In this monologue, cybersecurity strategist Matthew Rosenquist examines how recent conventional military setbacks experienced by Russia and Iran—illustrated by the Russian "spiderweb" attack that crippled its long‑range bomber fleet and Israel’s successful neutralisation of Iran’s air‑defence systems—demonstrate that smaller, well‑organised nations can inflict disproportionate damage on larger adversaries. He argues that these defeats expose the limits of kinetic warfare and push nation‑states toward affordable, globally‑reachable offensive cyber capabilities. Rosenquist predicts that, by 2026, aggressive states will markedly increase the scale, creativity, and aggressiveness of their cyber campaigns to fill the gaps left by faltering conventional forces, targeting economic assets, public sentiment, and critical infrastructure to achieve strategic objectives. He concludes with a warning to cybersecurity professionals that cyber risk will rise sharply, urging them to stay vigilant and prepared.
Chapters
As part of my work as a cybersecurity strategist, I conduct research and analysis on current events, specifically international conflicts that could boil over to the digital world, jeopardizing critical infrastructures and putting at risk other cybersecurity domains. The Ukraine war and Russian aggression have been at the top of my list for several years, but the recent and unprecedented attacks between Israel and Iran I now split my time covering both major conflicts. One of the conclusions I have come to is that smaller and more organized nations can punch way above their weight against a much larger opponent, significantly degrading the effectiveness of their traditional military investments. We've seen this in Russia with the spiderweb attack that destroyed a good chunk of the vaunted Russian long-range bomber fleet. We also saw this with Israel rendering Iran's air defense ineffective and freely destroying targets with impunity for several days now. It got me thinking. Military and defense experts in these countries must find ways to adapt to effectively strike back. Russia's overhyped war machine has ground to a near halt proving they cannot advance far or fast with conventional weapons and suffer insane losses for a few kilometers. Their forces are a shadow of what they once were and no longer command anywhere near the level of respect from foreign nations. Replenishment will take years. It may bankrupt their country and still may not achieve their foreign policy objectives. Iran, if the regime survives, will find itself in a similar situation. They need the ability to strike fear, undermine the economics, sway public sentiment in their favor, and disrupt the ability of their adversaries, including the allies supporting them. They need to be able to affordably reach anywhere in the globe and cause disruption. In a safe and sustainable way. Unfortunately, cyber fits that bill. So here's my prediction, likely also to appear in my upcoming 2026 cybersecurity predictions, that aggressive nation-states will double down on offensive cyber capabilities. And be sure to check out what I had predicted for 2025, as that's pretty interesting as well. Overall, these nations will become more aggressive and creative in their cyberattacks, with a wide range of objectives and related targets. And this is to support forum policy objectives. In fact, they will rely on cyberattacks to fill the gaps that traditional kinetic systems are currently struggling with. As bad as we currently see cyberattacks, it's about to get measurably much worse. So my fellow cybersecurity professionals, keep the coffee warm and flowing as cyber risks are about to ramp up like never before. It is true what they say. The only easy day in cybersecurity was yesterday.
