As 2025 draws to a close, it’s time to look back at the cyber landscape. This year wasn’t just about more threats; it was about smarter, more targeted attacks. While the headlines focused on massive data dumps and ransomware payments, the real stories are in the how and why.

If we learn from the major incidents of 2025, we can see three clear lessons that every business must take into 2026.

1. The Lesson from the Supply Chain

This year was dominated by third-party and supply chain attacks. We saw multiple instances where attackers didn’t breach a multi-billion dollar company directly. Instead, they found a vulnerability in a smaller, trusted software vendor that served hundreds of other companies.

By breaching the one, they gained access to the many.

• The Lesson: Your security perimeter is no longer your own four walls. It extends to every vendor who has access to your data or network. Vetting your vendors, reviewing their security posture (like their SOC 2 report), and managing third-party risk is no longer optional—it’s a core survival function.

Sources for this lesson:

• The 2025 Software Supply Chain Security Report (ReversingLabs): This report highlights the growing compromises in open-source libraries that are embedded in commercial software.
• The Growing Risk of Supply Chain Attacks in 2025 (Avatao): Details how attackers infiltrate trusted upstream components (like software updates) to “ride” into downstream customer networks, emphasizing guidance from CISA.
• Top 10 Most Overlooked Supply Chain Cyber Risks in 2025 (RiskLedger): Identifies critical blind spots, including dependencies on open-source software and unvetted cloud (SaaS) solutions.

2. The Lesson from AI-Powered Scams

We’ve moved beyond the typos of traditional phishing. In 2025, AI-powered social engineering went mainstream. We saw the rise of convincing “vishing” (voice) attacks using AI-cloned voices of CEOs to request fraudulent wire transfers. We also saw “quishing” (QR code) attacks bypass email filters entirely.

• The Lesson: You cannot rely on employee training alone to stop this. While a well-trained team is your best defense, it must be supported by rigid processes. For high-risk actions (like transferring money or changing credentials), your policy must include out-of-band verification—like a phone call to a known number—that doesn’t rely on the channel making the request.

Sources for this lesson:

• AI-Generated Phishing: The Top Enterprise Threat of 2025 (StrongestLayer): Explains how attackers use generative AI to craft hyper-personalized emails and even deepfake videos to conduct scams.
• Phishing 2025: Why It Still Fuels 60% of Cyber Attacks (Revel8): This analysis shows the rise of “quishing” (QR-code phishing) and vishing as a way to bypass traditional link scanners.
• How AI-Generated Content is Fueling Next-Gen Phishing (Security Boulevard): Reports that over 82% of phishing emails now utilize AI language models, making them grammatically perfect and highly convincing.

3. The Lesson from Identity Theft

The most “boring” and “basic” attack vector remained the most effective: stolen credentials. The majority of breaches this year were not the result of a complex, zero-day exploit. They were the result of a simple, stolen password, often one that was re-used on multiple sites and not protected by Multi-Factor Authentication (MFA).

• The Lesson: Identity is the new perimeter. Investing in complex network defenses is useless if an attacker can simply log in with valid credentials. Rolling out MFA across your entire organization is the single most effective security investment you can make. It is non-negotiable for 2026.

Sources for this lesson:

• 2025 Verizon Data Breach Investigations Report (DBIR) (Verizon): A foundational report showing that the use of stolen credentials remains a dominant initial access vector in breaches.
• 2025 Multi-Factor Authentication (MFA) Statistics (JumpCloud): Highlights a critical Microsoft statistic that over 99.9% of compromised accounts do not use MFA, proving its effectiveness.
• 60+ Key Data Breach Statistics for 2025 (Spacelift): Provides a stark statistic that as many as 86% of data breaches involve stolen credentials in some way.

Final Thoughts

Looking back, the theme of 2025 is clear: attackers exploited our assumptions of trust. They attacked our trust in vendors, our trust in “normal-looking” communications, and our trust in simple password-based authentication.

The clear mandate for 2026 is to adopt a “Zero Trust” model.

This isn’t just a buzzword; it’s a fundamental security strategy with a simple mantra: “Never trust, always verify.”

A Zero Trust mindset assumes that a breach is not just possible, but has already happened. It scraps the old idea of a “trusted” internal network and a “dangerous” external internet. Instead, it treats every user, device, and application as potentially hostile, regardless of where it is.

Here is what “Never trust, always verify” looks like in practice, applied to the lessons from this year:

1. For Vendor Risk: We no longer “trust” a vendor just because they are connected to our network. We implement least-privilege access, ensuring their software has the absolute minimum permissions necessary to function. We continuously monitor their connections, not just a one-time security questionnaire.
2. For AI-Powered Scams: We no longer “trust” an email or a voice just because it seems familiar. We build processes that verify high-risk requests out-of-band (e.g., a phone call to a known number to confirm a wire transfer). We verify the identity behind the request, not the request itself.
3. For Identity Theft: We no longer “trust” a simple password. We verify identity with Multi-Factor Authentication (MFA). We move to a model where identity is the new perimeter, and we continuously validate that identity by checking device health, location, and user behavior before granting access to any resource.

The goal for 2026 is to remove implicit trust from our systems and replace it with explicit, continuous verification. That is the only way to build a resilient defense against the threats of today and tomorrow.

---

Discussion

What was the most significant security event or trend for you this year? What’s the #1 lesson you’re carrying into 2026?

Sources

• Forrester: Top Cybersecurity Predictions For 2026
• Verizon: 2025 Data Breach Investigations Report (DBIR)
• Gartner: 2025 Identity and Access Management Trends

---