Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Michael Adjei, Director, Systems Engineering, & Trevor Dearing, Director of Critical Infrastructure Solutions at Illumio
Cybersecurity is evolving at an unprecedented pace in 2026, leaving organizations struggling to keep up. The persistent threat of agentic AI and supply chain vulnerabilities impacts every sector, particularly those unable to invest significantly in robust cybersecurity defenses.
Looking into the next year and beyond, companies need to be able to contain breaches to prevent large-scale security incidents.
Why Legislation Alone Won’t Save Us in 2026
While regulations and compliance frameworks are essential, there’s a limit to what legal mandates can achieve. There’s a mistaken belief that having more laws or guidelines in place will automatically make organizations safer. However, the real issue is that legislation often establishes only a minimum threshold for cybersecurity – and people treat it as such. What we consistently see is that effective resilience depends on much more than simply ticking boxes or passing audits.
In 2026, organizations and governments must focus on strengthening critical infrastructure from the inside out and supporting entire communities when disruptions occur. Recent responses to incidents showed that cyber events can ripple far beyond a single company, affecting local businesses and supply chains. In the coming year, building resilience will be about more than achieving compliance – it will be about the practical ability to keep services running for society.
Maximizing ROI by Preparing for the Inevitable Breach
The greatest ROI for CISOs in 2026 will come from investments that help organizations withstand and recover from attacks.
Effective segmentation and rapid incident response will continue to be vital for limiting the damage when – not if – a breach occurs. Over the next 12 months, we can expect organizations to focus their investments on technologies that enable them to quickly identify and contain threats before they spread. By dividing networks and critical systems into secure segments, organizations can prevent attackers from moving laterally and accessing their most valuable assets, known as the “crown jewels.” The biggest value will result from strengthening these response and containment capabilities rather than just trying to prevent every possible incident.
Tight Margins, High Risks: Why Utilities and Retail will be Prime Targets for Cyberattacks in 2026
Any sector operating on tight profit margins – such as utilities, retail, and transportation – will be at greater risk of attacks in 2026 because they can’t afford massive spending on cybersecurity. Unlike banks, which can invest significantly in cybersecurity, sectors such as energy and utilities, food retailers, or railway companies must prioritize keeping prices low for consumers, making large cybersecurity investments less likely and more challenging. As a result, these organizations are more cautious with their cybersecurity budgets, often delaying projects or investing only in the bare minimum required to maintain operations. This leaves them highly vulnerable to attacks, as their ability to keep pace with evolving cyber threats lags behind that of better-resourced sectors.
In the coming year, we can expect attackers to increasingly target industries such as utilities and retail, exploiting their limited cybersecurity budgets and reliance on outdated systems, which will lead to more frequent and disruptive incidents.
AI APIs will become the next big attack surface
The rapid adoption of agentic AI will drive a surge in autonomous connections between agents, systems, and applications. This hyperconnectivity will amplify existing API sprawl, overwhelming security teams and creating blind spots across digital infrastructure.
Without robust oversight, these unsupervised pathways will become prime targets for exploitation, turning what was barely a manageable API problem into a systemic vulnerability.
The rush to implement agentic AI will also result in insufficient supervision of how agents interact with other systems. Organisations will struggle to understand what access agents have to their systems and whether they are interacting with customers and sensitive data in the right way.
Cybercriminals will weaponize agentic AI to commit identity-based attacks
Depending on how people use agents, they are, in a way, relinquishing part of their identity to autonomous AI. Agents will assume people’s identities, accessing usernames, passwords, and tokens to log in to systems for automated convenience.
In 2026, cybercriminals will target the autonomous capabilities of agentic AI and exploit them to commit cyberattacks by compromising agent-to-agent communication. This approach could make agents appear culpable in potential mass exploitation incidents, allowing the true attacker to remain concealed in the shadows. Agentic AI’s novelty, paired with overlooked security and continued mass adoption, will likely fuel this trend.
This will force organisations to rethink identity, access, and accountability in a world where machines act faster, and more dangerously, than humans ever could.
Cybercriminals will target the service supply chain rather than software and hardware
In 2026, attackers will target service supply chains more aggressively than software or hardware supply chains. Past attacks on organisations with shared outsourced service providers have shown that third-party compromises are easier and more rewarding than attacking hardware or software vendors.
These providers often have legitimate internal access to sensitive systems and data, yet operate under inconsistent security standards compared to the larger organisations they service. When companies outsource core services, they create single points of failure that attackers can exploit. Attackers recognise this and will adjust their tactics accordingly for maximum gain.
2026 will demand bold action and smarter strategies to counter efforts from cyber criminals armed with rapidly developing AI agents and models. Resilience, adaptability, and proactive defense will be vital for organizations because while breaches are inevitable, a cyber disaster is preventable.
##
ABOUT THE AUTHORS
Michael Adjei:
Michael Adjei has over 20 years’ experience in network and cybersecurity. Currently he is Director of Systems Engineering at Illumio. Prior to joining Illumio, Michael worked in various roles in the European channel and UK distribution, specialising in perimeter and endpoint security. He has worked as a Support Engineer, Professional Services Consultant, Technical Trainer, and Sales Engineer.
Michael is an accomplished public speaker, regularly speaking at conferences and webinars. He holds a MSc in Network Systems Engineering and a BSc in physics in addition to several industry certifications
Trevor Dearing:
Trevor has been at the forefront of new technologies for nearly 40 years. From the first PCs through the development of multi-protocol to SNA gateways, initiating the deployment of resilient token ring in DC networks and some of the earliest use of firewalls. Working for companies like Bay Networks, Juniper and Palo Alto Networks he has led the evangelisation of new technology. Now at Illumio he is working on the simplification of segmentation in Zero Trust and highly regulated environments.
