesses, they're not going to be able to communicate well. Right. And they tend to be known as the person who says no. Whenever a revenue generating organization comes up with a great idea, they don't want to talk to security because security is going to say, no, don't do that. That conversation has to change. The CISO has to transform to be able to communicate in business value terms and be able to build relationships with those C-suite, the CEO and the board to be able to articulate how they're adding new and more value, not just doing protection against something that may or may not happen, not just being regulatory compliant. They still need to do those things, but they need to expand their palette of what value they're adding. Maybe it's upsell, maybe it's a competitive advantage, maybe it's helping the Good, Better, Best marketing program, maybe it's being able to provide features at parity with a competitor or over-the-top features that are meaningful to customers. Whatever it is, they have to be able to communicate in business terms. And so those CISOs who will understand the technology in the backend but can communicate with the business professionals, those are the ones who will thrive and succeed. The ones who don't will simply fail. And it's not going to be pretty. This is the year that we're going to see more and more of that happening. We're going to see technical CISOs displaced and CISOs who have business acumen brought in to replace them from the board, from the CEO, and from the C-suite peers. So this is a change that is going to be unpleasant. For many CISOs. Many of them won't make it through the end of 2026. Unfortunately, they will have to adapt. Failure to adapt means they'll be outdated. So key takeaways for managing cyber risk in 2026. We know AI is the big catalyst across the attackers, across the victims, across the security community. For the CISOs themselves from expectations perspectives. We know the attackers are going to use them to increase the quantity and quality of their attacks. We know the defenders will eventually get the tools to be able to counter some of those attacks, both in quantity and quality. And for the CISOs, this is a moment of transformation, and AI will be that topic. If the technical CISO comes in and says, we have to stop embracing AI or we have to slow it down, they will be seen as an inhibitor to business success. Whereas the CISOs say, hey, I've got a plan, we've got a framework, we— let's go fast with AI, but here are the guardrails. This is how we're going to manage the risk. They're going to be seen as that enabler, as a team player, and they're going to be communicating what they're doing in terms of business value, not of something that may or may not happen. So that's what we're going to see in 2026. It is going to be a challenging year for cybersecurity, to say the least. I'm looking forward to the challenges and opportunities in 2026 for cybersecurity. Please be sure to follow and like if if this content was interesting to you. There's a lot more out there, and I'm going to continue to talk about what goes on in 2026, the strategic relevance, what we need to do, and what best practices have to change.