How AI will transform cybersecurity in 2025 - and supercharge cybercrime

The cybersecurity landscape in 2024 was rocked by severe ransomware attacks, AI-driven social engineering, and state-sponsored cyber operations that racked up billions in damages. As we step into 2025, the mix of AI advancements, geopolitical tensions, and increasingly complex attack surfaces is setting the stage for an even more challenging cybersecurity environment.

Security experts are gearing up for what might be the toughest year yet in cyber defense, as attackers harness more advanced tools and tactics. Based on current threat intelligence and emerging attack trends, here are five key cybersecurity predictions that are likely to define 2025:

Ransomware Evolves into Data Destruction and Manipulation

Ransomware isn't just about holding data for ransom anymore; it's morphing into a tool for widespread disruption. These attacks have become a staple in the cyber threat world, with organizations shelling out millions to regain access to their encrypted data. But the game is changing. In 2025, ransomware gangs are expected to go beyond mere encryption and theft, aiming to compromise the integrity of critical data itself.

Imagine scenarios where attackers corrupt medical records in hospitals or manipulate financial data in banks. The consequences could go far beyond financial losses, threatening lives and eroding trust in institutions. Dick O'Brien from Symantec Threat Hunter Team by Broadcom notes, "Ransomware payloads themselves haven't changed much. We've seen some minor tweaks and improvements. However, genuine innovations have occurred in the ransomware attack chain. Your average, successful ransomware attack is a complex, multi-stage process involving a wide range of tools and significant hands-on work by attackers."

O'Brien points out that the shift is driven by evolving tools and tactics. "The main trend has been moving away from malware. Most tools attackers use today are legitimate software. In many attacks, the only malware we see is the ransomware itself, introduced and run at the last minute."

Recent studies from the Cybersecurity and Infrastructure Security Agency (CISA) highlight the growing sophistication of ransomware operators, who are now using AI and automation to execute faster, more targeted attacks.

What Organizations Can Do

• Implement advanced backup and disaster recovery strategies.
• Prioritize data integrity checks to catch any tampering.
• Invest in endpoint detection and response (EDR) tools to quickly identify and isolate threats.

AI-Powered Attacks Will Outstrip Human Defenses

AI is transforming industries, and cybercrime is no exception. In 2025, attackers will use AI to launch highly targeted phishing campaigns, develop advanced malware, and pinpoint system vulnerabilities at breakneck speeds. These AI-driven attacks will test even the most sophisticated cybersecurity teams, as the sheer volume and complexity of threats will surpass what manual defenses can handle.

A prime example is the use of generative AI to produce deepfake audio and video, which can trick identity verification systems or spread misinformation. Last year saw several high-profile cases where deepfake tech proved disturbingly convincing, hinting at its potential for misuse in cyberattacks.

Alex Cox from LastPass' information security team comments, "The cybercrime adversary community is opportunistic and entrepreneurial, quickly adopting new technologies. The use of deepfakes, artificial intelligence, and large language models (LLMs) is the next step in this evolution. Attackers aim to establish trust with victims at the initial stages of the attack through social engineering, often by impersonating decision-makers within the targeted organization."

The danger of AI-powered attacks lies in their scalability. An attacker can program an AI to crack weak passwords across thousands of accounts in minutes or scan an entire corporate network for vulnerabilities much faster than a human could.

What Organizations Can Do

• Deploy AI-driven defensive tools for real-time network monitoring.
• Train employees to spot sophisticated, AI-crafted phishing attempts.
• Collaborate with industry partners to share intelligence on emerging AI-driven threats.

The cybersecurity game of cat and mouse is entering a new, accelerated phase where AI is the primary tool for both attackers and defenders.

Critical Infrastructure Will Be a Prime Target

In 2024, attacks on critical infrastructure grabbed headlines, from European energy grids to U.S. water systems. This trend is expected to intensify in 2025, with nation-states and cybercriminals focusing on disrupting the systems societies rely on most. These attacks aim to cause maximum chaos with minimal effort and are increasingly used as weapons in geopolitical conflicts.

The vulnerability of critical infrastructure is compounded by aging systems and fragmented security protocols. For instance, many energy grids still depend on legacy technologies not designed to fend off modern cyberattacks. The increasing interconnectivity of operational technology (OT) and information technology (IT) also opens up new vulnerabilities.

Ian Bramson, vice president of global industrial cybersecurity at Black & Veatch, warns, "Many water companies and utilities lack the basics in their industrial cyber programs. They haven't established visibility into their OT networks or the control needed to prevent, detect, or respond to attacks."

