Hybrid Warfare and Cyber Attacks in Modern Conflict and Global Security
What Organisations Must Know in 2025
Steve Clarke, Head of Penetration Testing at CyberLab, explores the evolving threat landscape shaped by hybrid warfare and cyber attacks, with a focus on the conflict in Ukraine and its global implications.
This blog covers:
- The Conflict in Ukraine and Cyber Warfare
- Information Warfare and Disinformation
- Malware Spillage Beyond Borders
- Russia Targeted by Anonymous
- How to Protect Your Business and Data
- How to Book Your Free Security Consultation
The Conflict in Ukraine and Cyber Warfare
Hybrid warfare – where conventional military tactics are combined with cyber attacks, disinformation, and sabotage – has become a defining feature of modern conflict.
Ukraine remains a frontline example, having faced relentless cyber aggression since 2014, including the infamous 2015 power grid attack and the 2017 NotPetya malware incident.
In 2022, Russia launched a full-scale invasion of Ukraine, preceded by cyber operations such as the deployment of HermeticWiper, designed to erase data and cripple systems. These attacks exploited endpoint and server misconfigurations, often executing with local admin privileges.
In 2025, Ukraine continues to face hybrid threats, including GPS jamming, drone interference, and coordinated disinformation campaigns. Despite this, experts praise Ukraine’s cyber defence strategy, which includes partnerships with big tech firms and international allies.
Information Warfare and Disinformation
Disinformation remains a core tactic in Russia’s hybrid playbook. From fake news to social media manipulation, these campaigns aim to destabilise societies and erode trust in institutions.
While large-scale cyber attacks on Western infrastructure have not materialised as feared, experts warn that Russia’s cyber capabilities are likely being recalibrated for future use.
Ukraine’s experience offers lessons: proactive communication, media literacy, and civil society engagement are key to countering narrative warfare.
Malware Spillage Beyond Borders
Hybrid cyber weapons often lack geographic constraints. Malware like NotPetya and AcidRain have caused global damage, affecting systems far beyond their intended targets.
With limited operational controls, these threats can persist for years, making patch management and system hardening essential.
Russia Targeted by Anonymous
Hacktivist group Anonymous has claimed responsibility for cyber operations against Russian state assets, including website defacements, TV broadcast takeovers, and data exfiltration.
These actions mark a shift from traditional DoS attacks to more targeted and symbolic disruptions.
How to Protect Your Business and Data
The UK’s National Cyber Security Centre (NCSC) continues to update its guidance for organisations of all sizes. Key recommendations include:
- Patch Management: Ensure timely updates across all systems
- Access Control: Use strong authentication and limit privileges
- Monitoring: Implement logging and anomaly detection
- Internet Footprint: Minimise exposure and harden public-facing assets
- Human Factors: Train staff to report phishing and ensure offline backups are recoverable.
CyberLab supports over 28,000 organisations with tailored security solutions, helping businesses assess risk and strengthen their defences.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Mobile Security Threats & How To Protect Yourself from Common Risks
Your 2025 Guide to Mobile Threats and Defences
, Sales Director at CyberLab, outlines the evolving mobile threat landscape and offers actionable advice to help organisations and individuals secure their mobile devices.
Mobile devices are now central to business operations. According to Microsoft, over 80% of daily work is conducted on mobile platforms. These devices operate outside traditional corporate firewalls and are often in the hands of users who may not prioritise security – making them prime targets for cyber criminals.
Why Mobile Security Matters More Than Ever
Employees routinely access emails, documents, customer data, and applications via mobile devices. While this boosts productivity, it also increases exposure to threats such as malware, phishing, and data breaches.
The rise of Bring Your Own Device (BYOD) policies and remote work has further complicated mobile security management.
Top Mobile Security Threats in 2025
1. Outdated Operating Systems and Security Patches
Devices typically stop receiving updates within 3–4 years of release. Unpatched vulnerabilities are a leading cause of mobile breaches. Microsoft’s Secure Future Initiative urges organisations to retire outdated systems before they become liabilities.
2. Unsecured Third-Party Apps
Apps downloaded outside official stores (e.g. sideloaded APKs on Android) can introduce malware. These apps may access sensitive data, including passwords and banking details, without user awareness.
3. Weak Passcodes
Simple passcodes like “1234” or birthdates are easily guessed. Best practice now recommends 8-digit passcodes with no repeating patterns. Biometric authentication and phishing-resistant MFA are also strongly advised.
4. Unsecured Wi-Fi Networks
Public Wi-Fi remains a major risk. Attackers can intercept unencrypted traffic or hijack sessions. Microsoft recommends avoiding public networks unless using a trusted VPN.
5. BYOD Risks
Personal devices used for work can introduce threats if not properly managed. Risks include data theft, unauthorised app downloads, and lack of visibility into device security posture.
6. Lack of Endpoint Protection
Endpoint protection is no longer optional. Sophos and Microsoft now offer AI-powered threat detection and response for mobile endpoints, including behavioural analysis and automated containment. [microsoft.com]
7. Device Loss or Theft
EE reports that 10 million work devices are lost annually. Mobile Device Management (MDM) solutions allow remote wiping, location tracking, and access revocation to mitigate this risk.
8. Human Error
Employees remain a top vulnerability. Regular training and phishing simulations are essential. CyberLab’s layered security approach includes education, monitoring, and proactive threat hunting.
Mobile Device Management (MDM): Your First Line of Defence
An MDM solution helps organisations:
- Remotely wipe or lock lost devices
- Enforce strong passcode policies
- Ensure OS updates are applied
- Restrict access to risky apps
- Manage BYOD securely
MDM is cost-effective, easy to deploy, and scalable. CyberLab offers tailored MDM solutions—from entry-level setups to enterprise-grade deployments—based on your business needs.
Tales from the CyberLab: Cyber Security for Websites & Applications Explained
CyberLab Can Help
Speak with a CyberLab expert to review your mobile security posture and explore solutions tailored to your organisation. Book your free 30-minute consultation today.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
The Human Hack: Defending Against Common Social Engineering Techniques
Hackers are Exploiting People, Not Just Systems.
The foundational pillars of any organisation’s performance and resilience are people, processes, and technology. These elements are emphasised in the ISO 27001 framework, which underscores the importance of a holistic approach to information security management.
Despite robust technological defences and well-defined processes, it is often the human element that remains the most vulnerable. Social engineering usually involves manipulating or deceiving individuals into divulging credentials or granting some form of unauthorised access to malicious actors.
This article explores the pervasive threat of social engineering, exploring its techniques, real-world impacts, and strategies to fortify your defences against these sophisticated attacks.
What is Social Engineering?
Social engineering is a manipulation technique that exploits human psychology to gain access to confidential information or systems. Unlike technical hacking, social engineering relies on human interaction and often involves tricking people into breaking normal security procedures with the goal of obtaining sensitive information or unauthorised access.
