2025 Security and Compliance Predictions

2025 will continue the theme of powerful business and technological transformation under a never-ending barrage of cyber threats that are spawning faster and evolving in more complex ways than ever. To ward off an increasingly sophisticated community of threat actors, we’ll need to innovate faster than the speed of the threat landscape — but how? 

With decades of experience working various roles in the IT security and compliance space, I’ve witnessed the evolution of cyberthreats firsthand. It’s more complicated than ever to remain compliant and stay secure at scale. In this article, I’ll share my top ten security and compliance predictions that I believe will define 2025 across industries and around the world. 

#1: The AI Arms Race 

The lightspeed rise of artificial intelligence (AI) is transforming entire industries — and unfortunately, this includes the cybercrime industry. 

They say you must “fight fire with fire” and we'll need to do just that to stay ahead of AI-powered attacks like highly targeted (spear) phishing emails, sophisticated malware, and large-scale reconnaissance efforts. Our methods need to be faster and capable of thwarting an AI-powered attack. I anticipate many organizations will invest heavily in AI-driven security solutions to maintain the upper hand over the cybercriminals that are making similar investments of their own. 

#2: A Regulatory Balancing Act 

Governments around the world are continuously ramping up laws intended to protect the data and privacy of their citizens. With this goal, they must guide organizations toward best practices by establishing minimally acceptable standards of operation. This has resulted in large-scale complexity amidst a labyrinth of compliance standards that already exist today. 

Noncompliance is not optional. Regulatory standards like DORA, GDPR, NIS2, and Sarbanes-Oxley put companies at risk of huge fines and reputational damage. Expectations aren’t going to lessen if data breaches and unplanned outages continue to occur. Much like AI itself, compliance will evolve to include more stringent requirements and stronger enforcement. 

You can expect future measures to be more considerate of the complexity by aligning with-established frameworks like NIST and security best practice standards like the benchmarks from CIS. Newer regulations, such as the EU’s NIS2 and Digital Operational Resilience Act (DORA) are already placing increased emphasis on governance, framework alignment, as well as supply chain and technology stack resilience. 

#3: The Zero Trust Shift 

Zero trust is a simple philosophy: no user or device is inherently trustworthy. How many times have you opened a phishing test email link? With the ongoing blend of remote and onsite work, organizations will continue to enforce strict access controls and continuous authentication to reduce the attack surface. Putting zero trust into practice starts with a cultural shift + an investment in identity and access management solutions — but I believe this is a worthwhile investment. 

#4: The Quantum Threat Looms Large 

Quantum computers are super-powered computers that will be able to crack encryption algorithms that we currently use to protect sensitive information. Quantum technology may be in this position in as little as the next five years — cybercriminals are already involved in data hoarding, where they collect and store stolen data now for use in the future when the right technology or opportunity arises. In 2025, we’ll need to use encryption methods that are resistant to potential future attacks from quantum computers as this threat will rapidly evolve. 

#5: Ransomware: A Targeted and Personalized Menace 

I have no doubt that ransomware attacks will continue to plague organizations in 2025 — but with a more insidious twist. Smarter cybercriminals will employ advanced social engineering tactics to target specific individuals or organizations with highly personalized attacks. It’s a given that AI will help with this effort, pulling information across the web to support ransomware. Security basics will continue to run defense: strong authentication, regular patching, and employee training against human error. 

#6: The IoT Threat Landscape Expands 

The growth of Internet of Things (IoT) creates an enormous attack surface. Cybercriminals can exploit vulnerabilities in these devices to launch large-scale attacks, such as Distributed Denial of Service (DDoS attacks) or data breaches. In 2025, organizations will need to boost IoT security with stronger configurations, regularly updated firmware, and segmented IoT networks away from critical systems if they want to avoid an all-too-common breach. 

#7: Supply Chain Security 

As I mentioned previously, the technology supply chain has begun to be more integral with regulatory oversight — and for good reason. Reliance on common solutions like CDK Global and CrowdStrike caused high profile outages in 2024, with the effects felt by thousands of organizations and their customers around the world. Vendors may have privileged access to a company’s digital vault of data and sensitive information. In 2025, organizations will seek to improve resilience by stepping up their vigilance regarding their supply chain. I predict that they’ll be keeping a much closer eye on any weak spots in their vendors’ cyber policies and execution. Due diligence is going to be key — the supply chain shouldn't be exempt from zero trust. 

#8: The Growing Market for Cyber Insurance 

The demand for cyber insurance is on the rise as companies try to reduce the financial damage from data breaches, ransomware attacks, and other cyber incidents. While cyber insurance can’t make you compliant or improve your reputation after a breach, it will provide some measure of financial comfort for organizations impacted by cybercrime. 

Just as car insurers expect that keys won’t be left in the ignition; cyber insurers will also seek exemptions for their policy holders that do not demonstrate due diligence. There will be stricter policy expectations for basic security hygiene and limiting payouts to only those organizations that adhere to them to limit growing insurance losses. 

#9: Persistent Cybersecurity Skills Gap 

The cybersecurity industry continues to face a severe shortage of skilled professionals, which prevents organizations from effectively respond to emerging threats. This shortage gap will continue into 2025, leading to additional emphasis on ways to increase the efficiency and effectiveness of security and compliance activities through automation. 

#10: Building Cyber Resilience 

As we put a bow on the final days of 2024, it's obvious that existing efforts to prevent cyberattacks aren't enough — organizations must use every weapon in their arsenal to withstand attacks. But not everything that causes disruption is criminal: human error, flawed software updates, and poor practices throughout the technology stack can all result in devastating outages. Regardless of the cause, businesses must bounce back quickly when issues occur. This requires creating a solid response plan, regularly practicing those plans, and investing in robust tooling to increase the agility of their cyber defenses. 

All of this comes together into one concept: cyber resilience. 

In Conclusion: 

A proactive and adaptive approach to security and compliance is going to be mandatory in 2025. With AI-driven solutions, prioritizing zero-trust principles, and increasing efficiency through automation, organizations can mitigate risks, improve resilience, and safeguard their digital assets. 

I trust that 2024 has been a good year and hope 2025 brings peace and prosperity to you and your family. The team at Puppet feels blessed to have helped so many of you throughout the year with your infrastructure security and compliance requirements. If your holiday ‘wish list’ still includes a platform that supports 24/7 security, you can learn more about Puppet’s Security Compliance Enforcement here: 

STAY COMPLIANT 24/7