By: Paulina Okunytė

Nearly 90% of law enforcement support using AI to increase efficiency, while almost all are worried about safety.

A national survey of US first responders has shown that the agencies strongly lean toward adopting AI. Responses by law enforcement workers also showed a growing demand for cloud-native, data-driven, integrated mobile systems to improve the outcomes of using AI systems.

“Public safety agencies across the United States are grappling with challenges such as cyberattacks, legacy system outages, and the resilience and efficiency of their operations,” said Bob Hughes, CEO of technology company Mark43 behind the survey.

The survey, which included 538 public safety professionals, was conducted between October 2nd and October 23rd, 2024. An impressive 90% of law enforcement now support using AI, a 55% jump from last year.

More than half see it as a game-changer for productivity, with 89% believing it could be a powerful tool to reduce crime and transform the public safety industry. Law enforcement agencies also showed increasing trust that AI would be used responsibly.

Cybersecurity is still a concern

However, a significant number of law enforcement officers are concerned about cybersecurity risks. Eighty-four percent said their organization had experienced a cybersecurity issue in the last year, with scam calls, malware, and viruses being the top issues.

Over half (57%) of first responders report that their records management systems (RMS) are typically unavailable for more than 10 hours a year due to software updates. Similar issues affect computer-aided dispatch (CAD) systems.

Public safety professionals have experienced various technical difficulties, according to the survey. Almost all respondents reported experiencing at least one outage or malfunction in the past year, ranging from software update delays to power grid failures caused by natural disasters like hurricanes and wildfires.

Over two-thirds of law enforcement agencies have experienced on-premises system outages due to a lack of up-to-date technology.

A near-total majority (89%) of law enforcement worry that outdated systems could hinder their agency’s response to major events like sports, conventions, concerts, natural disasters, or cyberattacks.

Most public safety professionals believe the public would feel more confident if local agencies followed federal security standards like FedRAMP, which ensures top-tier security for cloud technologies.

“In 2025, leading public safety agencies will embrace cloud-native systems and AI to enhance efficiency, strengthen cybersecurity and resilience, improve mobility, and optimize resource allocation – ultimately enabling them to serve their communities more effectively,” concluded Hughes.

Original Story: https://cybernews.com/news/us-first-responders-embracing-ai/

National survey shows strong support for AI adoption and a growing demand for cloud-native, data-driven, integrated mobile systems to improve efficiency and outcomes

NEW YORK – Mark43, the leading mission-critical public safety platform, today announced the results of a U.S. national survey of first responders, revealing strong support for AI adoption, concerns about cybersecurity and a growing demand for cloud-native, data-driven, and interoperable computer-aided dispatch (CAD) and records management systems (RMS) to improve efficiency and public safety outcomes. A new 2025 U.S. Public Safety Trends Report released today documents the complete survey results.

“Public safety agencies across the United States are grappling with challenges such as cyberattacks, legacy system outages, and the resilience and efficiency of their operations,” said Bob Hughes, CEO of Mark43. “To address these concerns, first responders are seeking cloud-native, mobile, and data-driven public safety CAD and RMS systems that strengthen security, enhance resilience and also drive efficiency and better outcomes. A strong foundation—with a unified, open, and interoperable CAD and RMS—is essential. By leveraging Mark43’s real-time operating system, public safety agencies can build on this foundation, enabling them to improve the safety, security, and quality of life in the communities they serve.”

First responders want AI for efficiency and improved outcomes.

• Nearly all (90%) of law enforcement support their agencies using AI, an increase of 55% over last year’s survey. A majority (65%) say it would help them be more productive and efficient and a strong majority (89%) think that leveraging AI would help their agencies reduce crime.
• A majority (88%) of law enforcement trust their agencies to use AI responsibly. This is a 29% increase over last year’s survey.
• A majority (87%) of law enforcement believe AI is transforming the public safety industry for the better. The reasons they cite are largely efficiency improvements that include streamlining report writing, speedy data processing, enhanced analytics, more easily locating certain crimes, and generally improving productivity.

First responders are concerned about cybersecurity and resilience.

• Eighty-four percent of law enforcement acknowledge that their organization experienced a cybersecurity issue in the last year. Respondents reported that scam calls, malware and viruses were the top issues. 
• Over half (57%) of first responders cite that their RMS is typically unavailable for over 10 hours a year due to software updates, and 54% say the same for their CAD system. Furthermore, over two-thirds (68%) of law enforcement have experienced on-premises system outages due to a lack of updated technology. 
• A near-total majority (95%) of public safety professionals cited at least one outage or technology malfunction in the last year. This is an increase of 8% over last year’s survey. 
• Eighty-five percent of first responders believe disruptive events such as power grid failures, hurricanes and wildfires can overwhelm public safety agencies. 
• A near-total majority (89%) of law enforcement are concerned with how their agencies running on legacy systems would handle a tactical response during major events like sports, political conventions, concerts or natural disasters and cyberattacks.
• A majority of public safety professionals (83%) believe the general public would feel better if their local public safety agencies were required to adhere to federal government security standards, like FedRAMP, which mandates a premier and standardized approach to security and risk assessment for cloud technologies.

