Cybersecurity trends worth acting on in 2026

Each year brings a list of cybersecurity trends, and most contain at least one that never mattered. This one is selective: six shifts that change what a business should do, with the reasoning behind each and a practical first step.

1. Identity is the new perimeter

Offices, laptops, phones and cloud services mean there is no single network edge to defend any more. Attackers go after the thing that gets them in: someone’s login. In Verizon’s 2025 Data Breach Investigations Report, stolen credentials were the most common initial way into a breach, at 22%.

The response is called zero trust: don’t assume anything is safe because it is inside the network. Check every request, limit access to what’s needed, and review it regularly. In practice that means multi-factor sign-in on everything, a move towards passkeys (which replace passwords with keys held on your device and can’t be phished like a password), and removing access promptly when people change role or leave.

First step: turn on multi-factor sign-in for email, finance systems, cloud storage and anything with administrator rights.

2. AI on both sides

Defenders use AI to sort the flood of alerts, spot unusual behaviour and speed up investigation. Attackers use it to write more convincing phishing messages, clone voices and automate the search for weaknesses. The practical effect is that old advice such as “look for spelling mistakes” no longer works.

Don’t forget a third angle: the AI tools your staff use are themselves a risk if they paste confidential information into services you haven’t approved. We look at the defensive side in AI in cybersecurity.

First step: agree rules for confirming payment and bank-detail changes by a second route, such as calling a known number, and publish a short policy on which AI tools are approved.

3. Suppliers and software supply chains

Verizon’s report found third-party involvement in breaches had doubled to 30%. An attack on a supplier, an agency or a software provider can reach every customer connected to them. Your security is only as good as that of the companies with access to your systems and data.

First step: list who has access to what, ask your most important suppliers how they protect your data and what they would tell you if something went wrong, and remove access that is no longer needed.

4. Privacy rules and the cost of getting them wrong

Data protection laws now apply in most major markets, and regulators are increasingly willing to enforce them. Beyond fines, customers expect to know what you hold and why. Companies that know where their data lives and can answer questions about it find both compliance and incident response easier.

First step: make a simple inventory of the personal data you hold, where it is stored, who can see it and how long you keep it. Our guide to protecting customer data covers the practical steps.

5. Cloud settings are your responsibility

Cloud providers secure their platforms, and you secure how you use them. Many exposures come from ordinary configuration mistakes: a storage folder open to the internet, a service account with more access than it needs, a test system left running. As more business moves to the cloud, so does this risk.

First step: have someone review who can access your cloud storage and administration, and switch on the built-in alerts for risky changes.

6. Quantum-safe encryption, early but real

Today’s widely used encryption could eventually be broken by sufficiently powerful quantum computers. Nobody can do that yet, but sensitive data captured now could be stored and decrypted later. In August 2024, the US standards body NIST finalised its first post-quantum encryption standards, and suppliers are beginning to adopt them.

For most companies this is a planning matter, not an emergency. The sensible move is to find where you rely on encryption, such as VPNs, certificates and stored backups, note anything that must stay confidential for ten years or more, and ask key suppliers what their plans are.

First step: ask your largest software and cloud providers about their timeline for the new standards.

What this adds up to

None of these trends calls for exotic technology. They point to the same few disciplines: know who has access to what, verify rather than trust, keep systems updated and backed up, check your suppliers, and rehearse what you’d do if something went wrong. Our guides to basic cybersecurity practices and the ten threats growing companies face set out the first steps in order. If you’d like help deciding where to begin, you can talk to us.