Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Maria Cardow, Chief Information Officer at LevelBlue
As 2026 approaches, cybersecurity is entering a period of unprecedented speed and intensity. AI continues to amplify both attack and defense, while geopolitical tensions mount and ransomware groups evolve into well-funded, well-coordinated enterprises. In this environment, organizations must prioritize cyber resilience and keep one foot in the future to maintain a strong security posture. So what’s on the horizon for 2026? I connected with a few experts across LevelBlue to find out. Here’s what they expect:
Sundhar Annamalai, Chief Strategy Officer
The cyber threat landscape is constantly evolving, and AI represents the next, and most challenging, phase of that evolution. We expect threat volume to accelerate further, paired with increased sophistication through more believable social engineering, deepfakes, and other AI-enabled techniques. With that challenge comes the promise of AI-driven security measures. The scale of future threats will make a purely human-led defense model increasingly untenable, driving the imperative for AI to integrate into-and ultimately lead-the detection and response approach.”
In the near term, organizations will face trade-offs about how much remediation authority they grant to AI agents versus maintaining human review of AI-generated recommendations. Over time, as perceptions of risk mature, AI-powered cyber platforms will increasingly be able to assess risk and negotiate enforcement through secure interfaces, reducing alert volume and allowing security teams to focus on the most critical challenges. A central question for the industry is how quickly organizations transition from AI-enabled to AI-led cyber defense. Given that AI talent is at a premium across industries, we expect most organizations to lean toward buying rather than building, driving an acceleration in acquisitions of AI technologies that strengthen broader cyber defense programs.
Bill Rucker, Senior Vice President, LevelBlue Public Sector
A significant shift is occurring where agencies will prioritize cyber resilience over pure prevention. This strategy focuses on rapid recovery, robust continuity planning, and real-time response capabilities. Therefore, Incident Response (IR) services must be broadened to include comprehensive tabletop exercises, full integration with business continuity planning, and meticulous post-breach forensics. Providers can capitalize on this by packaging their IR offerings with defined resilience metrics, the use of automated playbooks, and establishing cross-agency coordination protocols.
Ziv Mador, VP Security Research
Ransomware attacks will continue and intensify as they have become one of the best money machines for cybercriminals. These gangs will expand the techniques they use for network infiltration, lateral movement, and data exfiltration. We shall see this ecosystem of ransomware groups and their affiliates continue to thrive, with new players occasionally emerging.
With cybercriminals continuing to compromise different organizations for ransomware attacks and other motives, we shall see their efforts continue to target publicly facing devices. That includes servers such as Firewalls, VPN, Web servers, and cloud instances, as well as IOT devices. Any publicly accessible interface may be used for the initial infiltration. With the help of AI, we may see more focus by cybercriminals and nation-state agencies on these devices.
Ed Williams, Vice President, SpiderLabs Consulting EMEA
The old adage �it’s always DNS’ reared its ugly head in 2025. We can assume that cloud migration will continue at pace, which will put extra strain and scrutiny on core Internet technologies like DNS and SMTP. By 2026, the spotlight could shift to BGP and PKI – the hidden systems that route nearly all internet traffic and secure every encrypted connection – where one small mistake could cause an even bigger outage.
Scott Swanson, Practice Leader, Security Advisory
Not getting political, but the US is not making a lot of new friends and our isolationist and nation snubbing political stance is causing global frustration. Countries that may have otherwise been an ally or at least help prevent attacks against their “friends” may focus on new bonds. As such, ransomware, extortion, disruptors, or destructive exploits and targeting will increase. Traditional powerhouses like Russia and China may conduct stealthy edge-device attacks, intensify cyberwarfare, and blur more lines between hacktivism and espionage as our government causes more reductions in regulations, breaks continuity of knowledge in enforcement and investigative entities, and raises the tone of hostility across the globe, which can increase the threats and vulnerabilities of US cyber posture and corporate preparedness.
Together, these insights reveal a 2026 defined by faster threats, higher stakes, and growing opportunity. The organizations that stay ahead will be those that strengthen resilience, modernize defenses, and lean into AI-enabled protection. In an ever-evolving industry, the pace of change isn’t slowing down. I look forward to seeing how businesses step up to keep up in the year ahead.
##
ABOUT THE AUTHOR
Maria Cardow is the Global CIO for LevelBlue. The majority of her 25-year career has been spent driving digital transformations for top firms like Goldman Sachs, MSCI, Citadel, Merrill Lynch, Credit Suisse, and CIBC. She attended the University of Chicago with a degree in Sociology with a focus on Economics. Throughout her career mentorship, education, and team-building have been central to her roles. Maria is actively involved in organizations that focus on supporting women in cybersecurity and is a leader in various diversity groups within the cybersecurity and insurance industry. She resides in Brooklyn with her family.