First responders want data-driven public safety for improved outcomes.

• A majority (86%) of public safety professionals believe data reporting processes could be improved at their organizations, and cite the top reason is to save time.
• Seventy-two percent of law enforcement agencies have a Real Time Crime Center, and 92% report they are effective in enhancing first responder and officer response. 
• Sixty-nine percent of law enforcement reported a Real Time Crime Center would benefit their agency and agencies in their community, with the top three benefits cited as  improved intelligence for greater future efficiency, improved public safety and faster response times to emergency calls. 
• Three-quarters (78%) of law enforcement agencies use analytics or business intelligence tools to analyze crime and internal data with 87% reporting it would be helpful to have them integrated into the records management system. The top three benefits of these tools that respondents cite are helping them understand crime patterns, increase operational efficiency, and support case investigations and pattern identification.
• Eighty-three percent of first responders think there should be greater crime data and statistics transparency with the general public. This sentiment has grown 26% since 2022 in the 2023 U.S. Public Safety Trends Report.

Public safety professionals call for an integrated modern platform and mobility for optimal efficiency.

• Three-quarters (76%) of law enforcement have spent more than half their shifts completing paperwork, with 70% having to use overtime to do so.
• Eighty-eight percent of law enforcement acknowledge that new, modern technology processes would help them better serve the community.
• A near total majority (97%) of law enforcement agree that tools saving time from typing the same information multiple times in a report would make an impact.
• The majority (65%) of first responders have had to return to a physical location to fill out reports, which is a 7% increase since last year’s survey. Furthermore, 55% of surveyed first responders need to be at their agency’s office to fulfill their duties. However, there is a desire for more flexible working arrangements, including 80% of emergency telecommunicators who would be more likely to extend their career if there were an option for remote work. 
• Over half (51%) of law enforcement have to log in to four to six applications for their role on a daily basis. This reflects an industry need for integrated systems that eliminate application silos and streamline manual processes to save time and resources.
• A strong majority (88%) of law enforcement feel that switching between multiple applications affects their efficiency in completing tasks. Almost all (99%) of law enforcement states it would be helpful to have a single, consolidated CAD and RMS platform that integrates all of the data sources they currently use.
• Eighty percent of law enforcement use their mobile phones as part of everyday work tasks. Eighty-seven percent of law enforcement would find it helpful if they had more information about the location they are responding to on their mobile devices, and 82% cite that having CAD and RMS on their mobile devices would increase confidence and efficiency.
• Nearly two-thirds (63%) of law enforcement cited an increase in requests for record expungement due to new state laws, and over three-fourths (85%) find it challenging to manage record sealing or expungement processes in their jurisdictions.

The Mark43 2025 U.S. Public Safety Trends report includes complete survey results and trends.

Using the expertise of emergency responders collected through the survey, insight from Mark43 customers and input from leading luminaries in public safety, the Mark43 2025 U.S. Public Safety Trends Report identifies the following emerging trends that will impact public safety in 2025 and beyond:  

1. AI for accelerating public safety operations
2. Cybersecurity and resiliency go hand-in-hand
3. Data-driven public safety for improved community outcomes
4. Comprehensive platform powers innovation

“In 2025, leading public safety agencies will embrace cloud-native systems and AI to enhance efficiency, strengthen cybersecurity and resilience, improve mobility, and optimize resource allocation—ultimately enabling them to serve their communities more effectively,” said Hughes.

Survey methodology

A national online survey of 538 public safety professionals was conducted by Propeller Insights between October 2 and October 23, 2024. Respondents opted into an online database; from there, they were targeted based on demographics. To further confirm qualifications, respondents were asked to verify their information in the survey itself with self-identifying qualifications. The maximum margin of sampling error was +/- 4 percentage points with a 95% level of confidence.

Original Story: https://drj.com/industry_news/new-2025-us-public-safety-trends-report-reveals-first-responders-are-embracing-ai-concerned-about-cybersecurity-and-want-to-improve-efficiency-with-modern-tech-systems/

Jane King highlights the Mark43 2025 U.S. Public Safety Trends Report on WMGT (NBC), live from Nasdaq.

By: Katie Sanders

QUICK SUMMARY

The biggest data breaches of 2024 exposed critical vulnerabilities across industries, from healthcare to telecommunications. Let’s examine the root causes, impacts, and expert-recommended strategies to strengthen cybersecurity and prevent future attacks.