Social engineering tactics are diverse and continually evolving. Some of the most common techniques include:
- Phishing: Deceptive emails or messages designed to trick recipients into providing sensitive information.
- Baiting: Offering something enticing to lure victims into a trap.
- Pretexting: Creating a fabricated scenario to steal victims’ personal information.
- Tailgating: Gaining physical access to restricted areas by following someone with legitimate access.
- Vishing: Using phone calls to trick victims into divulging information.
How Common is Social Engineering?
Social engineering is alarmingly common in cyber-attacks. According to findings from American-based Software and Cyber Security company Splunk, in 2023, 98% of all reported cyber-attacks involved some form of social-engineering, making it one of, if not the most prevalent methods used by cybercriminals and other threat actors. An average organisation can face over 700 social engineering attacks annually. [source: Splunk]
Phishing remains the most common social engineering technique, with millions of phishing emails sent daily around the globe. In the UK the 2024 Cyber Breaches Survey indicated that 84% of businesses and 83% charities have been targeted by phishing attacks this year already, with some cyber criminals impersonating other organisations in emails or online. [source: UK Government]
Real World Story – CyberLab Red Team
Tailgating into a Client’s Office
During a Red Team engagement, the team conducted thorough reconnaissance to understand staff reactions to access requests and building entry protocols. Exploiting this knowledge, a team member, posing as an employee on a phone call, approached a side entrance used primarily for Cycle to Work traffic. Waiting for an employee to open the door, the team member tailgated inside. When questioned by a security guard, he flashed a fake pass from his pocket. The presence of this card, combined with the confident demeanour was enough to convince the guard to allow the team member access.
Inside, the team member followed an employee into a lift that required keycard access. By closely shadowing the employee and engaging in light conversation, he gained access to the lift and descended to the basement. Here, most lifts required keycard activation, but one lift did not. Testing it, he found it led directly to the main lobby beyond the security barriers. Coordinating with a colleague, they both used this lift to bypass the barriers.
At the main lobby, they noticed another lift with the desired floor selected. Joining an employee in this lift, they engaged in friendly conversation, further establishing their legitimacy. On reaching the floor, they followed the employee to an office door requiring keycard access. Mentioning the company name, they tricked the employee into letting them in. Inside, they found a coffee machine and various unlocked meeting rooms. Booking a meeting room for an hour provided them with a secure space to operate.
This exercise demonstrated how effective social engineering techniques, such as tailgating, confident interaction, and exploiting human trust, can bypass robust security measures and gain unauthorised access to sensitive areas. The client was subsequently informed of the successful infiltration, highlighting vulnerabilities in their security protocols so that they could take remedial action to harden the physical security protocols and policies and also educate their staff to be more vigilant.
Social Engineering Examples
Notably, recently reported threat actor behaviours have highlighted the significant role of social engineering in cyber-attacks. For example, Microsoft have recently reported how a threat actor group known as Storm-1811 are using Microsoft Teams as a vector to target users. The threat actors contact the targeted users via Teams impersonating IT or help desk personnel. This would then lead to the threat actors exploiting Quick Assist, followed by credential theft using EvilProxy, then executing batch scripts, and using SystemBC for persistence and command and control. [source: Microsoft]
In another example, Checkpoint Software Technologies have recently identified 1,200 new domains associated with Amazon, 85% of which were flagged as malicious or suspicious. Some examples of theses discovered domains include:
- amazon-onboarding[.]com: a brand-new domain designed to steal carrier-related credentials
- amazonmxc[.]shop: This domain masquerades as Amazon Mexico and even has a similar layout. However, it reveals user login credentials to cybercriminals when entering them in
- amazonindo[.]com: Like the fake Amazon Mexico domain above, it also reveals user credentials to cybercriminals when entered
Amazon Prime day is very popular event where Amazon give away huge discounts and offers, attracting millions of users globally. This makes it a popular target for cyber criminals and combined with increasingly sophisticated phishing techniques and convincing malicious websites, there is a much higher potential for customers to be scammed. [source: Cyber News]
AI-Driven Social Engineering
Looking to the future, the integration of AI into social engineering is likely to result in even more sophisticated and automated attacks. As we have touched on in previous blog posts, we have already seen how AI and deepfake technology is being used offensively by malicious actors for social engineering purposes, whether to convey misinformation and create social unrest or to assist threat actors in obtaining unauthorised access or sensitive information.
One particular example involved cyber criminals using deepfake AI to extract millions of dollars from a multi-national company based in Hong-Kong. The cyber criminals achieved this by using deepfake generated images and audio of the company’s Chief Financial Officer, and other employees, to stage a conference call where they convinced and instructed another employee to transfer funds equivalent to almost £20 million. [source: Ars Technica]
As AI continues to evolve, we can expect to see the following developments:
- Hyper-Personalisation: AI will enhance the ability to tailor attacks to individual targets, making phishing emails and other forms of communication indistinguishable from legitimate ones.
- Real-Time Adaptation: AI-driven attacks will be able to adapt in real-time based on the target’s responses, increasing the likelihood of success.
- Scalability: AI will enable attackers to conduct large-scale social engineering campaigns with minimal human intervention, increasing the reach and impact of these attacks.
- Deepfakes: AI-generated audio and video deepfakes could be used to impersonate trusted individuals, further enhancing the credibility of social engineering attempts.
- AI-Powered Fraud: According to a report by Onfido, deepfake/AI fraud attempts in the US surged 3000% in 2023 from the previous year. These fraud attempts can range from face-swapping or ‘morphing’ apps to bypass facial recognition and verification, AI generated voice replication to impersonate an intended victim or authority figure, to AI generated fabricated images or video of a damaged vehicle or property as evidence in support of fraudulent insurance claims. [source: TNW]
Protecting Against Social Engineering
To best defend against social engineering attacks, organisations and individuals must adopt a multi-faceted approach that addresses various aspects of cyber and physical security. Here are some key strategies to enhance your defences:
Robust Policies
Establishing and enforcing strict security policies and procedures is crucial. These policies should include:
- Access Controls: Limiting access to sensitive information and systems based on the principle of least privilege.
- Password Management: Enforcing strong password policies and regular password changes.
- Data Classification: Categorising data based on its sensitivity and implementing appropriate handling procedures.
Multi-Factor Authentication (MFA)
Implementing Multi-Factor Authentication (MFA) adds an extra layer of security beyond just passwords. MFA can significantly reduce the risk of account compromise by requiring additional verification methods, such as:
- One-Time Passwords (OTPs): OTPs sent to a user’s mobile device or email.
- Biometric Verification: Using fingerprints, facial recognition, or voice authentication.
- Hardware Tokens: Physical devices that generate a secure code required for login.
Training and Awareness
Regular training programs are essential to educate employees about the latest social engineering tactics and how to recognise them. Training should cover:
- Phishing Simulations: Conducting regular simulated phishing attacks to test and improve employees’ ability to identify and respond to phishing attempts.
