Gen AI phishing surged 1,265% by late 2024. Breakout time is now 48 minutes, with the fastest observed at 51 seconds. Microsoft is blocking roughly 600 million identity attacks per day.
I do not read that as “more noise.”
I read it as a structural shift in how breaches happen, how fast they unfold, and what leaders will be judged on in 2026.
This article captures the seven predictions I expect to hit hardest, why they matter operationally, and what I would do about each one.
Who this is for
- CISOs and security leaders who need board ready priorities for 2026
- Identity, cloud, and appsec leaders dealing with credential driven intrusion and non human sprawl
- OT and critical infrastructure teams managing convergence risk
- Risk leaders looking for measurable resilience outcomes, not more tooling
How I suggest you use this
- Pick the three predictions that map to your highest business consequence.
- For each one, adopt the 90 day actions and the metrics.
- Run one table top exercise per quarter where prevention is assumed to fail.
If you only read one section, read this.
In 2026, I expect breaches to be defined by:
- AI compressing the kill chain, including impersonation fraud
- SOC automation replacing manual triage as a survival requirement
- Identity becoming the definitive perimeter
- Non human identities becoming the largest unmanaged attack surface
- OT convergence turning cyber events into operational disruptions
- Cyber insurance underwriting forcing baseline controls through evidence
- Supply chain exposure becoming a board level event due to blast radius
1) AI powered attacks move from “better lures” to kill chain compression
The headline is phishing. The reality is speed.
AI is collapsing the time between reconnaissance, targeting, and execution. The attacker no longer needs days of crafting. They iterate at machine tempo until something works.
What is changing
- AI generated phishing can drive 54% click through versus 12% for human crafted campaigns
- Deepfake fraud increased 1,740% in North America (2022 to 2023)
- The Arup Hong Kong incident showed multi executive impersonation and $25.5M moved through 15 transactions
How it shows up in real operations
- CFO and treasury are not “duped.” They are socially engineered through convincing identity artifacts across video, voice, email, and chat
- Approval chains get weaponized. The attacker does not break controls. They reroute them
- The first failure is usually not technology. It is process. Who can approve. Who can override. Who can escalate
The leading indicators I watch
- Payment and vendor change requests that arrive with urgency and authority cues
- “Out of band” validation that is still within the same compromised channel family
- Exception paths that bypass dual control during travel, after hours, or peak business cycles
What I would do in the next 90 days
- Treat voice and video as untrusted for high value actions. Use a separate verification control
- Lock high risk workflows behind strong identity and step up authentication, not just finance policy
- Run deepfake table top exercises with treasury, procurement, and HR. Test the humans and the process, not only the SOC
The metrics that matter
• Time to validate a high value request across a separate channel • Percent of privileged approvals that require step up authentication • Number of exception paths still active after 30 days
2) The SOC will not become autonomous, but it will become unrecognizable
The fantasy is a fully autonomous SOC.
The 2026 reality is a SOC that either uses automation aggressively or drowns.
What is changing
- Analysts can receive 960 to 4,484 alerts per day
- Up to 90% can be false positives
- Burnout is now an availability problem for the business
How it shows up in real operations
- Alert review becomes performative. People clear queues. The attacker moves
- Detection gets better, but decisioning gets worse. More telemetry, less certainty
- Every new tool increases surface area unless you reduce overlap and standardize response playbooks
The shift I push in mature teams
From “How many alerts did we process” to:
- Time to detect
- Time to decide
- Time to contain
- Time to restore
What I would do in the next 90 days
- Eliminate duplicate detections that create noise. One detection per outcome
- Automate the first 80 percent of predictable actions: enrichment, isolation steps, identity disablement, block lists
- Build an escalation ladder that forces clarity on containment authority
The metrics that matter
- Alert to action ratio for high severity events
- Percent of incidents where containment occurred within the first hour
- Analyst hours spent on triage versus response engineering
3) Identity becomes the definitive perimeter
I am seeing breach entry move away from malware and toward credentials, sessions, and tokens.
Identity is no longer a security domain. It is the security domain.
What is changing
- 22% of breaches begin with stolen credentials
- 79% of intrusions are malware free
How it shows up in real operations
- The attacker walks in like a user and lives inside legitimate tools
- Traditional perimeter signals fail because the activity looks “normal”
- Post compromise actions happen through SaaS, SSO, and remote management platforms
The blind spots I keep finding
- MFA everywhere except the one portal that matters
- Conditional access policies that exist, but are filled with exceptions
- Session theft and token replay that bypass “password hardening” programs
What I would do in the next 90 days
- Treat identity telemetry as a first class detection surface: impossible travel, atypical consent grants, high risk token usage
- Harden recovery paths: break glass accounts, help desk reset workflows, admin impersonation protections
- Make containment identity native: revoke sessions, rotate tokens, kill refresh tokens, not just isolate endpoints
The metrics that matter
- Time to revoke sessions for a compromised identity
- Percent of privileged access protected by phishing resistant MFA
- Number of identity related incidents where endpoint telemetry was irrelevant
4) Non human identities become the biggest unmanaged attack surface
This is where many modern organizations are most exposed and least honest.
