Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Rob Harrison, SVP Product Management, John Peterson, Chief Development Officer, and Tom Gorup, VP SOC Operations, Sophos
The cybersecurity landscape is changing at an unprecedented pace, and artificial intelligence is the primary catalyst. It can serve as both a sophisticated defense mechanism and a potential resource for attackers, creating a new generation of threats that are faster, more sophisticated, and more personalized than ever before. As we look toward 2026, the cybersecurity community will continue to confront the evolving opportunities and challenges presented by artificial intelligence at a growing scale.
Sophos’ John Peterson, Rob Harrison, and Tom Gorup have thought about the effect of AI in their own professions compiling their list of predictions below.
AI Will Supercharge Threat Actor Scale and Sophistication
In 2026, attackers will continue to use AI as a force multiplier. AI will make it easier to weaponize known vulnerabilities, orchestrate attack campaigns, lowering the barrier for basic hacking and enabling broad, rapid exploitation across the internet. Payloads will be customized faster than ever, and social engineering will become increasingly tailored, including phishing that reflects open-source knowledge of individual targets. Deepfake audio and video will make BEC campaigns more convincing and far more credible, making them easier to succumb to. AI will shift the balance of power by helping even low-skill threat actors operate with speed and precision once reserved for more experienced threat actors. (John Peterson, Chief Development Officer).
Regulation Will Hit the Mid-Market, Forcing a New Level of Security Maturity
In 2026, regulatory pressure will extend decisively into the mid-market. As AI accelerates the speed and scale of attacks, lawmakers and industry bodies will push security expectations beyond large enterprises and require smaller organizations to demonstrate stronger governance, clearer oversight, and continuous control performance. Mid-market businesses will be held to measurable standards for identity protection, monitoring, incident response, and evidence of AI governance. Compliance will shift from an annual checkbox to a year-round operational responsibility. Many organizations will lack the internal expertise to meet these demands, driving increased reliance on external partners for regulatory readiness, executive reporting, and safe AI adoption. Regulation will stop being something that happens “upstream” in the enterprise and become a defining force shaping security strategy across the mid-market. (Rob Harrison, SVP, Product Management).
Human-in-the-Loop Will Define MDR
MDR services will be forced to prove-not just claim-that humans are still in the loop. As AI-driven detection becomes table stakes, buyers will demand transparency into who is monitoring their environment, who is making decisions, and where human judgment is applied. MDR services that rely solely on automation will struggle to earn trust, especially during ambiguous, high-impact incidents. The strongest providers will be those that use AI to augment analysts, accelerating investigation, prioritization, and response, rather than replacing them. MDR will differentiate on accountable outcomes, not autonomous claims. (Rob Harrison, SVP, Product Management).
The Real Attack Surface: Your AI Application
We’re likely to see major breaches from prompt injection attacks within the next year. For years, security teams have worked to shrink their internet footprint, knowing that anything exposed increases risk. Firewalls, VPNs, and ZTNA all aimed to reduce that exposure. Now, almost overnight, we’ve created a new attack surface: rapidly deployed AI applications. Many are internet-facing, often unauthenticated, and connected to data many businesses would consider sensitive or confidential. Even more concerning, these applications are being granted the ability to take actions on behalf of the organization. The speed of AI adoption is driving huge efficiency gains, but unless organizations slow down and assess these risks, they’ll reopen exposures we’ve spent decades trying to close. (Tom Gorup, VP SOC Operations).
The Hidden Cost of Speed: Burnout
In 2026, organizations across virtually every industry may start to feel the downside of pushing AI for short-term wins without matching investments in human oversight and system understanding. As day-to-day work leans more heavily on automated reasoning, error rates can rise, not because people care less, but because constant delegation slowly dulls human judgment and pattern recognition. Cognitive overload is likely to become a real operational risk: machine-paced outputs will keep arriving faster and in greater abundance than human-paced decisions can be made, creating backlogs of unresolved work. Automation complacency may spread as teams grow comfortable trusting systems they no longer fully understand, widening the gap between perceived and actual risk. Burnout can increase as AI accelerates the tempo of work beyond what individuals and organizations can sustainably adapt to. And accountability may blur when outcomes are produced by human-machine collaboration, leaving no clear owner when things go sideways. In that environment, speed looks like progress until its hidden cost shows up in reduced stability, weaker resilience, and eroding human capability. (Tom Gorup, VP SOC Operations).
AI Lessons Learned: The Hidden Costs of AI Shortcuts
By rushing to solve short-term challenges with AI, we’ve started creating long-term problems for the security industry and beyond. Each quick fix introduces hidden dependencies, erodes human expertise and skill, and shifts risk into places we aren’t even considering. As teams lean more on automation, human skills will begin to fade, and analysts will start to feel the strain of keeping pace with systems that operate faster than their brains can process. Over time, this could lead to complacency, burnout, and even confusion about accountability. When an AI recommends an action, who truly owns the decision? (Tom Gorup, VP SOC Operations).
From AI-powered social engineering to the insider threat posed by your own AI applications, organizations must prepare for a future where threats from both human operatives and automated systems are increasingly intertwined. It has never been more imperative that organizations utilize and understand AI and continue to innovate to protect their environments.
##
