DUBAI — The cybersecurity landscape is constantly evolving, with new threats emerging all the time. As we look into the digital horizon of 2024, it becomes increasingly crucial to forecast the trends and challenges that will shape the cybersecurity landscape in the coming year.
To stay ahead of the curve, it’s important to be aware of the latest predictions.
Gartner has recently revealed its top eight cybersecurity predictions for 2024 and beyond. Among the top predictions, generative AI (GenAI) adoption will collapse the cybersecurity skills gap and reduce employee-driven cybersecurity incidents; two-thirds of global 100 organizations will extend directors and officers insurance to cybersecurity leaders due to personal legal exposure; and battling misinformation will cost enterprises more than $500 billion.
According to Deepti Gopal, Director Analyst at Gartner, beyond what’s possible with GenAI, solid opportunities are emerging to help solve a number of perennial issues plaguing cybersecurity, particularly the skills shortage and insecure human behavior.
Top Cybersecurity Predictions for 2024 * Generative AI will reduce the cybersecurity skills gap by 2028. * D&O insurance extension for cybersecurity leaders expected by 2027. * Around $500 billion will be spent on battling malinformation by 2028. * 75% of organizations will exclude unmanaged systems from zero trust strategies by 2026. * GenAI and integrated platforms will cut down employee-driven cybersecurity incidents by 40% by 2026. * IAM leaders will take on primary responsibility for breaches by 2026. * Combining data loss prevention and insider risk management with IAM context by 2027. * Redesign of application security for non-cyber experts by 2027. Source: Gartner
“The scope of the top predictions this year is clearly not on technology, as the human element continues to gain far more attention. Any CISO looking to build an effective and sustainable cybersecurity program must make this a priority,” she said.
Gartner recommends that cybersecurity leaders build the following strategic planning assumptions into their security strategies for the next two years:
- By 2028, the adoption of GenAI will collapse the skills gap, removing the need for specialized education from 50 percent of entry-level cybersecurity positions.
GenAI augments will change how organizations hire and teach cybersecurity workers, focusing on the right aptitude as much as the right education. Mainstream platforms already offer conversational augments but will evolve. Gartner recommends cybersecurity teams focus on internal use cases that support users as they work; coordinate with HR partners; and identify adjacent talent for more critical cybersecurity roles.
- By 2026, enterprises combining GenAI with an integrated platforms-based architecture in security behavior and culture programs (SBCP) will experience 40 percent fewer employee-driven cybersecurity incidents.
Organizations are increasingly focused on personalized engagement as an essential component of an effective SBCP. GenAI has the potential to generate hyper-personalized content and training materials that take into account an employee’s unique attributes. According to Gartner, this will increase the likelihood of employees adopting more secure behaviors in their day-to-day work, resulting in fewer cybersecurity incidents.
Organizations that haven’t yet embraced GenAI capabilities should evaluate their current external security awareness partner to understand how it is leveraging GenAI as part of its solution roadmap.
- Through 2026, 75 percent of organizations will exclude unmanaged, legacy, and cyber-physical systems from their zero trust strategies.
Under a zero-trust strategy, users and endpoints receive only the access needed to perform their jobs and are continuously monitored based on evolving threats. In production or mission-critical environments, these concepts do not universally apply to unmanaged devices, legacy applications, and cyber-physical systems (CPS) engineered for specific tasks in environments focused on safety and reliability.
By 2027, two-thirds of global 100 organizations will extend directors and officers (D&O) insurance to cybersecurity leaders due to personal legal exposure. New laws and regulations, such as the SEC’s cybersecurity disclosure and reporting rules, expose cybersecurity leaders to personal liability. The roles and responsibilities of the CISO need updating for associated reporting and disclosures.
Gartner recommends organizations explore covering the role with D&O insurance, as well as other insurance and compensation, to mitigate personal liability, professional risk, and legal expenses.
By 2028, enterprise spending on battling malinformation will surpass $500 billion, cannibalizing 50 percent of marketing and cybersecurity budgets. The combination of AI, analytics, behavioral science, social media, Internet of Things, and other technologies enable bad actors to create and spread highly effective, mass-customized malinformation (or misinformation).
Gartner recommends CISOs define responsibilities for governing, devising, and executing enterprise-wide anti-malinformation programs, and invest in tools and techniques that combat the issue using chaos engineering to test resilience.
Through 2026, 40 percent of identity and access management (IAM) leaders will take primary responsibility for detecting and responding to IAM-related breaches. IAM leaders often struggle to articulate security and business value to drive accurate investment and are not involved in security resourcing and budgeting discussions.
As IAM leaders continue to grow in importance, they will evolve in different directions, each with increased responsibility, visibility, and influence. Gartner recommends CISOs break traditional IT and security silos by giving stakeholders visibility into the role IAM plays by aligning the IAM program and security initiatives.
By 2027, 70 percent of organizations will combine data loss prevention and insider risk management disciplines with IAM context to identify suspicious behavior more effectively. Increased interest in consolidated controls has prompted vendors to develop capabilities that represent an overlap between user behavior focused controls and data loss prevention.
This introduces a more comprehensive set of capabilities for security teams to create a single policy for dual use in data security and insider risk mitigation. Gartner recommends organizations identify data risk and identity risk, and use them in tandem as the primary directive for strategic data security.
By 2027, 30 percent of cybersecurity functions will redesign application security to be consumed directly by non-cyber experts and owned by application owners. The volume, variety, and context of applications that business technologists and distributed delivery teams create means potential exposures well beyond what dedicated application security teams can handle.
Gartner recommends that to bridge the gap, cybersecurity functions must build minimum effective expertise in these teams, using a combination of technology and training to generate only as much competence as is required to make cyber risk-informed decisions autonomously.