By Edward Cooney and Bradley Watts
Cybersecurity is ever evolving as the way companies operate and do business changes. With more employees working remotely and using outside tools like AI assistants, the holes in many companies’ cybersecurity protocols are widening. Today, scams are being executed on a larger scale as bad actors become more sophisticated and leverage technology such as AI for greater efficiency. In this increasingly risky environment, companies across industries must zero in on the latest cybersecurity trends and implement key mitigation strategies to keep their systems and data protected.
Four Trends that Require Attention
-
Artificial Intelligence in the Workplace
AI and generative AI tools offer transformative potential for businesses across industries, but they come with data privacy and cybersecurity risks. Most public AI tools retain user inputs to train and improve their models, meaning any client data input may be retained and potentially exposed later.
Mitigation Strategies:
- At minimum, companies should have a documented AI use policy for employees that outlines:
- Which AI tools can and cannot be used
- Restrictions on usage of client/private data
- Proper disclosure methods such as contract clauses or policy agreements
- User responsibility and guidance on reviewing AI results for accuracy
- Restrictions on website access and software downloads
- Companies’ privacy policies and contracts should disclose their use of AI to ensure transparency up front with clients and partners.
- Organizations should consider adopting a closed AI environment, built exclusively for internal use. These systems are much more secure than public AI tools like OpenAI, Claude or Gemini.
- At minimum, companies should have a documented AI use policy for employees that outlines:
-
Classic Cyberattacks Remain a Threat
Classic attack types are as strong as ever. From ransomware and banking scams to phishing and smishing, attackers continue to prey on common weaknesses in companies’ cybersecurity. According to Verizon’s 2025 Data Breach Investigations Report, credential abuse accounted for 22% of breaches. The report identified exploitation of vulnerabilities as the initial point of access in 20% of breaches — with just over half of those vulnerabilities getting fixed via available patches over the course of a year. Additionally, the report noted that breaches involving ransomware increased from 37% in 2024 to 44% in 2025.
Mitigation Strategies:
- Enforce more secure password policies across the organization.
- Ensure that required system updates and security patches are applied promptly to reduce vulnerabilities.
- Regularly educate employees on how to detect social engineering and phishing attempts.
- Regularly review cybersecurity policies to ensure practices protect against traditional and emerging threats. Companies might consider adopting deep web search tools that scan breach databases for exposed data.
- An in-house cybersecurity leader or outside consultant can be a valuable resource. They have the cybersecurity-specific expertise to review your tech platforms, uncover gaps in protection and create a clear maturity model to get your company’s cybersecurity policies where they need to be.
-
Vendors and Apps Might Be Your Weakest Link
Attackers are increasingly targeting vendors, applications and hardware, resulting in more effective and often larger-scale attacks. The Verizon report found that breaches involving a third party doubled from 15% to 30% between 2024 and 2025. Vendors often have access to a company’s private information, like banking accounts or employee data, and that information is at risk should the vendor’s system be breached.
Mitigation Strategies:
- Build cybersecurity into the contracting process by developing guidelines or scoring potential partners based on their cybersecurity practices.
- Require vendors to submit all relevant contracts and insurance policies for review.
- Ensure strong banking controls including continuous monitoring and auditing of transactions to detect anomalies.
- Conduct external security scans to monitor breaches that may impact vendors or applications.
-
Zero Trust Policies Are the Next Line of Defense
Traditional perimeter defenses used by many companies, such as firewalls and VPNs, are becoming less effective with the rise of cloud computing, remote work and mobile devices. These models are set up to keep external actors out, but once someone is given access to the network they have access to nearly all of it. As attackers continue to get better at breaching passwords and multi-factor authentication, zero trust polices are emerging as the next line of defense.
Zero trust policies are grounded in identity management and identity security, following the principle “never trust, always verify.” These policies grant least privilege access, giving users just enough access to perform a specific function rather than granting them full network access with a single sign-on. With a zero-trust approach, users are required to have unique logins and dual authentication for different apps and data access points within the network. This setup creates multiple layers of security so if one fails, not all is lost.
The Conner Strong & Buckelew Advantage
Cybersecurity programs are a critical investment for companies across industries. They protect data and systems as attackers get smarter and breaches bring significant monetary and reputational consequences. The right insurance broker can be a valuable resource for companies navigating the development of cybersecurity programs that protect them against a range of threats.
At Conner Strong & Buckelew, our in-house cyber task force helps organizations shore up their cybersecurity and protection by:
- Continuously assessing today’s most pressing cyber risks and loss trends
- Providing a customized, maturity-model roadmap to help them understand where they are now and what they need in the future — in language that resonates with IT leaders and in the boardroom
- Connecting them with top-tier resources to execute a cybersecurity maturity model
- Evaluating vendor and other relevant contracts and insurance policies to identify risks and ensure appropriate risk transfer
- Designing and implementing comprehensive insurance coverage
Ready to arm your company with a strong cybersecurity program? Contact us today to partner with experienced professionals committed to protecting your business, reputation and bottom line.








