About the Predictions
From the growing capabilities of AI to the heightened scrutiny of regulatory frameworks, organisations are preparing for a range of complex cyber security challenges in 2025. These challenges are not just technical but will test their operational and strategic capabilities as well.
Our predictions bring together experts across Bridewell, offering insights from our technical, operational, and commercial teams. In these predictions, we examine issues such as AI-driven cyber attacks, regulatory pressures like NIS2, and the persistent skills shortage.
As the complexity of cyber threats continues to grow, this guide provides practical advice that reflects the multifaceted nature of modern cyber security, helping your business prepare for the challenges of the coming year.
Predictions
1. Resilience will be critical for tackling escalating cyber threats
2. AI will dominate both attacks and defence strategies
3. Commercial teams will drive cyber security service customisation
4. Cloud adoption will accelerate in operational technology environments
5. Regulatory changes will intensify the pressure on compliance
6. Innovation will continue to accelerate at an increasing rate
1. Resilience Will Be Critical for Tackling Escalating Cyber Threats
“At a macro level, escalating tensions between global powers are likely to drive a surge in cyber attacks, with some nations adopting strategic, long-term tactics while others focus on disruption and financial gain through ransomware. Alongside this, disinformation campaigns and hacktivism are on the rise, with AI-generated fake news emerging as a significant threat to social stability. Political and economic uncertainties, including elections and shifting budgets, will further complicate the landscape, influencing both technology investments and cyber defence strategies.
“On the micro level, businesses will grapple with shrinking security budgets and mounting compliance pressures, particularly due to potential enforcement notices levied for NIS non-compliance in 2025 and 2026. As compliance deadlines approach, organisations may find themselves vulnerable to exploitation by opportunistic vendors that claim false levels of expertise. They will need to carefully consider which suppliers they choose to work with.
“There will also be a continued shortage of specialised skills in-house, such as security architecture, engineering and OT security. This is creating “holes” in workforces that are otherwise abundant with people who can complete risk assessment services and cyber security audits. AI solutions present a range of possibilities, but without proper security measures to secure them, these projects can exacerbate existing security risks. Proactive approaches to strengthening internal capabilities or collaborating with knowledgeable partners will better position organisations to adapt.
“Looking ahead, organisations need to invest in building resilience through a mix of upskilling internal teams, carefully vetting external suppliers, and strengthening partnerships. Proactive engagement, particularly in training and collaboration with trusted vendors, will be crucial to navigating both technical and geopolitical challenges.”
2. AI Will Dominate Both Attacks and Defence Strategies
“AI has become that unescapable word which will continue to dominate in 2025. There are growing concerns about AI being used in breaches, such as creating bias in models, impersonation and extortion. For example, the technology is being used in phishing attacks to encourage wrongful payments of large sums of money. It’s even got to the point where if anyone joins a video call, how do they know for certain that they are talking to the people they are meant to be talking to?
“The response to this rising threat will be very much a case of fighting fire with fire. AI security products will play an increasing role in security strategies through pattern recognition, machine learning and detecting malicious activity. However, human expertise and awareness will remain essential for managing these tools effectively, particularly in complex organisations that may be managing upwards of 80 different security products. Streamlining these systems and integrating AI with human oversight will allow security teams to focus on mitigating new and emerging threats.”
3. Commercial Teams Will Drive Cyber Security Service Customisation
“We’re definitely seeing a larger emphasis on the importance of commercial teams. They’re increasingly playing a key role in tailoring cyber services to meet customer needs and helping them understand the economic consequences of their decisions. With security budgets ever-tightening, businesses can ensure that their security solutions are both technically sound and aligned with long-term financial goals and sustainable growth.
In keeping with this trend, customers are moving away from long-term, perpetual license contracts in software and towards longer-term contracts with service partners that are technology agnostic. This is offering them greater flexibility and more financial control. Commerciality is also becoming more important to procurement departments across CNI and government as they adopt more sophisticated methods of purchasing technology and technology-based services. There is an opportunity for commercial teams to educate procurement professionals on the unique requirements of cyber security services.
With greater resiliency now a top priority, particularly following high-profile incidents like CrowdStrike, businesses must adopt solutions that not only meet immediate needs but are also capable of supporting long-term recovery and cyber resilience. Service providers that can offer flexible, forward-thinking expertise will be best positioned to meet this growing demand.
