Usman Choudhary, Chief Product and Technology Officer, at the cyber firm VIPRE Security Group, some security trends that he suggests will dominate in 2025.
AI-powered phishing presents the biggest cybersecurity challenge for small and medium enterprises:
In 2025, AI-driven phishing will evolve into a more sophisticated and stealthy threat. Cybercriminals will leverage AI to craft highly personalised attacks using publicly available data and advanced language capabilities, making these scams increasingly difficult to detect. This emerging strategy of threat actors involves multi-stage attack chains where initial communications appear innocuous, gradually building trust before delivering malicious payloads.
Attackers will specifically target platforms like Microsoft 365 and Google Workspace, exploiting their inherent limitations for credential harvesting. Ransomware actors will develop “hybrid” campaigns that blend phishing techniques with nuanced social engineering, manipulating recipients into unwittingly downloading dangerous files.
Small and medium enterprises (SMEs) are at risk of becoming prime targets due to their limited cybersecurity resources. Criminals will not only directly attack these organisations but also use them as strategic entry points for more extensive supply chain attacks into larger enterprises.
Adoption of AI-driven email drafting tools will potentially lead to increased mis-delivery-related data breaches
Already, misdirected emails have become a critical cybersecurity concern. Potentially, it is the most common cyber incident reported to the UKโs Information Commissionerโs Office (ICO) from a GDPR compliance standpoint.
The rise of hybrid work model and the use of personal devices for work-related tasks often leads to misdirection of email, incorrect file attachments, and miscommunication. Auto-complete and auto-correct features in popular email clients such as Outlook and Gmail further exacerbate the risk of misdirected emails, especially as often multiple contacts have similar names.
As the adoption of AI-driven email drafting tools grows in 2025, the potential for data breaches triggered by misdirection increases exponentially. These advanced email writing assistants not only draft content but also suggest recipients based on historical patterns, introducing an additional layer of complexity. The consequences can be severe and costly. A single misdirected email can expose sensitive information to unintended recipients, highlighting the importance of vigilance and careful review in todayโs increasingly automated communication environment.
The exploitation of supply chain vulnerabilities through AI-generated malware will increase:
The cybersecurity landscape in 2024 witnessed a noticeable increase in the use of malware by cybercriminals to breach corporate networks, leading to widely publicised data leaks and reputational damage for the organisations involved. Likewise, criminals exploited supply chain vulnerabilities to infiltrate systems and cause severe disruptions, highlighting the far-reaching consequences of software integrity failures.
In 2025, cybercriminals are poised to deploy AI-generated malware to breach both corporate networks and exploit supply chain ecosystems for vulnerabilities. They will leverage AI to develop highly evasive malware to bypass traditional detection methods while also automating vulnerability scanning and phishing. To neutralise these threats, security professionals will need to respond with equally proactive and innovative defensive strategies, including seamlessly integrating zero-trust architecture, embedding AI-powered tools, and implementing rigorous software development practices into their operational workflows.
Mounting data breach costs and regulatory burden will amplify security awareness training urgency:
In 2024, enterprises faced an increasingly challenging cyber threat landscape, as cybercriminals successfully exploited the most advanced technologies, including AI, to breach organisations and cause mayhem. Research shows that the average cost of a data breach reached an all-time high with the global average cost of a data breach estimated at USD 4.88 million. Human error still remains the number one reason for a successful data breach.
To address this continuously intensifying situation, the regulatory burden is set to increase even more in 2025. The EU AI Act, which has already taken effect, has significant implications for organisations using AI in their operations, including cybersecurity and privacy. In the US, several states have either enforced or are enacting Data privacy laws in 2025, with all looking to address the collection, use and disclosure of personal data. These laws impose various obligations on businesses, including data protection, breach notification, and consumer rights.
