Gartner cybersecurity experts unveiled the top eight security predictions to help security and risk management leaders build their security strategies for the next two years based on those assumptions at the Gartner Security & Risk Management Summit in Sydney.

First of all, analysts warn that attackers will successfully weaponize operational technology (OT) systems to cause human casualties by 2025. OT attacks are getting more common and disruptive, so security leaders should start to be concerned about real-world hazards to humans and the environment on top of the information theft, Gartner noted.

“Unfortunately, what we've seen is bi-directional attacks emerging,” Gartner VP analyst Katell Thielemann said during the press conference, which includes a “deadly combination.”

She explained that not only is the number of disclosed vulnerabilities in the OT environments exploding, but also original equipment manufacturers (OEMs) who have most of those assets don't prioritize security. 

Threat actors are actively engineering malware to target those OT environments, Katell said. For example, there is a strain of malware that has been developed and was actively attempted to target the safety instrumented system which is designed to protect humans.

Plus, the time that bad actors need to develop and deploy malware has been shrinking. “It used to be years, then we went two months, and now we're talking about potentially weeks,” she said.

To address those heightened OT and IT threats, Gartner expects global governments and organizations will take more actions on security.

Gartner security excerpts forecast nearly one-third of nation-states will pass legislation to regulate ransomware payments, fines, and negotiations through 2025, and that number in 2021 was less than 1%. That’s why the firm suggests engaging a professional incident response team, law enforcement, and any regulatory body before negotiating with ransomware groups.

They also anticipate government regulations requiring consumer privacy rights will cover five billion people and over 70% of global GDP through 2023. Nearly 3 billion citizens across 50 countries had access to consumer privacy rights by 2021, according to Gartner.

Organizations Will Embrace Zero Trust, Single-Vendor security services edge (SSE)

In addition, analysts saw trends that more organizations will embrace emerging technologies and concepts such as zero trust and SSE.

60% of organizations will use zero trust architecture as a starting point for security by 2025, but more than 50% will fail to realize the benefits. “As zero trust is both a security principle and an organizational vision, it requires a cultural shift and clear communication that ties it to business outcomes to achieve the benefits,” analysts noted.

For SSE, they forecast that by 2025, 80% of enterprises will adopt a single-vendor SSE to unify web, cloud services, and private Application access. “Single-vendor solutions provide significant operational efficiency and security effectiveness compared with best-of-breed solutions, including tighter integration, fewer consoles to use, and fewer locations where data must be decrypted, inspected, and re-encrypted,” analysts pointed out.

Business Leaders Will Improve Security Awareness

On the private sector side, Gartner finds more security awareness has been raised among organizations and their leaders.

Currently, only 23% of security leaders monitor third parties in real time for threat exposure, according to Gartner’s data. But analysts expect 60% of organizations will start to mandate security risk as the primary determinant when conducting third-party transactions and business engagements by 2025.

For C-level executives, Gartner forecasts about half of them will see their employment contracts include cyber risk-related performance requirements by 2026. 

And 70% of CEOs will mandate an organization-wide resilience culture to survive threats from cybercrimes, severe weather events, civil unrest, and political instabilities by 2025, according to Gartner. 

“We can’t fall into old habits and try to treat everything the same as we did in the past,” Richard Addiscott, senior director analyst at Gartner, said at the summit. “Most security and risk leaders now recognize that major disruption is only one crisis away. We can’t control it, but we can evolve our thinking, our philosophy, our program, and our architecture.”