2025 Cybersecurity Trends from VIPRE: SMEs a Target and AI Malware to Fuel Supply Chain Attacks, With Regulatory Burden Amplifying Security Training Urgency

LONDON, Jan. 7, 2025 /PRNewswire/ -- 2024 saw increasingly sophisticated cybersecurity threats as criminals leveraged all forms of AI to create difficult-to-detect phishing attacks, deepfakes, and ransomware incidents. To counter these, organisations adopted AI-driven security solutions including threat detection, automated incident response, and intelligent vulnerability management, to protect data and infrastructure. In 2025, as AI evolves further in sophistication and adoption, alongside the growing burden of data breach costs and regulation – in addition to implementing advanced cybersecurity measures, organisations must prioritise real-world security awareness training.

Explaining why this is so, Usman Choudhary, Chief Product & Technology Officer, VIPRE Security Group, offers his thoughts on security trends that will dominate in 2025:

Combatting AI-powered phishing presents the biggest cybersecurity challenge for small and medium enterprises

In 2025, AI-driven phishing will evolve into a more sophisticated and stealthy threat. Cybercriminals will leverage AI to craft highly personalised attacks using publicly available data and advanced language capabilities, making these scams increasingly difficult to detect. This emerging strategy of threat actors involves multi-stage attack chains where initial communications appear innocuous, gradually building trust before delivering malicious payloads.

Attackers will specifically target platforms like Microsoft 365 and Google Workspace, exploiting their inherent limitations for credential harvesting. Ransomware actors will develop "hybrid" campaigns that blend phishing techniques with nuanced social engineering, manipulating recipients into unwittingly downloading dangerous files.

Small and medium enterprises (SMEs) are at risk of becoming prime targets due to their limited cybersecurity resources. Criminals will not only directly attack these organisations but also use them as strategic entry points for more extensive supply chain attacks into larger enterprises.

Adoption of AI-driven email drafting tools will potentially lead to increased mis-delivery-related data breaches

Already, misdirected emails have become a critical cybersecurity concern. Potentially, it is the most common cyber incident reported to the UK's Information Commissioner's Office (ICO) from a GDPR compliance standpoint.

The rise of hybrid work model and the use of personal devices for work-related tasks often leads to misdirection of email, incorrect file attachments, and miscommunication. Auto-complete and auto-correct features in popular email clients such as Outlook and Gmail further exacerbate the risk of misdirected emails, especially as often multiple contacts have similar names.

As the adoption of AI-driven email drafting tools grows in 2025, the potential for data breaches triggered by misdirection increases exponentially. These advanced email writing assistants not only draft content but also suggest recipients based on historical patterns, introducing an additional layer of complexity. The consequences can be severe and costly. A single misdirected email can expose sensitive information to unintended recipients, highlighting the importance of vigilance and careful review in today's increasingly automated communication environment.

The exploitation of supply chain vulnerabilities through AI-generated malware will increase

The cybersecurity landscape in 2024 witnessed a noticeable increase in the use of malware by cybercriminals to breach corporate networks, leading to widely publicised data leaks and reputational damage for the organisations involved. Likewise, criminals exploited supply chain vulnerabilities to infiltrate systems and cause severe disruptions, highlighting the far-reaching consequences of software integrity failures.  

In 2025, cybercriminals are poised to deploy AI-generated malware to breach both corporate networks and exploit supply chain ecosystems for vulnerabilities. They will leverage AI to develop highly evasive malware to bypass traditional detection methods while also automating vulnerability scanning and phishing. To neutralise these threats, security professionals will need to respond with equally proactive and innovative defensive strategies, including seamlessly integrating zero-trust architecture, embedding AI-powered tools, and implementing rigorous software development practices into their operational workflows.

Mounting data breach costs and regulatory burden will amplify security awareness training urgency

In 2024, enterprises faced an increasingly challenging cyber threat landscape, as cybercriminals successfully exploited the most advanced technologies, including AI, to breach organisations and cause mayhem. Research shows that the average cost of a data breach reached an all-time high with the global average cost of a data breach estimated at USD 4.88 million. Human error still remains the number one reason for a successful data breach.

To address this continuously intensifying situation, the regulatory burden is set to increase even more in 2025. The EU AI Act, which has already taken effect, has significant implications for organisations using AI in their operations, including cybersecurity and privacy. In the US, several states have either enforced or are enacting Data privacy laws in 2025, with all looking to address the collection, use and disclosure of personal data. These laws impose various obligations on businesses, including data protection, breach notification, and consumer rights.

The fallout of cybersecurity breaches in 2025 alongside the toughened regulatory landscape will give further impetus and urgency to security awareness training. While technological solutions are of course critical to defend against the constant onslaught of cyber-attacks, employees' understanding of the threat landscape and vigilance is indispensable for mitigating cybersecurity risk, and demonstrating regulatory compliance.

About VIPRE Security Group

VIPRE Security Group, the cybersecurity division of Ziff Davis, is one of the world's leading providers of cybersecurity solutions tailored for midsize to large enterprises. With nearly three decades of experience serving thousands of organisations and a global partner community, VIPRE's integrated cloud-based security solutions span across endpoint, email, compliance training, MDR, threat sandbox analysis, and threat intelligence data feeds. VIPRE provides the highest efficacy AI/ML-based advanced threat protection in the industry and simultaneously provides human risk mitigation tools through educational initiatives, GenAI tools, and technologies to empower users with a vision to democratise cybersecurity. Additionally, VIPRE's Inspired eLearning, the most awarded security awareness and phishing simulation platform in the industry, provides security awareness and compliance training for every business. VIPRE operates globally under various brands, including VIPRE®, StrongVPN®, IPVanish®, Inspired eLearning®, Livedrive®, and SugarSync®. More information at www.VIPRE.com.