Nation-state threats will worsen
The global geopolitical landscape is increasingly influencing the cyber threat environment. Nation-state actors, motivated by political or strategic goals, are launching more sophisticated cyberattacks which target critical infrastructure, government agencies, and private enterprises. These attacks are often highly targeted and can have devastating consequences that disrupt society and economies.
In 2025, we can expect an uptick in cyberattacks from nation-state actors as global tensions rise. The UK, like many other countries, has already experienced the consequences of these kinds of attacks – and new technologies such as AI and quantum computing are only making things more complex. Just last month, UK minister, Pat McFadden, warned that Russia and other adversaries of the UK are attempting to use AI to enhance cyber attacks against the nation’s infrastructure. Worryingly, however, over half (52%) of IT leaders in the UK do not believe the government can protect its citizens and organizations from cyberwarfare.
In 2025 we will increasingly see nation-state attacks move away from the direct theft of sensitive information and focus more on destabilising economies, disrupting services, or causing widespread panic. When it comes to threats such as these, catching the early warning signs is vital. Organizations need to ensure they are using proactive measures to detect and prevent threats before they materialise.
Supply chain attacks will continue to cause major disruption
For the last few years, it has become increasingly evident how vulnerable organizations are to supply chain attacks. Attacks on third-party vendors and partners were responsible for some of the highest-profile breaches in 2024, such as the Synnovis and the Network Rail attacks.
As such, supply chain security is now a priority for many businesses, particularly as they depend more on external vendors for critical services and products. This broadens the scope of cybersecurity efforts beyond the organization itself to include partners, suppliers, contractors and service providers. As such, organizations need to view their cybersecurity strategy holistically. It’s no longer enough to adopt a security posture that focuses solely on internal assets – businesses must extend their scope to the entire ecosystem.
Regulatory compliance becomes more complex
The importance of regulatory compliance in cybersecurity has shifted from being a mere checkbox exercise to a fundamental aspect of any organization’s strategy. And, with new regulations on the horizon, especially in the UK and Europe, businesses are now faced with even more stringent requirements.
For example, the EU’s Network and Information Systems Directive (NIS2) and Digital Operational Resilience Act (DORA) are pushing organizations to establish more robust cybersecurity frameworks. However, meeting these compliance requirements is not just about avoiding penalties. Organizations that invest in comprehensive cybersecurity programs, those that go beyond compliance and look to proactively protect against risks, are better positioned to maintain their reputation and trust among customers.
Additionally, as the number and complexity of regulatory frameworks continue to increase, the demand for compliance-as-a-service solutions – which help organizations navigate the complex landscape of local and international regulations – will increase. These services can offer businesses tailored solutions that simplify the process of ensuring adherence while also enhancing their overall cybersecurity posture.
Solution consolidation will be vital
Lastly, in response to the growing complexities of the threat and regulatory landscape, another trend we should expect to see in 2025 is the move toward single-platform solutions. Currently, organizations are heavily relying on point solutions designed to address specific security concerns, such as firewalls, anti-virus software, and intrusion detection systems. However, as the threat landscape grows increasingly complex, the demand for integrated solutions will increase and it’s important that organizations have the ability to easily work through the influx of information that is out there with single-platform solutions.
The author
Christina Kemper is Vice President of International at Armis
