Skip to content

2023 predictions

It was that time of year again ... Vendors, Analysts, "thought leaders" and security leaders shared their predictions for 2023.

Here's an overview of those I read and got something from:

Synthesis

Lots of predictors are "talking their book," with predections aligned to their roles, companies, or investments. This is unsurprising, as the same beliefs likely influence those relationships.

Overall, some themes were:

The Market

Consensus seems to be that VCs will invest in early-stage companies, while later-stage companies will see layoffs, down rounds, and PE activity. Cyber Security services may see increased demand.

The Threats

Attackers will evolve: * adopting new technologies like AI and ML * introducing cloud-native ransomware and improved exportion capabilities * leveraging new monetization vectors

Critical Infrastructure will see a continuation in the elevated volume of threat activity.

Security Programs

Limitations in budgets and hiring will have security leaders looking to consolidated vendors, but they may still pick tools to balance reducing headcount. Diversity, inclusivity, and cross-training will be used to help with the "talent gap." The supply chain security trend will continue, introducing a push for solutions that avoid profligation of third parties. Privacy and resiliency will be major themes.

Summaries

Frankly Speaking - 5 Cybersecurity Predictions for 2023

  1. Continuing "trend towards Security Engineers"
  2. A good year for Cybersecurity Services
  3. Smaller budgets, but tools over headcount spend
  4. Vendor consolidation
  5. VCs will stay busy in early-stage

Google Cybersecurity Action Team - January 2023 Threat Horizons Report

  1. More cross-platform targeting and pivoting from threat actors (cross CSP)
  2. Move from cryptomining to phishing or ransomware to monetize short-term attacker tenancy
  3. Risks from third-party dependencies, and security struggling to keep up
  4. Targeting of cloud services and resources to disrupt OT systems
  5. Increased amount of cloud-specific attack tools and malware, specifically ransomware

Emilio Escobar - My security predictions for 2023

  1. Security budgets will require additional justification
  2. Cloud adoption will accelerate, leading to additional breaches where security teams are not cloud-aware
  3. SaaS misconfigurations will rise
  4. Companies will pursue "Platform Engineering" and manage everything as code
  5. Movement to solutions that reduce need for third parties
  6. More security products that sell to developers directly
  1. More early stage VC activity
  2. More layoffs, down rounds, and PE activity in later stage cybersecurity companies
  3. Product predictions: Web3, AI/ML, API Security, No-Code Security, Managed Services,Security Program Value Realization, Identity Threat Detection, Automation Integrators, VAR evolution, Consumer Protection

6 IBM cybersecurity predictions for 2023: Ransomware and CaaS will spike

  1. Ransomware attacks, especially against organizations outside industries and regions already impacted
  2. Cybercrime-as-a-service boom
  3. ICS systems targeted by social engineering
  4. Increase in EDR and MFA evasion
  5. Implementation failures in zero trust

AT&T - 10 Cybersecurity predictions for 2023

  1. Continued threats to Critical Infrastructure and Public Sector
  2. OT attacks will become more prevalent
  3. Additional attention paid to Privacy
  4. Cultural focus on resilience and safety
  5. Fundamentals (Vulnerability and patch management, risk reduction, and Managed Extended Detection and Response (MXDR)) will regain focus
  6. Cyber Security as a Service expansion
  7. Tech-savvy and business-savvy CISOs needed
  8. Consolidation in Zero Trust tooling
  9. Increased attention from the Board
  10. Pain points from skills shortages and product silos

SentinelOne - #cybersecurity predictions for 2023

  1. Low sophistication threat actors will cash in
  2. Vendor consolidation and collaboration, at customer demand
  3. Cost will drive security programmatics
  4. Deepfakes will show up in social engineering
  5. MacOS will see cross-platform malware

2023 Security Predictions by Tal Dery, co-founder and CTO of Red Access

  1. Ransomware will stay a major concern
  2. Deepfakes will grow more sophisticated and widespread
  3. Enterprises will focus on browsing security
  4. Passwordless will reach the enterprise

Naked Security 33 1/3 – Cybersecurity predictions for 2023 and beyond

Security issues will come from the same places:

  1. Memory mismanagement
  2. Poor password choice
  3. Unpatched systems

The Hacker News - Cybercrime (and Security) Predictions for 2023

  1. Increase in digital supply chain attacks
  2. Increase in mobile-specific threats
  3. Continued risks in cloud security
  4. Ransomware-as-a-Service sticks around
  5. Data privacy laws will keep getting stricter

