Cybersecurity Check: 4 Trends and Risk Mitigation Strategies

Four Trends that Require Attention

1. Artificial Intelligence in the Workplace

   AI and generative AI tools offer transformative potential for businesses across industries, but they come with data privacy and cybersecurity risks. Most public AI tools retain user inputs to train and improve their models, meaning any client data input may be retained and potentially exposed later.

   Mitigation Strategies:

   • At minimum, companies should have a documented AI use policy for employees that outlines:
     • Which AI tools can and cannot be used
     • Restrictions on usage of client/private data
     • Proper disclosure methods such as contract clauses or policy agreements
     • User responsibility and guidance on reviewing AI results for accuracy
     • Restrictions on website access and software downloads
   • Companies’ privacy policies and contracts should disclose their use of AI to ensure transparency up front with clients and partners.
   • Organizations should consider adopting a closed AI environment, built exclusively for internal use. These systems are much more secure than public AI tools like OpenAI, Claude or Gemini.

2. Classic Cyberattacks Remain a Threat

   Classic attack types are as strong as ever. From ransomware and banking scams to phishing and smishing, attackers continue to prey on common weaknesses in companies’ cybersecurity. According to Verizon’s 2025 Data Breach Investigations Report, credential abuse accounted for 22% of breaches. The report identified exploitation of vulnerabilities as the initial point of access in 20% of breaches — with just over half of those vulnerabilities getting fixed via available patches over the course of a year. Additionally, the report noted that breaches involving ransomware increased from 37% in 2024 to 44% in 2025.

   Mitigation Strategies:

   • Enforce more secure password policies across the organization.
   • Ensure that required system updates and security patches are applied promptly to reduce vulnerabilities.
   • Regularly educate employees on how to detect social engineering and phishing attempts.
   • Regularly review cybersecurity policies to ensure practices protect against traditional and emerging threats. Companies might consider adopting deep web search tools that scan breach databases for exposed data.
   • An in-house cybersecurity leader or outside consultant can be a valuable resource. They have the cybersecurity-specific expertise to review your tech platforms, uncover gaps in protection and create a clear maturity model to get your company’s cybersecurity policies where they need to be.

3. Vendors and Apps Might Be Your Weakest Link

   Attackers are increasingly targeting vendors, applications and hardware, resulting in more effective and often larger-scale attacks. The Verizon report found that breaches involving a third party doubled from 15% to 30% between 2024 and 2025. Vendors often have access to a company’s private information, like banking accounts or employee data, and that information is at risk should the vendor’s system be breached.

   Mitigation Strategies:

   • Build cybersecurity into the contracting process by developing guidelines or scoring potential partners based on their cybersecurity practices.
   • Require vendors to submit all relevant contracts and insurance policies for review.
   • Ensure strong banking controls including continuous monitoring and auditing of transactions to detect anomalies.
   • Conduct external security scans to monitor breaches that may impact vendors or applications.

4. Zero Trust Policies Are the Next Line of Defense

   Traditional perimeter defenses used by many companies, such as firewalls and VPNs, are becoming less effective with the rise of cloud computing, remote work and mobile devices. These models are set up to keep external actors out, but once someone is given access to the network they have access to nearly all of it. As attackers continue to get better at breaching passwords and multi-factor authentication, zero trust polices are emerging as the next line of defense.

   Zero trust policies are grounded in identity management and identity security, following the principle “never trust, always verify.” These policies grant least privilege access, giving users just enough access to perform a specific function rather than granting them full network access with a single sign-on. With a zero-trust approach, users are required to have unique logins and dual authentication for different apps and data access points within the network. This setup creates multiple layers of security so if one fails, not all is lost.