Cybersecurity trends for 2025 and beyond: What you need to know

For example, when delivering proactive security engagements, we have sometimes encountered situations where our offensive security tools were detected by defensive technology. Sometimes, those detections were brittle enough that making a small change to the tool allowed it to bypass detection. However, editing and recompiling tools requires skill in software engineering – which not everyone has.

The speed, scale and sophistication of cyber attacks will continue to increase with attacker Mean-Time-to-Compromise (MTTC), and Mean-Time-to-Exfiltrate (MTTE) reduced to a few hours (from days and weeks in past years). AI-based attacks will have a significantly higher cost impact in the next 12 months than we have seen in the past 12 years… combined. Organizations will begin to move towards proactive and adaptive cybersecurity, which can only be made possible through Modular Platformization.

As security Co-pilots evolve from helpful assistants to fully autonomous ‘teammates’, the human job description for every cybersecurity role will need to be re-written. Although this won’t reduce the cyber skills gap in 2025, AI will help cover major tasks that were traditionally impossible without well-trained humans (ie. SOC Analysts, Developers, etc.), thereby significantly reducing the barrier to entry for non-cyber experts into the field.

The growing use of AI in cybersecurity and other business operations requires immense computational power, significantly increasing energy consumption and carbon emissions. As businesses adopt more AI-driven technologies, CIOs and CISOs will face increased pressure to balance technological advancements with corporate sustainability goals. This will compel organizations to optimize AI models for energy efficiency and adopt greener practices to minimize the environmental impact of their digital infrastructure.

In 2024, Chinese researchers successfully broke classic 50-bit RSA encryptions using a quantum annealing computer. Though this is not a case for alarm (RSA uses < 2048 bits), it does further exacerbate a sudden and urgent need for quantum-resistant crypto algorithms. In 2025, the race to deploy those algorithms will take on a greater focus for CISOs, particularly in Financial Services and those protecting Critical National Infrastructure.

With the increase in Cybersecurity related regulations across the EU (NIS2, DORA, AI Act, CRA, etc.), organizations will need to go beyond written, approved and implemented policies. A growing trend towards providing real-time evidence and assurance to regulators will become a norm, where the board demonstrates the outcome of meeting compliance (impact) rather than just the journey (intent).