ControlPlane - Cloud Native and Kubernetes Security Predictions 2023

  1. CVEs continue to rampage and tear through the supply chain
  2. Kubernetes RBAC and security complexity continues to intensify
  3. Slow adoption of zero trust will leave passwords and credentials open to theft
  4. Attackers will adopt AI and ML more effectively than defenders
  5. Automated defensive remediation will continue to grow slowly
  6. Cybersecurity insurance policies will descope ransomware and negligence

Venture in Security - The 360 degrees view of cyber: notes and reflections about the state of cybersecurity after the NightDragon's 2022 year in review event

  1. “Best of suite” platform companies will outperform “best of breed” point solutions
  2. "Tourist investors" will pull back, leaving more room for specialist investors with a solid understanding of cybersecurity
  3. "consolidation, simplification, and automation will remain big areas of focus for security leaders"
  4. Security service providers will get additional opportunities as trusted advisors
  5. Security teams will diversify hiring by recruiting people with industry lenses
  6. Increased application of AI and machine learning in cybersecurity
  7. Increased focus on cyber literacy

Oxeye - 5 Application Security (AppSec) Predictions for 2023

  1. AppSec and CloudSec will converge
  2. ‘Shift left’ will become ‘Shift everywhere’
  3. The C-Suite will demand greater visibility into the risk contributions of applications and teams
  4. Vulnerability Exploitability Exchange (VEX) will grow in popularity due to demand for clearer prioritization data
  5. Software supply chain security will finally have a clearer definition

BAE Systems - 2023 Cybersecurity Predictions

  1. Ransomware will have global impact
  2. Adversarial AI attacks could lead to real-world consequences
  3. Cyber insurance policy carve outs will have impact
  4. Energy security and cybersecurity to converge
  5. The industry will focus on retaining and upskilling mid-level cybersecurity employees
  6. The UK National Cyber Strategy will lead to an evolution in cyber capabilities
  7. 5G will bring attack surface

Lohrmann on Cybersecurity - The Top 23 Security Predictions for 2023 Part 1 Part 2

  • More cyber insurance issues and assorted (big) changes coming. Many won’t qualify.
  • More nation-state cyber attacks based on lessons learned from the Ukraine war.
  • Growing trouble with multifactor authentication (MFA) attacks.
  • New attacks against space vehicles and drones.
  • Social media attacks surge, including the use of targeted deepfakes.
  • Use of public cloud computing and digital transformations grows, along with cyber threats.
  • More critical infrastructure attacks that impact society.
  • Hacktivism grows into new areas and becomes a bigger problem.
  • Enterprises veering away from endpoint solutions and moving towards platforms to reduce complexity.
  • Ransomware will be back in new, more dangerous, blended forms.
  • More attacks against non-traditional technology, from cars to toys to smart cities.

Trend Micro Security Predictions for 2023

  1. Social engineering threats will continue and adapt to new technologies
  2. Ransomware will increase capabilities for data extortion
  3. Attackers will target home equiptment to account for (flawed) zero trust models
  4. Security issues from misconfigurations and inconsistent application of cloud
  5. Industrial internet of things security will struggle with the skills gap

Rak Garg - Security's Fifth Estate: Predictions for 2023

  1. Application security will better understand developers
  2. Phishing will get worse (especially due to AI)
  3. Security productivity will benefit from automation (like SOAR and XDR)

JupiterOne - Security Leaders Debate: Cybersecurity Predictions for 2023

  1. Cloud security will move beyond CSPM
  2. CI/CD and IaC tools for audit trails and solving other security problems
  3. Attacker monetization strategies will evolve
  4. Radical data breach transparency from CISOs 
  5. Security will give up on the user as a line of defense

AWS security heads offer top cybersecurity predictions for 2023

  1. MFA adoption will grow
  2. Increasingly inclusive workforce will address talent gap
  3. Collaboration will improve preparedness and incident response
  4. Training and education will be key
  5. IaC will make "shift left" tangible
  6. Business resiliency will see increased investment
  7. Purpose-built tools will increase visibility
  8. Automated reasoning will benefit cloud security
  9. Quantum-resistant cryptography will get serious