- Incident Reporting: Implementing a policy and dedicated channel for reporting incidents, encouraging employees to report suspicious activities promptly can help mitigate the damage caused by a social engineering attack, or even prevent them from being successfully executed.
- Role-Specific Training: Tailoring training to the specific roles and responsibilities of employees. For example, executives and finance staff may be targeted differently than IT personnel.
Regular Security Testing
Conducting regular phishing simulations and security audits helps identify and address vulnerabilities. These tests should include:
- Red Team Exercises: Simulating real-world attack scenarios to test the effectiveness of your organisation’s people, processes and technology at identifying, detecting and responding to various threats.
- Penetration Testing: Identifying and remediating vulnerabilities before they can be exploited by attackers.
- Vulnerability Assessments: Continuously scanning for and addressing potential security gaps in your systems.
Incident Response Planning
Having a well-defined incident response plan ensures that your organisation can quickly and effectively respond to social engineering attacks. Key components include:
- Incident Response Team: Establishing a dedicated team to handle security incidents. Building and maintaining an in-house incident response team can be costly and resource intensive. Outsourcing to a dedicated team of incident response experts on retainer, such as Sophos, is a practical alternative to alleviate some of these cost and resource burdens associated with maintaining IR forensic expertise and capabilities in-house, and provides peace of mind that a competent team of experts is ready to respond to a security incident should one occur.
- Communication Protocols: Outlining how to communicate internally and externally during a security incident. This should involve establishing clear guidelines for informing all relevant internal and external stakeholders, creating a crisis communications plan, and regular drills.
- Post-Incident Reviews: Conducting a thorough analysis of the incident to identify lessons learned so that you can harden your organisation’s cyber security posture and mitigate future attacks.
Additional Recommended Resources:
- NCSC Guidance on Phishing
- Cybersecurity & Infrastructure Security Agency (CISA): Avoiding Social Engineering and Phishing Attacks
By understanding the tactics used in social engineering and implementing these protective measures to counter them, organisations can significantly reduce their risk of falling victim to these deceptive attacks.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Securing Healthcare Organisations with Modern Cyber Defence Strategies
Navigating Cyber Security Challenges
Healthcare organisations often face challenges in safeguarding sensitive patient data and critical infrastructure.
With 67% of healthcare organisations hit by ransomware last year, the threat level is high. In this blog, we explore the complexities of securing healthcare organisations amidst the evolving threat landscape and discuss strategies to mitigate risks effectively.
Understanding the Threat Landscape
Healthcare organisations are prime targets for cyber attacks due to the valuable information they possess, including medical records, financial data, and intellectual property. Threat actors, ranging from cyber criminals to nation-state actors, constantly probe for vulnerabilities to exploit.
Some of the most common threats to healthcare include:
- Phishing Attacks: Cyber criminals use deceptive emails or messages to trick employees into revealing sensitive information or installing malware.
- Ransomware: Malicious software encrypts critical data, rendering it inaccessible until a ransom is paid, disrupting healthcare operations and patient care.
- IoT Vulnerabilities: The abundance of Internet of Things (IoT) devices in healthcare introduces new attack vectors, posing risks to patient safety and data integrity.
Cyber Diagnosis: Navigating Cyber Security Challenges in Healthcare
In this exclusive webinar hosted by CyberLab, in collaboration with industry-leading partners Sophos, Logpoint, Forescout, and SecurEnvoy, we explore how to safeguard healthcare organisations against cyber threats.
“We have Microsoft E5 licences, are the included protections enough?”
Many healthcare organisations leverage Microsoft E5 licenses for cyber security capabilities. While these subscriptions offer robust security controls, they may not address all security requirements.
- Comprehensive Coverage: Assess whether E5 subscriptions adequately cover endpoints, servers, and other critical assets, including unmanaged IoT devices.
- Third-Party Integration: Evaluate the interoperability of Microsoft tools with third-party solutions to ensure comprehensive threat detection and response capabilities. For example, Sophos offer MDR for Microsoft Defender.
- Continuous Improvement: Cyber security is an ongoing process and organisations need to invest in regular assessments, updates, and training to stay ahead of emerging threats.
Balancing Budget Constraints and Cyber Security
Securing healthcare organisations requires striking a balance between budget constraints and cyber security needs. Key strategies include:
- Risk-Based Approach: Prioritise investments based on the organisation’s risk profile, focusing on critical assets and vulnerabilities.
- Baseline Security Practices: Implement foundational security measures, such as patch management, access controls, and employee training, to establish a strong security posture.
- Vendor Collaboration: Partner with trusted vendors and technology providers to leverage expertise, identify gaps, and implement cost-effective security solutions tailored to the organisation’s needs.
Next Steps
Securing healthcare organisations is a multifaceted challenge that demands a proactive and strategic approach. By understanding the evolving threat landscape, evaluating security controls, and balancing budget constraints with cyber security priorities, healthcare institutions can mitigate risks effectively and safeguard patient data, ensuring continuity of care.
CyberLab look after over 150 public and private healthcare providers, working together to develop solutions that secure their sensitive data, meet compliance requirements, and ensure online threats don’t compromise their operation.
Our range of security services and solutions have been developed to meet the requirements of the NHS Data Security and Protection Toolkit (DPST) and future-proofs against the NCSC’s Cyber Assessment Framework (CAF).
Want to know more about how to secure your healthcare organisation? CyberLab will be at the Healthcare Excellence Through Technology (HETT) Conference in London, so come and talk to us!
Find out more about our healthcare solutions or book a consultation to speak to one of our experts.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
How to Prevent Cyber Attacks with Effective Logging and Monitoring
Detecting and Preventing Cyber Incidents
- Why Do We Need Logging and Monitoring?
- How Do We Do Logging and Monitoring?
- Identifying the Right Solution
- Our Recommendations
Why Do We Need Logging & Monitoring?
The dark web has been hugely commoditised and it is now very likely that multiple cyber criminals will gain awareness that you are vulnerable. This happens when one attacker, called an access broker, gains access to your environment and then sells that access to multiple other attackers. Their goal? Making money, causing chaos, stealing secrets, and holding your data hostage.
The risk and cost for organisations that are victim to cyber attacks are also increasing. The result of cyber attacks are often downtime, disruption and data loss. There are also other consequences many organisations face such damage to reputation, hefty fines for compromised data, losing trust from valued customers, and even the loss of hard-earned certifications.
While it might seem like a digital doomsday out there, here’s the secret: cyber attacks leave footprints. The art of prevention lies in spotting these traces before the attack compromises your systems and data. It’s like catching a thief in the act before they can make off with the loot. If you can detect unauthorised activity before damage is done, you can stop or prevent the attack being successful and limit the damage. That’s where logging and monitoring solutions come in.