4. Cloud Adoption Will Accelerate in Operational Technology Environments
“2025 will be the year where many organisations realise that their heavy investments in network detection and response (NDR) tools may not yield the expected results. This is largely due to the inability of many existing solutions to deliver on their promised capabilities. Additionally, operational immaturity within organisations will continue to be a significant barrier, preventing them from fully utilising and gaining value from their cyber security investments due to inadequate processes and expertise.
“We often find that in operational technology (OT) environments, there are very few security vulnerabilities affecting devices, so there will also be a focus on only adopting tools that are actually needed. There will need to be a renewed focus on employing security controls to achieve risk reduction, alongside adopting a mature approach in tandem.
“Cloud adoption, including for mission-critical OT environments, will gain momentum. There is a growing trend now to go cloud-first. Hybrid cloud solutions will become more popular, offering a common management platform that gives organisations greater control and redundancy over their critical systems.
To stay ahead, organisations must assess their current security investments and focus on solutions that bring real-world value. By prioritising hybrid cloud models and adopting a mature, risk-focused approach, businesses can better position themselves to handle the operational challenges that lie ahead.”
5. Regulatory Changes Will Intensify the Pressure on Compliance
“Regulatory changes will be a major focus in 2025. The NIS2 Directive will impact both EU companies and UK organisations providing services in the EU, while DORA’s influence will be felt beyond the financial sector. In the UK, the incoming Government has committed to bring forward new legislation which will extend cyber security requirements to additional sectors, and grant greater powers to regulators. Keeping ahead of the evolving regulatory landscape will remain a challenge across many industries.
“The energy sector in particular faces a steep challenge in the next few years as it works towards meeting the requirements of the enhanced CAF profile by 2027, but regulatory challenges are industry-wide. Delaying action is no longer viable, as increasing fines and expanding regulatory powers demand a more proactive approach.
“Geopolitical tensions will also drive attackers to use AI tools for impersonation and large-scale attacks. Combined with the ongoing shortage of skilled security professionals in areas such as Operational Technology, businesses will need to rethink how they confront these mounting risks. Organisations should prioritise early compliance efforts, strengthen AI-driven defences, and invest in specialised talent to navigate the evolving regulatory landscape.”
6. Innovation Will Continue to Accelerate at an Increasing Rate
"Whilst we don’t know what the next major innovation will be, we can be sure that the time to adoption will be faster than ever before. The world was caught off guard in 2023 and 2024 by how fast new generative AI tools, which were developed and adopted by organisations quicker than any technology prior to it. This rapid rate of change is something we must come to expect when revolutionary technologies emerge onto the marketplace.
"Staying ahead of the curve with one eye to the future is a must for security professionals in all industries and sizes of organisations. Both to ensure that value is realised from these generational leaps, and that risk is mitigated from the opportunities our adversaries also gain. In 2025 and beyond, it will be more crucial than ever that organisations have forward facing teams, actively reviewing and evaluating the speculative advances for risk and benefit.
"A great example of this is the pending revolution that quantum supremacy will bring, along with the risks it will create. This technology is bubbling on the cusp of growing rapidly in the next 5 years and, in 2025, organisations will start to feel its impact and need to address the present threats which the future evolution might bring.
"If securing legacy systems and networks is our past, and securing AI is our present, then planning for quantum must be our future."
Preparing for the Challenges Ahead
As the insights from our experts reveal, 2025 will bring a diverse set of cyber security challenges that organisations must prepare for now. The rise of AI in both offensive and defensive roles, heightened regulatory scrutiny, and the ongoing skills shortage will all demand a more proactive and strategic approach.
To succeed, businesses will need to balance cutting-edge technologies with operational maturity and human expertise. This means investing not only in AI-driven defence strategies but also in robust training programs to bolster awareness and resilience. As geopolitical tensions and economic pressures add further complexity, vendor-agnostic solutions that focus on reducing risk, rather than simply achieving compliance, will become essential.
By prioritising long-term value, fostering collaboration between commercial and technical teams, and staying ahead of evolving regulations, organisations can position themselves to face the rapidly changing threat landscape with confidence. The key to navigating 2025 successfully will be an adaptable, forward-thinking approach - one that not only anticipates emerging risks but also capitalises on new opportunities to strengthen cyber resilience.
