Google Cloud Security has presented its “Cybersecurity Forecasts for 2026” for yet another year. This is a report whose mission is to help security teams in large companies and SMEs identify the trends, threats and challenges that will take place next year.
According to cybersecurity experts at Google, next year there will be three main areas that will need to be paid special attention: the use of artificial intelligence; cybercrime, which will be considered the most disruptive global threat and the continued operations of state actors to achieve their strategic objectives.
What to take into account in 2026 in cybersecurity matters
In this article you will find expanded information on each of these three important trends to take into account in the field of security in 2026 according to Google.
The use of artificial intelligence by adversaries and defenders
According to Google, the new year will mark a new era in AI and security, for both adversaries and defenders.
In fact, cybercriminals are expected to use AI as the norm and not as the exception as before. This will completely change the landscape of cybersecurity threats, as the development and deployment of operations such as social engineering or malware development will be accelerated.
Another consequence of this is that phishing will no longer be simple, based solely on text, and will begin to use all types of audiovisual elements and languages. Thanks to the use of multimodal generative AI, both voice, text and video deepfakes will be used to impersonate and bring down users, both personal and corporate.
In this sense, vishing (voice phishing) will become popular and hyper-realistic business email compromise (BEC) attacks will take place on a large scale.
While AI is used by threat actors, it can also be used by those who want to defend themselves against their attacks. But empowering security operations with AI raises challenges such as “Shadow Agents” – employees using autonomous AI agents without authorization, which could lead to breaches and compliance risks – or the need to further secure identity and access management.
Cybercrime continues to wreak havoc worldwide
According to Google, financially motivated operations will increase over the next year, particularly ransomware and data hijacking. In fact, they will be the most financially damaging category of cybercrime globally, driven by large specialized groups exploiting third-party vendors and Zero-Day vulnerabilities in high-volume cascading attacks.
As organizations protect internal systems, more adversaries will make it their default strategy to systematically attack the underlying virtualization infrastructure (hypervisors).
Cyberphysical attacks
Google warns that Europe must prepare to face cyber-physical attacks targeting critical infrastructure, such as energy networks, transportation and digital infrastructure. These cyberphysical attacks will be combined with information operations that will seek to undermine the trust of the population.
Cyber espionage will also grow, according to Google Cloud, with cyber espionage campaigns orchestrated by governments such as Russia and China, which will target European governments, defense and research organizations in critical technology sectors.
In addition, threats will increase pressure on European supply chains, especially managed service providers and software dependencies, to gain access to large numbers of connected targets.
Main threats from governments
-Russia: According to Google Cloud, Russia's cyber operations will undergo a strategic shift, gathering intelligence to support global political and economic interests and gaining strategic footholds within international critical infrastructure environments.
-North Korea: North Korea's cyber threat apparatus will intensify its highly successful and lucrative operations against cryptocurrency organizations and users to generate revenue. They will increase technical innovation, relying on advanced social engineering tactics, such as luring their targets with fake hiring reviews and using deepfake videos.
Furthermore, North Korean IT workers will consolidate their presence and expansion in Europe, with the consequent financial and espionage risks for European organizations, having been strongly repressed in the United States, where they traditionally operated.
These workers, who threaten to disclose sensitive data or source code, will intensify their attacks with new skills in AI and blockchain. The adoption of virtualized corporate infrastructures and BYOD environments will make them more difficult to detect.
-China: The volume of China-related cyber operations will continue to increase with attacks on edge devices, exploiting Zero-Day vulnerabilities and targeting third-party vendors.
-Iran: Iranian cyber activity will seek greater regime stability and maintenance of regional influence amid current geopolitical conflicts. Regional tension between Iran, Israel and the United States will lead to a clear increase in cyber espionage, disruptive attacks and information operations.
Adaptation to the regulatory framework
In August 2026, the most stringent requirements of the European Union AI Law regarding high-risk AI systems will come into force. Companies operating in the EU are required to put in place robust risk management systems, will have to ensure data quality and will have to incorporate human oversight of their technology or face fines of up to 7% of annual global turnover.
Furthermore, the transposition of the NIS2 Directive (network and information systems security) into national legislation will strongly influence the cybersecurity landscape. Organizations will have new obligations regarding risk management in their supply chains and incident reporting obligations.
Leave a Reply