They have a secondary function as well, anyone who has suffered a cyber attack will tell you that despite having the initial detection of something untoward going on, it can be really difficult to actually feel confidence that you can see the whole picture and you are aware of everything that’s going on – logging and monitoring helps with that as well.
How Do You Do Logging & Monitoring?
In even relatively small IT environments, the scale of log information that will be generated is overwhelming. Especially if it’s scattered across multiple environments like public/private cloud/SaaS etc.
The first challenge? Gathering all these pieces into a single, meaningful picture. Endpoint Detection & Response and eXtended Detection and Response (EDR/XDR) and Security Information and Event Management (SIEM) solutions provide this central location to collate and view the log information from multiple sources.
So, you’ve got all your puzzle pieces in one place, but they’re still just random bits until you put them together. That’s where the real magic happens: processing. EDR/XDR and SIEM solutions typically sift through the sea of data to block out the ‘noise’.
Solutions such as LogPoint leverage some form of AI or ML intelligence to give an indication of how likely a particular event is going to be related to malicious activity. LogPoint’s version is called UEBA, which stands for User Entity Behaviour Analytics. UEBA uses AI and ML to correlate multiple events and link related ones together to give a fuller picture than looking at individual events in isolation.
EDR/XDR solutions usually do something similar but typically the events they are correlating are limited to information coming from endpoint security or proprietary network devices. LogPoint and other SIEM tend to have a much broader scope of interoperability and call pull event information from pretty much anywhere that it’s being generated.
How Do I Know Which Solution Is Right?
It can be difficult to know which solution is right for your organisation, and its often a case of selecting which fulfils your need the best. If you don’t need to monitor extensive hardware devices, web sites, databases, etc, then an EDR/XDR solution might be for you. If you have multiple databases or databases that hold sensitive information, it’s probably a good idea to be watching them closely via a SIEM solution as they will be a prime target for an attacker.
With both types of solution the information still needs to be monitored by a human. LogPoint mitigate this through the use of their Security Orchestration and Response (SOAR) technology that aims to take automated action based on certain triggers when particular activity is detected. EDR/XDR solutions often have similar functionality but it’s probably fair to say they are not quite as extensive or complex as a SIEM solutions.
These automated response solutions are great, but they can also be incredibly disruptive if allowed free reign over systems. Very quickly users will be complaining they cannot carry out their duties because things are being blocked. This brings me to the final challenge with logging and monitoring, it invariably means a security specialist with “eyes-on-glass” (i.e., watching the screen) is necessary to manage both types of solutions effectively.
Again, the approach to take to manage this final challenge depends on any number of factors – the size of business, the driving forces behind the adoption of logging and monitoring, the desire for Opex over Capex, or the constant problem of getting skilled Cyber security staff, to name just a few.
What Would CyberLab Recommend?
If an organisation lacks in-house expertise but recognises the value and importance of logging and monitoring, it is increasingly common to adopt a managed service approach.
This involves partnering with third-party suppliers who have dedicated security specialist teams to handle the heavy lifting. One of the key benefits of this approach is peace of mind – knowing that systems are being actively protected around the clock.
To support this, the Posture Assessment tool offers a quick and easy way to identify strengths and weaknesses, providing a clearer picture of overall security posture.
A dedicated page of recommendations for improving logging and monitoring is available, including guidance on which tools can help.
For organisations looking to strengthen their security and protect their data, a consultation with one of our experts is available to explore tailored solutions.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
The Top Five Cyber Threats of 2024 and How to Strengthen Resilience
Mid-Year Analysis on Cyber Security Trends for 2024
As we progress through 2024, the cyber threat landscape continues to evolve rapidly, presenting new challenges for organisations and individuals alike. In this edition, we shift our focus from past incidents to the present and future threats that pose the greatest risks.
Understanding these threats is crucial for developing effective strategies to safeguard against them. Cybercrime is expected to become the world’s third largest economy by 2025, estimated to cost $10.5 trillion in damages globally, according to cybercrime magazine.
This month, we highlight the top five most dangerous cyber threats of 2024, exploring their nature, potential impacts, and the steps you can take to protect yourself and your organisation. Join us as we explore these pressing cyber threats and provide insights into enhancing your cyber resilience.
Offensive AI as a Threat Multiplier
At the RSA Conference 2024, cyber security experts identified offensive AI as a significant threat multiplier, presenting it as one of the top five cyber threats for the year. Stephen Sims highlighted how malicious actors leverage AI and automation to rapidly identify vulnerabilities, automate the generation of exploits, and launch sophisticated attack campaigns.
This offensive AI capability accelerates the discovery and exploitation of vulnerabilities, posing a formidable challenge for defenders. Sims emphasised the urgent need for defensive strategies capable of countering the speed, automation, and intelligence wielded by attackers, underscoring the importance of innovative defensive measures to mitigate this evolving threat landscape in 2024.
AI-Driven Social Engineering Threats
Social engineering has long been a prominent cyber threat, relying on psychological manipulation to deceive victims. Attackers exploit human traits such as trust, fear, and curiosity to gain access to critical systems or sensitive information. Traditional social engineering methods include phishing, baiting, pretexting, and tailgating.
The increasing digital transformation and real-time information sharing have made individuals more susceptible to these attacks. In 2022 alone, there were 493 million ransomware attacks, and 19% of all data breaches were due to stolen or compromised login credentials.
AI has significantly amplified social engineering tactics, enabling attackers to develop more complex and convincing attacks tailored to targeted individuals. AI-driven social engineering can include:
- Hyper-personalised phishing
- AI-generated natural language content
- Emotional manipulation
- Detection evasion
- Automated reconnaissance
These advancements allow attackers to craft tailored, context-aware campaigns quickly and efficiently, making traditional defences less effective. Businesses must now contend with AI-generated deepfakes, persuasive phishing emails, and sophisticated data manipulation, requiring a proactive and adaptive approach to cybersecurity.
Implementing multi-factor authentication, employee training, phishing simulations, and AI-based defence mechanisms are essential to counter these advanced threats.
Ransomware Remains a Prevalent Threat in 2024
Despite significant global law enforcement efforts, ransomware activity has continued to surge in 2024. According to the Sophos 2024 Ransomware Report, global ransomware attacks in 2023 set a record high, surpassing the previous year by nearly 70%. In the first quarter of 2024 alone, 1,075 ransomware victims were posted on leak sites. Major ransomware groups like LockBit and ALPHV/BlackCat were responsible for 30% of the activity.
The report also highlights the financial impact of these attacks, with average ransom payments increasing by 500% in the last year. A staggering 63% of ransom demands were for $1 million or more, and 30% exceeded $5 million, indicating that ransomware operators are targeting larger payoffs.
Overall, these reports indicate that ransomware isn’t slowing down in 2024 and remains one of the largest threats to organisations. Few organisations have the right tools, people, and processes in-house to manage their security program around-the-clock while proactively defending against new and emerging threats.
