The biggest cybersecurity trends for 2027 are AI-enabled attacks moving from theory into the FBI's statistics, exploited vulnerabilities overtaking stolen credentials as the top way in, and EU rules turning security into a legal obligation for anyone who sells software. Here are all ten, with the number behind each:
- AI-enabled attacks are now measured. The FBI recorded $893 million of AI-related losses in 2025 in its first AI category, out of $20.9 billion in total internet crime losses.
- Exploits come first, and AI speeds up discovery. Vulnerability exploitation caused 31% of breaches, up from 20%, and only 26% of known-exploited vulnerabilities were fully fixed (Verizon DBIR 2026).
- Ransomware: more attacks, fewer payers. Ransomware appeared in 48% of breaches, but 69% of victims did not pay.
- Third parties and the software supply chain. Breaches involving a third party rose 60% to 48% of the total, and Sonatype found 454,600 new malicious open-source packages in 2025.
- Identity is the target. More than 97% of identity attacks are password attacks, and Microsoft says phishing-resistant MFA stops over 99% of them.
- AI agents and shadow AI become an attack surface. 45% of employees now regularly use AI on work devices, and 67% of them through personal accounts.
- State actors stay inside critical infrastructure. Ten agencies issued a joint advisory on Chinese government-linked hacking in October 2026.
- Regulation turns into deadlines. EU Cyber Resilience Act reporting started September 11, 2026, and its main obligations apply December 11, 2027.
- Post-quantum migration gets dates. NIST's draft deprecates RSA and ECC after 2030 and disallows them after 2035.
- Vendors consolidate while defenders run short. Google closed its Wiz acquisition, and 59% of security teams report critical or significant skills needs (ISC2).
Every figure comes from the organization that measured it (the FBI, CISA, NIST, the European Commission, the DHS budget, and security firms' own research and SEC filings), plus our own search data where it adds something. Vendor research is labeled as such.
Let's get into it.
1. AI-Enabled Attacks Are Now Measured
AI in cybercrime has moved from speculation to statistics.
The FBI's 2025 Internet Crime Report added its first "AI related" category: 22,364 complaints and $893 million in losses, including more than $632 million in investment scams with an AI element. Total reported losses rose 26% to $20.9 billion. The Verizon 2026 Data Breach Investigations Report found the median threat actor used generative AI across 15 documented techniques, from targeting to malware development.
Vendor data points the same way. CrowdStrike's 2026 Global Threat Report found AI-enabled adversaries increased operations by 89%, and IBM's 2026 breach study found AI-driven attacks up 56%, adding about $1 million to the cost of a breach.
What companies are doing
Anthropic disclosed that a Chinese state-sponsored group used its Claude Code tool to run an espionage campaign in which AI performed 80% to 90% of the work against about 30 targets, with a small number of intrusions succeeding.
What to expect in 2027
Expect deepfake voice and video to show up in more fraud and hiring scams in 2027, and expect AI to shorten every stage of an attack. Defenses that rely on spotting bad grammar or unfamiliar voices will stop working; verification steps that don't depend on how a request looks or sounds will matter more.
2. Exploits Come First, and AI Speeds Up Discovery
Attackers are getting in through unpatched software faster than defenders can fix it.
The same DBIR found vulnerability exploitation caused 31% of breaches, up from 20%, making it the top way in. Only 26% of known-exploited vulnerabilities were fully fixed, down from 38%, and the median fix took 43 days. Google's Mandiant reported in M-Trends 2026 that exploits were the top entry point for the sixth straight year, and that the average time to exploit is now negative: attacks routinely start before a patch exists. CrowdStrike measured the average eCrime breakout time at 29 minutes.
AI is now finding bugs at a scale patching can't match. In Anthropic's Project Glasswing, about 50 partners found more than 10,000 high or critical vulnerabilities in roughly a month using an AI model. In open-source projects, only 75 of 530 disclosed high or critical bugs had been patched.
What to expect in 2027
The constraint in 2027 is patching capacity, not finding vulnerabilities. Expect security teams to prioritize by real exploitation (CISA's known-exploited list) rather than severity scores, and expect pressure on software vendors and open-source maintainers to ship fixes faster.
3. Ransomware: More Attacks, Fewer Payers
Ransomware is everywhere, but fewer victims are paying.
The DBIR found ransomware in 48% of breaches, up from 44%, but 69% of victims did not pay, and the median payment fell to $139,875. Chainalysis (vendor data) found on-chain ransomware payments of about $820 million in 2025, down 8%, even as claimed victims rose 50%. The two datasets disagree on whether the typical payment rose or fell, which reflects different samples: Verizon's breach cases versus Chainalysis's blockchain-traced payments.
