Imagine venturing on a long trip in your old car without giving it a prior brake or tire inspection.  In this case, you’re running only on hope that you’ll reach your destination. This scenario is comparable to your organization operating with legacy software.

Hope is a good thing, but there’s little room for it when your legacy software and, by extension, your organization’s goals are in question. You need informed expectations instead, which is why you must understand the gravity of your legacy software risks. The scale and sophistication of modern threats has made this even more of a pressing issue. 

This article will help you better understand the risks of legacy software, why security risks take priority over anything else, and why it is imperative to tackle them immediately and continuously.

Risks of Legacy Software

In January 2023, the US GAO (Government Accountability Office) published a report on the state of information technology at the IRS (Internal Revenue Service).

The report revealed that legacy applications made up approximately 33% of the IRS’ IT environment. The IRS defined “legacy” as apps that are at least 25 years old or are written in an obsolete programming language. It’s worth noting that many of these applications were 35+ years old, some even as old as 64 years.    

In addition, legacy software instances in use — defined by the IRS as software at least two versions behind the latest — comprised 23% of the agency’s most frequently used commercial software.

What prevented the IRS from getting rid of old software or taking steps to modernize? The fact that, as the agency itself stated, this software was critical to its daily work.

IRS is one of countless organizations using legacy software. Some sources claim that almost two-thirds of modern companies use end-of-support applications. In reality, this number may be even higher.  

Whatever the exact numbers, legacy software is deeply entrenched in our IT infrastructures. Old code is inextricably linked with new code, so when we try to remove or change it, that creates a butterfly effect with a potentially devastating impact on operational continuity.

However, that doesn’t mean that we shouldn’t take steps to upgrade. Legacy software is known for being one of the weakest links in information environments, which necessitates intervention. So how can you reconcile these two sides?

The first step is to clearly understand the inherent risks entailed by using legacy software. The second is to take action in harmony with your objective means and specific conditions.

Common Risks Associated with Legacy Software

The dangers and setbacks associated with legacy software use can be divided into two broad categories: operational risks and security risks.

1. Operational risks:

• Deteriorated performance: Old software wasn’t developed with modern workload requirements in mind, meaning it’s near impossible for it to handle today’s loads of data and users. In addition, due to software entropy, its performance naturally deteriorates over time, making it laggy, buggy, and prone to failures.
• Inadequate integration: Legacy software is often incompatible with new technologies and operates in a silo, unable to connect to other components in your information environment as well as modern external software.
• Competitive disadvantage: As a high percentage of legacy software prevents you from using modern technologies, businesses can lag behind competitors that employ new, innovative, and scalable technologies.
• High maintenance costs: Outdated software typically requires special licensing and specialized knowledge to continue to function. 
  
  Considering that both are expensive and the latter is also rare, it’s no wonder that in 2019, GAO found that the operation and maintenance of only 10 of the federal government legacy systems cost $337M yearly.
• Skill shortage: As software ages, fewer experts know how to maintain it. The older the software, the more acute the shortage of skills necessary for its maintenance.  
  
  In addition, employee turnover can lead to the complete absence of professionals who know how to maintain the legacy software. This is especially true considering that IT skills of this type are often passed on through word-of-mouth, rather than formalized in process documents. The result is that key knowledge can disappear when certain experts leave the organization.
• Poor user and customer experience: Outdated interface, subpar efficiency, low speed, and manual (instead of automated) work are all drawbacks tied to old software. 

2. Security risks: 

• Security vulnerabilities: On average, legacy software accumulates more than 400 vulnerabilities every year. Hence, the older the software, the higher the number of security threats you face.
  
  This insecure state is due primarily to the legacy software’s unpatched status, its reliance on old protocols and poor access controls, and, generally, the inferior security measures from the time it was created.
• Data risks: If it’s not siloed, data in legacy software is usually at risk because of old encryption methods, such as DES and 3DES in healthcare, and the lack of support for modern strong encryption algorithms, such as AES-256. 
  
