Tom Pelham, global head of cyber and data and Arran Roberts, partner at Kennedys examine what the new year has in store for the cyber market.

The digital threat landscape is set to undergo rapid and unsettling changes. The high profile attacks we’ve seen recently are not just news events, they are blueprints for the future. The following five predictions outline how cyber threats will evolve, who will be targeted, and how corporate boards will finally be forced to take notice.

The supply chain will be the primary weapon

We predict that threat actors will increasingly use supplier networks as their main point of entry. Instead of spending huge effort breaking into a major corporation, attackers will target the smaller, less protected companies that supply them. This creates a “domino effect” where one breach impacts larger partners across the supply chain. Threat groups know that taking down a crucial vendor, even a small one, can stop the entire operation of a global brand, giving them maximum leverage to demand a ransom. As governments and regulators demand more extensive vetting of partners, this focus on the supply chain will intensify, making vendor risk management a top priority.

Accountability will shift to the C-Suite

Cyber security and resilience failures will stop being seen as solely IT problems and will become failures of corporate governance. Regulators, like the UK’s ICO, will focus their enforcement actions on Directors and Officers (D&O), demanding proof that the board has invested properly in security, instilled a security-minded culture, and rigorously audited its partners. Expect to see significant fines and, potentially, major lawsuits holding individual executives personally accountable for data security negligence. This will force boards to treat cybersecurity as a fiduciary duty, ensuring it is a standing item on every board agenda.

Extortion tactics will become personal

As companies become more resilient and less inclined to pay ransoms, threat groups will ramp up psychological pressure to force negotiations. We predict an increase in threats that extend beyond intangible and remote networks, targeting executives and their families with intimidation, doxing (publishing private information), and even physical threats. Furthermore, threat actors will use advanced AI and deepfake technology to create false, highly damaging videos of CEOs or insert forged evidence of criminal behaviour into stolen data sets. The goal is simple: threaten to crash the stock price and destroy the company’s reputation, forcing a payment to prevent the release of the fabricated, yet believable, lie.

Ransomware will become more fragmented and indiscriminate

The recent take-downs of large, structured threat groups (like LockBit) have not reduced the frequency of attacks, but they have made the ecosystem more chaotic. We predict a surge in attacks from smaller, unpredictable, and less-sophisticated “Wild West” groups. This fragmentation means the attacks will be less targeted but more pervasive, hitting companies of every size simply based on opportunity. While sophisticated groups will still aim for larger companies, this chaotic environment ensures that no business, regardless of size or industry, can safely assume they are too small to be a target.

The most significant regulatory development in the UK will likely be the formal introduction of a targeted ban on ransomware payments. Following the government’s consultation (which closed earlier this year), the new legislation would prohibit the payment of ransoms by all publicly funded entities.

This ban would create a new, distinct list of organisations in the UK that are legally unable to pay a ransom. Consequently, the public sector will be forced to rapidly shift its focus and budget toward robust cyber-resilience.

A critical point of pressure in 2026, will be the fate of suppliers to publicly funded entities. While the ban may not ultimately be formally extended to cover the entire supply chain, there will be intense regulatory scrutiny and contractual pressure on these suppliers to also adopt a “no-pay” posture.

Cyber insurance will become mandatory

The pressure from large corporate clients will effectively make cyber insurance a mandatory requirement for doing business, similar to public liability policies. Even smaller companies within the supply chain will be expected to procure cyber insurance as part of the tender process. We predict a rapid increase in demand and a shift in perceptions that moves cyber insurance away from “nice to have” territory.