Bramson emphasizes the need to treat industrial cyber as a safety issue. "Virtual attacks on these systems can have significant real-world physical impacts. Making cyber a safety concern mandates action and prioritizes resources. All utilities take safety seriously, and extending that to cyber gives it the priority it needs. It's about public welfare and employee safety, which makes OT mission-critical for water utilities."

What Organizations Can Do

• Partner with government agencies like CISA to identify and mitigate vulnerabilities.
• Segment OT and IT networks to limit the impact of breaches.
• Invest in continuous monitoring and real-time threat detection for critical systems.

Protecting critical infrastructure isn't just about cybersecurity—it's a matter of national security.

Supply Chain Attacks Will Escalate

The interconnected nature of global business has created a breeding ground for supply chain attacks. These breaches exploit vulnerabilities in third-party vendors, allowing attackers to infiltrate multiple organizations through a single entry point. In 2025, experts predict these attacks will become more frequent and sophisticated.

The SolarWinds cyber attack is a stark example, compromising thousands of organizations by targeting a widely used software provider. Similarly, the Kaseya ransomware attack showed how small vendors can serve as gateways to larger enterprises. Supply chain attacks are particularly insidious because they exploit trusted relationships between companies and their vendors, often remaining undetected for months.

Governments and regulatory bodies are taking action. In 2024, new guidelines for supply chain security were introduced in the US and the European Union, stressing the need for transparency and accountability. However, compliance alone won't be enough to thwart attackers who are constantly refining their methods.

Matti Pearce, vice president of information security, risk, and compliance at Absolute Security, explains, "CISOs will need innovative detection and monitoring techniques to uncover unauthorized AI applications that might not be directly observable on network traffic. Focusing on user education and providing secure, approved AI tools will be central strategies in mitigating these risks. The rise in AI use is outpacing its security, leading to AI attacking AI, creating a perfect storm of threats for enterprise users."

"The security industry still doesn't know how to protect AI well," Pearce adds. "Human error, not malicious adversaries, will be the reason for this expected conflict. With increased AI adoption, we can expect to see AI poisoning in the already vulnerable supply chain. A critical AI flaw could be the entry point for a new and novel attack that goes undetected and causes significant economic disruption."

What Organizations Can Do

• Conduct thorough security audits of all third-party vendors.
• Implement zero-trust principles to limit the impact of compromised partners.
• Use threat intelligence to identify and respond to supply chain vulnerabilities proactively.

The security of your supply chain is only as strong as its weakest link.

The Cybersecurity Workplace Skills Gap Will Widen

The cybersecurity industry is grappling with a significant talent shortage. A report by ISC² indicates that over 3.4 million cybersecurity jobs were unfilled globally in 2024, a number expected to grow in 2025. This workforce gap poses a major challenge as the demand for skilled professionals continues to rise.

It's not just about numbers; it's about specialized skills. Many organizations struggle to find employees proficient in threat intelligence, AI-driven defenses, and cloud security. Overburdened teams face increased risks of burnout, leading to higher turnover rates and worsening the problem.

Dick O'Brien observes, "A shift in the balance of power is underway in the criminal underworld, requiring human solutions. Historically, operators of large ransomware families were at the top of the cybercrime food chain. They franchised their businesses using the ransomware-as-a-service (RaaS) model, where 'affiliate' attackers leased their tools and infrastructure in exchange for a cut of ransom payments. However, this model's unintended consequence has been to place more power in the hands of affiliates, who can quickly migrate to rival operations if one is shut down. Ransomware operations are now competing with each other for affiliates, offering increasingly better terms for their business."

To tackle this crisis, organizations are exploring creative solutions. Upskilling programs and internal training initiatives are helping existing employees transition into cybersecurity roles. Additionally, automation and AI are taking over repetitive tasks, allowing human analysts to focus on strategic decision-making.

What Organizations Can Do

• Invest in training and mentorship programs to develop internal talent.
• Partner with universities and coding boot camps to build a pipeline of skilled workers.
• Embrace diversity initiatives to attract candidates from underrepresented groups.

Closing the cybersecurity talent gap isn't just an industry challenge—it's a societal imperative.

What These Predictions Mean for 2025

The cybersecurity challenges looming in 2025 are formidable, but they're not impossible to overcome. Organizations can fortify their defenses against innovative cyber threats with a multilayered approach that combines technological solutions with human expertise.

AI-powered defensive tools offer real-time network surveillance, while strict segmentation between OT and IT systems protects critical infrastructure. Zero-trust security principles and thorough vendor audits help mitigate supply chain vulnerabilities. By investing in cybersecurity training programs to address the talent shortage, organizations can harness human ingenuity to proactively address vulnerabilities.