Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Biren Patel, Senior Manager, Cyber Defense Center, Ontinue
Research and market intelligence firm Cybersecurity Ventures predicts that global spending on cybersecurity products and services will exceed $520 billion annually by 2026, up from $260 billion in 2021. At the same time, cybercrime is projected to cost approximately $16 trillion by 2029, up from estimates of $10.29 trillion worldwide in 2025.
Malicious cyber actors are becoming more sophisticated, and the consequences of cyber incidents are becoming more costly-from reputational damage and customer attrition to revenue loss and regulatory fines.
As 2025 comes to a close and we prepare for the new year, the time is now to consider what threats the industry may face in the year ahead, and start preparing to thwart attacks and mitigate potential consequences.
Attackers Pivot to ZTNA Bypass Techniques
Zero Trust Network Access (ZTNA) has replaced vulnerable VPNs as the preferred secure access model. However, in 2026, I predict that ZTNA will move from an emerging target to a primary breach vector. Expect to see the first major, widely publicized ZTNA vulnerability that exploits flaws in posture validation, authorization logic, or Single Sign-On (SSO) integration. Organizations must recognize that zero trust is a continuous process, not a product, and ensure their security stack is actively monitoring ZTNA telemetry for emergent bypass patterns.
The Cloud Serves as the Chief Entry Point for Attackers in the Year’s Most Notable Breaches
The velocity of cloud adoption has dramatically outpaced the maturity of Cloud Identity Governance. In 2026, I predict that excessive identity entitlements and cloud misconfigurations will be the entry point for the year’s most impactful cloud breaches. Traditional, on-premises identity models are unequipped to manage the scale and complexity of dynamic cloud environments. One stolen cloud credential can give an attacker quick access to the most at-risk part of the network-the growth in Operational Technology (OT) devices on the cloud has only exacerbated this-and lead to lateral movement to the most important parts of the network.
Physical Attack Vectors Resurge via OT/IoT Endpoints
As network segmentation improves, attackers will return to overlooked physical attack vectors to gain an initial foothold, with a specific focus on Operational Technology (OT) and poorly secured IoT environments. We predict a spike in incidents linked to compromised physical access targeting manufacturing, healthcare, and critical infrastructure sectors. This highlights the critical need to extend threat monitoring and visibility beyond the traditional IT domain and include all industrial and consumer-grade endpoints.
Shadow IT Failures Become a Catastrophic Breach Vector
The biggest breaches in 2026 won’t start with a newly discovered flaw; they will start with a forgotten asset. I predict that un-inventoried, unpatched shadow IT devices (ranging from legacy servers to IoT endpoints) will be a main surface for ransomware attacks. As perimeter defenses strengthen, attackers will increasingly scan for the soft underbelly: the rogue machine that bypassed modern controls two years ago. Complete, real-time asset visibility will become the most vital security initiative of the year.
Patching Neglect Must be Reclassified as a Governance Failure
In 2026, organizations will treat willful patching neglect as the business risk that it is. I predict that insurance carriers and regulators will begin explicitly targeting “known, unpatched critical vulnerabilities” (especially those on perimeter devices like VPNs and firewalls) as evidence of gross negligence. This will shift the burden from IT teams lacking capacity to CISOs needing to demonstrate robust governance over their vulnerability management lifecycle. Ignoring cyber hygiene will lead to clear compliance failures and higher financial liabilities.
While security leaders will undoubtedly contend with new and existing threats in the year ahead, deploying the right technologies and following fundamental cybersecurity best practices will empower them to uphold security in 2026 and beyond.
##
ABOUT THE AUTHOR
Biren Patel, Senior Manager, America SOC, Ontinue
Biren Patel is Ontinue’s Senior Manager, leading the SOC team in America.