  Outdated software makes it difficult to back up and recover data, which can lead to data loss. In addition, old software may not support modern monitoring methods, which affects the visibility of your data flows.
• Insufficient security coverage: Even though most companies have an EDR in place, traditional EDRs provide increasingly less support for legacy software — or don’t provide it at all anymore.
• Compliance challenges: Compliance regulations often establish strict security requirements, primarily regarding data safety; however, these requirements are nearly impossible for legacy software to implement inherently. 
  
  New software that can help bridge security gaps may be a solution, but it can often be challenging to find and implement. 

Even though operational risks outnumber security risks, the latter are much harder to address. Security risks encompass myriad threats which can lead to operational problems as well.

A global 2023 study shows that for organizations, increased security was the number one reason for modernizing legacy applications and data. It was cited as even more important than increased efficiency and cost reduction.
Real-World Examples of Legacy Software Security Risks
The Volt Typhoon and WannaCry security incidents are two infamous examples that illustrate the consequences of neglecting legacy software security risks.

Volt Typhoon is an APT (advanced persistent threat) group that targeted legacy software and devices to penetrate critical US infrastructure. The targets were unpatched for security issues and had weak, outdated configurations. A security analyst discovered the attack campaign in 2023, but there were indications that it started in 2021 or earlier. 

WannaCry is ransomware with worm-like elements, presumably used by the notorious APT group Lazarus to target legacy software that relied on the Windows SMBv1 protocol. This protocol was developed in the 80s, and due to the much simpler network environment at the time, it didn’t include encryption or SMB signing and had weak authentication. 

The WannaCry attack affected between 200,000 and 300,000 devices in 150 countries that used Windows Server 2003, Windows XP, and Windows 7. The attack caused financial damage amounting to approximately $4B.

The Evolving Landscape of Modern Threats

The security threat landscape is perpetually changing at a rate that appears to be much faster than blue teamers can keep up with.

Although new security threats are emerging every day, they are mostly sophisticated variations of well-known threat categories.

How Modern Threats Target Legacy Software

We’ve already provided two examples of security incidents — APT and ransomware — involving vulnerabilities in legacy software.

But for a more complete picture of the pitfalls of neglected outdated software vulnerabilities, here are two more examples:

The Equifax data breach

The well-known credit bureau was attacked by a state-sponsored hacker group in 2017. The hackers exploited a vulnerability in older Apache Struts versions, CVE-2017-5638, which allowed remote code execution.

It’s worth noting that Apache Struts is an open-source MVC framework, meaning this was a cyberattack carried out through a third-party dependency.   

This incident is especially interesting because the problem was not a nonexistent patch. Instead, the data breach happened as a consequence of Equifax’s failure to update its old software on time, precisely because of the complexity of its legacy-filled IT infrastructure.

The breach exposed the sensitive data of 143 million people (addresses, social security numbers, credit card numbers, and more) and cost Equifax $1.4B.

The Sandworm attack on Ukraine’s power grid

This cyberattack took place in 2022 and resulted in an operational disruption, more precisely, a massive power outage.

The key role in the attack played an end-of-life software version running on a MicroSCADA control system that allowed default access to an API. The API should’ve been deactivated, but since it wasn’t, it allowed Sandworm, the notorious hacker group, to access a substation’s circuit breakers and cause a blackout.

Urgency in Addressing Risks of Legacy Software

Due to their grave consequences, legacy software risks require prompt action.

Sometimes, taking action means relegating an outdated piece of software to history. But due to its deep embeddedness in modern infrastructures, taking action, more often than not, means protecting and securing your legacy software and alleviating its common operational shortcomings.

That way, you:

• Manage immediate security risks
• Cope with compliance and regulatory pressures
• Avoid financial implications of inaction
• Ensure business continuity and resilience

A great place to start addressing most risks is to conduct a legacy software vulnerability audit.