Microsoft's Digital Defense Report 2025 found more than half of attacks with a known motive were driven by extortion or ransomware. IBM put the global average cost of a breach at a record $4.99 million in 2026.
What to expect in 2027
Expect ransomware groups to keep shifting to data theft and extortion, which works even when backups are good. Recovery planning in 2027 has to cover data exposure and regulatory reporting, not just restoring systems.
4. Third Parties and the Software Supply Chain
Attackers increasingly come in through someone else.
The DBIR found 48% of breaches involved a third party, up 60%, and only 23% of third parties fully fixed missing or weak MFA on cloud accounts. In open source, CISA warned about the Shai-Hulud worm, which compromised more than 500 npm packages and stole developer credentials. Sonatype counted 454,600 new malicious packages in 2025 and 149,329 more in Q3 2026 alone, including the first known case of a rogue AI agent publishing a malicious package.
What to expect in 2027
Expect vendor risk programs to move from questionnaires to evidence (MFA status, SBOMs, patch timelines) in 2027, driven partly by the EU rules in trend 8. For engineering teams, pinned dependencies and delayed adoption of new package versions become basic hygiene.
5. Identity Is the Target
Most attacks still go after accounts, human and machine.
Microsoft found more than 97% of identity attacks are password attacks, and identity-based attacks rose 32% in the first half of 2025. Its estimate: phishing-resistant MFA stops more than 99% of them, even when the attacker has the right password. The DBIR found a human element in 62% of breaches, and Mandiant found voice phishing is now the second most common way in, at 11% of intrusions.
What companies are doing
Palo Alto Networks closed its CyberArk acquisition in February 2026, saying machine identities now outnumber humans by more than 80 to 1. CrowdStrike reported a 130% rise in incidents linked to North Korean operatives, often posing as remote IT workers.
What to expect in 2027
Expect passkeys and phishing-resistant MFA to become the baseline in 2027, and expect identity programs to expand to cover service accounts, API keys and AI agents, which now outnumber employees. Our search data shows passkeys going mainstream: "passkeys" searches are up 22% in a year.
6. AI Agents and Shadow AI Become an Attack Surface
The AI tools employees use are now a security problem in their own right.
The DBIR found 45% of employees are regular AI users on corporate devices, up from 15%, and 67% of them use non-corporate accounts. Source code is the top type of data sent to external AI tools. IBM's 2025 study found 13% of organizations reported breaches of AI models or applications, and 97% of those lacked proper AI access controls.
Standards are forming. NIST launched an AI Agent Standards Initiative in February 2026 covering agent security and identity.
What to expect in 2027
Expect AI governance to become part of the security budget in 2027: approved tools with enterprise accounts, data loss controls for AI prompts, and permissions for agents that act on company systems. Our search data shows the topic arriving: "prompt injection" searches are up 175% and "ai cybersecurity" up 83% in a year.
7. State Actors Stay Inside Critical Infrastructure
Nation-state hacking of critical infrastructure is persistent, not episodic.
In October 2026, ten agencies led by the FBI, CISA and NSA issued a joint advisory on Chinese government-linked actors combining automated scanning, botnets and hands-on hacking against US critical infrastructure. CrowdStrike measured China-linked activity up 38% in 2025, and Microsoft saw Russian activity against NATO countries outside Ukraine up 25%.
What to expect in 2027
Expect utilities, telecoms and their suppliers to face more federal and insurer scrutiny in 2027, and expect "living off the land" techniques that hide in normal admin tools to remain the hardest to detect.
8. Regulation Turns Into Deadlines
Europe has turned cybersecurity into hard legal deadlines; the US is moving more slowly.
The EU's Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities from September 11, 2026, with its main obligations applying from December 11, 2027. NIS2 covers 18 critical sectors, though the Commission proposed easing it for about 28,700 companies in January 2026. The financial sector's DORA rules have applied since January 2025.
In the US, CISA's incident reporting rule under CIRCIA was listed for a September 2026 final rule, a date that has passed.
What to expect in 2027
For anyone selling software or connected products in the EU, 2027 is the compliance year: vulnerability handling, SBOMs and 24-hour reporting need to work before December 2027. In the US, expect sector rules and contracts, not one federal law, to set requirements.
9. Post-Quantum Migration Gets Dates
The move to quantum-resistant cryptography now has a timeline.