Machine identities outnumber humans by orders of magnitude, and they are over privileged by default.
What is changing
- Machine to human identity ratio reported at 144 to 1
- Identity breaches frequently trace back to service accounts, tokens, and API keys
How it shows up in real operations
- A leaked key is not a “secret problem.” It is an access problem
- Service accounts accumulate privileges silently because nobody owns them end to end
- CI CD and automation pipelines become the new admin console
The failures I see repeatedly
- No inventory of non human identities that matter
- No owner for secrets rotation and expiry
- Static credentials living in code, config files, and build logs
What I would do in the next 90 days
- Build a non human identity inventory tied to business services, not tools
- Enforce rotation, expiry, and least privilege with technical guardrails
- Instrument detection for anomalous machine identity behavior: new geo, new workload, new API patterns, privilege escalation
The metrics that matter
- Percent of machine identities with an owner, purpose, and expiry
- Percent of service accounts with least privilege baselined and enforced
- Mean time to rotate exposed secrets in production
5) OT and IT convergence turns cyber risk into operational risk
The air gap is not a strategy. In 2026, the operational question is not “Can we prevent intrusion.” It is “Can we keep operating safely while we contain and recover.”
What is changing
- OT environments commonly run multiple remote access tools
- Industrial ransomware continues to rise, with manufacturing a dominant target
- Real world outcomes increasingly include service disruption, not just IT impact
How it shows up in real operations
- Remote access becomes the primary control failure, not a sophisticated exploit
- Vendor pathways are the quiet entry point. Contracts define access. Reality ignores contracts
- Safety and production pressure create exception debt that never gets repaid
What I would do in the next 90 days
- Map every remote access path into OT and assign an owner. If nobody owns it, it is a liability
- Segment by consequence, not convenience. The most critical processes must be the hardest to reach
- Build an OT incident playbook that prioritizes safe state operations, not IT style containment that risks instability
The metrics that matter
- Number of remote access paths into OT with named ownership and approvals
- Time to isolate a compromised vendor pathway without shutting down production
- Frequency of tested safe state and recovery procedures
6) Cyber insurance becomes a security forcing function
Premiums stabilizing does not mean requirements are relaxing.
Underwriting is increasingly acting like an external audit with real consequences.
What is changing
- A large share of applications are denied on first submission
- Missing MFA remains a consistent rejection driver
- Business Email Compromise and funds transfer fraud represent a major claim category
How it shows up in real operations
- Controls that are “in progress” do not count
- Evidence matters more than intent. If you cannot prove it, you do not have it
- Insurance requirements start driving budget and priority faster than risk registers
What I would do in the next 90 days
- Build evidence packs continuously: screenshots, logs, restore tests, policy enforcement outputs
- Focus on the controls underwriters consistently care about: MFA, EDR coverage, backup immutability, recovery tests
- Use underwriting findings as an accelerator for executive alignment
The metrics that matter
- Percent of endpoints with verified EDR coverage and monitoring
- Backup restore test frequency and success rate
- Time to produce an evidence pack for top controls within 24 hours
7) Supply chain breaches become a board level event, not a security metric
Third party risk is no longer about vendor questionnaires.
It is about blast radius.
What is changing
- Third party involvement is now placed around 30% of breaches
- One exploited product can cascade across thousands of organizations
How it shows up in real operations
- A supplier incident becomes your incident, with your brand carrying the cost
- Software supply chain exposure shows up as trust in build systems, updates, and dependencies
- Procurement cycles reward speed, while security risk accumulates silently
What I would do in the next 90 days
- Classify suppliers by business consequence and required assurance, not spend
- Demand proof for the few controls that matter: secure build practices, vulnerability disclosure, patch SLAs, access boundaries
- Design for containment: least privilege integrations, segmented data access, kill switches for third party connectivity
The metrics that matter
- Percent of critical suppliers with validated assurance evidence
- Time to disable a third party integration without business collapse
- Number of high consequence integrations operating with least privilege
The leadership takeaway
In 2026, I am not asking, “Are we protected?”
I am asking, “When it breaks, how fast can we contain it, keep operating, and recover with credibility?”
If you want one practical exercise, do this.
Pick your most critical workflow, one identity pathway, and one supplier connection.
Then ask a brutal question.
If that fails tomorrow, can we still operate by end of day.
The comment prompt
If you want to pressure test your program, tell me which sector you operate in and which of the seven is your biggest risk driver. I will tell you what I would measure first.
#CyberSecurity #CISO #IdentitySecurity #OTSecurity #SupplyChainSecurity #CyberResilience