Organisations must prioritise their cybersecurity measures to effectively navigate this evolving landscape.

AI – A Double-Edged Sword

Artificial Intelligence (AI) is a powerful force in cybersecurity, strengthening defences and increasing threats.

It enhances cybersecurity capabilities through real-time threat detection and response. Machine learning algorithms analyse vast data sets to identify patterns and anomalies that may signal cyber-attacks, allowing organisations to respond swiftly and minimise damage.

AI poses both advantages and challenges in digital security. While it enhances defence mechanisms, cybercriminals leverage AI to create sophisticated malware and more effective phishing attacks.

This duality reshapes the security landscape and highlights the need for constant advancements in cybersecurity technologies and strategies to combat evolving threats.

The cybersecurity landscape faces significant challenges due to a 67% rise in AI-driven attacks. These sophisticated attacks use advanced machine learning to adapt and evade traditional security measures.

This highlights the dual nature of artificial intelligence in cybersecurity, as it is both a tool for enhancing security and a weapon for malicious actors.

The rise of autonomous AI agents raises significant concerns for cybersecurity experts. These agents can execute complex cyberattacks independently, prompting critical questions about accountability and the effectiveness of current security protocols.

Cybersecurity professionals face increasing challenges as AI capabilities evolve, highlighting the need for proactive and adaptive strategies to protect digital assets.

Evaluating the ethical and operational implications of integrating AI in cybersecurity is crucial. AI-powered security tools can significantly enhance real-time threat detection, enabling quicker and more accurate responses to cyber threats. However, these advancements also introduce certain risks.

Investing in robust AI governance frameworks is crucial to address risks associated with AI technologies. These frameworks should guide responsible use and measures to prevent misuse, such as manipulation or biased decision-making.

Balancing AI’s advantages with its risks is essential for maintaining the integrity and security of our digital infrastructures, ensuring that AI enhances cybersecurity without compromising ethics or effectiveness.

Ransomware Evolution

Ransomware is once again dominating news headlines as it evolves into a sophisticated service-based model fundamentally altering the threat landscape.

This shift is not merely a passing trend; it signifies a pressing call to action for individuals and organisations to remain vigilant.

Ransomware as a service (RaaS) enables cybercriminals to easily launch attacks using accessible tools, increasing the frequency and severity of ransomware incidents across all business sectors.

As attackers become more advanced and targeted, robust cybersecurity measures and ongoing education on threats are essential.

In response to the growing ransomware threat, everyone in an organisation must take proactive measures to strengthen defences.

This includes regular data backups, advanced security software, and fostering cybersecurity awareness among employees. Staying vigilant against evolving ransomware tactics is crucial to protecting our digital lives.

The cybersecurity landscape is facing significant challenges due to the rise of RaaS. This trend democratises access to sophisticated cyberattack tools, effectively lowering the barriers for individuals and groups seeking to engage in cybercrime.

As a result, there has been a marked increase in cyber threats aimed particularly at small and medium-sized enterprises (SMEs), which often lack robust security measures compared to larger organizations.

Critical infrastructure sectors such as healthcare, energy, and transportation are prime targets for cybercriminals seeking high-profile breaches.

The emergence of RaaS highlights the professionalization of cybercrime, as experienced criminals support less skilled attackers.

This collaboration strengthens the underground market and complicates defenses against evolving threats. Thus, there’s an urgent need for enhanced cybersecurity strategies and a better understanding of risks faced by businesses and critical infrastructure.

In today’s digital landscape, organizations face an increasing array of cyber threats that can jeopardize their sensitive data and operational integrity.

To combat these evolving threats effectively, Organisations must conduct thorough assessments of their security vulnerabilities, identifying potential weaknesses within their systems, networks, and processes.

Enhancing endpoint protection is a foundational step in bolstering cybersecurity. This includes deploying advanced antivirus solutions, implementing firewalls, and utilising threat detection technologies to monitor and respond to suspicious device activities. Organizations should also consider adopting real-time monitoring solutions and automated responses to mitigate potential breaches.

Refining backup strategies is crucial alongside endpoint protection. Organizations should implement comprehensive data backup protocols with regular automated backups both on-site and off-site to ensure quick restoration of critical data during ransomware attacks or other data loss incidents. Regular testing of backup systems is also essential to ensure their effectiveness.

