Democratised cyber crime, AI-powered malware and supply chain threats are just some of the cyber trends we’re anticipating for 2024.
Given the growing complexity of cyber threats, digital and physical infrastructure faces mounting challenges. In the past year alone, we've seen cyber criminals refine their arsenal with sophisticated tools aimed squarely at evading defences and causing disruption. This isn't an underground effort but a professional marketplace, teeming with state-backed operatives, criminal collectives, and rogue activists.
To counter these growing cyber threats in an increasingly volatile landscape, organisations need to proactively anticipate what lies ahead. By pooling the expertise of our consultants and experts, drawing on findings from our 24/7 security operations centre (SOC), and using our own annual research data, we’ve compiled the top ten trends you should be prepared to encounter in the next year.
For more on each of these predictions, including additional commentary from our team and insights from our research, download our full 2024 predictions report.
1. The Rise of Ransomware-as-a-Service (RaaS)
The growth of Ransomware-as-a-Service (RaaS) will catapult large-scale criminal gangs to enterprise status and level up the lower-skilled crime groups. Ransomware operators with the skills to write software for use by affiliate groups have identified a gap in the criminal market and are accelerating the professionalisation of cyber-crime; achieving the size and habits of major enterprises and even adopting departmental specialisms such as R&D and offering defined career structures. Low-level cyber criminals will also find it easier to gain access to and use ready-made ransomware services to launch their own campaigns.
2. Democratised Cyber-Crime: Polymorphic and AI Powered Malware
AI will continue to lower the barrier to entry for criminals by creating code and enabling more sophisticated attack methods through automation. This includes polymorphic malware, which mutates with every infection and adapts by learning from attack data, exploiting vulnerabilities, and constantly evolving its tactics to evade detection. Organisations and criminals will compete over the next 12 months to take advantage of the technology.
3. Constrained Cyber Budgets
Budget cuts will continue next year in many sectors despite intense threats and the introduction of new technologies. This will lead to difficult choices and increasing pressure on security teams. Organisations will need to strategically assess, prioritise, and optimise their security investments to prevent wasting precious resources on tools and initiatives that fail to strengthen their security posture.
4. Supply Chain Challenges
Supply chain attacks will continue to pose serious problems in 2024. Not only have cyber criminals become expert in moving through suppliers’ systems to their ultimate target, but supply chains are becoming increasingly complex and very difficult to secure end-to-end. As concerns mount, organisations will need to turn to specialists to conduct assessments of supply chain partners to judge where and how each supplier poses a risk.
5. Increasing Threats in CNI and Energy Sectors
CNI sectors face heightened risk due to the severity of disruption an attack can cause, essentially being a weapon of war to cyber criminals. Energy in particular is an area of major governmental concern, given its critical role in all economies and the sensitivity to price rises among consumers. The International Energy Agency has warned that energy systems are at “unprecedented threat” from cyber-attacks, particularly green energy technologies those in the renewables segment of the market. Combined with Ofgem’s intricate regulatory demands and the rollout of the Cyber Assessment Framework (CAF), the sector must brace for a turbulent year.
6. Cyber Strikes in the USA
The US remains a long way behind Europe and other regions in terms of nationwide cyber security regulation, despite moves by the Biden administration to improve standards in federal organisations and software providers. American organisations will remain vulnerable targets of cyber-attacks, as there is little motivation to adopt security programmes or measures beyond what is required by law.
7. A Big Year for Cyber in Politics
Cyber-attacks often correspond with major political events, and 2024 will see a UK general election and the US presidential election. Preparation will be key as Russia, North Korea, Iran, and activist hacking groups all carry their own motivations explore opportunities to inflict disruption. Following “the biggest data breach in UK history” at the Electoral Commission in 2023, organisations will need to step up security to prevent threat actors from entering networks or interrupting proceedings during 2024.
8. The Proliferation of IoT Devices
From industrial sensors to smart healthcare systems, the growth and integration of Internet of Things (IoT) devices into our daily lives is rapid and increasingly sophisticated. There has been a positive shift in the development of IoT regulations, however the application of more rigorous and wide-ranging approaches to risk management, monitoring and response, and operational visibility in complex and critical infrastructure will be essential for maintaining compliance and fortifying security.
9. Consolidation in Cyber Security Tools
A steadying increase in the number of security tools used and budget pressures will see greater consolidation and simplification from organisations in 2024. We will see wider acceptance of cyber security frameworks, increased integration, and less use of standalone security solutions to reduce the heavy demands and time-consuming nature of managing multiple tools and mitigating cyber risks.
10. The Beginning of the End for Passwords
Passwords alone offer protection for individuals when travelling and work at a low level but are far from secure for major businesses and CNI organisations. Increasing deployments of MFA (multi-factor authentication) security have already reduced the volume of successful data breaches, and we can expect this to continue. However, MFA is not an approach that can be applied to major enterprises quickly or operational technology with a lifespan of multiple decades. This will be a challenge for 2024, as organisations seek to implement new authentication methods whilst combatting issues such as MFA fatigue and criminal by-pass mechanisms.
Blogs
