Cybersecurity doesn’t stand still for long. Just when teams feel they’ve caught up, attackers tend to change tactics again (usually faster than anyone would like). The good news is that defence is evolving just as quickly.

We’ve pulled together some of our expert predictions on what’s coming next and what organisations should be thinking about now.

AI is now on both sides of the fence

Artificial intelligence is already changing the game. On the attack side, it’s being used to write more convincing phishing emails, scan systems faster, and automate parts of attacks that used to take time and effort.

On the defence side, it’s helping security teams spot unusual behaviour, filter alerts more effectively, and respond to incidents quicker than ever.

In short, AI is now playing for both teams, and it’s getting better at both jobs. Slightly unsettling, but also very useful (depending on which side you’re on).

Identity is the new security perimeter

The old idea of a fixed “network boundary” doesn’t really exist anymore. People work remotely, systems live in the cloud, and everything connects to everything else.

So instead of protecting a perimeter, organisations are now focusing on identity, making sure the right people have access.

Expect to see more:

• Multi-factor authentication becoming standard everywhere
• Passwordless logins becoming more common
• Continuous checks on user behaviour, not just one-off logins

In practical terms, access is now based on “who you are” rather than “where you are”. 

Deepfakes and social engineering are becoming more convincing

Social engineering remains one of the most effective attack methods, and it’s becoming harder to detect. AI-generated voices, video, and highly tailored messaging are raising the bar significantly.

In some cases, attackers can now convincingly impersonate senior staff or trusted contacts in real time.

To reduce risk, organisations will need to focus on:

• Verifying sensitive requests through independent channels
• Strengthening internal approval processes
• Training staff to recognise modern manipulation tactics, not just obvious phishing attempts

One important shift is cultural: it should be normal to double-check unusual requests, even if they appear to come from someone senior.

Supply chain risk continues to grow

Even well-secured organisations can be exposed through third-party suppliers, contractors, or software dependencies. Attackers increasingly target these weaker points rather than going directly at the main organisation.

This is driving greater focus on:

• Vendor risk assessments
• Software transparency and dependency tracking
• Stronger contractual security requirements

Security now extends beyond internal systems, it spans entire business ecosystems.

Regulation is becoming more demanding

Across multiple regions, cybersecurity regulation is tightening. Organisations are increasingly required not only to implement security controls, but also to demonstrate and evidence them.

This is shifting cybersecurity further into board-level responsibility, with greater focus on governance and accountability.

Security now requires visibility and proof, not just controls in place. 

The skills gap remains a key challenge

Demand for cybersecurity professionals continues to outpace supply, particularly in areas such as cloud security, incident response, and threat intelligence.

This is leading to:

• Greater reliance on managed security services and specialist external partners
• Increased outsourcing of specific security functions to trusted providers
• More automation of repetitive tasks
• Greater investment in upskilling existing IT teams

While tools are improving rapidly, skilled people, whether in-house or through trusted external expertise, remain at the centre of effective defence.

Final thoughts

Cybersecurity is increasingly about adaptability rather than static defence. The landscape continues to shift, and organisations need to be able to respond as quickly as threats evolve.

Those that perform best treat security as an ongoing discipline rather than a one-off project, something embedded into how they operate day to day.

And at the core of it all is a simple habit: if something feels unusual, it’s worth a second look, even if it appears to come from someone you trust.