Promoting cybersecurity awareness among employees is another key component in a robust defense strategy. Training programs should be implemented to educate staff about recognizing phishing attempts, following safe browsing practices, and understanding their role in maintaining the organization’s security posture. Regularly updating this training helps to keep security awareness fresh and aligned with emerging threats.

Furthermore, developing robust incident response plans is essential for minimizing damage during a cybersecurity incident. These plans should outline specific procedures for detecting, responding to, and recovering from security incidents. Regularly rehearsing these plans through simulations ensures that all team members understand their roles and can act swiftly in a real scenario.

By implementing these comprehensive strategies, enhancing endpoint protection, refining backup strategies, fostering cybersecurity awareness, and developing effective incident response plans—organizations can significantly strengthen their defenses and safeguard against the increasing tide of cyber-attacks.

Zero Trust Architecture

The transition to Zero Trust Network Access (ZTNA) represents a major change in cybersecurity. Unlike traditional models that rely on perimeter defenses, ZTNA operates on a “never trust, always verify” principle.

This means every user, device, and application must be authenticated and authorized before accessing resources, enhancing the protection of sensitive information, especially in remote environments.

Organizations are integrating multi-factor authentication (MFA) into their access control measures alongside ZTNA.

MFA requires users to provide multiple verification forms, like a password combined with a biometric scan or a temporary code sent to their mobile device. This extra security layer protects sensitive data even if user credentials are compromised.

Continuous monitoring is crucial for real-time threat detection. By leveraging advanced analytics and machine learning, organizations can track user behaviour to identify anomalies indicating unauthorized access or internal threats.

Maintaining vigilance and adjusting security measures based on these observations can significantly lower the risk of data breaches.

In response to escalating cybersecurity threats, companies must adopt the “never trust, always verify” principle. This approach demands a comprehensive reevaluation of access controls and identity management.

Every user, device, and connection must be rigorously validated before granting access to sensitive systems, regardless of whether they operate within or outside the network. By firmly implementing this principle, organizations will significantly enhance their security posture and effectively tackle the challenges posed by modern cybersecurity risks.

Organisations are decisively adopting ZTNA frameworks across their networks to significantly enhance security.

In addition, they are integrating multi-factor authentication and implementing continuous monitoring practices to strengthen their defences against potential threats. This proactive strategy creates a safer digital environment and effectively mitigates risks.

Conclusion

Get ready for an exciting journey into Cybersecurity in 2025 and beyond! This future combines advanced technology with strategic thinking. Organisations can adopt innovative solutions to protect their digital assets and foster growth as we identify emerging risks. Cybersecurity will focus not just on defence but also on proactive strategies to thrive in a complex landscape.

*Ademola is the first Nigerian Professor of Cyber Security and Information Technology Management. He is also the first Professor of African descent to achieve Chartered Manager Status and serves as the General Evangelist of CAC Nigeria and Overseas.

These findings were reported in the recent Kaspersky Incident Response analyst report.

The Kaspersky Incident Response analyst report provides insights into cyberattacks investigated by the Kaspersky team in 2024, using data from organisations seeking help with incident response and highlights trends in security threats across various sectors and regions.

The report aids organisations in enhancing their security measures and developing effective incident response strategies.

According to the report, in a concerning trend that has persisted for years, public-facing applications have once again emerged as the primary vector for cyber attacks, accounting for 39.2% of cases in 2024.

Valid accounts have solidified their position as the second most common attack vector, representing 31.4% of incidents and showing a significant increase compared to 2023.

This surge indicates a growing number of companies being targeted by initial access brokers (IABs), who capitalise on compromised credentials sold on the darknet to facilitate further attacks.

This trend is particularly alarming in the context of Ransomware-as-a-Service (RaaS), where IABs play a crucial role in streamlining cybercriminal operations.

The data also revealed that victims in these cases were often compromised beforehand, leading to leaked credentials without immediate detection.

Trusted relationships have seen an uptick from the previous year, now accounting for 12.8% of attack vectors, while phishing remains a significant threat, utilised in nearly one out of every ten cases (9.8%).

