Top 5 Cyber Security Trends for 2025
The cyber landscape is more turbulent than ever. Microsoft recently reported a 2.75-fold increase in ransomware attempts this year, while research predicts that global cyber attacks in 2024 will surge 105% compared to 2020. There is a dire need for more qualified cyber professionals as generative AI is lowering the barrier to entry for attacks. Unfortunately, cyber skills gaps have been reported in both the U.K. and Australia, with women making up only a quarter of the industry. But how will we roll into next year? TechRepublic asked cyber experts to predict the top trends impacting the security field in 2025. SEE: Number of Active Ransomware Groups Highest on Record 1. Renewed focus on third-party risk management, including the AI software supply chain This year, headlines were dominated by the CrowdStrike incident, which disabled about 8.5 million Windows devices worldwide and caused huge disruption to emergency services, airports, law enforcement, and other critical organisations. SEE: What is CrowdStrike? Everything You Need to Know However, this is far from the first instance of a supply chain attack being put on the public’s radar; the MOVEit attacks from last year may also still be fresh in the mind. Due to the prevalence of these incidents, Forrester analysts predict that governments will ban certain third-party software in 2025. Additionally, more companies are using Generative AI to code new software, which could open it up to weaknesses. AI-generated code has been known to cause outages, and security leaders are even considering banning the use of technology in software development. For executives, this all illustrates how essential third-party risk management is to operations, leading to a new focus in 2025. Max Shier, the chief information security officer at cyber advisory firm Optiv, told TechRepublic in an email: “Third party risk management, supply chain risk management, and increased oversight and regulatory requirements will drive the need for companies to focus on and mature their governance, risk, and compliance programs.” Jacob Kalvo, the CEO of proxy provider Live Proxies, added: “It is expected that in 2025, organisations will likely shift toward proactive ways of assessing and monitoring supply chains. It could be leveraging zero-trust architectures that will verify at stages of access, where the companies deal with external partners. “This shift to increased supply chain scrutiny marks a wider trend of bringing cybersecurity into general enterprise-wide risk management.” AI software is one of the weakest links in the software supply chain While businesses race to capitalise on generative AI solutions, the speed of their adoption has resulted in some areas of oversight when it comes to security. A study from HackerOne found that 48% of security professionals believe AI poses the most significant security risk to their organisation. Cache Merrill, founder of software development company Zibtek, told TechRepublic by email: “As AI tools increasingly integrate into software development, we anticipate attackers targeting the software supply chain’s weakest AI-driven components. The focus will no longer be just on vetting third-party code but scrutinising AI models that may have inadvertently introduced security gaps through data poisoning or bias exploitation. “By 2025, supply chain security will demand a whole new layer of vigilance, where even the datasets and AI models feeding into our applications are analysed for adversarial tampering. A secure supply chain won’t just be about code but curating safe and verifiable AI training sources.” Paul Caiazzo, VP of security services at Quorum Cyber, told TechRepublic that attackers may specifically target weaker AI tools to exfiltrate sensitive data. “CISOs will struggle to secure them due to a lack of AI skills and tooling,” he added. Must-read security coverage 2. Macs will become more targeted by cybercriminals Experts say that Macs will become even more of a target for cybercriminals in the next year. Kseniia Yamburh, malware research engineer at Mac security provider Moonlock, told TechRepublic by email: “Once considered safer, macOS now faces rising threats, particularly from stealer malware designed to collect sensitive data. “Our research at Moonlock shows a notable spike in macOS-targeted stealer malware, with 2024 seeing 3.4 times more unique samples than 2023.’ SEE: Threat Actors Increasingly Target macOS, Report Finds The number of macOS vulnerabilities exploited in 2023 increased by more than 30%, with attackers using infostealers, fake PDFs, fake Mac apps, legitimate Microsoft apps, and other novel techniques to breach the operating system this year. In November, several malicious macOS apps were linked to North Korea. The growing interest in Apple devices may be due to their increasing prevalence in organisations and greater competition amongst cybercriminals in the Windows landscape. 3. Identity to shift into the jurisdiction of security teams Security experts predict that in 2025, responsibility for identity and access management within companies will shift from IT departments to security teams. Sagie Dulce, VP of research at segmentation firm Zero Networks, said identity-based attacks are the leading cause of breaches, and this is not looking to change. As these attacks escalate, security professionals are needed to eliminate potential entry points. Dulce told TechRepublic: “This is not new, but is a growing trend as more identities belong to services and apps — they are harder to manage and control. Most organisations are currently blind to their exposure from service accounts, privileged identities, secrets spread, third party access, and more. “These identities are often the lowest-hanging fruits in organisations and attackers know it. As many web applications are still exposed to the internet, getting initial access via compromised credentials to a web app remains the main attack vector utilised to gain initial access.” 4. Cyber regulations will divide countries Global cyber regulations are becoming stricter — especially with the rise in nation-state cyber attacks. As a result, legislation will focus on geopolitics and national security interests. Vishal Gupta, CEO of security software provider Seclore, told TechRepublic in an email: “In the coming year, long raging wars and general geopolitical tensions will drive the bulk of regulations. Countries and groups of countries will create regulations to protect their own interests over deemed enemies and will
Top 5 Cyber Security Trends for 2025 Read More »











