In 2024, I wrote about the cybersecurity trends I believed would shape the near future. At the time, the industry was focused on generative AI, ransomware, remote work, and an expanding regulatory landscape. Many of those themes turned out to be directionally correct—but the way they played out surprised even experienced practitioners.

Two years later, it’s worth revisiting those predictions. Some held up well. Others missed the mark. More importantly, a few of the most impactful changes weren’t obvious at all in 2024.

This post reflects on what came true, what didn’t, and what I believe now defines cybersecurity heading into 2026.

In 2024, I warned that AI-driven cyberattacks would become more sophisticated and adaptive. While that framing wasn’t wrong, it overstated the technical novelty of what actually happened.

AI didn’t introduce fundamentally new attack techniques. Instead, it dramatically lowered the cost and effort of executing existing ones. Phishing became faster, more personalized, and easier to scale. Social engineering improved in quality and volume. Reconnaissance and targeting became trivial.

The real shift wasn’t intelligence—it was economics. Attackers didn’t need to outsmart defenders; they only needed to overwhelm them.

What I underestimated in 2024 was how quickly human-dependent security controls would fail under AI-driven scale.

I argued in 2024 that the traditional security perimeter was dissolving and that zero trust would become increasingly important. That prediction proved correct—but incomplete.

What disappeared wasn’t just the network boundary. The distinction between “inside” and “outside” stopped mattering altogether. Identity became the control plane, and authenticated access became the primary target.

By 2025, session hijacking, token theft, OAuth abuse, and adversary-in-the-middle attacks were no longer edge cases. They were common. MFA was still necessary—but no longer sufficient on its own.

The biggest realization for many organizations was uncomfortable:
A successfully authenticated user could no longer be assumed trustworthy.

Ransomware-as-a-Service was a major concern in 2024, and it absolutely continued to cause damage. But by 2026, it was no longer the dominant threat model.

Attackers increasingly favored quieter approaches:

Ransomware was noisy and expensive. Silent compromise was easier to sustain and harder to detect.

In hindsight, I overweighted ransomware relative to the broader shift toward identity-driven attacks and long-lived access.

In 2024, I highlighted IoT as a growing risk due to weak security controls and rapid adoption. That risk didn’t disappear, but it didn’t materialize evenly across industries.

IoT proved most critical in:

For most enterprises, however, IoT wasn’t the primary breach vector. Identity systems, SaaS platforms, and cloud control planes were far more attractive targets.

The risk was real—but narrower than I anticipated.

I expected evolving cybersecurity regulations to materially improve organizational security posture. What actually improved was visibility, not resilience.

Disclosure requirements, audits, and compliance frameworks forced organizations to acknowledge incidents more transparently. They did not, on their own, prevent breaches or meaningfully reduce impact.

By 2026, it became clear that compliance answers “Did you follow the rules?”
It does not answer “Can you withstand failure?”

That distinction matters.

In 2024, I pointed to insider threats as a growing concern. What changed was my understanding of the root cause.

Most “insider” incidents weren’t driven by malicious employees. They were driven by:

Attackers didn’t need insiders. They simply became them.

The biggest change between 2024 and 2026 wasn’t a new technology or a breakthrough attack technique. It was a shift in how security failures actually happen.

Most incidents didn’t occur because defenses were missing. They happened because trust was granted too easily and held for too long.

That reality forces a different starting point for modern security programs:

The organizations that adapted weren’t the ones that bought the most tools. They were the ones willing to challenge long-held assumptions about users, access, and control.

My predictions in 2024 weren’t wrong, but they missed the center of gravity. I spent too much time focused on emerging threats and not enough on how existing trust models would be exploited at scale.

By 2026, cybersecurity is less about keeping attackers out and more about controlling the damage once they’re in.

That shift has fundamentally changed how I think about identity, access, and what “secure” really means.