In this AI Risk/Reward Podcast interview, host Alec Crawford talks with cybersecurity expert Matthew Rosenquist about highlights from his ten 2025 cybersecurity predictions. Rosenquist emphasizes three key trends: (1) an AI‑driven arms race where attackers will use generative AI to scale and personalize phishing, vulnerability discovery, and social engineering, forcing defenders to adopt comparable AI tools to keep pace; (2) the need for email and endpoint security vendors to quickly integrate AI capabilities, as traditional filters will be outmatched by AI‑generated attacks, creating a competitive advantage for early adopters; (3) rising stakeholder expectations—from consumers, regulators, auditors, and boards—driving mounting pressure on security teams and budget demands, with a projected 30% increase in spending that may still lag behind rapidly evolving threats. Rosenquist also warns that nation‑state actors, with billions of dollars in offensive R&D, will lead the threat landscape, targeting critical infrastructure and releasing powerful exploits that cascade down to cybercriminals, amplifying risks for all organizations. The conversation paints a picture of a 2025 cybersecurity environment marked by accelerated AI weaponization, heightened regulatory and executive scrutiny, and aggressive state‑sponsored cyber activity.
Chapters
Hi everyone, it's Alec Crawford from the AI Risk/Reward Podcast, and we've got a special edition here with Matthew Rosenquist, who has released his 10 cybersecurity predictions for 2025. Welcome, Matthew.
Thank you. Thank you.
So let's kick it off with number 9, the AI arms race. AI will revolutionize attacks and defenses. With scalable capabilities. So talk to us about that. What should we focus on here?
Well, you know, AI's been coming. In fact, everybody's been using it the past year, but we're now reaching a point where the use cases for AI, both for the attackers and now starting for the defenders, it's really coming into its own maturity, fruition, if you will. So the attackers are thinking, "Okay, how can I use this to scale my attacks? How can I use it to make them more effective, more believable?" especially around social engineering, right? And they're starting to, they've been tinkering to figure out, okay, how can I use it for vulnerability detection, right? Automated and things of that sort. And we're going to see these tools come to the forefront and people are going to, the bad guys are going to start adopting these very quickly. And if you can imagine a generative AI tool, if you're a social engineer and if you're a cyber criminal, right? You love social engineering because it's easy, right? Now you have a tool that allows you to talk in local language anywhere around the world. You have the ability to start to customize those phishing attempts and a system that can learn from its failures, right? It can detect potentially how long somebody waits on an email before they close it or deletes it or clicks on it, right? All that kind of telemetry now that you can start to gather, you can teach your AI system, this is a good path, improve that direction, or this is not a good path, take a different direction, right? And let it iteratively learn and how AI can write compelling text and messages. It's very powerful. So now you can automate this, you can have it improve. And as soon as those tools start to come out, everybody on the dark side is going to be using them. And right now, our current tools, our current capabilities, the current analysis of telemetry can't scale to that level. But that's going to force the defenders to also step up. And so now they're going to use the very same tools the attackers are going to use to help detect those new and innovative attacks and those adaptations as the aggressive AI is maneuvering. The defensive AI should be able to maneuver it near the same speed, but it's going to be a requirement. You simply will not be able to keep up with the innovation for the other side using AI if you're not using it as well. So we're now, we're gonna see the arms race actually come into play in cybersecurity in regards to AI. This is the year it starts, not it ends, it starts. And we will have another decade of this arms race or more when it comes to AI.
Yeah, top of the first inning. And are there, so let's talk about email for a second there and phishing attacks as you mentioned. Is there, are there, what companies do you think are gonna be addressing, addressing this? Any guesses?
