Industry executives and experts share their predictions for 2025. Read them in this 17th annual VMblog.com series exclusive.
By Denny LeCompte, CEO of Portnox
The cybersecurity world is under siege. Security leaders face mounting pressure to deliver ironclad defenses without compromising operational efficiency, all while navigating an evolving threat landscape, rising compliance demands, and soaring cyber insurance premiums.
A Portnox survey of 200 Chief Information Security Officers (CISOs) at large enterprises with annual revenues exceeding $500 million was recently conducted by Wakefield Research. The findings reveal a stark reality for cybersecurity in 2025, underscoring the need for adaptable, effective solutions that balance security and usability.
Job Security Amid Rising Breach Risks
The stakes for CISOs have never been higher. Nearly all respondents (99%) expressed concern about losing their jobs if a breach occurs, with 77% admitting they are very or extremely worried. This anxiety isn’t misplaced. In a world where the cost and frequency of breaches continue to rise, CISOs shoulder the burden of protecting their organizations’ data, reputation, and financial stability.
Adding to their concerns is the growing sophistication of cyberattacks. A staggering 86% of CISOs are very or extremely worried about breaches bypassing their defenses, with larger enterprises expressing heightened anxiety. While many are focused on preventing breaches, the reality is sobering: current defenses may not be enough to withstand advanced threats.
Zero Trust: Overhyped or Underdeveloped?
Zero Trust is often heralded as the future of cybersecurity, but the survey reveals mixed perceptions. While all respondents (100%) agree that Zero Trust Network Access (ZTNA) has not fully lived up to its promise, only 38% view it as the definitive path forward. Many are skeptical, citing implementation challenges and the need for significant updates to existing frameworks.
Interestingly, despite the skepticism, 83% of CISOs report plans to increase investments in Network Access Control (NAC), a critical component of Zero Trust frameworks. Over half (61%) strongly agree that NAC is essential, signaling its enduring relevance in securing endpoints and controlling access.
The Limits of Multi-Factor Authentication
Multi-factor authentication (MFA) has become a cornerstone of modern security strategies, yet it’s clear that cracks are forming in its armor. Nearly all CISOs (99%) worry that MFA doesn’t adequately protect employees, with 85% expressing significant concerns. Younger organizations-those under 35 years old-report even greater unease, with 38% being extremely worried about MFA’s shortcomings.
These limitations are underscored by a consensus: 100% of CISOs agree that MFA cannot keep pace with evolving threats, and 55% strongly agree. This concern is even more pronounced in larger organizations, with 62% believing MFA falls short of safeguarding against future threats.
Passwordless Authentication: Promise and Challenges
As organizations grapple with the limitations of MFA, passwordless authentication is emerging as a viable alternative. With compromised passwords implicated in 81% of breaches, it’s no surprise that CISOs are paying attention to this method. However, adoption remains slow, with only 7% of organizations fully implementing passwordless systems.
Passwordless authentication offers tangible benefits despite the barriers-cost, complexity, and employee resistance. Over half of CISOs (52%) expect stronger access control, while 50% foresee an improved employee experience. However, success will hinge on overcoming challenges like user resistance (45%) and ensuring robust vendor support (49%).
Compliance and Cyber Insurance: Persistent Pain Points
Navigating regulatory demands is a constant struggle, with 90% of CISOs feeling overwhelmed by shifting compliance requirements. The EU’s NIS2 directive is a prime example: only 10% of CISOs feel completely prepared to meet its standards.
Cyber insurance adds another layer of complexity. Many CISOs lack clarity on what their policies cover. More than half are unsure if their insurance protects against key threats like supply chain attacks (58%), insider threats (57%), and ransomware (51%). This uncertainty leaves organizations exposed to potentially catastrophic risks.
The CISO’s Balancing Act
Beyond technical defenses, CISOs must manage a delicate balance between robust security and operational efficiency. A majority (59%) strive to address both external threats and internal employee concerns, while 42% prioritize security above all else. However, employee frustration with security measures-citing slow processes and frequent password changes-underscores the tension between usability and protection.
This balancing act highlights a critical need: solutions must empower CISOs to deliver seamless, user-friendly security without compromising organizational safety.
Looking Ahead: A Call for Action
As we step into 2025, the challenges facing CISOs are clear, but so are the opportunities. Cybersecurity leaders must embrace innovative solutions like passwordless authentication and reimagine their approach to Zero Trust frameworks. Simultaneously, they must address compliance gaps and ensure cyber insurance policies provide adequate coverage for evolving threats.
At Portnox, we believe that CISOs deserve tools that protect their organizations and provide peace of mind. By investing in adaptable, cloud-native solutions, security leaders can rise to meet the demands of an increasingly hostile environment while fostering trust and confidence among their teams.
In this ever-changing landscape, one thing remains constant: the resilience and ingenuity of the CISOs who safeguard our digital world.
##
ABOUT THE AUTHOR
Denny LeCompte is CEO of Portnox, a leading provider of cloud-native, zero trust access control solutions, where he is responsible for overseeing the day-to-day operations and strategic direction. Denny brings over 20 years of experience in IT infrastructure and cyber security. Prior to joining Portnox, Denny held executive leadership roles at leading IT management and security firms, including SolarWinds and AlienVault. Denny holds a Ph.D. in cognitive psychology from Rice University.