Supply Chain Risk: A Growing Concern
Supply chain risk continues to be a significant threat in 2024, as we’ve already seen from major incidents this year involving MoD and MITRE, which we covered in our blog outlining the top five cyber incidents of 2024 so far. Despite increased awareness, many businesses still struggle with effectively managing these risks. According to the UK Government’s Cyber Security Breaches Survey 2024, 31% of businesses and 26% of charities conducted cyber security risk assessments in the past year. Larger organisations are more proactive, with 63% of medium businesses and 72% of large businesses conducting these assessments.
However, only 11% of businesses review the cyber risks posed by their immediate suppliers, a figure that rises to 28% for medium businesses and 48% for large businesses. This limited oversight is concerning given the complex and interconnected nature of modern supply chains. The qualitative data indicates that while awareness of supply chain cybersecurity risks is growing, smaller organisations often lack the formal procedures necessary to manage these risks effectively.
Cloud Vulnerabilities: The Invisible Threat
As organisations continue to migrate their operations to the cloud, vulnerabilities within cloud environments have become a critical concern in 2024. The flexibility and scalability of cloud services come with a unique set of security challenges that can be exploited by well-versed threat actors.
A significant factor contributing to cloud vulnerabilities is misconfiguration. According to reports as far back as 2019, misconfigured cloud settings were responsible for nearly 70% of all cloud security incidents, and according to IBM’s Cost of a Data Breach Report, 45% of reported breaches were cloud-based. These misconfigurations can lead to unauthorised access, data leaks, and compliance issues. Additionally, the shared responsibility model of cloud security often leads to confusion about where the provider’s security obligations end and the client’s responsibilities begin, leaving gaps that can be exploited. The NCSC has published free guidance on cloud security and shared responsibility models.
The rise in cloud-based attacks has also been driven by increasingly sophisticated threat actors targeting cloud infrastructure. For instance, the recent breaches involving high-profile cloud services such as the recent Microsoft Azure incident have shown that attackers are leveraging advanced techniques and exploiting zero-day vulnerabilities to bypass security controls, escalate privileges, and access sensitive data. These incidents highlight the importance of robust security practices, including regular audits, comprehensive monitoring, and strict access controls.
To mitigate cloud vulnerabilities, organisations should focus on improving their cloud security posture through continuous monitoring to identify any vulnerabilities or misconfigurations exposing their cloud infrastructure’s attack surface, employee training and implementing robust policies for access, user groups and data handling, and of course, adherence to best practices for cloud configuration and management. The Center for Internet Security (CIS) has published the CIS Benchmarks, a series of prescriptive recommendations for configuring over 25 cloud and network vendor product families including AWS, Azure and Google Cloud Platform (GCP).
By addressing these vulnerabilities proactively and implementing industry best practices and benchmarks, businesses can better protect their data and maintain trust with their customers.
What Can We Learn From These Trends?
The top five cyber threats of 2024 so far serve as a stark reminder of the evolving threat landscape. By understanding the risk and implementing a layered and strategic approach to cyber security, organisations can better protect their people, data, and customers.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
The Top Cyber Threats in Fintech and How to Reduce Cyber Risk
Securing the Future of Financial Technology: Navigating Cyber Security Challenges in a Rapidly Evolving Landscape
The finance sector is one of the biggest targets of cyber threat actors with 65% of organisations hit by ransomware in 2024, according to recent research by Sophos. As the financial technology (Fintech) sector continues to revolutionise the way we handle money, the stakes for cyber security have never been higher.
The integration of innovative digital solutions, from AI-driven financial services to blockchain technology, has opened up new opportunities for growth, but it has also expanded the threat landscape.
This blog explores the current cyber security challenges facing the financial technology industry, the impact of these threats, and the best practices that companies can adopt to safeguard their operations and customer trust.
The Rising Threats in Fintech: A Snapshot of Today’s Cyber Security Landscape
The Fintech industry, characterised by its rapid adoption of cutting-edge technologies, is a prime target for cybercriminals. According to recent reports, the financial services sector experiences cyber-attacks 300 times more frequently than other industries, with Fintech companies being particularly vulnerable due to their digital-first nature. The rise of AI and machine learning in Fintech has further complicated the threat landscape, as these technologies can be both a tool for defence and an instrument for sophisticated attacks.
Key Threats Facing Fintech Today
- Data Breaches: With vast amounts of sensitive financial data at stake, data breaches remain one of the most significant risks for Fintech and financial services firms. Recent breaches, such as the SolarWinds attack, have highlighted the vulnerabilities in supply chains and third-party providers, making it clear that no organisation is immune.
- AI-Driven Cyber Attacks: The same AI technologies that enable personalised financial services are also being used by cybercriminals to automate attacks, enhance phishing campaigns, and exploit vulnerabilities faster than traditional methods. For instance, AI can create highly convincing deepfake videos and emails, making it easier to deceive even the most vigilant employees.
One of the most alarming examples occurred in earlier this year, when cybercriminals targeted a Hong Kong-based financial services firm in a first-of-its-kind heist. Using advanced deepfake technology, the attackers impersonated the firm’s Chief Financial Officer (CFO) during a video conference call. They convincingly replicated the CFO’s voice and appearance, deceiving an employee into transferring nearly £20 million to a fraudulent account. [source: Ars Technica] - Regulatory Challenges: With evolving regulations such as GDPR and PSD2 in Europe, and new guidelines from the FCA and other financial authorities worldwide, Fintech companies must navigate a complex web of compliance requirements. Failure to comply not only risks legal substantial penalties, but also damages brand reputation.
The Future of Fintech Security
Quantum Computing
The Fintech industry faces a significant challenge with the advent of quantum computing, particularly regarding encryption. As quantum technology advances, traditional cryptographic methods could become obsolete, necessitating a costly overhaul of encryption standards. The transition to quantum-resistant encryption is crucial for maintaining data security but will require significant investment and regulatory adjustments across the global Fintech sector. According to a recent report by Moody’s Ratings “Quantum computing’s threat to asymmetric encryption is currently mitigated by challenges in error correction, scalability, talent shortages and limited computing power…” However, quantum computing could break asymmetric encryption within 5 to 30 years. [source: Fintech Magazine]
The Global Treasurer predicts that quantum computing will revolutionise the Financial Services and Fintech industries, particularly in financial modelling, analysis, payment systems and cyber security. Financial institutions will need to adopt quantum-resistant algorithms, shifting towards more dynamic and adaptive security strategies. This evolution will require collaborative efforts across the global financial sector, including international cooperation, to build resilient global payment systems, enforce standardised regulations, and ensure a secure, efficient future leveraging quantum technology.