Virsec’s Solution to Legacy Software Risks

Virsec is a security platform that specializes in legacy software. Its primary concern is outdated and unpatched server workloads and applications running on them. And that’s for a good reason: Over 80% of breaches occur precisely on servers.
 
Virsec extends its trademark zero-trust runtime defense to outdated Windows (2003, 2008, and 2012), Red Hat Enterprise Linux, Cent OS, Ubuntu, and Suse server operating systems, defending them as effectively as modern server workloads. 

For instance, the platform provides NIST, CISA, and PCI compensating security controls pertaining to Windows Server 2012 workloads and application runtime environments.

If we had to single out a few essential Virsec features, they would be the following:

• Trusted execution environment
  The “deny-all, allow-on-trust” Virsec’s model guarantees that trusted code is the only code executing in your legacy application runtime environment. This approach allows you to prevent unauthorized activities by default.
• Real-time monitoring
  Virsec constantly monitors your legacy workloads, looking for deviations from their baseline behavior.
• Zero-dwell time
  When the platform detects deviations from expected behavior, pointing to a possible cyberattack, it takes only milliseconds to stop the threat.   
• Autonomous application control
  Virsec creates and enforces trust policies that enable your legacy applications to perform their intended function, uncorrupted by unauthorized intentional or inadvertent manipulation.
• Visibility
  The platform provides insights into the scripts, executables, and files running on your workloads. This capability enables you to know all running processes and programs, allowing only those that are trusted. “Know your software, trust your protection” — that’s Virsec’s motto.
  
  It’s worth noting that EDRs and XDRs lack this capability. The consequence is a failure to provide adequate legacy software protection.

With its capabilities, Virsec allows you to use your legacy software in secure and protected ways, mitigating ransomware and other devastating security risks plaguing outdated software.

Conclusion

In this article, you learned the common risks associated with legacy software. Although operational risks outnumber security risks, we showed through real-world examples that the latter can have far-reaching consequences, making managing them a priority.

Legacy software security risks need your immediate attention, and you need a purpose-built solution to protect your outdated workloads and applications from the next WannaCry.

Virsec is precisely that — a purpose-built legacy software security solution. Having been around for a long time, Virsec has seen the changing threat landscape, and works with a thorough understanding of the subtleties of legacy software and the pains organizations have when using it.

See Virsec in action — book a free demo today.

Understanding the Complexity of Software Supply Chains

The software supply chain functions as the backbone of modern business operations. It comprises a complex network of third-party components, libraries, scripts, and processes that collectively power software systems. While these components offer enhanced functionality and efficiency, they also introduce a web of dependencies that can be challenging to manage. Every third-party element brings a separate set of vulnerabilities and risks, which, if not properly addressed, can compromise the entire system.

The complexity of software supply chains is further amplified by the diverse origins of these components. Developers often rely on open-source libraries and third-party vendors to accelerate innovation, but this practice can inadvertently introduce unverified and potentially harmful code into their systems. Understanding the intricate interplay of these components is crucial for organizations aiming to secure their software environments and maintain operational integrity.

Identifying Risks in Third-Party Software Dependencies

The reliance on third-party software components presents myriad risks that can undermine the security and functionality of an organization’s IT infrastructure. One of the most significant threats stems from vulnerabilities within these third-party elements. Unpatched software can become an easy target for attackers, who exploit these weaknesses to infiltrate systems and extract sensitive information. Furthermore, the lack of visibility into the provenance of software code raises concerns about the trustworthiness of these components.

Another critical risk is the limited transparency into the security practices of software vendors. Organizations often have little insight into how these vendors manage and protect their code during the distribution process. This lack of transparency can lead to situations where attackers intercept and modify software, injecting malicious code that can go undetected for extended periods. To mitigate these risks, it is essential for organizations to conduct thorough assessments of their third-party dependencies, ensuring that only trusted and verified components are integrated into their systems.

