Do we follow or create trends in cybersecurity?

Cybersecurity is at the center of concerns for companies around the world. With the acceleration of digital transformation, cyberattacks have become more sophisticated, amplifying the challenge for business. In 2025, again, we will see a significant increase in cyber threats and, at the same time, a growing demand for new risk mitigation strategies. It is imperative that as an executive, you closely monitor these changes and how they impact the way you protect your organization’s assets.

Artificial intelligence: ally and threat

According to the World Economic Forum’s “Global Risks Report 2024”, cyber threats, or cyber insecurity, are among the four biggest global risks for the coming years. The use of artificial intelligence (AI) by criminals will become one of the main challenges for 2025. Hackers can use AI to automate and enhance attacks, making malware and other threats smarter and harder to detect. This requires that organizational resilience is better crafted by using AI to predict and neutralize attacks before they cause significant damage.

A study by Gartner also reinforces this prediction, estimating that by 2025, 60% of global companies will use AI for cybersecurity. Artificial intelligence will be essential for monitoring large volumes of data in real time, identifying anomalies, and automating incident responses, something crucial in a scenario where the speed of response can determine the success or failure of a cyber defense.

Vulnerable supply chains and third parties

I also highlight vulnerability in supply chains and third parties. One of the biggest cyber risks for 2025 is the increase in attacks targeting suppliers and business partners, rather than direct attacks on corporations. These attacks can allow cybercriminals to access internal systems through vulnerable third parties, as we saw in the attack on SolarWinds. Companies will need to conduct regular security audits on their suppliers and develop strategies to protect their ecosystems.

5G and IoT: new challenges, new vulnerabilities

With the global expansion of 5G networks, expected to accelerate in 2025, new cyber risks emerge. Gartner estimates that by then, more than 30 billion Internet of Things (IoT) devices will be connected, creating a vast field for potential attacks. The massive connectivity that 5G provides expands the attack surface, as each connected device becomes a potential entry point for threats.

To protect themselves in this new scenario, companies must implement robust security architectures that cover everything from the network to connected devices. Zero Trust Architecture, which is based on the idea of not automatically trusting anything inside or outside the corporate network, is one of the trends that will gain the most traction by 2025.

From the traditional SOC to an AI-powered SOC

With the advent of these new technologies, a traditional Security Operation Center (SOC) (SIEM-based) is no longer sufficient, considering the large number of devices, attack surfaces, multiple access points, and information beyond the traditional edge of a network. The use of a SOC (with XDR/MDR solutions) to prevent, detect, and respond to an incident using AI will be mandatory.

The human factor and a cybersecurity culture

The human factor remains one of the main vulnerabilities in cybersecurity. Studies by the Ponemon Institute indicate that 82% of data breaches involve some type of human error. By 2025, creating a strong cybersecurity culture within companies will be as essential as implementing cutting-edge technological solutions. This requires an ongoing investment in employee training and awareness of safety practices.

How to report cyber risks to company leaders?

One of the critical challenges for cybersecurity leaders is how to report risks in a clear and understandable way to board members. Often, the technical aspects of cyber risks can be too complex for directors who don’t have a background in technology, to easily understand.

The key to effective communication is translating technology risks into business impacts. For example, instead of reporting technical vulnerabilities, the focus should be on the financial or operational consequences of those risks. I recommend using clear financial metrics, such as the potential impact on revenue, recovery costs, or loss of customer trust.

Another effective approach is to classify cybersecurity risks into three categories:

• strategic risks;
• financial risks;
• operational risks.

This helps the board understand where cyber threats may affect the organization most critically, making it easier to make informed decisions about security investments.

Cybersecurity as a strategic priority

I have no doubt that by 2025 (again), cybersecurity will be an essential component of business strategy, and business leaders will need to treat digital protection as a core responsibility. The combination of emerging threats, such as the use of AI by criminals, the vulnerability of supply chains, and the explosion of 5G-connected IoT devices, creates a challenging landscape, but also full of opportunities for innovation.

Keeping up with these trends, anticipating incidents and managing risks in an ever-changing world will be critical to protecting your business. The key to success will be collaboration between cybersecurity leaders, IT teams, and boards of directors to ensure that information security is treated as a strategic priority.

Umberto Rosti
CEO Brazil of Stefanini Cyber, a Stefanini Group company