Few could have imagined how quickly autonomous AI agents would reshape enterprise security in 2025.
Sure, experts expected AI to have an impact, given how rapidly organizations were deploying it and nation-states were using it to discover and exploit vulnerabilities. Then came Anthropic’s disclosure in November of a sweeping AI-orchestrated cyber espionage campaign involving its Claude Code tool, and suddenly the concerns were no longer theoretical. The incident raised the prospect of chained AI agents carrying out continuous phishing, fraud, and data-breach operations at scale, without human oversight.
By year’s end, most industry observers’ attention had shifted from the standard, persistent issues—ransomware attacks, data breaches, credential theft, insider threats—to AI and its very real potential to upend enterprise security.
With a new year upon us, Focal Point gathered guidance from leading cybersecurity experts to identify what chief information security officers (CISOs) and their team members should be watching for in coming months.
Here are our top 11 cybersecurity trend predictions, along with specific recommendations for how to best tackle these challenges:
1. A trusted commercial agentic AI platform will be hijacked and used to attack other platforms
WHY IT MATTERS: Just as attackers have long turned infected machines into botnets to launch large-scale attacks, experts expect threat actors to seize control of a trusted commercial AI platform next year and then use herds of AI agents to target other systems.
“The relative newness of securing agentic AI, the scarcity of experts in this space, and the bespoke nature of security guardrails being put in place today create this kind of exposure.”Bradley J. Schaufenbuel, vice president and CISO, Paychex
“The relative newness of securing agentic AI, the scarcity of experts in this space, and the bespoke nature of security guardrails being put in place today create this kind of exposure,” said Bradley J. Schaufenbuel, vice president and CISO at Paychex. The results could include widespread operational chaos, extensive compromises, and a great loss of confidence in agentic AI, he said.
HOW TO PREPARE: To mitigate such risk, McKinsey recommends treating AI systems more like employees than tools, with clear ownership across onboarding, deployment, and offboarding, ongoing monitoring tied to performance indicators, defined escalation triggers, and explicit accountability for AI-agent actions.
2. Agentic AI worms will spread by injecting malicious prompts into MCPs and code repositories
WHY IT MATTERS: As with Anthropic’s discovery, agentic AI can enable near-autonomous, destructive hacking campaigns, according to Pieter Danhieux, CEO of Secure Code Warrior, and Matias Madou, Ph.D., CTO of Secure Code Warrior.
In a recent roundup of predictions on how DevSecOps will evolve and impact the industry in 2026, they warned that as Model Context Protocol (MCP), an open standard that allows developers to connect data sources with AI tools, gains wider adoption, it will become an attractive target for attackers. Those attackers could exploit MCPs and code repositories by injecting malicious prompts, creating AI worms that spread quietly but cause significant damage.
“Worms are making a comeback.”Tom Kellerman, vice president of cyber risk, HITRUST
“Attacks like this are likely to get worse before they get better,” Danhieux and Madou wrote. “CISOs with low visibility into which AI tools are in use, what they’re connected to, and how they’re interacting with sensitive repositories will find themselves at a distinct and risky disadvantage.”
HOW TO PREPARE: To address that risk, visibility across your entire network is critical. Danhieux and Madou suggest pairing MCP-enabled agentic AI with strong access controls, continuous monitoring, and developers who are trained to think like security professionals.
3. AI’s inability to understand intent will become a security problem
WHY IT MATTERS: Large language models (LLMs) often struggle in situations where understanding intent, motive, or appropriateness matters more than recalling facts. In 2026, Arun Vishwanath, a security consultant and author of The Weakest Link, predicts that some attackers will exploit those gaps by manipulating meaning and context rather than simply trying to trick models with incorrect information.
“LLMs are trained on human expression, not human cognition,” Vishwanath said. “AI can reproduce what people say but can’t infer intent, motive, or appropriateness, which makes them vulnerable to subtle manipulation and intent failures.”
[Read also: How cybersecurity can leverage machine learning and LLMs—a primer for beginners]
HOW TO PREPARE: To minimize such risks, McKinsey advises integrating agentic AI systems into updated risk and governance frameworks that account for the new failure modes introduced when autonomous systems act without human judgment. Embedding structured human review and oversight alongside autonomous capabilities gives teams a better chance to catch intent, context, or reasoning failures before subtle manipulation escalates into a real security issue.
4. Small AI misjudgments will add up to become larger security problems
WHY IT MATTERS: As AI is woven into more day-to-day business decisions, it will have to make judgments, draw on context, and exercise common sense. While these systems may seem confident and capable, they still lack human intuition, which can lead AI agents to make subtle mistakes a person likely would not.
“The real risk from AI isn’t model error; it’s wisdom debt.”Arun Vishwanath, security consultant, author of “The Weakest Link”
In 2026, experts such as Vishwanath expect IT security teams to begin feeling the impact of such missteps as they accumulate, potentially leading to more significant issues. The more missteps that occur, the greater the consequences the network will suffer.
