Industry executives and experts share their predictions for 2025. Read them in this 17th annual VMblog.com series exclusive.
By Kevin Kirkwood, Chief Information Security Officer (CISO) at Exabeam
In this article, Kirkwood delves into the evolving role of CISOs and the emerging challenges in the cybersecurity landscape. He examines how CISOs will transition from scapegoats to strategic partners, focusing on articulating the complexities of cyber incidents and driving organizational transparency and resilience. Kirkwood also highlights the rise of “living off the land” attacks, as adversaries exploit legitimate tools within networks to evade detection, a trend fueled by escalating geopolitical tensions. Furthermore, he explores the intensifying battle between AI-powered attackers and defenders, where generative AI will produce adaptive, elusive malware, forcing organizations to enhance their detection capabilities with advanced AI tools.
Breach-Related Class Action Suits: CISOs No Longer on the Firing Block
In the coming year, the role of the CISO will shift from being a point of blame to a strategic partner in managing and explaining breach-related incidents. In the last few years, we’ve seen CISOs face personal repercussions and complete blame after a cyberattack. But in the coming year, organizations will start to recognize the CISOs as ‘Chief Explainers to attacks. Instead of taking blame for breaches, this role will need to articulate the nuances and complexity of a breach if one occurs, defensive strategies and decisions around risk management.
This shift reflects a broader understanding that cyber incidents often stem from systemic issues rather than individual failures. As a result, CISOs will work closely with legal and executive teams to address vulnerabilities, promote transparency, and guide the company’s cybersecurity posture, ensuring they are viewed as essential partners in resilience rather than liabilities.
Geopolitical Tensions Spur Living Off the Land Attacks
In 2025, we can expect a rise in ‘living off the land’ attacks, where attackers exploit legitimate tools and processes within an organization’s network to avoid detection. As geopolitical tensions rise, cybercriminals from nations like Russia, China and Iran may increase their use of this technique, spreading across networks, establishing multiple backdoors and ensuring they can re-enter if initial access points are cut off. As these attacks grow more sophisticated, organizations will need to refine their ability to distinguish between normal operations and subtle deviations, focusing on baseline behavior and anomaly detection. Law enforcement and cybersecurity agencies, including CISA, the FBI and the NSA, will need to bolster their efforts to counter these evolving threats, ensuring they can anticipate and mitigate such stealthy incursions.
The Battle Between AI-weaponized Attackers and AI-powered Defenders Will Intensify
Malicious actors will increasingly use generative AI to create morphing malware-code that adapts and mutates to evade detection, making traditional defenses obsolete. These new strains of AI-generated malware will be more efficient and harder to trace. At the same time, defenders will lean on AI tools to streamline threat detection, asking more sophisticated questions and flagging abnormal behavior more quickly.
Conclusion
The cybersecurity landscape is growing increasingly complex, and the role of the CISO is evolving to meet these challenges head-on. As Kirkwood outlines, the CISO is no longer just a shield against threats but a strategic leader responsible for informed decision-making within organizations.
Meanwhile, the rise of stealthy “living off the land” attacks fueled by geopolitical tensions and the intensifying battle between AI-driven attackers and defenders underscore the increasing complexity of cyber threats. To navigate these challenges, organizations must refine detection capabilities, embrace advanced AI tools, and develop a culture of proactive security leadership.
##
ABOUT THE AUTHOR
Kevin Kirkwood is the Chief Information Security Officer (CISO) at Exabeam. As CISO, he is responsible for protecting Exabeam’s employees, customers, and data assets from digital threats. Kirkwood also leads a multidisciplinary security organization at Exabeam, overseeing Governance, Risk, and Compliance (GRC), Application Security (AppSec), Security Operations Center (SOC), and Physical Security.
