Security leaders are navigating a threat environment defined by speed, automation, and asymmetry. Three currents stand out this year, and they reward different responses.

CURRENT 1Ransomware diversifiesits pressureanswer with recovery planningthat also knows what was takenCURRENT 2Identity attacks moveupstreamanswer with narrower privilege,shorter sessions, a hardenedhelp deskCURRENT 3Phishing scales withgenerative AIanswer with phishing-resistantauthentication and out-of-bandchecksCURRENT 1Ransomware diversifies its pressureanswer with recovery planning that also knowswhat was takenCURRENT 2Identity attacks move upstreamanswer with narrower privilege, shortersessions, a hardened help deskCURRENT 3Phishing scales with generative AIanswer with phishing-resistant authenticationand out-of-band checks
Three currents, three different responses.

Ransomware diversifies its pressure

Encryption is no longer the whole business model. Extortion now layers data theft, harassment of customers and partners, and regulatory-deadline pressure on top of the traditional lockout. The practical consequence: recovery planning that only answers "can we restore?" is half a plan. The other half is knowing what was taken, being able to say so quickly, and having decided in advance who negotiates, who notifies, and who talks to the press.

Encryptionthe traditionallockoutData theftwhat was taken, andproof of itHarassmentof customers andpartnersDeadlinepressureregulatory clocksused as leverageEncryptionthe traditional lockoutData theftwhat was taken, and proof of itHarassmentof customers and partnersDeadline pressureregulatory clocks used as leverage
Extortion in layers. Restoring from backup answers only the first.

Identity attacks move upstream

Attackers increasingly skip the endpoint and go for the authentication flow itself — session token theft, help-desk social engineering, MFA fatigue, and abuse of legitimate remote-access tooling. Programs that narrowed privileged access, shortened session lifetimes, and hardened the help desk's identity-verification script have quietly removed whole classes of incident.

Phishing scales with generative AI

The tell-tale broken English is gone. Lures are fluent, personalized, and cheap to produce in any language, which means user training built on "spot the typo" is training for the last war. The compensating controls are structural: phishing-resistant authentication, verified out-of-band channels for payment changes, and detection logic built around attacker behavior rather than message cosmetics.

The organizations responding well share a pattern: they spend less on predicting which threat arrives next, and more on making every path shorter to contain — narrower privilege, faster recovery, clearer ownership.

The next wave of resilience will come from cross-functional readiness, not point tooling alone. That is a budgeting statement as much as a technical one.