Well, it's going to be the traditional email and endpoint kind of tools that'll probably be doing it first, whether they're cloud or server-enabled, it doesn't matter. If you are an email filter, right, or an email security tool, and all of a sudden the enemy has this superweapon, you have two choices. You either adapt and get better, right, to meet the enemy, or you fold up shop and you go to Bermuda and retire, right, on a nice warm beach somewhere offline. The companies are going to want to stay, you know, in business. They're going to want to stay relevant and competitive. So they have a financial incentive to figure out how to do this, how to do this well, and then compete. And whoever does it well early gets a competitive advantage among those defensive security email filters and firewalls and things of that sort. And the same will hold true for the endpoints. Because when somebody does click that malicious link, right, it needs to understand, okay, it's a dropper. It sent me to a bad web page. I've got to notify the web filter or whatever. I need to protect this system. And so you're going to see endpoint systems also incorporate these kinds of technologies to really protect that endpoint.
Yeah, totally makes sense. Number 5, rising stakeholder expectations. As dependence on digital systems grows, consumers, regulators, and boards will demand Stronger cybersecurity measures.
Yeah.
So tell us about that.
This is a wild card. And you think, oh, well, no big deal, right? I mean, every year we have greater expectations. But as we start shaping out 2025, it's not going to be incrementally worse. When we look at some of the attackers, and I know we've got one more we're going to talk about, when we look at the attackers and their tools, we look at, you know, AI being in the mix and that's a force amplifier. And we look at all these different aspects, especially our reliance on technology. We see a much greater impact than we have in the past. And when people get impacted or businesses get impacted or governments get impacted, expectations change, right? We don't like to be victimized. And if it is our critical infrastructure, if it is our personal finances, if it is, you know, our ability to stay online and be on social media because we're addicted to it, whatever it is, if it impacts that, we don't like it. We tend to have a very visceral reaction and therefore the expectation goes up. So when we talk about expectations, is it the consumers? Well, yeah, absolutely. But it's also the politicians they call who say, "Create stronger regulations to protect this." So, it's the regulators. But then, it's also the auditors to make sure you're in line with best practices or certain security standards or regulations. And well, it's also then gotta be the executive management, right? Because if your customers are worried about it and your business partners, their expectations go up, too. They don't like it when you lose their data where you create a vulnerability in their environment, so their expectations go up. And now you bring in the board, right? With all these expectations and the business is on the line, the regulators are breathing down your neck, and you've got auditors here and there and everything else, and CEOs called before Congress. Now the board's involved, so their expectation goes up. The only big victim here— I wouldn't say victim— the— it all comes rolling downhill. To the security teams.
Yeah.
Because everyone's expectation, no matter what it is, is going to go up. And we're already very thin. We're already hard pressed. So this isn't a, you know, one last piece of straw to break the camel's back. This is a hay bale being dropped on that poor camel. And there's just no chance. So it's going to be a very challenging time by the time we get to about Q3 of 2025. The stress is going to go up, the expectations, the tools, the panic in some cases, and especially how leadership is going to communicate. This is what we're doing. This is the limits of that. This is what I need. And I know you're not going to give me everything I need or want. So this is the residual of what's going to happen. This is the residual. It's going to—
I think that sounds like I need a 30% bigger cybersecurity budget today or you're going to have a bigger problem later this year, right?
Yes. Yes. And it never, I mean, the expectations don't all rise at once. It's this burn that can, and so even if you do ask for something today and get it, I need a 30% budget increase. Great. Which means you're able to satisfy the expectations that came in yesterday. But what about the expectations that change in 3 months? Yeah. Does that mean you're now gonna try and go get another 30% bump? Right? It's just not gonna work. People don't like that.
Yeah, I hear you. Yeah.
Challenges.
And number 1 of the top 10 cybersecurity predictions for 2025, nation-state actors lead the charge. They will continue to be the primary catalyst for cybersecurity advancements. Tell us about that.
