With new threats, technologies, regulation and geopolitical challenges ahead, 2025 is set to be another landmark year for the cybersecurity world. We asked ISC2 members to share some of their cybersecurity predictions and expectations for the year ahead.
Every year we dust off the crystal ball and turn to our subject matter experts for some guidance on what the year ahead will bring in terms of cybersecurity. Whether its threats, innovation, new rules to operate by or something more obscure. We start with a look at some of the predations from ISC2 members, from both readers of ISC2 Insights as well as from some of the members that have contributed articles to Insights over 2024.
2025 – Another Landmark Year for AI
The most significant topic of this year has been artificial intelligence (AI) and given the rapid and on-going evolution of the technology, the AI story is far from over.
“We are in the phase of making AI bigger to handle more data. The next phase of industry evolution will be to distribute AI to the edge, each iteration brings us closer to a more connected, intelligent future,” said Mohamed Mahdy, CISSP, CISSP-ISSAP, SSCP.
But the evolution of AI doesn’t stop with moving AI out to the edge. Mahdy also believes we are ready for a wholesale combination of AI with identity and authentication. An area that has already seen a great deal of automation applied to it, access controls could be the next major security space ready for AI and greater autonomy.
“AI will transform identity and access management (IAM) by learning to recognize not just who you are, but how you behave, giving a new dimension to the concept of Identity,” Mahdy added. “In a world of increasing regulations, strong access management not only protects data but also streamlines compliance efforts. IAM not only enforces security controls but gives valuable telemetries to further identify the traffic and use that for enhancing business operations.”
Increased proliferation of AI was echoed by many members who supplied predictions for 2025. Many highlighted an increased reliance on AI to help mitigate skills and personnel shortfalls within the cybersecurity team.
“The use of AI will continue to expand and mature in the field of cybersecurity. Organizations and executives are likely to look at it to bridge skill gaps and compensate for talent shortage,” said Amey Thatte, CISSP.
AI, along with quantum computing, is also set to complicate the threat landscape in the year ahead, alongside playing a role in supplementing available skills, as Grant Hughes, CISSP, CCSP, SSCP, CC noted in his prediction.
“The advancement of AI and quantum computing will increase attack complexity, frequency and scope, putting encryption systems and internally developed AI models at higher risk. Organizations may lose expertise due to automation, leading to SOC analyst burnout as attacks rise. Government-controlled quantum capabilities and ethical AI regulations will bring new security challenges and drive cultural shifts, while misinformation targeting organizations on social media will grow,” Hughes said.
A More Resilient Year
Cybersecurity resilience has been a recurring theme across member articles in 2024. While purely defensive strategies are a regular approach, shifting focus towards a more resilient environment, one that can recover from an incident quickly and with minimal or no negative fallout, without compromising protective strategies.
“[In 2025] cybersecurity will shift from focusing on protection to prioritizing 'cyber resilience.' With threats becoming inevitable, organizations will move away from focusing solely on preventing breaches to designing systems that can rapidly recover, self-heal and adapt in real time, said Akhil Mittal, CISSP, CCSP. Going further with this quite radical, but logical view of the year ahead, he added: “This shift will redefine how businesses approach risk, emphasizing operational continuity and adaptive defense over the pursuit of absolute security - a radical departure from today’s mindset.”
Cybersecurity resilience extends beyond being able to bounce straight back from an incident. It’s also about being able to successfully migrate from one technology or platform to another without compromising the business, as Bence Hezso, CISSP explained.
“In 2025, organizations will place greater emphasis on exit strategies as they face the growing realization that cloud migrations come with unexpected costs. Planning for the unforeseen will become crucial to maintaining business resilience in a shifting cybersecurity landscape,” he said.
It's All About the Data and the Cloud
The reliance on cloud and shared services is showing no signs of reducing. With the increased reliance on AI, its likely to grow further, with some members pointing to cloud suppliers becoming an ever-greater data and systems risk factor for organizations.
“Addressing the risks and opportunities in your cloud suppliers will become a must, as topics such as personal and confidential data use are now more magnified due to the emerging challenges of LLMs, data breaches and more – securing personal data through confidential computing is one example,” said Hannah Suarez SSCP.
“There will be more focus on issues such as data sovereignty, as we aim to address the technical challenges of a cloud-driven future,” Suarez added.
One Platform to Rule Them All
Technology consolidation is also expected to be a big theme in the year ahead, buoyed by increased use of AI and greater offloading to the cloud. Particularly in the cybersecurity space, there is a view among some of our members, with predictions of application consolidation and a “one platform for all” approach that places key intelligence and tools in one place to aid the cybersecurity team to monitor and act faster.
“As a head of infosec, I've observed a growing trend towards using a single platform for predicting, preventing, detecting, and responding to modern threats. This approach can reduce reliance on multiple security tools, which often have limited capabilities and can create a single point of failure affecting our organization and business – so I predict this trend will continue,” said Vu Van Than, CISSP, SSCP, CC.
Greater use of predictive tools and security models was a theme across several predictions. “Cybersecurity teams will pivot from reacting to threats to anticipating them, with a focus on predictive security models. Organizations will increasingly rely on threat intelligence enhanced by behavioral analytics to forecast attacks before they occur, transforming the way threats are predicted, hunted, and mitigated,” Mittal noted.
A Matter of Trust
Finally, the issue of cybersecurity trust will be front of mind in the year ahead. Zero trust was a major topic of discussion in 2024, with 2025 set to see greater adoption of zero trust security approaches to ensure that unauthorized access does not result in unfettered access to systems and data.
“The real cybersecurity crisis won’t be breaches - it will be trust erosion. As supply chain attacks and insider threats multiply, organizations will no longer assume inherent trust in vendors, employees, or partners,” Mittal explained. “Zero trust will no longer be just a network concept; it will become the new guiding philosophy for business relationships. Trust will need to be earned and verified constantly, reshaping how companies interact at every level.”
Related Insights