“The real risk from AI isn’t model error; it’s wisdom debt,” Vishwanath said, referring to the accumulation of small judgment mistakes AI systems can make when operating without human intuition. “These systems are fluent but lack judgment. So they make small but consequential mistakes whenever they act without human intuition, which accumulate over time to cause big failures.”
HOW TO PREPARE: Vishwanath says CISOs should start treating this AI-induced cognitive complexity as a measurable risk, and closely monitor it in 2026.
Col. Ed Debish (Ret.), a 27-year U.S. Marine Corps veteran, likens this need for oversight to a PACE plan—Primary, Alternate, Contingency, and Emergency—a military backup strategy that’s essential in modern cyber resilience. “The adage ‘Two is one, and one is none’ underscor[es] that the PACE plan is vital for ensuring essential capabilities remain operational,” noted Debish, who today serves as an executive client adviser supporting federal teams for Tanium, a leading cybersecurity solutions provider (and publisher of this magazine).
“Organizations, especially in the military, government, and critical infrastructure sectors, cannot afford single points of failure,” Debish added, especially as AI and technology-in-depth strategies become embedded in modern-day cybersecurity. Put simply: AI is a tool in your cyber arsenal, not a one-and-done cure-all. “A resilient ecosystem,” he explained, “requires layered capabilities, verified readiness, and continuous visibility.”
5. Skilled developers will stay relevant as AI struggles with judgment-heavy security decisions
WHY IT MATTERS: AI security tools are promising and powerful, but their underlying LLMs might not meet the needs of most IT security departments.
“Organizations, especially in the military, government, and critical infrastructure sectors, cannot afford single points of failure.”Col. Ed Debish (Ret.), U.S. Marine Corps veteran and executive client adviser supporting federal teams, Tanium
In 2025, for example, studies found that LLMs couldn’t consistently distinguish between vulnerable and safe code because they struggle with more subjective, contextual vulnerabilities such as authentication, access control, and security.
“These categories represent common, serious threat vectors that will only be exacerbated by the use of AI coding tools, especially given the speed at which they can produce functional code,” Danhieux and Madou note, predicting such gaps will continue to demand skilled developers in 2026.
HOW TO PREPARE: Organizations should treat these areas as high-priority learning paths for developers, particularly those in enterprise environments where AI coding assistants are becoming part of everyday workflows. Given the enormous popularity of these new AI coding tools, “secure by design” should also be a guiding principle, Danhieux told Focal Point.
That means building security into software from inception. “A functional ‘secure by design’ initiative, upheld by security-proficient developers, is the antidote to out-of-control technical debt and costly late-stage security measures,” Danhieux said
6. CISOs will feel more pressure to use AI for defensive purposes—but few will succeed
WHY IT MATTERS: Ninety-five percent of cybersecurity professionals believe AI can help improve the speed and efficiency of their efforts to prevent, detect, respond, and recover from threats, according to a Darktrace survey. But David Gee, former HSBC CISO and an Australia-based risk adviser to boards of directors, doubts many will succeed in implementing defensive AI tools anytime soon.
“Given that most have resource constraints and lack their own cyber AI strategy, I would predict that only 20% of CISOs will be able to achieve this requirement,” Gee said.
HOW TO PREPARE: Progress might actually depend less on adopting AI-powered defenses than on strengthening the fundamentals those tools rely on. As organizations look to deploy AI for security operations, they need platforms that provide clean, real-time visibility across endpoints and environments, along with the ability to act quickly when things go wrong.
7. AI will finally help CISOs tackle complexity
WHY IT MATTERS: For decades, enterprise security has been deliberately simplified to make it easier for humans to understand and operate protection models. That approach favored manageability over resilience.
“For the past 30 years, we’ve been simplifying and homogenizing security so that humans can understand our protection models. With agentic AI, we will no longer have such limitations.”Tim Brown, CISO, SolarWinds
In 2026, experts expect agentic AI products to automate and streamline core security functions, including vulnerability management, red teaming, and penetration testing. SolarWinds CISO Tim Brown, for one, sees AI enabling a shift toward security architectures that embrace complexity as a feature rather than a liability, allowing enterprises to design environments that are more resilient than humans alone could realistically manage.
“For the past 30 years, we’ve been simplifying and homogenizing security so that humans can understand our protection models,” he said. “With agentic AI, we will no longer have such limitations.”
HOW TO PREPARE: Look for autonomous IT tools and platforms that can help facilitate this shift, which is already underway. Companies like Microsoft, for example, are rolling out AI security agents to triage alerts and prioritize vulnerabilities at scale, while industry forums such as RSA Conference 2025 highlight the rise of AI in modern security operation centers (SOCs).