Why Asset Visibility is Important for Security

Asset visibility is a fundamental aspect of maintaining a secure software environment. Without a clear understanding of what’s running on their servers, organizations are left vulnerable to potential threats that can compromise their operations. Asset visibility involves gaining a comprehensive view of all files, scripts, libraries, processes, and executables within an organization’s IT infrastructure. This visibility allows organizations to identify unauthorized or suspicious components that could pose a risk to their systems.

By achieving full asset visibility, organizations can establish a baseline of normal operations, making it easier to detect anomalies and potential threats. This proactive approach enables IT teams to respond swiftly to security incidents, minimizing the impact on business operations. Additionally, asset visibility supports compliance efforts by ensuring that all software components meet regulatory requirements and adhere to best security practices.

Enhancing System Integrity to Protect Servers

System integrity is a critical component of a robust cybersecurity strategy. It involves ensuring that all software components within an organization’s IT infrastructure are trustworthy and have not been tampered with. Enhancing system integrity requires a combination of tools and practices designed to verify the authenticity and reputation of executables, processes, and scripts running on servers.

Organizations can enhance system integrity by implementing automatic verification mechanisms that establish the provenance of all software components. These mechanisms help to identify any unauthorized changes or modifications to the software, allowing IT teams to address potential threats before they can cause harm. Additionally, vulnerability protection measures can be employed to safeguard systems against known threats, further strengthening the organization’s security posture.

Leveraging Virsec’s Free System Integrity Insight Report

To assist organizations in navigating the complexities of third-party software supply chain risks, Virsec offers a free System Integrity Insight Report. This comprehensive report provides organizations with detailed insights into their server workloads, helping them identify and mitigate potential threats. The report includes a thorough analysis of all files, scripts, libraries, processes, and executables, offering a clear view of the organization’s IT assets.

One of the key features of Virsec’s report is the automatic verification of executables to establish their provenance and file reputation. This feature ensures that only trusted components are running on an organization’s servers, reducing the risk of malicious code being executed. By leveraging this free report, organizations can gain a better understanding of their current risk landscape and take proactive steps to enhance their security measures.

Strategies to Mitigate Software Supply Chain Risks

Mitigating risks associated with third-party software supply chains requires a multi-faceted approach that combines technology, processes, and collaboration. Organizations should begin by conducting comprehensive assessments of their software components, identifying and prioritizing vulnerabilities that need to be addressed. Implementing robust asset visibility solutions is essential for maintaining a clear view of the organization’s IT environment and detecting potential threats.

The risks associated with third-party software supply chains are significant, but they can be effectively managed through a combination of strategic planning and advanced security tools. By leveraging resources such as Virsec’s free System Integrity Insight Report, organizations can gain valuable insights into their server workloads, enabling them to identify and mitigate potential threats. With a proactive approach to cybersecurity, organizations can protect their operations and maintain trust in their software systems.

Ready to test your organization’s system integrity? Click here to sign up for your free report! 

Nearly every day we hear of another ransomware attack against a public or private institution. In fact, the numbers are much higher. In the first half of 2021, more than 2,000 attacks were reported to the FBI in the U.S. alone, a 62% increase from the same period in 2020. And it’s impossible to know how many more attacks were never reported. With this surge, total damages are rising as well. Estimates by Cybersecurity Ventures project ransomware damages will reach $20 billion by the end of 2021 and a whopping $265 billion by 2031. But it doesn’t have to be this way.  

Download our new report, “Stopping Ransomware Attacks with True Runtime Protection” to learn about some of the key factors that contribute to the success of ransomware attacks, as well as recent initiatives and innovations that enable defenders to take power back from attackers. We look at how ransomware is evolving, the technologies that are effective – and not effective — at stopping ransomware and why, the decision to pay or not to pay the ransom, the impact of cyber insurance, and the role of the U.S. government in addressing the crisis. 

