December 23, 2025 3 Minute Read

As 2025 closes and we look toward 2026, the cybersecurity industry is bracing for radical changes that go beyond just intensifying existing problems.

To help prepare for these new challenges, at least as much as is possible, a few of our experts weigh in on the defining shifts across the security landscape, from the evolution of nation-state tactics and the crisis in core internet infrastructure to the necessary, strategic pivot toward cyber resilience and identity-centric defenses like Zero Trust.

Scott Swanson, Practice Leader, Security Advisory, Stroz Friedberg, A LevelBlue Company

Evolving Ransomware and Nation-State Cyber Operations

Not getting political, but the US is not making a lot of new friends, and our isolationist and nation-snubbing political stance is causing global frustration.

Countries that may have otherwise been an ally or at least help prevent attacks against their “friends” may focus on new bonds. As such, ransomware, extortion, disruptors, or destroyer exploits and targeting will increase.

Traditional powerhouses like Russia and China may conduct stealthy edge-device attacks, intensify cyberwarfare, and blur more lines between hacktivism and espionage as our government causes more reductions in regulations, breaks continuity of knowledge in enforcement and investigative entities, and raises the tone of hostility across the globe, which can increase the threats and vulnerabilities of US cyber posture and corporate preparedness.

Ed Williams, Vice President, Spiderlabs, CPS

Core Internet Technologies Under Scrutiny

The old adage “it’s always DNS” reared its ugly head in 2025. We can assume that cloud migration will continue at pace, which will put extra strain and scrutiny on core Internet technologies like DNS and SMTP. By 2026, the spotlight could shift to BGP and PKI—the hidden systems that route nearly all internet traffic and secure every encrypted connection—where one small mistake could cause an even bigger outage.

Scott Swanson, Practice Leader, Security Advisory, Stroz Friedberg, a LevelBlue Company

Quantum Computing Breaking Traditional Encryption

As commercial quantum computers advance toward breaking asymmetric cryptography, budgets could burst with new or unexpected quantum security spending as companies scramble to adopt quantum-safe encryption and migration plans. Cryptographic agility on the part of CISOs, as well as vendor migration tracking and updates to outdated vulnerability libraries, will be paramount. I see many failures in this space.

Bill Rucker, President of Trustwave Government Solutions

Cyber Advisory: Zero Trust and Identity-Centric Security

Incident Response: From Defense to Resilience

A significant shift is occurring where agencies will prioritize cyber resilience over pure prevention. This strategy focuses on rapid recovery, robust continuity planning, and real-time response capabilities.

Regulatory & Strategic Alignment

Compliance is becoming increasingly complex due to new regulatory mandates concerning AI governance, data provenance, and demands for greater security transparency. The implication for cyber advisory and Security Operations Center-as-a-service (SOCaaS) providers is the necessity to help agencies navigate evolving frameworks, including new AI ethics guidelines, Zero Trust mandates, and complex international data laws.

The best opportunity lies in building compliance-as-a-service modules into existing offerings. These modules should cover audit readiness, AI risk assessments, and policy alignment consulting to ensure clients meet all new strategic and regulatory requirements.

Ziv Mador, VP Security, LevelBlue SpiderLabs

Ransomware Attacks

These attacks will continue and intensify as they have become one of the best money machines for cybercriminals. These gangs will expand the techniques they use for network infiltration, lateral movement, and data exfiltration. We shall see this ecosystem of ransomware groups and their affiliates continue to thrive, with new players occasionally emerging.

With cybercriminals continuing to compromise different organizations for ransomware attacks and other motives, we shall see their efforts continue to target publicly facing devices. That includes servers such as Firewalls, VPNs, Web servers, and cloud instances, as well as IoT devices. Any publicly accessible interface may be used for the initial infiltration. With the help of AI, we may see cybercriminals and nation-state agencies place greater focus on these devices.