8. Security analysts will begin managing AI agents alongside people
WHY IT MATTERS: It remains to be seen how common autonomous AI agents will be in the enterprise or whether multi-agent scenarios, where teams of agents collaborate, will be technically feasible in 2026. But if the technology advances as rapidly as it did in 2025, experts like Taylor Lehmann, director of healthcare and life sciences in Google’s Office of the CISO, imagine IT security org charts changing.
“AI adoption will transform security analysts’ roles, shifting them from drowning in alerts to directing AI agents in an agentic SOC,” Lehman wrote in a blog. “This will allow analysts to focus on strategic validation and high-level analysis, as AI handles data correlation, incident summaries, and threat intelligence drafting.”
HOW TO PREPARE: Organizations need to create discrete boundary definitions for authorizing, authenticating, and monitoring each agent, Lehmann advises.
9. CEOs and boards will face increased scrutiny after major cyber events
WHY IT MATTERS: CISOs and chief security officers (CSOs) have historically borne much of the blame following costly cyberattacks. Former Uber CSO Joe Sullivan was convicted in federal court on charges of obstructing justice related to a 2016 breach. Equifax CISO David Webb and CSO Susan Mauldin left their jobs after a massive 2017 data breach exposed the records of more than 143 million people. And SolarWinds’ Brown was initially charged by the SEC for his handling of disclosures about malicious code being injected into his company’s widely used software in 2019 (Brown spoke to Focal Point after a preliminary settlement).
“For too long, CISOs have taken the fall for breaches… while the people who make the real financial decisions walk away untouched. That era is ending.”John Kindervag, former Forrester analyst
That dynamic may be shifting. In early September, the board of Australia’s Quantas Airways deducted more than $500,000 from the paychecks of its CEO Vanessa Hudson and other executives following a June cyber incident exposing the records of more than 6 million passengers.
John Kindervag, a former Forrester analyst who coined the security term “zero trust,” predicts executive accountability for cyber incidents will finally land where it belongs: in the boardroom.
“For too long, CISOs have taken the fall for breaches they could not prevent because they lacked authority, resources, or budget,” he said. “They get blamed while the people who make the real financial decisions walk away untouched. That era is ending.”
[Read also: Boards and brand reputation—7 steps to boost investor and consumer confidence]
HOW TO PREPARE: Enterprises should institute performance contracts and compensation structures that tie executive pay to measurable cybersecurity outcomes. Kindervag believes we’ll see more of that soon. Such accountability will push CEOs to issue “executive orders” within their organizations, making it clear that cybersecurity is not optional, that zero trust is the standard, and that prevention without containment is not enough, he said.
“Only when the people at the top start feeling the consequences will cybersecurity mature from a cost center into the structural engineering of modern business,” Kindervag said.
10. Boards will insist CISOs put a dollar value on breaches
WHY IT MATTERS: As senior leaders face more scrutiny after breaches, experts such as Crystal Lister, a Google security adviser in the CISO’s office, say boards will raise their expectations of security teams beyond just outlining the threat landscape.
“CISOs take note: Boards are asking us about business resilience and the impact of advanced, machine-speed attacks—like adversarial AI and securing autonomous identities such as AI agents,” Lister noted.
HOW TO PREPARE: CISOs must be ready to quantify risk in business terms, including what security investments are delivering, what a breach could cost, and how cyber incidents affect the bottom line. “Have your dollar figures ready, because this is the new language of defense for boards.”
11. Healthcare CISOs will measure cyberattack impact by hospital closures rather than downtime
WHY IT MATTERS: Rising operational and labor costs have already pushed many healthcare organizations to the edge. Twenty-two hospitals closed in the first 10 months of 2025 alone, according to Errol Weiss, CSO at Health-ISAC, an industry consortium that enables healthcare organizations to share cybersecurity threat intelligence and response insights.
For small facilities operating on thin margins, the financial impact of a cyberattack, which can reach millions of dollars in remediation costs and lost revenue, can be fatal. Weiss noted that attacks are increasingly forcing hospitals that were already struggling to shut their doors permanently, leaving entire communities without local care and contributing to the urgent and growing problem of healthcare deserts throughout the U.S.
HOW TO PREPARE: For healthcare centers, ramping up third-party risk management will be key, as hospitals regularly exchange vital patient data with local physicians’ offices—small-to-medium-size businesses with few resources to spend on cybersecurity. And those vendors add up. For example, Sutter Health, a not-for-profit healthcare system that runs clinics across Northern California, has 24,000 vendors. “We need to spend time finding ways to help our third parties address cybersecurity in the same way we do,” said Sutter CISO Jacki Monson.
Health-sector enterprises can access breaking threat info—including vital patch management announcements—on the American Hospital Association’s cybersecurity and risk webpage. In September, the AHA and Microsoft expanded their Rural Health Resiliency program, which includes free cyber assessments and AI training at rural hospitals. And Health-ISAC offers tech solution summits, webinars, and workshops.
"For rural healthcare, a breach is no longer just an operational crisis,” Weiss said. “It’s an extinction event."