A look forward
Animation unavailable...
This year’s cloud security story is still unfolding and a few things are clear: attacks are fast, environments are dynamic, and the expectations sitting on security teams have never been higher (we say this every year).
Yet amid this urgency, security is undergoing a transformation. Investment in doing security the right way makes a meaningful difference in addressing and reducing organizational risk. Security teams are investing in the right foundations today – open innovation, AI, and runtime visibility – and they’re making marked improvements not just reacting to threats, but laying the groundwork for long-term resilience. This isn’t a trend; it’s a strategic and fundamental shift within modern security with measurable impact.
As we look ahead to the second half of 2025 and beyond, we expect to see the following:
1.
An increase in the number and frequency of threats targeting AI infrastructures.
As organizational AI implementations continue to grow and develop, attackers will continue to follow the data, money, and computing power. We first identified LLMjacking in early 2024, and have witnessed and continued to report on the development of a massive underground market. We’ve since discovered successful AI-generated malware. As victims innovate, so do attackers.
2.
Expect to see “AI as a tool” evolve into “AI as a partner.”
With platform-integrated AI like Sysdig Sage already driving faster investigations and remediation, AI has already pushed beyond being just a chatbot. We anticipate the shift is coming soon from AI to agentic AI, where it starts making containment decisions, triggering actions, and defending systems with only human oversight.
3.
The security-developer relationship/gap will continue to grow closer.
Security responsibility isn’t just being shifted left, it’s being shared. With developer-friendly remediation context and less noise, security will become natural, not painful. Together, these teams will treat security issues like how developers treat bugs – triage, prioritize, and fix at the speed of new code.
4.
Supply-chain attacks and CI/CD exploits will continue to test boundaries.
Expect to see more defaults bypassed and conveniences tested. Fortunately, most of this year’s findings have been proactive security researchers, but don’t be surprised if someone gets caught flat-footed. Runtime will be the only defense once code is run.
5.