Compliance and regulations in quantum computing is not just becoming central to cyber security in Financial Services, but also to ensuring market viability. The Director of Quantum at KPMG, Michael Egan states that “While quantum technologies are rapidly developing, the threat of ‘Harvest now, Decrypt later’ is real and immediate. With increasing legislation, together with long procurement and mitigation cycles, there is a need to act now.” [source: KPMG]
The Role of Compliance and Regulatory Standards in Strengthening Cyber Defences
Compliance with industry standards is not just a legal obligation; it is a critical component of a robust cyber security strategy. Frameworks such as ISO/IEC 27001 and guidelines from regulatory bodies like the FCA in the UK provide a structured approach to managing sensitive data and mitigating risks.
Key Compliance Measures for Fintech
- Data Protection Compliance: Ensuring adherence to FCA, GDPR and other data privacy and financial authority regulations is essential for protecting customer data, and arguably the integrity of Fintech and Financial Services industries. This includes implementing robust data encryption, conducting regular audits, and maintaining clear data governance policies.
- PSD2 and Open Banking: With the advent of open banking, Fintech companies must ensure that their APIs are secure, and that customer consent is properly managed. Compliance with PSD2 not only protects consumer data but also enhances trust in digital financial services.
- Adoption of Cyber Security Frameworks: Leveraging established cyber security frameworks like NIST, ISO/IEC 27001 or the Cyber Essentials scheme in the UK can help Fintech firms standardise their security practices and stay ahead of emerging threats.
Best Practices for Cyber Security in Fintech
To navigate the complex cyber security landscape, Fintech companies must adopt a proactive approach. Here are some best practices that should be integral to any Fintech firm’s cyber security strategy:
- Regular Penetration Testing and Red Teaming: Penetration testing and red teaming exercises are crucial for identifying vulnerabilities before attackers can exploit them. By simulating real-world attacks, these practices allow Fintech companies to evaluate their security posture and improve their defences.
- Managed Detection and Response (MDR): MDR services provide continuous monitoring and analysis of an organisation’s security environment. By outsourcing to experts, Fintech firms can ensure that threats are detected and mitigated in real-time, reducing the risk of a successful attack.
- Incident Response and Recovery: Having a robust incident response plan is essential for mitigating the damage caused by cyber incidents. Fintech companies should invest in both in-house and outsourced incident response teams to ensure a swift and effective reaction to breaches.
- Employee Training and Awareness: Employees are often the first line of defence against cyber threats. Regular training sessions on phishing, social engineering, and secure data handling can significantly reduce the risk of human error leading to a security breach.
- Vulnerability Management: Regularly updating and patching software, coupled with continuous vulnerability assessments, is vital for maintaining a secure infrastructure. Cyber security as a Service (CSaaS) solutions, such as HackRisk, can help Fintech companies manage vulnerabilities effectively without overburdening internal teams.
Building a Resilient Cyber Security Strategy in Fintech
As Fintech continues to reshape the financial services landscape, the importance of cyber security cannot be overstated. By understanding the current threats, complying with regulatory standards, and implementing best practices, Fintech companies can build a resilient security posture that not only protects their operations but also fosters trust with their customers.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Top 5 Cyber Security Predictions for 2025 and How to Prepare Now
Preparing for the Unpredictable: Trends Shaping the Future of Cyber Defence
As the digital landscape evolves, so do the threats and opportunities in cyber security. With 2025 on the horizon, organisations face an increasingly complex web of challenges – from AI-powered attacks to the growing influence of regulation. To stay ahead, it’s crucial to understand where the industry is heading over the next 12 months.
In this blog, we outline our top 5 cyber security predictions for 2025, offering insights into emerging trends and practical strategies to bolster your cyber defences. It’s no surprise that advancements in AI are shaping the future of cyber security, driving both innovation and new challenges in the year ahead.
AI: The Double-Edged Sword of Cyber Attacks
Artificial Intelligence continues to revolutionise the way we approach cyber security, but it’s also empowering attackers with unprecedented capabilities. In 2025, we predict a significant rise in AI-driven cyber threats, from hyper-realistic phishing scams to automated vulnerability exploitation at scale. Deepfake technology, for example, is being used in phone scams and social engineering attacks, mimicking voices and appearances with unsettling accuracy to deceive victims. These attacks will be faster, more sophisticated, and harder to detect, leveraging AI’s ability to mimic human behaviour and analyse defences in real-time.
To counteract this, organisations must embrace AI-enhanced security solutions, invest in workforce training, and prioritise threat intelligence sharing. The battle against AI-powered attacks will demand a proactive and adaptive approach.
Ransomware Reloaded: The AI-Powered Threat
Ransomware attacks are expected to surge in 2025, with AI adding a dangerous new dimension. Attackers are increasingly leveraging AI to identify vulnerabilities more efficiently, automate their attacks, and tailor their tactics for maximum impact. Ransomware attacks can be supported through AI, which can adapt in real time, encrypting files faster or evading detection by mimicking legitimate processes.
The stakes are higher than ever, as these sophisticated attacks target not only businesses but also critical infrastructure and individuals. To combat this, organisations must invest in advanced threat detection systems, conduct regular security audits, and ensure robust incident response plans are in place to minimise downtime and financial loss.
Cyber Insurance 2025: Adapting to the AI-Driven Risk Landscape
Our next prediction for the top 5 cyber security threats of 2025 is that cyber insurance is expected to undergo significant shifts as the landscape of digital threats evolves. The market for cyber insurance is projected to grow to $22.5 billion over the course of 2025*, reflecting the increasing complexity and risks businesses face from cyber attacks.
One of the major factors influencing this change is the rapid growth in AI-driven threats. Insurers will be looking for businesses to demonstrate robust cyber resilience, particularly through proactive risk management practices such as implementing advanced cybersecurity measures and understanding the full scope of potential cyber exposures.
Coverage will likely expand beyond just ransom payments, with an increased focus on protecting against broader costs like business interruption, reputational damage, and legal repercussions.
As the sector matures, businesses will need to balance cost-effective measures with comprehensive protection, and insurers may offer discounts for companies that adopt stronger cyber security protocols, such as multi-factor authentication and endpoint detection.
Tales from the CyberLab: Cyber Insurance Explained with Marsh
Cyber risk has evolved into a dynamic threat for organisations that requires proactive management.
Eric Alter, Senior VP Risk & Cyber Engagement Leader from Marsh joins the podcast to explain the complexities of cyber insurance and how it protects your organisation when cyber incidents occur.
Jailbreaking AI: Exploiting Language Models for Sensitive Data
In 2025, we anticipate a rise in the misuse of AI language models like ChatGPT through a technique known as jailbreaking. By exploiting vulnerabilities in the model’s safeguards, attackers can bypass restrictions and manipulate the AI into generating harmful content or aiding in illicit activities.
For instance, these jailbroken models might be used to craft highly convincing phishing emails, simulate conversations to extract sensitive information, or even provide step-by-step guidance for malicious actions. As AI becomes increasingly integrated into businesses and everyday life, it’s vital to establish clear usage policies, monitor for abuse, and stay updated on advances in AI safety to mitigate these risks.
