The shape of the problem
Cybersecurity is a contest between people trying to get into systems and people trying to keep them out, and both sides adapt. The threats that dominate headlines change from year to year, but the underlying causes are remarkably stable: software has flaws, people can be persuaded to do unsafe things, and systems are often configured with convenience in mind rather than safety.
This article surveys where threats and defences appear to be heading. It avoids numbers on purpose. Statistics about cybercrime vary widely depending on who collects them and how, and a forecast of any specific future is a guess. What can be described fairly is the direction of travel and the habits that hold up regardless.
Threats that look set to continue
Ransomware and extortion. Malicious software that locks files and demands payment has been a major problem for organisations of all sizes for years. Attackers have also moved towards stealing data and threatening to publish it, which means that restoring from a backup solves only part of the problem. Authorities generally advise against paying, and recommend reporting incidents.
Phishing and social engineering. Tricking a person is often easier than breaking a system. Messages that imitate banks, delivery firms, colleagues or services remain one of the most common ways in. The techniques are described in more detail in the guide to phishing attacks.
Stolen and reused credentials. When one service is breached, leaked passwords are tried on others. This is why the same password in two places is a standing risk.
Unpatched software and exposed services. Attackers scan the internet constantly for systems running known-vulnerable versions or with management interfaces open to anyone. The window between a fix being published and attackers using the flaw can be short.
Supply chain attacks. Instead of attacking a target directly, an attacker compromises a supplier, a software library or an update mechanism that the target already trusts. This is a growing concern because modern software depends on large trees of third-party components.
Connected devices. Cameras, routers, sensors and appliances are often left with default credentials and outdated firmware. Devices like these have repeatedly been recruited into large networks of compromised machines, and the problem of default credentials and the importance of firmware updates are both well documented.
Threats that are changing
AI-assisted attacks. Language models can write convincing messages in any language, and generated voice and video can imitate real people. This makes some scams more believable and cheaper to run. The fair statement is that AI lowers effort for certain attacks; it does not make every attack new. Defenders are also using machine learning, for example to flag unusual behaviour. Understanding how models behave, including why they sometimes produce confident errors, helps in judging both sides, and the broader picture is in discussions of AI applications.
Deepfakes and impersonation. Convincing fake audio or video makes “is this really them?” harder to answer from a single call or clip. A practical response is process rather than detection skill: confirm unusual requests, especially about money, through a second, known channel.
Quantum computing and cryptography. A sufficiently large quantum computer could break some of the public-key encryption used today. Such machines do not exist at that scale yet, and when they will is uncertain. Standards bodies have already been working on replacement algorithms, and organisations are starting to plan migrations. For individuals, the sensible response is to keep software updated so new algorithms arrive automatically. The background is in our look at quantum computing.
Attacks on cloud and identity. As more services live in the cloud, attackers focus on accounts, access tokens and misconfigured storage rather than breaking into buildings or servers. Leaked API key secrecy failures, such as secrets committed to public repositories, are a frequent cause.
Embedded and body-adjacent devices. Medical and wearable devices, smart locks and vehicles raise the stakes because failures can have physical effects. This is part of why the discussion of the internet of bodies includes security and privacy as central issues.
How defences are evolving
Passkeys and stronger sign-in. Passwords are widely recognised as a weak point. Passkeys, which use public-key cryptography tied to your device, resist phishing far better than passwords and are being adopted by many services. Where a service does not support them yet, two-factor authentication using an app or hardware key is usually better than a text message code, and password managers make unique passwords practical.
Zero trust thinking. Rather than trusting everything inside a network perimeter, the idea is to verify each request and give each user and device only the access it needs. At home scale, this resembles network segmentation, where smart devices are kept apart from computers.
Secure by design. There is growing pressure on manufacturers to ship products that are safe by default, with unique credentials, signed updates and fewer exposed services. Hardware features such as secure boot help ensure a device runs only trusted software.
Automatic updating and memory-safe languages. Many serious vulnerabilities come from memory handling errors in older languages, and newer languages reduce that class of bug. Update systems that apply fixes quickly shrink the window of exposure.
Better detection and response. Organisations increasingly assume that some attacks will succeed and invest in noticing them early and recovering quickly. This is a sober and useful change of mindset.
Regulation and disclosure. Rules about breach reporting and product security are expanding in many regions, and the norms of responsible disclosure help bugs get fixed. How these pressures affect companies is discussed in the piece on security industry impact.
What builders should do
If you build things that connect to a network, you are part of the security picture.
- Change or remove default credentials, and avoid hard-coding secrets in code or repositories.
- Plan how your device will receive firmware updates before you ship or deploy it.
- Encrypt traffic and sensitive stored data; the essentials are covered under data encryption.
- Collect only the data you need, and be careful with cameras and microphones.
- Treat input from outside as untrusted.
- Follow the practical advice in a maker guide to connected project security.
What households should do
- Use a password manager and unique passwords, and turn on stronger sign-in options for email, banking and your main accounts.
- Install updates for phones, computers, routers and smart devices, and replace devices that no longer receive them.
- Be suspicious of urgent messages, and verify through an independent channel.
- Keep backups using a sensible backup strategy, including a copy that is not constantly connected.
- Put smart gadgets on a guest or separate network where your router allows it.
- Know where to report fraud in your country.
A realistic outlook
New technology brings new variations on old problems, but the habits that matter most change slowly: patching, strong authentication, backups, least privilege and healthy suspicion. Nobody can promise complete safety, and the details of the threat picture will keep shifting. Getting the basics right will protect you against a large share of what you are likely to encounter, and it leaves you better placed to adapt when the next trend arrives.