Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Dr. Darren Williams, Founder and CEO, BlackFog
Artificial intelligence is shaping the future of cybersecurity, as both a catalyst for innovation and a new vector for risk. Enterprises have embraced AI tools at speed, but behind its promise of efficiency lies a growing security blind spot: shadow AI.
In 2026, this duality will reach a breaking point, and organizations must find a way to harness AI’s power without losing control of their data.
Shadow AI is creeping in as a top enterprise threat
While we’re usually looking outward for cyber risks, sometimes the threat is coming from inside the house. Unauthorized and unmonitored shadow AI tools have become a prime example of this, and the problem will only worsen in the year ahead. Generative tools are now part of daily business life, but many are used without any oversight from IT and security teams. What might start out as harmless experimentation from employees trying to get their job done can quickly evolve into a hidden ecosystem of extensions and plug-ins quietly processing sensitive data.
Our own research has revealed that nearly half (49%) of employees reported using AI tools at work that are not approved by their employer. The research also highlights significant gaps in awareness of how that data is saved, analyzed and stored. This lack of clarity does little to deter them from using tools if it means making time savings, with 71% of respondents believing the productivity gains from using unapproved AI tools outweigh the potential data-privacy risks.
The result is an expanding governance gap where intellectual property, customer data, and trade secrets may be stored or reused indefinitely.
Organizations will be forced to confront this problem head-on in the year ahead or face catastrophic security issues down the line. AI governance will need to be tightly enforced, backed up by effective oversight and monitoring to stop unapproved AI tools from accessing data and systems.
Shadow AI will be a risk multiplier
As well as heightening cyber risk, shadow AI also multiplies the cost of security failures. When sensitive data leaks through unsanctioned tools, tracing the path of exposure becomes near impossible. As a result, it leaves organizations unsure where their information is saved and who can access it.
IBM research shows that breaches involving unmanaged AI tools add an average of $670,000 to the overall cost of an incident. That number is likely to climb in 2026 as shadow AI access spreads further into systems. Preventing these silent leaks demands visibility. Businesses will need to map where AI tools interact with their data, set clear boundaries on what tools are allowed and what data can be shared with them, and deploy continuous monitoring to catch exfiltration.
AI turns data exfiltration into a precision weapon
We’ve seen ransomware steadily evolve in recent years, with data theft replacing encryption as the main goal of attackers. Our research has found that around 96% of publicized ransomware attacks now involve exfiltration.
AI is playing a key role in the next stage in the ransomware evolution, enabling threat actors to launch attacks that are faster and more precise.
Machine learning models can trawl through stolen data and identify valuable targets. Commercially available AI video tools can create eerily convincing deepfake videos, and LLMs can help craft perfectly tailored phishing emails. With these tools at their disposal, even small and inexperienced groups can now operate at a level previously reserved for global crime syndicates.
AI is also accelerating the trend of polymorphic malware that can adapt to defenses on the fly once it has been deployed. This means we’ll be seeing more ransomware attacks launched that are capable of evading detection, and exfiltrating data before it can be stopped. The only effective defense will be real-time visibility, spotting malicious activity and attempted data theft before it can be completed.
SIEM gives way to prevention and AI-driven defense
Security Information and Event Management (SIEM) systems have been the backbone of enterprise defense for years, but they are reaching their limits as the speed and scope of incoming threats increase.
SIEMs are costly, complex, and reactive, and their focus on collecting alerts long after the damage is done will be less relevant in 2026 as the focus shifts from post-incident forensics to prevention.
AI will drive this change, enabling systems that recognize abnormal behavior and stopping attacks as they happen. By blocking unauthorized data transfers and automating response, prevention-first models will replace endless alert triage and win back valuable time for security teams.
##
ABOUT THE AUTHOR
Dr. Williams is a serial entrepreneur and founder of 3 technology startups. He is currently the founder and CEO of BlackFog, Inc. a global cybersecurity company focusing on ransomware prevention and cyber warfare. Dr. Williams has pioneered anti data exfiltration (ADX) technology for the prevention of cyber attacks across the globe.