Securing the Backbone: OT and Physical Security Threats to Critical Infrastructure
As we move into 2025, threats to Operational Technology (OT) and physical security are expected to rise significantly, particularly in sectors that rely heavily on critical national infrastructure (CNI). These infrastructures, such as energy grids, water treatment plants, and transportation systems, often use legacy systems that were not designed with modern cyber security in mind.
This makes them vulnerable to both cyber and physical attacks, especially as they become more interconnected with internet-enabled systems. The convergence of IT and OT increases the risk of cyber criminals or state-sponsored actors gaining access to these systems, potentially disrupting operations or even causing physical damage.
The Director of National Intelligence recently released a report where it found that “Iran-affiliated and pro-Russia cyber actors gained access to and in some cases have manipulated critical US industrial control systems (ICS) in the food and agriculture, healthcare, and water and wastewater sectors in late 2023 and 2024”.
Additionally, the dependence on third-party vendors and suppliers for essential services can introduce further vulnerabilities, creating a lucrative target for attackers. Given these challenges, enhancing the security posture of CNI has become a priority for governments and organisations worldwide, with increased collaboration and regulations to address these threats.
Looking Ahead: Navigating the Future of Cyber Security in 2025
As we look toward 2025, the cyber security landscape is set to become even more dynamic and complex. Emerging threats driven by AI, the convergence of IT and OT systems, and the growing reliance on cloud technologies will continue to challenge organisations across all sectors. Ransomware will evolve, aided by AI, while critical infrastructure faces mounting risks from both cyber and physical attacks.
The increased focus on cyber insurance, evolving regulations, and the growing importance of threat intelligence will shape how businesses approach security. Adapting to these changes requires a proactive mindset, robust security strategies, and a commitment to constant learning and adaptation to stay one step ahead of the ever-evolving cyber threat landscape.
With vigilance and innovation, organisations can better navigate these challenges and secure their futures in 2025 and beyond.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Vibe Hacking: How AI Is Used to Manipulate, Deceive and Exploit Users
The Dark Side of AI: How Cybercriminals Are Exploiting Technology
Organisations everywhere are harnessing remarkable productivity gains with AI, but there’s a flipside we can’t afford to overlook. AI isn’t just fuelling innovation. It is also opening new pathways for cyber threats.
In this blog, we’ll look at how AI is making it easier for people to commit cybercrime and changing the way attacks are carried out. We’ll discuss the problems this creates, such as more targeted and convincing attacks, and suggest practical solutions to help organisations and individuals stay safe.
What is Vibe Hacking?
Vibe hacking refers to the use of AI not just to automate cyber attack tasks, but to strategically shape and amplify the psychological impact of those attacks. Unlike traditional hacking, which often targets technical vulnerabilities, vibe hacking manipulates both digital systems and human perception.
AI enables threat actors to:
- Craft emotionally resonant extortion messages
- Tailor tactics to exploit behavioural vulnerabilities
- Adapt attack strategies in real time
This isn’t just more efficient cyber crime, it’s a new era of AI-orchestrated threat campaigns, where the entire lifecycle of an attack is guided by machine intelligence.
Example: Claude AI Used as Criminal Co-Pilot
The recent Anthropic Full Threat Intel Report reveals how Claude, an AI system, is being weaponised by cyber criminals. The data extortion campaign ran across 17+ organisations in sectors including government, healthcare, and emergency services. This wasn’t just automation, it was AI-driven orchestration.
Claude executed:
- Reconnaissance
- Credential harvesting
- Lateral movement
- Data exfiltration
- Psychological extortion crafting
The attacker embedded their preferred tactics in a CLAUDE.md file, guiding Claude’s behaviour. Ransom demands reached $500,000, with stolen data ranging from medical records to government credentials.
This is a textbook case of “vibe hacking”, where AI doesn’t just assist, it dictates the strategy too. The implications for incident response and threat modelling are profound. The sophistication and scalability afforded by AI means that even relatively unsophisticated adversaries can now launch highly coordinated, multi-stage attacks with unprecedented speed and precision.
AI is transforming the threat landscape, organisations need to level the playing field
If it’s happening with one AI tool, it’s safe to assume cyber criminals are exploiting AI at every opportunity. From ransomware development to sanctions evasion, AI is enabling threat actors to scale operations, simulate expertise, and bypass traditional barriers.
AI is not just enhancing attacks, it’s enabling them from scratch, and at a much lower skill entry level. This shift is democratising cyber crime, allowing individuals with minimal technical knowledge to execute complex campaigns. The barrier to entry has dropped, but the risk has surged.
Generative AI in Cyber Security Explained
Generative AI is changing the game. Is it helping defenders more than attackers? Dive into the risks, opportunities, and real-world impact of AI on cyber security.
Dave Mareels, Senior Director of Product Management at Sophos, joins the podcast to explore how generative AI is reshaping the cyber threat landscape.
Adapting Your Cyber Defences to Defend Against Vibe Hacking
To stay ahead organisations must evolve their defences beyond traditional perimeter security. This means building resilience not just into systems, but into people, processes, and decision-making. Here’s how to adapt your cyber strategy to meet the challenge:
1. Monitor AI-Assisted Behaviours
AI-assisted attacks often leave subtle behavioural footprints. These may include unusual access patterns, emotionally charged phishing content, or adaptive social engineering tactics. Monitoring for these signals requires more than just technical tooling, it demands human insight and contextual awareness.
Actionable Tip: Train your team to recognise AI-generated deception. Consider threat hunting exercises that simulate AI-driven tactics.
2. Enhance Employee Vetting and Insider Threat Detection
AI lowers the barrier to entry for cyber crime, which means insider threats may emerge from previously low-risk roles. Whether intentional or accidental, internal misuse of AI tools can lead to data leakage, reputational damage, or compliance breaches.
Actionable Tip: Introduce AI usage policies and vet employee access to generative tools. Use behavioural baselining to flag anomalies in internal activity.
3. Invest in AI-Aware Defence Strategies and Tooling
AI is not just a threat, it’s also a powerful ally. Organisations must invest in defence strategies that leverage AI for good: predictive analytics, automated incident response, and intelligent access controls.
Actionable Tip: Evaluate your current tooling for AI-readiness. Are your defences capable of recognising and responding to machine-led threats? If not, it’s time to upgrade.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
Top 5 Cyber Security Predictions for 2026 and How to Prepare Now
Expert Insights from the CyberLab Board
In November 2025, the UK Government released a comprehensive report on the economic cost of cyber crime, which highlights how the average cyber incident costs a UK business £195,000. Scaling this to an annual UK cost, generates an estimate of £14.7 billion, equivalent to 0.5% of the UK’s GDP [Source]. The growing threat landscape and significant cost of cyber crime makes cyber security a pressing issue for all UK businesess.