Here are just a few takeaways from the report: 

• Ransomware is most damaging when it moves laterally from desktops to servers, which are online 24/7/365 and house all the critical applications and data necessary to keep an organization operational. Adding complexity to remediation and response, ransomware attacks now involve double extortion tactics – threatening to leak infiltrated data if the victim doesn’t pay the ransom. 
• More than 75% of companies infected with ransomware are using endpoint protection products (EPP) or endpoint detect and response (EDR) tools that they believe could help stop attacks, when in fact these tools do not. Ransomware attacks are leveraging multi-step kill chains, deploying file-less malware, and using remote code execution (RCE) techniques that are bypassing these conventional, probabilistic security controls.
• Victims of ransomware that decide to pay the ransom are rarely able to retrieve all their data and, the majority that do pay, are often hit again with another ransomware attack, sometimes by the same group that executed the first attack. But the decision to pay or not may soon be a moot point for organizations located in states that are considering prohibiting ransomware payments.
• More organizations are opting for cyber insurance but expect it to become more costly and difficult to attain. And it is far from a silver bullet solution. In fact, some research indicates the practice encourages cybercriminals as policyholders are more likely to pay the ransom.
• The world runs on software, yet application runtime remains one of the most vulnerable attack surfaces in any organization. Ransomware attacks repeatedly target applications and workloads most vital to the business, so we need to secure our organizations by protecting the software workload while it is running, wherever it is running. Ensuring attackers cannot exploit critical applications to run malicious code, is the only way to eliminate ransomware threats.Download the report for more details on the multi-faceted challenges of ransomware and what you need to know to better mitigate risk and stop attacks before they start, or read how to prevent ransomware breaches in healthcare.

As we approach 2025, with all the recent developments in artificial intelligence, one question resurfaces over and over again: How will AI affect cybersecurity?

This article answers that question. It presents our top 10 cybersecurity predictions for 2025 vis-à-vis the current AI revolution. From novel threats in critical industries to innovation in AI-driven security, these predictions highlight the challenges and opportunities shaping the future of cybersecurity, near and far.

What to Expect in 2025

1. Global Growth of Ransomware-as-a-Service

Ransomware accounted for 70.13% of cyberattacks in 2023. With the average payout currently at $2.73M, there’s no doubt we’ll continue to witness a barrage of ransomware attacks in 2025 — with one or two trends likely to grow: a rise in Ransomware-as-Service (RaaS) and AI-assisted attacks.

RaaS has already revealed its devastating impact on MEA economies. As AI becomes even cheaper to develop and easier to deploy, it’s reasonable to expect an explosion of its use as part of this cybercrime model.

Why?

The short answer is because AI makes ransomware attacks affordable, it refines them, and it’s hard to defend against.

The long answer is because it can:

• Automate ransomware development by generating malicious code and highly evasive polymorphic malware components, removing the need for rare and costly development skills.
• Enhance social engineering attacks by crafting persuasive personalized phishing emails and text or voice messages that mimic human communication.
• Improve targeting by analyzing voluminous datasets from compromised databases, conducting OSINT to identify easy, high-value targets, and determining the best timing and methods to attack.
• Facilitate vulnerability exploitation by automating the discovery of security risks and customizing exploit kits to target specific systems and evade advanced defense.
• Streamline payout operations by powering bots that negotiate ransom and laundering payments through complex blockchain transactions that are difficult to track.
• Democratize ransomware by allowing threat actors to create infrastructure for non-technical users and provide instructions, troubleshooting, and multilingual support to global affiliates through AI-powered chatbots.
• Increase attack efficiency by optimizing payload distribution methods, such as embedding ransomware in the most common file formats and applications.

 

2. Aggravated Vulnerability Risk Management Fatigue

As things stand now, there’s no good reason to believe that vulnerability management fatigue will recede soon. Quite the contrary, we predict it to worsen.

The key reasons are the following:

• Amount of vulnerabilities caused by the continuously growing and changing threat landscape
• Overload of security alerts that SOCs and security analysts face daily
• High rate of false positives that security solutions identify regularly
• Stacks of non-exploitable bugs that nonetheless, require analysts’ attention
• Substantial lack of trained professionals that widens the gap between what’s needed and what’s available.

