Back
Cyber Risk in 2026: What Security Leaders Need to Pay Attention to Now
Featuring insights from DirectDefense’s fireside chat with Jim Broome, Rick McElroy, and Tim Armstrong
Watch the Full Webinar
The Reality: Cyber Risk Isn’t Changing – It’s Accelerating
Budget cuts. Leaner teams. AI-generated code. Expanding attack surfaces.
Cyber risk in 2026 doesn’t look entirely new, but it is moving faster, becoming harder to see, and shifting into areas many organizations still struggle to control.
In this fireside chat, DirectDefense leaders sit down with Rick McElroy, CEO of Nexasure, to break down what actually changed in 2025 and what security teams need to rethink right now.
1. The Shift to Outsourcing Is No Longer Optional
Security teams are being asked to do more with less and many are responding by outsourcing operational functions.
But the conversation has evolved. It’s no longer just what can we outsource? It’s what must stay in-house, and why?
Today, those decisions are being driven by:
- Data governance requirements
- Geographic compliance constraints
- Visibility into third-party supply chains
The takeaway: outsourcing can scale operations, but accountability, and risk, doesn’t go away with it.
2. The Browser Is Now a Primary Attack Surface
As work becomes more distributed, the browser has quietly become one of the most critical and exposed entry points.
Employees are:
- Logging into business apps
- Accessing sensitive data
- Using AI tools
…all from the same environment.
That consolidation creates efficiency but also risk. Security strategies that still prioritize traditional endpoints over browser activity are missing where a lot of real exposure now lives.
3. AI Is Driving a New Class of Risk (and Scale)
AI is accelerating productivity but also expanding the attack surface in ways many teams aren’t prepared for.
One of the biggest examples: AI-generated code.
AI is producing code at massive scale, vulnerability rates mirror human output (~OWASP Top 10 issues) and QA and security teams are not scaling at the same pace.
The result is a continuous pipeline of new vulnerabilities faster than most organizations can assess or remediate.
At the same time, shadow AI usage is creating a parallel problem:
- Employees are using tools like ChatGPT and Claude without oversight
- Corporate data is being shared outside approved systems
- Security teams often have little to no visibility
This is not a future problem. It is already happening inside most organizations.
4. Attackers Aren’t Going Through You Anymore
Security investments are working, at least at the perimeter. Organizations have made meaningful progress by hardening endpoints, improving detection and response capabilities, and increasing overall visibility across their environments.
As a result, direct attacks have become more difficult and more expensive for adversaries to execute.
So attackers adapted.
Rather than going through well-defended environments, they are increasingly going around them, targeting third parties, exploiting vendor relationships, and moving deeper into extended supply chains. In many cases, the real exposure is not even a direct vendor, but a vendor’s vendor.
This is where visibility begins to break down, and where risk becomes significantly harder to quantify, monitor, and control.
The key takeaway is simple: as organizations mature their internal defenses, their risk does not disappear, it shifts outward.
5. Ransomware Is More Coordinated (and Messier) Than You Think
Ransomware is no longer a single attacker or even a single team.
Our SOC team is seeing multiple threat groups operating in the same environment, different teams handling exfiltration, persistence, and encryption, and attackers interfering with each other.
At the same time, threat actors are increasingly using legitimate tools (like RMM software) to blend into normal operations.
That makes detection less about known threats and more about understanding what normal looks like in your environment.
6. Frameworks Are Becoming a Business Language
Frameworks like NIST and CMMC are no longer just compliance exercises. They are becoming:
- A way to justify investment
- A common language for board-level conversations
- A structure for managing third-party risk
Without that framework alignment, it becomes significantly harder to explain why security initiatives matter or where to prioritize.
What This Means for Security Leaders
The common thread across all of this is that security is no longer just about defending your environment.
It’s about understanding how work is actually getting done (AI, browser, SaaS), gaining visibility into ecosystems you don’t fully control. scaling operations without losing accountability and defining “normal”.
The organizations that succeed in 2026 will not just respond faster, they will see more, earlier, and across more layers of their environment.
Watch the Full Conversation
If you want to go deeper into how these trends are playing out in real environments and what security teams are doing about it watch the full fireside chat.
04.09.26