So this has been kind of a strategic issue and it's been going on for the better part of a decade, but we're coming to this high point now. That we need to understand. So we've got all sorts of different threat agent archetypes out there. We've got cybercriminals and they're pretty powerful. I mean, they make lots of money and we've got data harvesters and all sorts of things. But the biggest of the big are the aggressive nation states. Even top-end cybercriminals, organized cybercriminals, right? They don't invest anywhere near as much as nation states. You may have an organized cybercriminal group willing to pay $20,000, $30,000, maybe even in some cases like $50,000 or $60,000 for a zero-day vulnerability. That's peanuts compared to what nation states are willing to pay. They'll throw in, "Oh, let's start the bidding at $20 million, right? We're gonna start it there and go up." So they've been investing like this in vulnerabilities, in vulnerability discovery technologies, in attack capabilities, infrastructures, in exploitation engine development. They've been investing in personnel, hiring people, educating people, hiring them, creating entire streams to make it sustainable. They're treating it like an intelligence agency or a military. Division. So they were building up capabilities and now they're at the point, right, after investing billions and billions in R&D, and think about that, billions of dollars in cybersecurity offensive R&D, you get something. When you throw that much money, you tend to get a lot for it. Maybe not everything you want, but a lot. So they now have capabilities that they're ready to unleash. And when we look at the political, the geopolitical kind of structures out there, there is a lot less restraint for many of the most aggressive nation-states in regards to who they'll attack, what they'll attack, and even whether attribution is possible. Because typically, right, when you look back on the last decade, Governments did bad things, they did offensive things, but they wanted plausible deniability. They wanted to hide from it. Now, that's, it's a nice option. If you can do that, great. But there are offensive and highly aggressive nation states that it's get the mission done first. And if you can keep it stealthy, great, but get the mission done. That's what we're dealing with. And so we're seeing all sorts of attacks, especially against critical infrastructure. Some of them are passive right now, and we believe they're positioning. Others are much more active, right? They're trying to bring things down. They're trying to undermine confidence. They're trying to shift politics. They're trying to push foreign policy goals. It's becoming the Wild West. So you've got now this very mature capability with many countries out there to be able to do harms and attacks. You've got less restraint from the international community. And I think we're gonna see a whole redefinition starting this year, this year and the next 3 years to kind of get a different feel of what's okay in this cold, warm digital war warfare attacks. What's okay for one country to do to another? Because that isn't clearly defined. People are not accepting the norms that were created a couple of years ago. Nope, they've blown past those. So it's, we just don't know. There's a tremendous amount of ambiguity and a tremendous amount of power and capability in the hands now of these nation states. And that will have an effect on everything in cybersecurity. And I know a lot of people go, well, wait a second. Yeah, I'm a small business owner. I'm just a consumer. These countries aren't going to attack me. No, they're not going to attack you directly. But when they have that $20 million vulnerability that, you know, is a remote, remote exploit for iOS or for Windows, and they unleash that on their target, and maybe it's some critical infrastructure sector, finance or healthcare or government, great. Right? Not you, but they release that. Everybody can see it. And those cybercriminals we were talking about earlier? Oh, they're gonna be one of the people that grab it. The researchers, the— everybody's gonna grab it, tear it apart, dissect it, figure out what cool parts there are, and then integrate it into their attacks. Those phishing attacks that are trying to get your bank account, the ones that you do get in your email, Yeah, those are gonna benefit downstream from all this R&D investment that these nation states have thrown out there. So yeah, it does affect us. And if those nation states are successful in disrupting food supply, right? Or in taking down electricity or undermining telecommunications, that's gonna affect you. You probably want food and healthcare and electricity and little things like that. Again, it can affect us in many different ways, but we're seeing the investment and the lax restraint, right? This vagueness that they can now play in. And we're going to see impacts in 2025 based on that. And that's going to affect everything else. So in my top 10, when we're talking about the 10 things that I predict, that is woven into the narrative across everything. We can't escape that.
Well, thank you, Matthew. This has, uh, been highlights from Matthew Rosenquist's 10 Cybersecurity Predictions for 2025. Thanks for listening.