AI can play a profound role in alleviating these problems. As an automation and efficiency instrument, it can help fill in workforce shortage gaps, decrease false positive rates, and accelerate data processing.

3. Widened Security Gap

The widening security gap continues to reflect the growing challenge organizations face in keeping their security proportional to the size and complexity of the modern threat landscape.

Cyberattacks such as APTs are becoming increasingly sophisticated, and technologies like cloud computing, IoT, mobile phones, and APIs are continuously expanding the attack surface. At the same time, many businesses are struggling with budget constraints, outdated tools, insufficient security measures, and overstretched teams. 

This disparity leaves vulnerabilities exposed, increasing the likelihood of breaches, non-compliance, and reputational damage. And it will continue to do so in 2025.

In this case, AI will play a twofold, contradictory role: 

• It will continue to contribute to the security gap by threat actors in the cyber kill chain and their tool stacks.
• It will have the potential to become instrumental in helping security teams protect digital assets and developers follow secure coding practices.

4. Piled up Tech Debt

The technical debt in 2022 was estimated to be approximately $1.53 trillion in just the US. Today and globally, the number is likely much higher.  

In the cybersecurity context, technical debt manifests as vulnerabilities, inefficiencies, or outdated software components, leading to heightened security risks.  

The following factors will continue to play a prominent part in increasing the existing technical debt:

• Legacy software
• Suboptimal code
• Outdated protocols and security mechanisms
• Short-term fixes favored at the expense of long-term solutions
• Inconsistent security policies due to the coexistence of modern and old software

AI will ensure a more sustainable approach to managing technical debt by automating repetitive tasks, helping improve code quality, and enabling proactive maintenance and modernization.

5. Increasingly Sophisticated Attack Vectors and Increased Cybersecurity Budgets in Response

Cyber threats are evolving dramatically precisely because of the recent developments in artificial intelligence, especially in generative AI.

Key emerging attack vectors include:

• Deepfake impersonation and AI-powered social engineering/phishing, which make it difficult to differentiate between legitimate and fraudulent communication.
• Zero-click malware that can execute without user interaction and bypass traditional detection methods.
• Adaptive malware that can adjust to different environments to evade detection and increase its damaging effect.
• Inaudible commands that exploit voice-activated systems like Alexa to execute unauthorized actions.
• AI system jailbreaking which manipulates AI models, such as Meta’s Llama 3 and OpenAI’s GPT-4, to force them to perform unintended actions.

6. Growing Software Supply Chain and Third-Party Risks

2023 marked a record 58% year-over-year increase in entities affected by software supply chain cyberattacks in the US. It seems that we still haven’t learned our lessons from the notorious SolarWinds attack.

The software supply chain and third-party dependencies will continue to be a frequent target for threat actors and one of the major headaches for CISOs in 2025. They provide a roundabout — but due to subpar security measures and monitoring — often easier way for attackers to penetrate deep into their target systems without being noticed.  

Our expectations for the next year include:

• Continuing upward trend of security incidents involving the software supply chain.
• More open-source vulnerabilities affecting a greater number of IT ecosystems.
• Heightened regulatory compliance pressure in the form of strict requirements focused on supply chain risk, such as NIS2 and DORA in the EU.
• Higher emphasis on SBOMs, demanding the provision of detailed inventories of software components and dependencies for the sake of transparency and, by extension, security.
  

Here, too, AI will play a dual role. Defenders will harness its power to boost smart monitoring, response, and vulnerability discovery in the supply chain. Attackers, in contrast, will abuse it to conduct an efficient reconnaissance and optimize their attacks.

7. Continued Struggle with Tool Sprawl

When organizations rely on too many security tools from different vendors, they inadvertently create a complex and inefficient security toll stack plagued by redundancies. The result is fragmented systems that do not integrate well, leading to multiple blind spots and, contrary to expectations, reduced cybersecurity visibility.

