10 Cybersecurity Shifts Security Leaders Expect in 2025
Summary
Drawing on interviews with security leaders, Team Cymru’s David Monnier outlines 10 expectations for 2025, including zero-trust adoption, automated security operations, AI-assisted detection, more quantitative cyber-risk management, and ransomware multi-extortion.
Key points
- Interviewees framed security as a strategic business function and urged leaders to explain cyber risk through its impact on critical business services.
- One expert warned that traditional VPN access can let attackers scan for resources and move laterally; zero trust limits access to specific users, applications, and environments.
- Automation is expected to scale security operations; one interviewee described systems testing samples across multiple operating systems and deploying tested responses within minutes.
- An AI use case described in the article is monitoring logging configurations to find coverage gaps and recommend improvements; the author also emphasizes human validation and responsible use.
- Experts described ransomware shifting toward multi-extortion, including stealing sensitive data before encryption, while basic tactics remain effective against unprepared organizations.
- Other predictions include deeper board engagement, more quantitative cyber-risk assessment, cross-sector collaboration, diverse security-team skills, and security tailored to business and customer needs.
Article Details
- Topic
- Expert predictions on 2025 cybersecurity priorities, including strategic security, zero trust, automation, AI-driven detection, cyber risk quantification, ransomware, collaboration, and customer-centric security.
MITRE ATT&CK
People
Andrew GontarczykCISO at Pure Storage; discussed communicating cybersecurity priorities effectively to audit committees and boards.Brett Stone-GrossDirector of Threat Intelligence at Zscaler; advocated zero trust architecture and noted that attackers who gain network access can scan and move laterally.Jeffrey WheatmanSVP and Cyber Risk Strategist at Black Kite; discussed how security teams and business leaders assess risk from different perspectives.Jim TillerCISO at Cyberbellum; discussed risk assessment using the OODA loop and the importance of understanding business needs.Jo√£o Pedro Gon√ßalvesGlobal CISO at EQT Group; described the shift toward multi-extortion tactics, including stealing sensitive data before encryption.Mikko HyppönenChief Research Officer at WithSecure; described automated systems detecting threats, testing samples across operating systems, and deploying responses.Rafal LosHead of Services Strategy at ExtraHop; discussed connecting technical security issues to business impact through collaboration.Rick DeLoachDeputy CISO at ADT; discussed tailoring security measures to protect life-safety systems such as smoke and carbon monoxide detectors.Ryan ChapmanThreat Hunter and Instructor at SANS Institute; described how recurring basic tactics remain effective against unprepared organizations.Wade WellsLead Cybersecurity Threat Detection Engineer; discussed AI as an accelerant and the need to validate its outputs.
Industries
financeI interviewed over 30 leaders across sectors that drive our economy and protect our society - from finance and healthcare to law enforcement. These conversations revealed a clear pattern: organizations that treatHealthcareover 30 leaders across sectors that drive our economy and protect our society - from finance and healthcare to law enforcement. These conversations revealed a clear pattern: organizations that treat security asLaw enforcementacross sectors that drive our economy and protect our society - from finance and healthcare to law enforcement. These conversations revealed a clear pattern: organizations that treat security as a business