by Gary S. Miliefsky, CISSP, fmDHS
As the publisher of Cyber Defense Magazine, I have a great honor and pleasure to meet with many of the market leaders and innovators in the space. Here’s what I discovered this year:
Geopolitical Tensions Spur Living Off the Land Attacks
In 2025, we can expect a rise in ‘living off the land’ attacks, where attackers exploit legitimate tools and processes within an organization’s network to avoid detection. As geopolitical tensions rise, cybercriminals from nations like Russia, China and Iran may increase their use of this technique, spreading across networks, establishing multiple backdoors and ensuring they can re-enter if initial access points are cut off. As these attacks grow more sophisticated, organizations will need to refine their ability to distinguish between normal operations and subtle deviations, focusing on baseline behavior and anomaly detection. Law enforcement and cybersecurity agencies, including CISA, the FBI and the NSA, will need to bolster their efforts to counter these evolving threats, ensuring they can anticipate and mitigate such stealthy incursions. –Kevin Kirkwood, CISO at Exabeam
Widespread Adoption of Zero-Trust Architecture
The shift to a zero-trust model will accelerate, driven by the need to protect increasingly complex, distributed networks. Organizations will adopt zero-trust as the default security posture, ensuring that no device, user, or system is inherently trusted, especially in cloud and hybrid environments.
Deepfakes Will Unleash a Devastating New Wave of Social Engineering Attacks
No longer just a theoretical risk, video-based deepfakes will become highly realistic and imperceptible from reality. This technology will be weaponized in social engineering attacks, allowing criminals to impersonate executives, forge high-stakes transactions, and extract massive payouts from unsuspecting victims. With AI making deepfakes accessible at the push of a button, the potential for financial fraud will explode, forcing organizations to rethink how they verify identity in an increasingly deceptive world. – Steve Povolny, Senior Director, Security Research & Competitive Intelligence at Exabeam
AI and Machine Learning as Core Components of Cyber Defense
Artificial Intelligence (AI) and machine learning will become integral to cybersecurity, automating threat detection, response, and even prediction. These technologies will enhance SOC (Security Operations Center) capabilities by quickly analyzing vast amounts of data, identifying patterns, and reacting to threats faster than human capabilities.
“The artificial intelligence market is expected to surpass 826 billion U.S. dollars in 2030. While immensely transformative for enterprise tech developments, AI and other over-the-top solutions present an opportunity for government agencies to reinforce the resiliency of their emergency communications systems and other critical infrastructure. Across the public safety sector, implementing resilient, compliant tech infrastructure is a must for agencies looking to bolster their cybersecurity efforts against external threats. There’s probably a misconception in the market that on-premises solutions are somehow more secure than cloud-based solutions. They are not. Cloud-based solutions — including the latest AI tech — do what the next-generation 911 movement has been trying and not always succeeding to do for a couple of decades, which is to improve the resiliency, redundancy, geodiversity and efficiency of emergency communications systems. Investing in these technologies should be at the forefront of local and federal law enforcement agendas.” – Tim Perry, Head of Strategy at Prepared
“The growth of automation and AI in cybersecurity will augment the professional shortage and speed up responses, but it’s a double-edged sword. Cybercriminals will also use these tools to craft more complex threats.”
– Chris Spargen, Associate Director, Solutions Engineering, Fortra
Public Safety Agencies Under Attack
“As we look ahead to 2025 and beyond, public safety agencies will increasingly use modern technologies, such as cloud-native software, to enhance mobility and resilience. It’s crucial that public safety agencies continuously evaluate their cybersecurity posture, especially as malicious actors become more skilled and sophisticated at digital attacks. Where should law enforcement agencies begin? To effectively manage organizational risk tolerance, start by identifying the most valuable assets through an inventory of “crown jewels.” Then, build a risk strategy by asking key questions and prioritizing investment in secure, resilient technology, as it will save time and cost in the long run. In addition, public safety agencies should adopt a recognized framework like the NIST Cybersecurity Framework (CSF) to provide a structured approach to managing cybersecurity risks. Tactical items to include are vulnerability management, regular backups, monitoring, and audit functions, and incident response tabletop exercises to ensure built-in muscle memory for seamless mitigation in the event of breach.” – Larry Zorio, Chief Information Security Officer at Mark43
Expedited Exploitation Cycles
With AI’s ability to identify weaknesses faster than humanly possible, the time from vulnerability discovery to exploitation will shrink significantly. Attackers will leverage AI to automate the assembly and deployment of exploits, building on more complex attack strategies and rapidly escalating threats. To stay ahead, organizations must adopt predictive AI capabilities within their cybersecurity frameworks. Leveraging tools that utilize AI to simulate attack vectors will enable teams to proactively identify and patch vulnerabilities, staying a step ahead of threat actors. – Steve Wilson, CPO at Exabeam
Convergence of IT and OT Security
As operational technology (OT) becomes more connected to IT systems, cyber threats targeting critical infrastructure will increase. This will push organizations to integrate IT and OT security strategies, protecting systems like industrial control systems (ICS) and SCADA from increasingly sophisticated attacks.
Increased Focus on API Security
With the explosive growth of cloud services and microservices architectures, API security will become a top priority. Attackers will target APIs as weak links in the security chain, leading organizations to adopt specialized tools to secure these crucial connections.