This state naturally translates into serious challenges for security teams in the form of:

• Lack of specialized knowledge for managing disparate platforms.
• Inconsistency in data formats.
• Alert fatigue and work burnout.
• Missed critical vulnerabilities due to the lack of cohesion across tools.

With the expansion of the cybersecurity tool market, organizations have a plethora of solutions to choose from, and this situation is here to stay. Emerging AI-powered security tools have the potential to worsen the current state of sprawl, but can be countered if businesses make a concerted effort to identify their actual needs, approach strategically, invest wisely in AI tools and consolidate their existing tool stack.

8. AI SOC Automation with a Security Copilot

One of the best ways to streamline repetitive tasks and analyze overwhelming volumes of relevant security data in real time is to implement AI SOC automation with a security copilot.  

Security automation copilots are intelligent assistants that:

• Search for data patterns that point to potential threats.
• Run predefined playbooks and escalate incidents in response to specific threats.
• Integrate with threat intelligence sources to provide updated information, correlating data from multiple feeds.
• Prioritize alerts, minimize noise, and offer remediation guidelines.
• Monitor applications, networks, and endpoints in real time to detect suspicious activities.
• Suggest solutions based on past incidents, providing step-by-step guidance for less experienced security analysts.
• Orchestrate workflows across tools like SIEMs, firewalls, and EDRs.

As a result, SOCs can enjoy:

• Fast detection and threat response.
• Improved accuracy.
• Reduced alert fatigue.
• Decreased skill gaps.
• Scalability.

By combining these benefits, this innovative technology allows security teams to respond more effectively to current and future complex cybersecurity challenges. That is why we expect it to be one of the cybersecurity trends in 2025.

9. Advanced Threats using AI Models to Target AI Models

We already discussed various ways in which threat actors can use AI to facilitate their attacks. However, the abuse of AI for nefarious purposes doesn’t stop there.

Other AI systems can also be targets of AI-fueled attacks, thus making the exploding use of artificial intelligence in different industries, from healthcare to energy to automotive, a grave security risk in 2025.

These attacks will tend to exploit AI models’ intrinsic weaknesses, targeting either the training, decision-making, or operational phases.

Examples include the following:

• Crafting inputs to deceive AI models into making bad decisions
• Reverse-engineering AI models to leak sensitive personal or proprietary data
• Injecting biased data in the AI model’s training phase
• Stealing an AI model through API queries, resulting in unauthorized use of proprietary technologies
• AI-powered bots committing malicious actions that disrupt automated processes like market trading and autonomous vehicle navigation

Take the first point as an illustration. Can you imagine the life-threatening consequences of this type of abuse in the healthcare or automotive industries?

10. Accelerated Adoption of Zero-Trust Architecture

Organizations will continue to adopt zero-trust architecture at an accelerated pace because it’s the only way to protect against modern, multifaceted malware and zero-day threats. 

By applying the “verify first, then allow” principle, zero trust ensures that only approved processes, libraries, code, and software components run, stopping unauthorized changes, regardless of whether they come from a known or unknown agent or threat. 

In addition, the zero-trust approach ensures that every third-party component and interaction is authorized correctly, preventing incidents in the software supply chain.

Advances in automation and AI will make implementing zero-trust easier, helping companies stay ahead of severe existing and new advanced risks.

Considering that remote work and cloud services — which imply that sensitive information is no longer confined to a single location — are becoming the new default, this approach will continue to resonate strongly with organizations in the years to come.

Conclusions

Cybersecurity in 2025 will be a battleground in which AI will be both the sword and the shield. As threats become more creative, so must our defenses, blending human inventiveness with AI accuracy. 

The predictions we’ve presented should not be understood only as glimpses of what’s to come. The right way to see them is as a timely call to action. Let’s set our priorities straight and solidify our protection against old and new threats for a more secure and better future.

Learn more about Virsec’s zero-trust runtime defense and how to stop threats before they even start.