2.1 AI Threat & Defense Signals
Region: Global • Industries: Cross-sector • Confidence: High
- AI-generated phishing goes mainstream. Multiple studies and surveys in 2025 show:
- AI-crafted emails now routinely outperform human-written phishing in click-through and bypass of user suspicion.
- A global survey found most adults could not reliably distinguish AI-generated phishing from legitimate emails, with only ~46% correctly identifying AI phishing.
- Reports cite phishing volume increases >1,000% compared with pre-generative-AI baselines, driven by cheap, localized, and personalized campaigns.
Sources: eSecurity Planet; NYPost survey; DeepStrike AI attack statistics; Hoxhunt report; CM-Alliance.
- Deepfakes and voice cloning move from proof-of-concept to operational use.
- Universities and enterprises warn that video and voice deepfakes of executives are being used for urgent-payment fraud (BEC 3.0).
- Group-IB and others document AI voice "vishing" attacks that drain millions via convincingly spoofed internal calls.
Sources: UNC ITS Awareness 2025; Group-IB deepfake vishing analysis; CM-Alliance Phishing 3.0.
- LLM-enabled attack tooling matures.
- Google's Threat Intelligence Group and others observe commercial AI-enabled "attack assistants" advertised on underground forums for phishing, lure generation, infrastructure management, and basic malware dev.
- Academic work shows autonomous LLM agents can plan and execute end-to-end attacks in enterprise-like environments in controlled tests.
Sources: Google GTIG AI Threat Tracker; CMU "When LLMs autonomously attack"; industry AI security reports.
- Defensive AI is catching up, but unevenly.
- Major vendors roll out AI-driven anomaly detection and incident triage, but many SMEs lack the data quality and tuning expertise to rely on these tools alone.
- Regulatory and governance pressure around AI models (EU AI Act, NIST/ENISA guidance) is increasing, but adoption is still early-stage.
Takeaway: Over the next 12–24 months, AI-amplified social engineering and identity abuse should be treated as a top-tier risk, on par with ransomware.
2.2 Blockchain / Crypto Signals
Region: Global • Industries: Financial, DeFi, National-state • Confidence: Med-High
- High-value heists persist despite security "win" months.
- Chainalysis and others estimate >US$2 billion in cryptoassets stolen in 1H 2025.
- High-profile incidents include the Bybit US$1.5 billion theft attributed by the FBI to DPRK-linked actors and DeFi protocol exploits such as Balancer (>US$100–120 million) and SwissBorg/Nemo Protocol hacks.
Sources: Elliptic & Chainalysis coverage; Guardian/Business Insider on Bybit; The Record, Infosecurity, Halborn on Balancer and DeFi hacks.
- State-linked crypto theft is now a strategic funding stream.
- DPRK-linked groups (e.g., Lazarus ecosystem) continue to use crypto theft for sanctions evasion and weapons funding.
- Attribution is increasingly public and rapid, but asset recovery remains limited.
- Operational pattern:
- Initial access via stolen keys, compromised CI/CD, or supplier staking infrastructure (e.g., SwissBorg/Kiln).
- Movement of funds through mixers, cross-chain bridges, and OTC brokers still frustrates enforcement.
Takeaway: For any organisation touching crypto, key management, supplier due diligence, and on-chain monitoring are now foundational security controls.
2.3 Quantum & Post-Quantum Cryptography (PQC)
Region: Global • Industries: Critical Infrastructure, Finance, Government • Confidence: Med
- Standards are here; migration is not.
- NIST has released initial post-quantum cryptography (PQC) standards and guidance on migration timelines, noting a 10–20-year typical transition horizon for major cryptographic shifts.
Sources: NIST IR-8547; NIST CSRC PQC guidance; NCSC (UK) PQC migration timelines.
- Roadmaps emphasise discovery over "big bang" change.
- NIST NCCoE and DHS PQC guidance stress crypto inventories, discovery tools, and risk-based prioritisation, starting with:
- Long-lived confidentiality needs (e.g., medical & national-security data).
- High-assurance identities and control-plane cryptography (e.g., PKI, VPN, code signing).
Sources: NCCoE PQC Migration project; DHS Post-Quantum guidance; GSA PQC Buyer's Guide.
Takeaway: In the next 12–24 months, PQC readiness = visibility + pilots; full migration will span a decade, but discovery work is time-critical.
2.4 SDLC, SaaS & Cloud-Native Trends
Region: Global • Industries: SaaS, Tech, Public sector • Confidence: High
Key patterns from ENISA, Verizon DBIR, and 2025 incident reports:
- Misconfigurations, identity & access weaknesses, and third-party SaaS integrations remain the leading root causes for breaches.
- ENISA's 2025 Threat Landscape (4,875 incidents analysed, Jul 2024–Jun 2025) highlights:
- DDoS as the dominant incident type (≈77% of reported incidents) in the EU public-administration data set.
- Ransomware remains the single most impactful threat across sectors.
Sources: ENISA Threat Landscape 2025 & sectoral public administration report; IndustrialCyber/ENISA summaries; WEF Global Cybersecurity Outlook.
- SaaS/CI-driven SDLC:
- Outages and auth failures (see Section 3) increasingly block access to CI/CD, artifact repositories, SOC tooling and backups, forcing teams into degraded, less secure operating modes.
- Security teams are under pressure to treat pipeline and SaaS uptime as part of security resilience, not just availability.
Takeaway: For modern SDLC and SaaS ecosystems, identity & configuration management plus third-party risk drive more breaches than "novel zero-days" in most environments.
Table 1 – Macro Signals (Last ~12 Months)
| Vector |
2025 Signal Snapshot |
Region / Industry Focus |
| AI-enabled phishing |
40–50%+ growth; most adults cannot reliably spot AI phishing; 1,000%+ phishing rise |
Global • All industries |
| Ransomware |
Still most impactful threat in EU & healthcare |
EU, Healthcare, Critical Infrastructure |
| DDoS |
77% of incidents in ENISA public-admin dataset |
EU Public Administration |
| Crypto/DeFi theft |
>US$2 B stolen H1 2025; DPRK steals >US$2 B alone |
Global • Financial / DeFi / National-level |
| Quantum-safe migration |
PQC standards published; migration guidance emphasises inventory first |
Global • Gov, Finance, Critical Infrastructure |
← Scroll horizontally to view full table →