Ransomware Resilience and Recovery Measures
Ransomware attacks will continue to rise in frequency and sophistication, prompting organizations to not only enhance prevention strategies but also focus heavily on resilience and recovery. Backup systems, incident response plans, and multi-layered defenses will become critical to minimizing ransomware impact.
Quantum Computing Threats and Post-Quantum Cryptography
As quantum computing progresses, the potential to break traditional encryption algorithms will become a looming threat. Organizations will start adopting post-quantum cryptography to safeguard sensitive data against future quantum-based attacks, laying the groundwork for long-term data security.
Regulatory Pressure and Data Privacy Enhancements
Global and national governments will introduce stricter data privacy and cybersecurity regulations, compelling organizations to prioritize compliance. Regulations like the GDPR and CCPA will expand, and new frameworks will emerge, focusing on securing sensitive data, mitigating risks, and addressing cybersecurity accountability.
“Service providers will be forced to raise their security and operational standards to meet increased customer expectations and comply with regulations like GDPR, DORA, and CCPA. The evolving digital landscape and rising risks from natural disasters and public crises highlight the need for resilient, cloud-based communication channels and advanced systems to ensure operational continuity.”
– Theo Zafirakos, Cyber Risk and Information Security Expert, Fortra
Cyberattacks on Critical Infrastructure will Reach Crisis Levels, Threatening to Destabilize Entire Nations
Large-scale cyberattacks on critical infrastructure—such as power grids, utilities, and healthcare systems—will reach unprecedented levels. As geopolitical tensions rise and cybercriminals become more emboldened, attackers will increasingly target essential services that can cripple entire nations. These attacks will be designed to maximize disruption and force victims into paying massive ransoms. – Gabrielle Hempel, Customer Solutions Engineer, Exabeam
Supply Chain Security as a Key Focus Area
Supply chain attacks, such as the infamous SolarWinds breach, will lead to increased scrutiny of third-party vendors and supply chain security. Organizations will implement stricter vetting processes, continuously monitor vendor risks, and adopt security frameworks designed to protect against these growing threats.
Software Bill of Materials (SBOMs) Adoption and Evolution in 2025
In 2025, the adoption of SBOMs will expand beyond traditional software, with AI and ML applications driving demand for more advanced BOM frameworks. Concepts like ML-BOMs (as defined by CycloneDX) will need rapid evolution to address the intricacies of modern LLM applications. These models rely on dynamic and often opaque supply chains, where each ML component, data set, and algorithm may introduce unique vulnerabilities. For government and defense organizations, effectively managing this complexity will require an expanded ML-BOM standard that can account for continuous updates, complex dependencies, and provenance tracking across AI and ML systems. Achieving interoperability across ecosystems will remain critical, but automation, coupled with emerging regulatory standards, will play a pivotal role in maintaining compliance and security across increasingly complex AI supply chains. – Steve Wilson, CPO at Exabeam
Rise of Offensive Security and Threat Hunting
The industry will see a significant rise in offensive security measures, with threat hunting and red teaming becoming critical components of cybersecurity programs. Proactively identifying vulnerabilities, simulating attacks, and uncovering weaknesses before malicious actors exploit them will become common practice.
Cloud Security and Multi-Cloud Solutions
As businesses adopt multi-cloud environments, the need for robust cloud security solutions will intensify. Organizations will increasingly look for tools that offer consistent security policies across multiple cloud platforms, ensuring visibility, compliance, and threat protection for cloud-native applications.
“Hyperscalers will turn increasingly toward developing native cybersecurity solutions to drive revenue growth. As cloud services mature, cloud providers will release a myriad of security features promising seamless integration and management within their ecosystems. We’ll likely see hyperscalers making strategic acquisitions of cutting-edge security companies to strengthen their offerings.”
– Nick Franklin, Global AWS Technology Alliance Director, Fortra
2025 Will Bring a Wave of Triple Extortion Attacks Targeting Partners and Subsidiaries
Hackers are getting greedier and more sophisticated. In 2025, companies won’t just face the theft of their data and ransom demands—they’ll see attackers extort their partners, suppliers, and even customers. After locking systems and stealing data, hackers will squeeze not just the victimized company, but the entire ecosystem they work with, demanding ransoms from any organization with a connection. Triple extortion will become the latest method to maximize profits from a single attack, wreaking havoc across entire supply chains. – Gabrielle Hempel, Customer Solutions Engineer, Exabeam
These predictions reflect the key directions cybersecurity is heading towards, addressing both emerging threats and the innovative solutions that will define the future of digital protection.
About The Author
Gary Miliefsky is the Publisher of Cyber Defense Magazine and a renowned cybersecurity expert, entrepreneur, and keynote speaker. As the founder and CEO of Cyber Defense Media Group, he has significantly influenced the cybersecurity landscape. With decades of experience, Gary is a founding member of the U.S. Department of Homeland Security, a National Information Security Group member, and an active adviser to government and private sector organizations. His insights have been featured in Forbes, CNBC, and The Wall Street Journal, as well as on CNN, Fox News, ABC, NBC, and international media outlets, making him a trusted authority on advanced cyber threats and innovative defense strategies. Gary’s dedication to cybersecurity extends to educating the public, operating a scholarship program for young women in cybersecurity, and investing in and developing cutting-edge technologies to protect against evolving cyber risks.
