The Year of Proactive Defense: Staying Ahead of Threat Actors

As January reaches its midpoint, more cybersecurity experts have weighed in on what the year ahead holds for the industry. From the rapid advancement of artificial intelligence to evolving strategies in application security and a renewed focus on education and workforce training, 2025 promises to be a transformative year.

Entities in every sector face a growing need to adapt to sophisticated threats, regulatory changes, and an increasingly interconnected digital ecosystem.

In this article, we explore the predictions shared by leading voices in cybersecurity and the innovations shaping how we protect data, systems, and people in the year ahead.

Dan Bridges, Technical Director at Cyware 

“2025 will likely see a shift toward a more interconnected, regulation-driven cybersecurity landscape, where organizations of all sizes work together to protect not only their own systems but also the broader supply chain ecosystem. This collective approach, driven by legislation and bolstered by technology, promises a more resilient and secure future for businesses worldwide.” 

As we look toward 2025, it is more crucial than ever to remember the importance of securing our supply chains against the ever-growing threat of cyber attacks and the harm they can cause. With increasing interconnectivity and supply chain complexity, breaches in one part of the ecosystem can quickly ripple through to other areas, making collective defense strategies more vital than ever to maintain business resilience. Organizations must stay vigilant and acknowledge the need to assess, monitor, and review their own cybersecurity practices as well as those of their third-party vendors. This shift will likely push companies to not only improve their own security postures but also to collaborate more effectively across industries.  

The coming year is set to be significantly influenced by regulatory frameworks like the EU’s Digital Operational Resilience Act (DORA) and the Network and Information Systems Directive 2 (NIS2). These regulations are already shaping the landscape by imposing stringent requirements on organizations to secure their supply chains and critical infrastructures, particularly in sectors such as finance and essential services. In the coming years, it is likely that such regulations will expand to encompass more industries, creating a uniform standard for operational resilience and cybersecurity risk management across the board.

Willy Leichter, Chief Marketing Officer at AppSOC

“Ransomware will continue to persist and grow because it is not a single, monolithic type of attack that we can identify and stop. Simply put, it’s extortion, not far removed from local mobsters demanding “protection” money by threatening your livelihood, safety, or family.”

Ransomware remains the most lucrative way to monetize cybercrime by encrypting data, damaging critical systems, or just threatening reputational damage. But beneath the surface, there is a massive shift driven by the explosion of generative AI. AI systems, whether used offensively or defensively are huge force multipliers – what used to take months of careful reconnaissance, by patient long-game hackers, can now be done in minutes by almost anyone.

Additionally, AI systems themselves will increasingly be the target of attacks. By using prompt injections, jailbreaking, and other innovative types of hacking, attackers can increasingly trick AI tools into revealing data, compromising credentials, or fooling end-users who will increasingly rely on “trusted” AI tools. 

Lawrence Pingree, Vice President at Dispersive  

“When I was an analyst, I wrote extensively about the effects of AI on cybersecurity, and autonomous execution of attacks, higher speed automated triage of attack surfaces, and multi-stage capabilities were expected.”

Increasing costs are related to the targeted attacks that seek to gain monetarily from ransom payments, unfortunately many pay, which some countries have banned to stop rewarding the threat actors.

Darren Guccione, CEO and Co-founder of Keeper Security 

“Education systems will remain a prime target for cybercriminals in 2025 due to the vast troves of sensitive personal and financial data they collect. K-12 schools alone average more than one cyber incident per school day, according to CISA, underscoring the sector’s vulnerability.”

This trend extends to higher education institutions, which face additional risks from the integration of complex research data, intellectual property and open network environments. As cyber attacks grow in frequency and sophistication, the need to strengthen cybersecurity across all levels of education is critical. 

In 2025, cybersecurity fundamentals will become a core focus in both K-12 and higher education curricula. This shift reflects the acknowledgment that cyber hygiene must be taught as early as possible and reinforced through a student’s academic journey. Higher education institutions will expand their investment in cybersecurity training, not only to protect their systems but also to develop the next generation of cybersecurity professionals. 
 
To support this transformation, collaborations between cybersecurity experts, public sector organizations and educational institutions will intensify. Initiatives like Flex Your Cyber and resources from government agencies will provide actionable tools and guidance tailored to students, parents, educators and administrators. By prioritizing cybersecurity awareness and readiness for all of these groups, education systems at all levels can better defend against modern cyber threats while empowering the broader community to build a more secure and resilient digital future 

Nicole Carignan, Vice President of Strategic Cyber AI at Darktrace

“205 is the year of AI agents and multi-agent systems: A challenge for cyber professionals, and an opportunity for threat actors.”

Following significant advances in generative AI in 2022 and 2023, throughout 2024 we saw significant focus on innovation and development of AI agents, which are autonomous AI systems that are designed to complete specific tasks. We predict 2025 is set to be the year of multi-agent systems (or “agent swarms”). That means we’ll see increasing use cases across businesses where teams of autonomous AI agents are working together to tackle more complex tasks than a single AI agent could alone. However, the rise of multi-agent systems, particularly in cybersecurity, is a double-edged sword. 

The rising use of multi-agent systems will introduce new attack vectors and vulnerabilities that could be exploited if they aren’t secured properly from the start. Attacks that we see today impacting single agent systems, such as data poisoning, prompt injection, or social engineering to influence agent behavior, could all be vulnerabilities within a multi-agent system. But the impacts and harms of those vulnerabilities could be even bigger because of the increasing volume of connection points and interfaces that multi-agent systems have. 

One benefit of AI agents is that they can discover other agents and communicate, collaborate and interact. Without clear and distinct communication boundaries and explicit permissions, this can be a huge risk to data privacy. These are not issues that traditional application testing alone can address. 

Moreover, the stakes for these systems will be extremely high. Multi-agent systems are poised to make AI tools even more useful and productive for consumers, and as they increase adoption for critical daily tasks such as managing household finances, these systems will contain increasingly sensitive and valuable data. 

That’s why robust security measures and data guardrails are required at the start to prevent these systems from being exploited and running amok.

Jason Mar-Tang, Field CISO at Pentera

“Despite initial concerns about AI’s transformative threat in cybersecurity, we’re seeing that its role in cyberattacks has been more supportive than groundbreaking.”

Generative AI has become a tool for attackers, yet its applications are still limited to simpler, lower-level tasks. For example, AI is frequently used to overcome language barriers and craft convincing phishing emails, sift through large data sets for sensitive information, and repetitive tasks, allowing attackers to scale their efforts without increasing resources. However, these tactics remain human-driven, with AI enhancing rather than leading the charge. 

In 2025, AI’s role in cyberattacks will likely remain “subtle but significant.” AI may help threat actors evade detection with minor variations in malware or generate realistic content for social engineering, but the expected surge in complex, autonomous AI-driven attacks hasn’t yet materialized, and I don’t think we should expect it yet. Instead, we should expect threat actors to keep utilizing their tried and true methodologies, now augmented with AI for efficiency.