Industry executives and experts share their predictions for 2025. Read them in this 17th annual VMblog.com series exclusive.
By Michael Smith, Field CTO for DDoS Mitigation and Application Security at Vercara
As we bid farewell to 2024, it is a moment to reflect on the year behind us and what lies ahead. For many, 2024 marked the rise of Generative AI, with countless innovations reaching the public. However, for cybersecurity professionals, the year underscored an ongoing reality: the relentless growth in the scale, frequency, and impact of cyberattacks. At Vercara, we experienced over three times as many Distributed Denial of Service (DDoS) attacks in 2024 compared to 2023 – a stark reminder of the escalating threat landscape.
The cybersecurity sector also grappled with a profound truth about AI: it is a double-edged sword. On one hand, AI enhanced our defensive capabilities, automating workflows and reducing effort while making our tools more intelligent. On the other hand, it empowered attackers, increasing their productivity and success rates through tactics like social engineering and phishing. Nation-state actors also leveraged AI, heightening threats to U.S. and NATO critical infrastructure.
In 2025, the integration of AI and cybersecurity will continue to deepen, unlocking advanced defensive capabilities – but also introducing new types of threats and attacks that are “AI-powered.” The result will be a cyber threat landscape that is both more secure, but at the same time, even more vulnerable.
AI: The key ingredient to rising attack ROI
Businesses use AI to increase productivity, reduce the time to go to market with new capabilities, and increase their ROI. Cybercriminals are no different, and we can expect them to use AI to grow their ROI and reach record levels in 2025.
In 2024, AI and automation played a significant role in numerous cyber incidents. These technologies were used in numerous ways, from targeted attacks on individual companies to widespread misinformation during the election. These tactics proved alarmingly effective, with many falling victim to their impact. The ability to adapt messages in real-time and analyze media and social media content with precision are trends that are likely to persist and evolve in the years ahead.
Attackers will be leveraging AI to create more personalized and convincing phishing and social engineering campaigns. By analyzing an individual’s semi-public social media presence, they can use AI-generated deep fakes to impersonate them and exploit the trust of others. These deep fakes can deceive colleagues, business leaders, or even institutions like financial services, healthcare providers, and mobile carriers. Until effective methods are developed to identify and counter these techniques, many individuals will have their sensitive information compromised through this tactic.
AI’s role in credential stuffing attempts
The cybersecurity industry has dedicated significant effort helping users recognize the telltale signs of phishing emails – hovering over links to check their destination, examining the sender’s address, and noticing when an email lacks personalization, such as your name. Over time, spotting phishing attempts becomes easier with experience. However, the rise of AI has made phishing attacks more effective, enabling emails to appear highly personalized and alarmingly authentic.
Cybercriminals are not just crafting more convincing phishing emails – they are also creating fake phishing sites that mimic legitimate ones, tricking users into entering their login credentials. Once they capture your username and password, they often employ tools for credential stuffing, testing those stolen credentials across multiple websites to exploit reused passwords. With a compromised account in hand, attackers can launch a range of follow-up actions, such as withdrawing funds, placing unauthorized orders, or impersonating users to exploit their access for further malicious activities.
AI and automation empower attackers to deploy phishing sites more quickly and with greater variation, making them harder to detect. These technologies also enable the rapid development of credential stuffing plugins, allowing their tools to target a wider range of websites. Additionally, they significantly shorten the timeline of entire phishing process from sending an email to turning those stolen credentials into profit.
Everybody needs to step up their cyber hygiene next year, whether that be businesses or the everyday consumer. The best defense against the rising threat of phishing and account takeovers is establishing strong security controls and leveraging advanced protective AI to counteract malicious AI. Businesses should adopt solutions such as advanced bot detection, single sign-on, multi-factor authentication, workflow authentication for sensitive actions, and enforced password rotations. These strategies are essential to safeguarding organizations, their employees, and their customers from evolving AI-powered cyber threats.
Nation-state activity heating up
The government, public and private businesses, and citizens are increasingly concerned about the threat of nation-state cyber activity, especially those on critical infrastructure and during significant events like the US and Europe elections. A recent Vercara survey found that ransomware, nation-state attacks, and phishing are the types of attacks consumers are most concerned about in the new year.
In 2024, we witnessed significant threats from nation-state actors on U.S. and NATO critical infrastructure, impacting organizations like water processing plants, telecommunications companies, and government agencies. Geopolitical conflicts are likely to remain and grow, and we will see increased threats from Russia, China, Iran, and North Korea.
Many nation-states’ governments support, or at least tolerate, large ransomware groups, such as Lazarus Group and BlackCat. Ransomware-as-a-Service (RaaS) activity on U.S. critical infrastructure will escalate in the new year. Nation-state cybercriminals will also continue using AI to their advantage. As we saw in several national elections in 2024, cybercriminals will even go as far as using AI to generate disinformation content impersonating public figures. They will then use AI-backed social media bots as a message amplifying network to make disinformation campaigns more widespread and still stay personalized and believable.
Businesses that do not prioritize protection against these attacks will be especially vulnerable, putting customer trust and data at a heightened risk. Organizations responsible for critical infrastructure will need to fortify defenses against cyberattacks, especially as nation-state hackers continue to evolve, leveraging the advancements of AI to become even more advanced and harder to detect.
2025: the year of upleveling defenses
Considering 2024’s major trends in cybersecurity – from some of the most significant attacks and AI’s emergence in attack sophistication and defenses to increasing nation-state threats and risks to U.S. critical infrastructure – business leaders are approaching the new year with heightened awareness.
While we can only make an educated guess about what will happen in 2025, one thing is for sure: the importance of preparedness and current knowledge on cybercriminal tactics, techniques, and procedures. Cyber risk and the impact of a cyberattack should be viewed as a business risk, and it is critical that all leaders are aligned on plans, strategies, and enlisting technologies and skilled staff necessary to protect themselves, their employees, and their customers.
##
ABOUT THE AUTHOR
Michael Smith is the Field CTO for DDoS Mitigation and Application Security at Vercara. He is responsible for the organization’s overall technology strategy including product management, threat intelligence, customer support, and sales and channels enablement. Smith initially started as a Russian translator in the U.S. Army, before serving in CTO roles in startups and information security officer roles leading major government security projects. With over 30 years of experience in cybersecurity, information technology, and intelligence, he has managed high-profile incidents such as the wave of DDoS attacks against major U.S. banks in 2012 and 2013 and attacks by e-commerce account takeover gangs, as well as security monitoring for the 2014 FIFA World Cup and 2014 Winter Olympic Games, and preparations for both the 2018 and 2020 Olympic Games.
