By Robert Hannigan, Chairman of International Business at BlueVoyant
The cybersecurity landscape in 2025 was defined not just by high profile breaches, but by the quiet, growing vulnerabilities that made them possible. Single point weaknesses rarely stayed isolated; instead, disruption spread quietly through shared suppliers, unseen dependencies, and trusted relationships that had never truly been tested. In the UK, “highly significant” cyber attacks rose by 50% from 2024, highlighting the growing threats almost all organisations are experiencing.
As a result, security leaders must move beyond reactive controls and checkbox assurance toward a more realistic understanding of how modern attacks unfold. The year ahead will not be defined by bold predictions, but by how effectively organisations respond to what 2025 already made impossible to ignore.
Supply Chain Risk Reaches an Inflection Point
Unlike any other year in recent memory, 2025 emphasised the importance of effective third-party cyber risk management with suppliers. With several high-profile breaches making front-page news – to the point where the UK Government felt compelled to intervene financially – supply chain cyber risk became a global reality.
Incidents increasingly played out over weeks rather than hours, business recovery took longer, and the operational impact often extended well beyond the initially affected systems. Security teams found themselves managing widespread outages and breaches, from lost access and halted operations to reputational and financial fallout – that had real-world consequences for employees and suppliers.
BlueVoyant research revealed that 98% of UK businesses were negatively impacted by supply chain breaches in the 12 months to September 2025 – highlighting how widespread these threats have become. Attackers have demonstrated that exploiting trust is often more effective than breaching networks directly. Shared technologies, service providers, and business relationships have become unintentional pathways for disruption. In many cases, organisations were impacted not because their own controls failed, but because assurance stopped at the boundary of the enterprise.
As a result, organisations are increasingly being judged on how they demonstrate continuous, verifiable visibility into supplier risk. This requires moving beyond point in time assessments toward evidence that trust is actively monitored and maintained.
AI-Generated Deepfakes, and a New Age of Deception
At the same time, the rapid adoption of AI has reshaped how attacks are executed and scaled. Deepfake vendor calls, auto generated procurement documents, and synthetic onboarding requests are no longer edge cases, but recurring challenges for global enterprises.
AI has made impersonation cheaper, faster, and harder to detect. In this environment, attackers do not need to penetrate networks if they can convincingly pose as a trusted partner. Static assurance models struggle to keep pace, particularly where identity, provenance, and verification are not designed to operate continuously.
As AI is adopted across the economy, poorly secured systems – and the data that supports them – will increasingly become targets themselves. Techniques such as data poisoning will continue to threaten trust, integrity, and decision-making at scale.
Nation State Pressure and Blurred Threat Lines
Geopolitical instability continues to shape cyber activity in the second half of the 2020s. Hostile nation states increasingly behave as though they are engaged in an active cyber conflict with Western economies, and this is becoming more visible across the threat landscape.
This hybrid environment is driving greater reliance on criminal groups as proxies, further blurring the line between state backed and financially motivated attacks. Ransomware as a Service (RaaS) is likely to expand and escalate as criminal operators benefit from protection, coordination, or safe harbour, while continuing to exploit weaknesses across global supply chains.
Defining Effective Security Strategies in 2026
Responding to these challenges does not require a complete reinvention of security strategy, but a return to fundamentals applied at ecosystem scale. Over the past year, organisations that managed disruption most effectively were those that moved beyond isolated controls and adopted a more collaborative approach to defence.
Rather than relying on static assessments and periodic reviews, they invested in continuous visibility, shared intelligence, and faster remediation across operational partners. This reflects a growing recognition that resilience is no longer achieved in isolation, but through coordinated action across the environments that support day to day operations.
Progress is being made by organisations grounding themselves in the basics, including strong authentication, clear ownership of risk, verifiable software, and data lineage. These measures do not eliminate risk, but they materially reduce its impact and restore control in an increasingly unpredictable digital environment.
From Reaction to Readiness
A more resilient model of cyber defence is beginning to take shape. Leading organisations are moving away from isolated assurance and towards shared responsibility, treating visibility and trust as collective efforts rather than internal checkboxes. Supplier engagement is becoming more continuous and operational, supported by shared dashboards, collaborative remediation, and real time insight.
This approach does not eliminate surprise, but it shifts the balance. Organisations that invest in verification over assumption, support smaller but critical partners, and treat visibility as a team sport are better equipped to absorb disruption and act when incidents occur. Ultimately, in today’s environment, resilience is built through action.