Preparing for Threats to Come: Cybersecurity Forecast 2026
Google Cloud Blog — November 4, 2025
Google Cloud’s Cybersecurity Forecast 2026 report outlines key cybersecurity trends and threats expected to shape the coming year, offering guidance for security leaders and teams as they prepare for evolving challenges. The forecast is based on real‑world data and insights from Google Cloud security leaders, frontline analysts, researchers, and incident responders.
The forecast anticipates that cybersecurity in 2026 will be defined by rapid evolution from both attackers and defenders. Adversaries are expected to adopt artificial intelligence (AI) as a standard tool rather than a niche advantage, using it to scale and enhance operations across the entire attack lifecycle. Defenders will also leverage AI, including agentic AI, to strengthen security operations and accelerate detection and response capabilities.
Artificial Intelligence, Cybercrime, and Nation‑State Activity
AI Threats
- Threat actors will increasingly use AI to boost the speed, scope, and effectiveness of their campaigns, making AI a default part of offensive operations.
- Prompt injection attacks — where adversaries manipulate AI prompts to execute hidden commands — are expected to rise significantly as a targeted threat against enterprise AI systems.
- AI‑enabled social engineering will accelerate, including deepfake‑enhanced voice phishing that uses AI‑driven voice cloning to impersonate executives or IT staff, increasing the difficulty of defense and detection.
AI Advantages and Security Operations
- Widespread adoption of AI agents will introduce new security challenges, requiring organizations to map and secure their evolving AI ecosystems. Identity and access management (IAM) will need to evolve to recognize AI agents as distinct digital actors with managed identities.
- AI is expected to transform security analyst roles by handling routine data correlation, incident summaries, and threat intelligence drafting, allowing analysts to focus on strategic validation and high‑level investigation within an agentic SOC framework.
Cybercrime Trends
- Ransomware combined with data theft and extortion will remain among the most disruptive and financially damaging categories of cybercrime, with attackers increasingly targeting third‑party providers and exploiting zero‑day vulnerabilities for large‑scale data exfiltration.
- As financial sectors increasingly adopt cryptocurrencies, adversaries are expected to leverage public blockchains to enhance the resilience of their operations against traditional takedown efforts.
- With security controls maturing at the guest operating system level, adversaries are predicted to pivot toward attacking underlying virtualization infrastructure, presenting a significant blind spot. A breach at this layer could compromise entire digital estates quickly.
Nation‑State Cyber Activity
The forecast also highlights expectations for state‑sponsored cyber operations:
- Russia is expected to shift toward prioritizing long‑term strategic goals and advanced cyber capability development beyond tactical support for active conflicts.
- China‑nexus operations are anticipated to exceed those of other nations in volume, with a focus on stealthy attacks that exploit zero‑day vulnerabilities and target edge devices.
- Iran’s cyber activity is predicted to remain multifaceted and resilient, blurring traditional lines between espionage, disruption, and hacktivism in pursuit of regional objectives and regime stability.
- North Korea will likely continue financially motivated operations, cyber espionage, and expansion of IT‑related threat activity.
Preparing for 2026
Understanding emerging threats will be critical for organizations to stay ahead of adversaries in 2026. Google Cloud recommends reviewing the full Cybersecurity Forecast 2026 report for deeper insights into these trends and challenges. Special forecasts tailored to specific regions such as EMEA and JAPAC are also available, and a corresponding webinar featuring threat intelligence experts is offered to provide additional context.