Industry executives and experts share their predictions for 2025. Read them in this 17th annual VMblog.com series exclusive.
By Stephen Gates, Principal Security SME at Horizon3.ai
Today’s cybersecurity battlefield is volatile, and in 2025, organizations can expect even more intense, rapid change. With how quickly attackers can slip through defenses and proliferate their attacks, defenders cannot wait until a threat appears before leaping into action. Organizations must instead shift to an attacker mindset, proactively identifying exploitable weaknesses and mitigating potential risks before it’s too late. When a single attack can wreak havoc across all of an organization’s critical systems, cybersecurity teams need a wartime mindset, one defined by relentless validation, exhaustive rigor and uncompromising accountability. In 2025, organizations will abandon their old playbooks and start striking first, grounding their defense strategies in precise, proactive offense.
Here are three key predictions for how that will manifest:
Cybersecurity Defenders Will Embrace Real Adversarial Exercises
Cybersecurity teams can no longer take the periodic “red team vs. blue team” scrimmage approach when testing for vulnerabilities and weaknesses; this simply does not mirror today’s dynamic threat landscape. Relying on an annual, quarterly or even monthly exercise to check the “we tested it” box isn’t just risky – it’s reckless.
Instead, cyber risk assessment must be ongoing and continuous. This will lead to the growing adoption of autonomous pentesting, with automated and scheduled offensive exercises. These pentests will be more targeted as organizations veer from a “secure everything” approach to more proactively address new potential risks. Organizations must be able to recreate the Tactics, Techniques, and Procedures (TTPs) of actual adversaries in real-time to identify weaknesses and patch them immediately. Organizations will move to address the actual vulnerabilities and risks present within their systems, rather than structuring defenses around theoreticals and “what-ifs.”
The game is changing, and the organizations that win will be those that stop reacting and start proactively proving their resilience.
Strategies Will Be Proof-Based and Battle-Tested
Cybersecurity strategy must align with hard evidence and data, not outdated handbooks and moldering “best practices.” There are no “best practices” in a landscape this dynamic, where new threats emerge every day and every technological innovation-especially those in AI-presents a new opening to attack. Strategies need to be flexible and highly tactical, evolving based on tangible insights delivered on a regular basis.
In 2025, the new standard for cybersecurity will be “battle-tested,” which allows room for constant reshaping and refinement based on the latest threat conditions. With tested proof of exploitable vulnerabilities driving defenders’ actions, security testing will become more targeted, efficient, effective and continuous.
The New Threat Landscape Will Redefine Cyber Insurance
It’s not just defenders who are feeling the pain of smarter, more complex cyberattacks: cyber insurers also face an existential threat to their business models.
With the risks so high, insurers need the most comprehensive risk assessments possible to make decisions about offering coverage. To ensure they can obtain the insurance they need, organizations will have to prove they can mitigate as much damage as possible with their own cybersecurity structure if they come under attack. Combine this change in policy with rising premiums, and cyber insurance will become less of a safety net and more of an emergency parachute-only deployed in the direst of circumstances when all other methods have failed.
Over the next year, organizations will reorganize their cyber defense operations in ways that elicit proof of effective defense and ongoing risk reduction; this will hasten the adoption of autonomous pentesting and similar strategies that prioritize continuous, active detection over static summaries. Ongoing, targeted testing will make organizations and their partners more resilient to both present and future threats, so they can thrive in 2025 and beyond.
##
ABOUT THE AUTHOR
Stephen Gates, Principal Security SME, Horizon3.ai
Stephen brings over 25 years of expertise in information security to his role at Horizon3.ai. As a seasoned Security SME, he has a comprehensive hands-on background in deploying and implementing on-premises, cloud-based, and application security solutions. A recognized writer, blogger, presenter, and published author, Stephen is dedicated to delivering actionable insights and raising awareness about the pressing cybersecurity challenges organizations face today.
