2025 in cybersecurity – a year of acceleration, adaptation, and hard lessons

If 2024 was the year when AI entered the security conversation, 2025 is the year it became part of attackers’ everyday toolkit. The cybersecurity landscape didn’t just evolve – it accelerated, blurred the line between digital and physical risk, and highlighted how slowly many organisations still adapt to long-known weaknesses.

Here’s a short overview of the key developments that shaped cybersecurity in 2025.

AI-supported attacks go mainstream

AI didn’t replace cybercriminals in 2025 – it made them faster, more efficient, and harder to detect.

Throughout the year, researchers observed:

• Increasing use of AI-generated phishing that adapts language, tone, and context to each recipient

• Malware variants written or modified with AI tools to avoid static detection

• Faster and more targeted reconnaissance, with attackers using AI to analyse public data, employee structures, and exposed assets

• Growth in AI-enabled voice and video fraud, especially targeting finance and C-level staff

These trends show a clear shift: AI is reducing the skill and time required to run sophisticated attacks, allowing mid-tier adversaries to operate with far greater impact.

Ransomware remains dominant, but the pattern evolves

Ransomware stayed one of the most disruptive threats of 2025, but the way groups operate continues to change.

Notable developments include:

• A steady mix of high-profile “big game” victims and a growing number of mid-sized targets, especially in critical sectors

• Faster attack chains, with some intrusions moving from access to impact within hours

• Widespread use of double extortion and an increase in destructive elements

• Heavy reliance on compromised credentials and weak authentication

Organisations without consistent patching routines, MFA coverage, or network segmentation were generally more exposed to impact – a reminder that strong fundamentals remain essential.

Critical infrastructure under continuous pressure

2025 delivered a long list of incidents across sectors that directly affect everyday life.

Healthcare providers, energy companies, manufacturing sites, municipalities, and public services all faced:

• Operational downtime

• Data theft

• Ransom demands

• Long recovery cycles

The year reinforced a simple truth: many critical systems remain under-resourced, under-protected, and increasingly interconnected – making them ideal targets for financially motivated attackers.

Identity becomes the frontline of defence

Attackers don’t necessarily need to “break in” anymore. In many cases, they simply log in.

This year showed a clear rise in:

• Account takeover attempts

• Social-engineering-driven MFA theft

• Abuse of over-permissioned or poorly monitored accounts

• Token theft on compromised endpoints

• Weak off-boarding practices leaving dormant but valid access paths

Identity-driven compromise is now one of the most common intrusion methods across many environments. Strong authentication, least privilege, and good endpoint hygiene remain the foundation of modern defence.

Supply chain attacks continue to expand

The supply chain remained a popular entry point for attackers throughout 2025.

Common patterns involved:

• Compromised service providers being used as stepping stones

• Malicious or manipulated software packages

• Open-source dependencies introducing risk through imitation or tampering

• Lateral movement from a single vendor into multiple customers

The lesson is unchanged: security boundaries no longer end at an organisation’s own infrastructure. Visibility into partners, tools, and third-party services is becoming essential.

Regulation tightens – and organisations race to keep up

2025 highlighted that regulatory changes continued to evolve quickly. With NIS2 and related national laws taking shape across Europe, organisations encountered new expectations around:

• Asset inventory

• Incident reporting

• Logging and monitoring

• Risk management

• Continuity planning

• Governance and accountability

For many organisations, the challenge wasn’t the documentation – it was translating requirements into practical, day–to–day operational processes.

People remain cybercriminals’ favourite vector

Despite advances in technology, human behaviour continues to be one of the most effective ways into an organisation.

But 2025 also showed that:

• Continuous, realistic training

• Clear internal processes

• Awareness around phishing and social engineering

• Role-specific guidance

…can significantly reduce the number of successful attacks. Security culture remains one of the few defences that scales across both technology and process.

2025 reinforced that modern cybersecurity isn’t about chasing every new technology trend. It’s about consistently doing the fundamentals well:

• Strong identity protection

• Reliable patching

• Clear asset visibility

• Prepared incident response

• Empowered security teams

• A culture that values awareness and accountability

The tools evolve. The threats evolve. But the organisations that stayed resilient this year were the ones that treated cybersecurity as a continuous discipline, not a crisis response.