Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Chad LeMaire, CISO, ExtraHop
As we enter 2026, AI is becoming embedded across the enterprise and attackers are increasingly exploiting interconnected ecosystems to compromise several organizations at once.
Because of this, security leaders, including CISOs and CSOs, must shift from reactive defense to strategic governance, treating AI as a core security responsibility, prioritizing identity-centric controls, and preparing for adversaries who move faster, smarter, and deeper than ever before.
Nation-State Threats Will Become Smarter, Broader and AI-Driven
In 2026, nation-state threats will expand and evolve with AI-driven exploits becoming the tool of choice. These actors are no longer focused solely on governments or critical infrastructure: they’ll increasingly target the private industry just as aggressively, recognizing that disrupting supply chains, financial systems, and major contractors can destabilize economies and indirectly impact government operations.
Unlike the noisy, high-impact attacks of the past, today’s campaigns are defined by patience and precision, with actors embedding themselves deep within networks and waiting for the right moment to strike. As the line between espionage and disruption blurs, security teams must prioritize the most likely and most dangerous threats.
AI is amplifying these operations, as already seen with a Chinese state-sponsored group orchestrating the first agentic-AI cyber espionage campaign, giving sophisticated adversaries the ability to automate reconnaissance, accelerate exploitation, and deploy adaptive, self-learning tools that operate with minimal human control. As a result, defenders will face opponents who can act faster, think longer, and strike smarter. CISOs must treat nation-state activity as a core business risk and elevate their defenses accordingly by building intelligence-led programs that anticipate, simulate, and counter the next generation of AI-powered attacks. Every organization, public or private, is part of the nation-state battlefield.
Supply Chain Attacks Will Dominate 2026
Supply chain and third- and fourth-party access, applications, and data are increasingly becoming a prominent attack vector that will expand into 2026. Attacks like the Salesforce-Salesloft Drift attack will become increasingly common. Rather than having to gain access to hundreds of organizations one at a time, threat actors can exploit one and have immediate access to hundreds or even thousands of organizations.
In order to combat these risks, it’s imperative that companies implement zero trust principles and concepts, and it all starts with identity. Protecting identities and ensuring that every user, device, and vendor connection is verified and continuously monitored is crucial. Companies that fail to invest in robust identity architecture will struggle to manage access and visibility across complex partner ecosystems and will be open to a wave of incoming supply chain attacks.
From Smash-and-Grab to Strategic Infiltration: The New Era of Ransomware Tactics
The continuum of ransomware tactics will range from quick, opportunistic “smash-and-grab” attacks to calculated, strategic operations, making post-compromise detection, granular visibility and threat intelligence a priority in 2026.
While the overall number of incidents may be decreasing, the sophistication and financial impact of each attack is rising sharply. Groups like LockBit are spending more time moving laterally within networks before deploying malware, maximizing leverage and potential ransom demands. Nation-states, on the other hand, are dwelling quietly inside systems, waiting for the most advantageous moment to strike-often combining data theft, extortion, and operational disruption.
This evolution underscores a shift from volume-based attacks to high-value, precision strikes. Defenders must therefore broaden their defenses beyond endpoint protection to include comprehensive visibility and rapid detection of lateral movement. As attackers grow more patient and methodical, proactive threat hunting and intelligence-driven defense will be essential to counter the next wave of ransomware campaigns.
AI-Integrated SOC Will Become a Cybersecurity Imperative
After a year of rapid experimentation, security leaders have realized that the biggest challenge with AI integration isn’t capability, but control. Many expected AI to be fully integrated into the SOC by now, but rushing deployment created more risks than efficiencies. A lack of clear governance, oversight, and testing frameworks inadvertently expanded the attack surface rather than reduced it.
With new standards like ISO 42001 emerging, it’s clear that AI must be treated as part of overall cyber risk, not a standalone innovation. Every AI system interacts with your network, your data, and your people, which means the risks fall squarely within the CISO’s domain.
Going into the new year, CISOs who recognize this shift and take ownership of AI as a security imperative will lead the way. They’ll move beyond enablement to enforcement, prioritizing ethical testing, continuous validation, and adversarial simulation to ensure AI strengthens, rather than undermines, defense. The next year of cybersecurity won’t favor those with the most advanced AI models, but those who integrate AI into business architecture and decision-making systems and processes with the smartest and most secure guardrails around them.
In 2026, the organizations that succeed will be those that approach cybersecurity with precision, intelligence, and discipline. The future of cybersecurity favors defenders who build resilience not just through advanced tools, but through smarter strategy and unwavering security rigor.
##
ABOUT THE AUTHOR
Chad E. LeMaire is deputy chief information security officer (CISO) at ExtraHop, a leader in modern network detection and response (NDR). Prior to ExtraHop, Chad served in the US Air Force for 31 years, where he held five senior level roles developing and implementing cybersecurity strategies and capabilities.