NIST's draft transition guidance deprecates RSA and elliptic-curve cryptography after 2030 and disallows them after 2035. It selected HQC as a backup encryption algorithm, with a final standard expected in 2027. CISA published a list of product categories where buyers should require post-quantum support, including browsers, cloud platforms and full-disk encryption. An executive order requires federal systems to support TLS 1.3 by January 2, 2030.
What to expect in 2027
Expect 2027 to be the inventory year: finding where cryptography is used and which vendors have post-quantum roadmaps. Data with a long shelf life (health, financial, government) is the priority, because it can be stolen now and decrypted later.
10. Vendors Consolidate While Defenders Run Short
The security industry is consolidating and growing fast, while security teams stay stretched.
Google closed its acquisition of Wiz in March 2026, and Palo Alto Networks closed CyberArk. The leaders keep growing: Palo Alto's next-generation security ARR rose 63% to $9.1 billion, CrowdStrike's net new ARR rose 51%, and Fortinet's product revenue rose 52%.
Defenders are short of people. The ISC2 2025 Workforce Study (16,029 respondents) found 59% report critical or significant skills needs, up from 44%, with AI the top skill gap. And the federal government is cutting: the DHS fiscal 2027 budget request cuts CISA by $385.8 million and 867 positions.
What to expect in 2027
Expect buyers to consolidate onto fewer platforms in 2027, and expect AI-driven security operations to be sold as the answer to the skills gap. With less federal capacity, more of the burden falls on companies and their vendors. Our search data shows the training market cooling: "cybersecurity bootcamp" searches are down 84% and "cybersecurity training" down 45% in a year.
What We're Seeing in Search
Our database tracks US search demand across tens of thousands of trends. For cybersecurity, as of August 2026: "prompt injection" is up 175%, "ai cybersecurity" up 83% and "passkeys" up 22% in a year, while "zero trust" is down 18%, "cybersecurity training" down 45% and "cybersecurity bootcamp" down 84%. Interest is moving from established frameworks and career courses to AI-specific threats and passwordless login.
For related reads, see our AI industry trends and software development trends.
The Common Thread
Put the ten shifts side by side and one pattern runs through them: speed now favors the attacker, and the rules are catching up.
AI shortens every step of an attack, exploits arrive before patches, and breakout takes minutes. Defenders face more vulnerabilities than they can fix, more identities than they can track, and fewer people to do the work. Regulators, led by the EU, are responding by turning good practice into legal deadlines.
If you plan for three things in 2027, plan for these: prioritize patching by real-world exploitation and give it dedicated capacity; make phishing-resistant authentication the default and extend identity controls to machines and AI agents; and get your vulnerability reporting, SBOM and supplier evidence ready for the EU Cyber Resilience Act's December 2027 deadline.
Frequently Asked Questions
What are the biggest cybersecurity trends for 2027?
The biggest shifts are AI-enabled attacks, exploited vulnerabilities as the top entry point, ransomware with fewer victims paying, third-party and supply chain breaches, identity attacks, AI agents and shadow AI as new attack surfaces, nation-state activity in critical infrastructure, EU regulatory deadlines, post-quantum cryptography migration, and vendor consolidation alongside a skills shortage.
How much did cybercrime cost in 2025?
The FBI's Internet Crime Report recorded $20.9 billion in reported losses in 2025, up 26%, including $893 million in its first AI-related category. IBM put the global average cost of a data breach at a record $4.99 million in 2026.
When does the EU Cyber Resilience Act apply?
Its reporting obligations for actively exploited vulnerabilities and severe incidents started on September 11, 2026. Its main obligations apply from December 11, 2027.
When do organizations need post-quantum cryptography?
NIST's draft guidance deprecates RSA and elliptic-curve cryptography after 2030 and disallows them after 2035. Federal agencies are already buying post-quantum-capable products in categories CISA has listed, and data with a long shelf life should be protected first.
Is ransomware still growing?
Attacks are, but payments are not. Verizon's 2026 DBIR found ransomware in 48% of breaches, while 69% of victims did not pay. Chainalysis estimated on-chain ransomware payments fell 8% to about $820 million in 2025 even as claimed victims rose 50%.
Want to spot the next security shift before it hits the mainstream? Read our guide on how to identify market trends or browse what's gaining traction in our trending topics list.
Never miss a trend again
- One trend broken down with the numbers
- Who's making money, and what to build
- A website on the rise
- A breakout app
Join 5,000+ founders
