Industry executives and experts share their predictions for 2025. Read them in this 17th annual VMblog.com series exclusive.
By Paul Davis, Field CISO, JFrog
The rapid evolution of AI technologies worldwide highlights a strong and growing commitment from both the public and private sectors to leverage AI for innovation, competitive advantage, and tackling complex challenges. In fact, in 2024 companies were projected to spend $235 billion on AI, a figure that is expected to nearly triple, reaching over $630 billion by 2028. Generative AI, a subset of this broader AI ecosystem, accounts for 17.2% of global AI spending today. Next year, we will continue to see investment in AI/ML increase as DevSecOps teams dedicate more funds, time, and resources to deploying AI/ML models and/or using AI/ML automation to accelerate their time-to-market.
With this in mind, below are some key considerations to watch in 2025 on how AI management practices, AI agents, and the optimizations made to the software supply chain will impact how developers approach their work.
AI Management and Optimization for Developers
In 2025, we’ll face significant challenges in securing AI from both a technological and business risk management standpoint. Currently, the industry has general knowledge of how to use AI, but – my observation is – we still don’t have a complete understanding of how to manage the business, technology and data risks around AI.
A recent study conducted by JFrog supports this claim – suggesting that although organizations are aware of the security issues associated with AI models, they lack the ability to mitigate them. Additionally, 57% of organizations say the lack of integration between AI/ML security and existing security programs leaves potential blind spots. As such, only 39% feel confident in their ability to secure AI/ML models.
Building ML models is a complex and time-intensive process. Data scientists regularly face challenges in deploying their ideas into production, due to knowledge gaps with the teams who possess the essential security controls and traditional infrastructure services and frameworks needed to implement these new solutions into production. The disconnect between ML development and traditional application security (AppSec) practices has contributed to an increase in vulnerabilities found in MLOps platforms. When ML developers fail to standardize their MLSecOps practices or integrate with their organization’s existing AppSec frameworks , organizations lose the oversight and control necessary to eradicate vulnerabilities or risks before ML models go live.
Thus, in the coming year, it’s essential we deepen our understanding of AI and machine learning engines, how they operate, the risks they pose, and how to best support AI in a production environment, so we can fortify our defenses against AI/ML attacks and reduce risk.
AI Agents
Today’s business landscape has already “normalized” the idea of GenAI being an integral part of daily workflows. However, the more prevalent approach in today’s workplace is that we should use GenAI as a supporting tool to help provide insight and guidance as opposed to just trusting it implicitly. However, this may soon change due to the emergence of AI agents, which can interact with their environment, gather data, and use that data to achieve either pre-set or develop new self-guided goals. Because AI agents are autonomous and can make decisions to perform actions without user input, it’s imperative we have more stringent criteria around the use of this technology, particularly in the area of IT security.
The Need for Speed with Human Oversight
Security is about being proactive, agile and responsive. Being able to fortify defenses extensively enough to “defend at machine speed” while your attackers have access to the same technology and get increasingly sophisticated in their attack patterns, represents the next frontier for IT and security leaders. For developers and the infrastructure teams, AI agents will be needed to monitor the constant updates, improvements and add-ons needed to keep pace with the ever-growing footprint of software they manage, even if it comes at the risk of sacrificing security for speed. ML and traditional software velocity will be accelerating, but we need to keep control and ensure that we keep the business on track.
Software Supply Chains
We’ve learned through several recent examples that any and every action taken within the software supply chain (SSC) can trigger significant consequences (log4j, Hugging Face, PyPI, npm, etc.) In 2025, developer teams, IT security teams, and CISOs will face heightened demands to streamline software delivery and enhance the security pipeline. Every action within the software supply chain (SSC) can trigger significant consequences, making it essential to integrate security practices at every stage of software development – making developers and security teams interdependent. The integration of SSC and security processes through flexible software systems, compatible security applications, and empowered security teams will be essential for successful software delivery in 2025.
##
ABOUT THE AUTHOR
Paul Davis is an experienced IT Security Executive who, as Field CISO at JFrog, works to help CISOs, IT execs and security teams, enhance protection of their software supply chain. Additionally, he advises IT security startups, mentors security leaders, and provides guidance on various IT security trends. Paul also spends his time exploring the latest technologies, DJing, reading, and boating.