2026 is set to be a landmark year for cyber security. AI, deepfake technology, quantum risk and supply chain vulnerabilities are converging to reshape the cyber landscape. Cyber criminals are now faster, more scalable and increasingly autonomous, relying less on human expertise and more on intelligent, self-learning tools.
In response, cyber defence must evolve too. It is no longer enough to react. Security needs to be predictive, adaptive and capable of operating at machine speed.
CyberLab’s Board have put together their predictions for 2026, and their insights reveal powerful themes that businesses must prepare for.
1. AI Changing the Threat Landscape: Defence and Attack at Machine Speed
AI is not just changing cyber security. It is redefining it. In 2026, AI will accelerate cyber defence, enabling faster detection, automated response and real-time threat modelling. However, it is also lowering the barrier to entry for cyber criminals, powering attack strategies that are faster, continuous and increasingly self-managing.
David Pollock, Chairman, highlights this duality:
“AI will speed up hackers’ ability to attack businesses and government. AI will also speed up our ability to defend and protect our customers.”
We will see a shift from human-led attacks to AI-led adversaries capable of executing cyber attacks without direct human involvement. These systems will operate at machine speed, identifying vulnerabilities, exploiting zero-day flaws and coordinating simultaneous attacks across multiple networks.
AI-driven attacks will be able to adapt mid-attack, changing strategies in response to defensive actions. They will learn from failed attempts, replicate successful exploits and scale attacks globally in seconds.
Ryan Bradbury, CTO, explains:
“The speed, scale and automation possible with agent-driven attacks will surpass anything we’ve seen before. We have to stop preparing only for human-led threats and start planning for autonomous AI-led adversaries.”
This means cyber defence will need to become dynamic, adaptive and automated. Continuous validation, predictive analytics and machine-speed response will become non-negotiable. AI-led defence will become the standard, not the exception.
2. Deepfakes, Identity Fraud and the Human Factor
While AI transforms the technical threats, humans will remain the most vulnerable target. In 2026, social engineering will become significantly more sophisticated as deepfake technology enables hyper-realistic voice, video and identity spoofing.
Wayne Price, Commercial Director, warns:
“Deepfakes and synthetic media will cause a surge in identity fraud, forcing organisations to ramp up digital identity verification practices.”
Attacks will no longer rely on poorly written phishing emails. Instead, employees may receive video messages from a supposed CEO requesting payment transfers, or voice calls mimicking trusted suppliers.
Gavin Wood, CEO, believes identity protection and human awareness will be critical:
“Human attack vectors will continue to be exploited, especially with AI-driven deepfakes, voice spoofing, phishing, and super realistic, authentic-looking videos, et cetera. Securing the human will be absolutely key for cyber security in 2026.”
Identity and access management will become one of the most important areas of cyber security, with organisations investing heavily in digital identity verification, behavioural biometrics and continuous trust authentication.
3. The Future of Ransomware and Smarter Phishing
Ransomware will remain one of the biggest threats in 2026, but AI will make it more intelligent, harder to detect and significantly more scalable. Attackers will use AI to craft personalised phishing emails that are context-aware and perfectly mimic internal communications or supplier messages.
Adam Myers, Sales Director, has seen a clear rise in this trend:
“We’re seeing emails that look more real and on brand. It’s harder to spot. AI is helping hit that on scale.”
These emails are technically perfect, grammatically accurate and contextually relevant, making them almost indistinguishable from legitimate communications. AI will also be used to test email variations, conducting A/B testing on targets to improve success rates.
Elena Doncheva, Marketing Director, advises:
“Train your people, as they will likely be the first line of defence. Monitor your digital footprint and the dark web for data that attackers can utilise. Test your business continuity plans, disaster recovery and incident response plans. You can never be too prepared.”
4. Quantum Risk, IoT Growth and Zero Trust Security
Technology will continue to evolve, bringing both opportunity and risk. Quantum computing, while still emerging, poses a direct challenge to current encryption standards. Organisations will need to begin preparing now by exploring quantum-resistant security measures.
Wayne Price summarises the shifting landscape:
“Expect AI, deepfakes, ransomware, quantum computing, and a surge in IoT and cloud-connected devices to reshape cyber security in 2026.”
The growth of connected devices, cloud services and remote infrastructure will dramatically widen the attack surface. This will push organisations towards adopting zero trust frameworks, continuous monitoring and automated threat detection.
While AI transforms the technical threats, humans will remain the most vulnerable target. In 2026, social engineering will become significantly more sophisticated as deepfake technology enables hyper-realistic voice, video and identity spoofing.
Wayne Price, Commercial Director, warns:
“Deepfakes and synthetic media will cause a surge in identity fraud, forcing organisations to ramp up digital identity verification practices.”
Attacks will no longer rely on poorly written phishing emails. Instead, employees may receive video messages from a supposed CEO requesting payment transfers, or voice calls mimicking trusted suppliers.
Gavin Wood, CEO, believes identity protection and human awareness will be critical:
“Human attack vectors will continue to be exploited, especially with AI-driven deepfakes, voice spoofing, phishing, and super realistic, authentic-looking videos, et cetera. Securing the human will be absolutely key for cyber security in 2026.”
Identity and access management will become one of the most important areas of cyber security, with organisations investing heavily in digital identity verification, behavioural biometrics and continuous trust authentication.
5. Supply Chain Security Becomes a Business Requirement
Supply chain security emerged as a central issue in some of the most significant cyber incidents throughout 2025. As organisations grappled with the repercussions, it became clear that robust supply chain protections are not just desirable but essential.
Elena Doncheva, highlights:
“These trends are already visible in the recent news. It is crucial every organisation is prepared to protect and respond to attacks”
Recent incidents with M&S, Harrods, Co-Op and Jaguar Land Rover put into perspective how critical supply chain is for all organisations.
Cyber security is no longer just a technical matter. It is becoming a competitive differentiator. Organisations will start to lose contracts if they cannot prove they meet minimum cyber security standards.
Tom Davies, CFO, predicts big changes:
“Procurement teams will start to look at cyber cover in the same way that they do insurance. Those without sufficient cyber cover will start to lose customers.”
Insurers and regulators are also tightening requirements, demanding proof of cyber resilience, business continuity strategies and responsible data handling practices.
In 2026, cyber maturity will be a strategic advantage.
Final Thoughts: Secure Your Organisation and Use Cyber Security as Competitive Advantage
2026 will be defined by machine-speed threats, identity risk and a widening digital attack surface. AI will be used both to launch attacks and to defend against them. Organisations that embrace AI-driven cyber defence, human-first security awareness and supply chain resilience will be best positioned for the next era of cyber risk.
Cyber security in 2026 is no longer just about protection. It is about trust, readiness and competitive strength.
Stay Secure. Security will be your edge.
Free Posture Assessment
Understand your security risks and how to fix them.
Take the first step to improving your cyber security posture, looking at ten key areas you and your organisation should focus on, backed by NCSC guidance.
Claim your free 30-minute guided posture assessment with a CyberLab expert.
