Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By: Kyle Kurdziolek, VP, Security of BigID
Artificial intelligence is transforming cybersecurity in ways we’re only beginning to understand. In 2026, we’ll see this transformation accelerate as both defenders and attackers integrate AI into their core operations. This isn’t about robots taking over or doomsday scenarios. It’s about a fundamental shift in how security works, who can participate, and what skills matter. Organizations that understand these changes and adapt their strategies will find themselves better positioned to protect their data and operations. Here are the key trends that will define cybersecurity in the year ahead.
The AI Arms Race
Cyber criminals will increasingly use generative and agentic AI to automate reconnaissance, curate highly convincing phishing attempts, tune malware, and coordinate multi-stage attacks at machine speed. The defenders are looking for the same return on AI focusing on the detection and automated responses. Although it will remain behind until further advancements and maturity come from governance and model hygiene. It will be imperative for organizations to start building tabletop exercises against AI-threat scenarios, and to see how organizations can leverage AI to their defensive advantage.
The real challenge for defenders isn’t just deploying AI tools. It’s doing so responsibly while managing unprecedented data risks. As organizations rush to adopt AI, they’re inadvertently exposing personal data in training sets and model outputs. Customer information leaks into AI systems. Sensitive data crosses borders through cloud AI services. Models trained on unvetted data create compliance nightmares. The fundamental problem remains: you can’t protect what you don’t know about. Organizations need complete visibility into their data landscape before they can safely leverage AI for defense. This means understanding what data feeds your AI systems, where it comes from, who can access it, and how it flows through your models. Without proper data discovery, classification, and governance frameworks, AI becomes another vector for data exposure rather than a solution. Organizations must build comprehensive data intelligence capabilities first, then layer AI defenses on top of that foundation. The winners in 2026 will be those who master data governance before scaling their AI initiatives.
Ransomware Evolution
Ransomware-as-a-Service (RaaS) will continue to scale while their use of AI will conceal payloads to be stealthier and extortion faster due to automated data discovery, targeted extortion, and faster lateral movement. This evolution will more than likely increase double/extortion variants with a broader monetization.
Software and Cloud Supply Chain will Rise
Attacks that compromise build systems, open-source dependencies, or third-party cloud services will produce broad, high-impact access. There will be a continued rise or future spikes in supply chain compromises that will cascade across multiple industries.
Autonomous Security Operations Center (SOCs) will Gain Further Adoption
As I predicted last year, autonomous SOCs have started increasing their footprint on the benefits of AI in security operations. We’ll see more organizations start increasing their adoption in AI technologies and autonomous SOCs is a step in the right direction to do so, in order to eliminate the well known burdens that span across SOCs today.
Building Resilient Defenses
The scale and speed of threats demand more automated remediation and containment efforts. An increase in defensive AI and feedback loops powered by automated actions will need to be required to keep pace with the stride of offensive adoption with AI.
Convergence of Security and Data Science
By next year, security will not need a new framework or technology, it’s the cultural and operational merger between security and data science disciplines. The convergence will be inevitable as AI pipelines are becoming the new critical infrastructure, adversarial machine learning will rise, and regulations will enforce cross-discipline accountability.
The Path Forward
These predictions represent opportunities as much as challenges. AI is leveling the playing field in unexpected ways. Smaller organizations can now access defensive capabilities that were once exclusive to enterprises with massive security budgets. Automation handles the repetitive tasks that burn out talented analysts.
The organizations that succeed in 2026 won’t be those that perfect their defenses. They’ll be those that adapt fastest to new realities. Build your AI governance frameworks now. Start your automation initiatives today. Break down the silos between your security and data science teams. The future of cybersecurity isn’t about preventing all attacks. It’s about building resilient systems that detect, respond, and recover faster than ever before.
##
ABOUT THE AUTHOR
Kyle is the VP of Security at BigID and was recently named one of the Top 30 Chief Innovation Security Officers for 2025. He focuses on applying Agentic AI to real-world security challenges. That includes streamlining operations, reducing alert fatigue, and modernizing risk management.