“Cyber threats continue to evolve relentlessly, with attackers adapting their methods to exploit the most vulnerable points in companies’ defenses. This highlights the critical need for organisations to not only strengthen their immediate security measures but also to cultivate a proactive and adaptive incident response culture that can stay ahead of these emerging risks,” comments Konstantin Sapronov, Head of Global Emergency Response Team at Kaspersky.

To protect businesses from possible threats, Kaspersky experts recommend:

• Implementing robust password policy and multifactor authentication processes.
• Removing management ports from public access.
• Establishing a zero-tolerance policy for patch management or compensation measures for public-facing applications.
• Ensuring that employees maintain a high level of security.
• Use services like Kaspersky Incident Response or Kaspersky Managed Detection and Response to identify and stop the attack in early stages, before cybercriminals can reach their final goals.

The threat landscape has expanded in recent years as our world has become more interconnected. This has resulted in cybercriminals seeking out more opportunities to exploit vulnerabilities for profit.

Cybercriminals are far more organised than ever before and what we would typically call a “gang” is made up of a team of people that look a lot like their own legitimate business with departments for recruitment and finance.

As a result, attacks have moved away from simple virus disruptions to costly incidents that involve ransomware, encryption and Denial-of-Service.

Trend Micro has been tracking and monitoring the evolution of these organised crime groups in an effort to turn the tide against these illicit enterprises and create a safer digital world.

To have a true impact and combat the threat of cybercriminals, we share this threat intelligence with other security vendors, as well as academics and law enforcement agencies.

This “better together” way of thinking has seen us train up hundreds of law enforcers over the past decade or more and has contributed to the dismantling of highly successful criminal organisations.

International collaboration with INTERPOL

One of our longest standing law enforcement partnerships is with INTERPOL. From providing information about malicious actors to the threats and infrastructure used in their many attacks, our information provides valuable intelligence for their use.

This strategic partnership aims to enhance cyber expertise within law enforcement agencies, empowering them to effectively investigate and counter cybercriminal activities.

A key part of Trend’s partnership with INTERPOL is the work we do together under the Africa Cyber Surge Operation.

Started in 2022, the first round of the operation was so successful that a second campaign ran for four months in 2023, which saw law enforcement organisations from 25 countries participate.

During this time, Trend provided investigators with information about over 3,700 malicious command and control servers, 1,500 malicious IP addresses located in South Africa, Egypt, the Seychelles, Algeria and Nigeria, and malicious traffic detections linked to scams, malware, phishing and command and control servers.

From this and other shared insights, police made 14 arrests and identified a massive 20,674 suspicious cybercrime networks linked to losses of over $40 million.

Global police do a fantastic job of hunting down those responsible for cybercrime. But resources and in-house expertise are often stretched.

That’s why public-private partnerships are so important to the ongoing fight against ceaseless malicious online activity.

Operation Cronos locks out LockBit

More recently, we witnessed the takedown of one of the world’s most notorious ransomware gangs, LockBit, thanks to the cooperation between trusted partners and law enforcement agencies.

The Ransomware-as-a-Service (RaaS) group was responsible for between 25% and 33% of all ransomware attacks in 2023, claiming thousands of victims since it was first observed in September 2019.

LockBit’s business model revolved around affiliates that would be responsible for the attacks with the group claiming a 20% cut of the ransomware payment.

In February this year, the UK’s National Crime Agency initiated Operation Cronos which saw the seizure of the group’s source code, its technical infrastructure used to carry out attacks and its leak site. With these in hand, law enforcement announced arrests, sanctions and cryptocurrency confiscations.

The operation was well publicised across LockBit’s network and site, which has helped to cast doubt on the gang’s once powerful reputation as a RaaS group.

Following Operation Cronos, Trend Micro received a sample of what is believed to be a new version of LockBit’s software.

With this sample, we have been able to pass on intelligence to our law enforcement partners and bolster our defences for customers.

These attacks will keep on coming unless we discomfort and disrupt the threat actors themselves. By sharing resources and intelligence, the cybersecurity industry has demonstrated it can cripple cybercriminals and their infrastructure.

We are after all working towards the same goal: a safer online environment for all.