HP Wolf Security experts have made a number of predictions for how the cyber threat landscape is likely to change in 2026 – and how organizations need to adapt their defences…
Attackers will accelerate their investments in cookie theft
Ian Pratt, HP Global Head of Personal Systems Security at HP Inc.
Generalised multi-factor authentication (MFA) deployment will accelerate threat actors’ switch to stealing cookies and tokens instead of passwords. This means threat actors will need to act swiftly from time of theft, utilising the stolen cookie before it expires to insert backdoors that then grant them persistent access. Online marketplaces will expand to enable this with rapid trading and exploitation.
Defences against cookie and token theft are not mature and they are inconvenient for users. This means that we will see attacks involving such theft becoming increasingly commonplace. This is particularly serious for privileged users such as sysadmins, who frequently use web browsers to access high-value administrative websites, such as Entra ID, Intune, or AWS web portals, where cookie theft creates an easy path to a catastrophic enterprise breach.
Issuing sysadmins with a second PC, a Privileged Access Workstation (PAWs), is today’s recommended best practice, but is far from universally implemented, and there are plenty of examples where PAWs themselves have become compromised. For critical applications, enterprises should look toward additional layers of defence, such as strong isolation and application security posture attestation.
Cybercriminal groups will rely on AI agents to automate reconnaissance and target organizations
Alex Holland, Principal Threat Researcher in the HP Security Lab
In 2026, we expect to see organized crime groups automate workflows and outsource more tasks using AI agents in their attacks, especially preparatory tasks like researching victims to target. Beyond this, rapid improvements in large language models and agentic AI systems are expanding their role in the attack lifecycle. Threat actors will no longer limit their AI use to basic automation or phishing content creation. They will also start using AI to assist with complex tasks like vulnerability discovery.
AI assistance will help threat actors to scale their operations, making campaigns more efficient by reducing the resources and skills attackers need to breach targets.
Against a barrage of AI-assisted attacks, even the best detection tools will miss some threats. Instead, organizations need to ensure threats can be contained, isolated, and remediated, safeguarding their fleets, maximising uptime, and ultimately securing the future of work.
Physical attacks on devices will become cheaper and easier for cybercriminals
Boris Balacheff, Chief Technologist for Security Research and Head of the HP Security Lab
Hybrid work is accelerating the commoditisation of attacks enabled by physical access to devices. This is because devices are more exposed as employees are more mobile and distributed; and the tools needed for device tampering become increasingly accessible and affordable. In 2026, IT leaders should anticipate that this will continue, with easy-to-use exploitation kits and investment by threat actors into new physical attack techniques. In response, security auditors will increasingly focus on how organizations deploy best practices to protect data and device integrity across their fleets of devices.
Employees today work in cafés, bars, hotels, and conference centres across the globe, using shared infrastructure and peripherals – and giving threat actors ample opportunity to tamper with a device when its owner steps away. With physical tampering, threat actors can seek to exfiltrate data, grasp control of compromised devices to gain broader access to enterprise networks, and even mount destructive attacks to brick devices that are not designed with self-healing built in from the ground up. To ensure that the ‘Future of Work’ is secure, organizations will need to prioritise hardware with security and resilience built in at every level. They will need to look for device security capabilities to help protect hardware and firmware integrity, as well as data security, from physical attacks and will need to integrate hardware-level authentication and attestation into their zero-trust architecture strategies.
Organizations will finally take notice of IoT, edge, and print security after a string of attacks
Steve Inch, Global Senior Print Security Strategist at HP Inc.
After a year of high-profile attacks against connected devices, organizations will finally prioritise security for devices at the network edge. For example, security vulnerabilities allowed for remote takeovers of printers, highlighting the risks of leaving printers unprotected.
For too long, printers have been the lowest priority on every security team’s list. Many organizations lack basic visibility and control over print infrastructure. This creates security blind spots – from exploitation attempts to insider threats, outdated firmware, malicious updates, and misconfigurations, such as open ports or unchanged default credentials.
These security gaps give threat actors a potential launchpad to not only compromise a printer and the data it holds, but also other devices on the network. In the year ahead, organizations and governments will demand that endpoint devices like printers come with continuous and active system monitoring throughout their lifecycle.
Organizations need to secure their complete device ecosystem, including their printers. They should prioritise the ability to automate print fleet security compliance and automatically assess fleet firmware vulnerability status, minimising IT overhead in 2026.
Quantum resistance will become a vendor requirement
Thalia Laing, Principal Cryptographer at HP Security Lab
A year on from the introduction of new NIST standards for quantum-resistant asymmetric cryptography, public sector and critical infrastructure companies are going to accelerate planning and vendor engagements to chart a path towards migration. This process will reveal the scale of the challenge: with NIST intending to deprecate RSA-2048 by 2030 and all RSA and Elliptic Curve Cryptography by 2035, many vendors are likely to seize the opportunity to move directly from RSA-2048 to quantum-resistant algorithms, particularly in critical industries and long-life systems, such as hardware.
With ongoing advances in quantum computing, the prospect of a quantum computer capable of breaking asymmetric cryptography within a decade is becoming increasingly plausible. The US Government’s decision to set a quantum-resistance deadline of 2027 for new National Security System devices signals this urgency. [FLAG: Timeline depends on US National Security Memorandum and standards adoption; date may not be universal]
To become quantum resilient, organizations must start by preparing their long-lived hardware, including their printers and PCs. With a typical commercial PC refresh averaging at just over four years and an office-class commercial printer lifespan of between four to five years – devices procured in 2026 have the potential to be in use within the timeframe of a cryptographically relevant quantum computer.
From 2026 onwards, quantum resilience will increasingly influence hardware procurement decisions. This will increase pressure on device manufacturers to future-proof their devices by embedding quantum-resistant cryptography into their products, while pushing for the protection of long-life data.
Identity, provenance, and persistent control
Peter Blanchard, Document Workflow Security Strategy Principal at HP Inc.
In 2026, we’ll see efforts within enterprise security shift from fragmented identity frameworks and perimeter-based controls to a unified, data-centric model. Today’s zero-trust implementations often create complexity and fatigue, with identity scattered across users, apps, and devices. This fragmentation leads to blind spots, inconsistent enforcement, and poor user experience. The next phase will prioritise consolidation: centralised identity orchestration that simplifies access, strengthens governance, and reduces operational risk.
At the same time, we’ll see security move from focusing on point of entry, to managing the custody of data throughout its lifecycle. Organizations will need visibility into where data originates, how it is used, and who has access – even after it leaves their boundaries. Identity and policy will travel with the data, embedded through persistent controls, telemetry, and rich metadata. Dynamic permissions such as ‘can I share this?’ will evolve into continuous oversight, ensuring compliance online and offline.
Provenance and lifecycle control will become critical in the age of AI, where transparency and trust are non-negotiable. By embedding identity, custody, and governance controls into the core of digital ecosystems, organizations will achieve stronger, adaptive security that protects without adding friction, safeguarding the ‘Future of Work’.