2024 was another banner year for cybercriminals—and not in a good way for the rest of us. From massive credential leaks to supply chain compromises, the sheer scope and creativity of this year’s data breaches were enough to keep even the most seasoned security teams awake at night.

What’s striking isn’t just the volume of incidents but how breaches are evolving, targeting overlooked vulnerabilities and exploiting new attack surfaces like AI-generated phishing scams or cloud misconfigurations. From government records to telecommunications giants, no sector was safe from the growing sophistication of cybercriminals. 

As technical leaders, you know the stakes: reputational damage, regulatory fallout, and the ever-looming threat of customer attrition. If 2024 taught us anything, it’s that our approaches to security need to be just as dynamic and resourceful as the adversaries we’re up against.

Proactive steps to help keep data secure include implementing strong password policies, using multi-factor authentication, encrypting sensitive data, regularly updating software, and regularly conducting security audits. Employee education and training are also essential as human error is a common cause of data breaches.

Vlad Cristescu, Head of Cybersecurity at ZeroBounce, says his company lives and breathes cybersecurity. He shared how they’re tackling challenges and keeping systems secure:

• Zero Trust philosophy: Nobody, inside or outside the company, gets a free pass. Every user and device must prove they belong.
• Constant monitoring: We use smart tools to watch for anything suspicious 24/7.
• Educate the team: Cybersecurity isn’t just IT’s job; it’s everyone’s job. We train our team to spot phishing emails and other threats.
• Prepare for the worst: We don’t just have an incident response plan; we practice it so we’re ready if something happens.
• Pick partners wisely: We hold our vendors to high standards because we know their security affects ours.

“Every breach reminds us that cybersecurity isn’t something you can set and forget. It’s an ongoing priority, and we’re all responsible. If we learn from what happened in 2024 and stay vigilant, we’ll all be better prepared for whatever comes next,” emphasized Cristescu.

In this roundup, I’ll examine five of 2024’s biggest data breaches: National Public Data, Ticketmaster, Dell, AT&T, and Change Healthcare, and offer firsthand insights from industry experts.

Each of these breaches highlights different vulnerabilities and offers lessons on how to better protect data in an increasingly digital world.

Ticketmaster Data Breach

In June 2024, the hacking group Shiny Hunters claimed to have stolen customer details from Ticketmaster and Live Nation, a global leader in ticket sales and event management, affecting approximately 560 million individuals.

“ShinyHunters is a threat actor group known for successfully breaching companies and selling the customer data they access on the black market,” notes John Paul Cunnigham, CISO at Silverfort.“In this case, the attack came via a managed service provider used by Ticketmaster.”

The stolen data included names, addresses, contact details, credit card information, and ticket orders, posing risks of financial fraud and identity theft. The breach exposed the vulnerabilities in Ticketmaster’s customer data management practices and underscored the risks of storing large volumes of personal and financial information.

The consequences of the Ticketmaster breach were far-reaching. Many customers faced increased risks of financial fraud and identity theft, prompting Ticketmaster to issue warnings and advise affected individuals to monitor their financial accounts closely. The breach also led to reputational damage for Ticketmaster, as customers and partners expressed concerns over the company’s ability to protect their personal information.

A holistic human-centered security approach, coupled with good block and tackling security implemented by a professional security team, will go a long way to preventing most cyber attacks.

According to Cunnigham,“Greater attention needs to be given to both human and machine identities used in the performance of services and integrations with third-parties and service providers. Organizations attempt to stop bad actors with a patchwork network of identity controls and tools, and often rely overly on third-party attestations such as SOC2 reports.”

“These point solutions operate in silos, securing only what they know. Many enterprises rely on a patchwork mix of one or more cloud identity providers (IdPs) and other point solutions to secure the accelerating number of identities. Attackers know this and take advantage of the gap in security to hop from one part of an organization to the next to steal data. Identity is extremely distributed, but its security doesn’t have to be. Without a unified security layer, identity and security teams will continue struggling to protect the accelerating number of identities, sacrificing security and productivity.”

What did the Ticketmaster breach teach us? Cristescu believes,“We’re only as strong as our weakest vendor. If a third party you rely on isn’t secure, your data is at risk.”

So, what can organizations do?“Take a closer look at your partners. Audit them regularly, ask tough questions about their security practices, and don’t be afraid to walk away if they can’t meet your standards,” continues Cristescu.

AT&T Data Breach

AT&T, one of the largest telecommunications companies in the United States, experienced a data breach in July 2024 that impacted approximately 70 million customers. The breach was caused by a sophisticated cyberattack that targeted AT&T’s customer database, leading to the exposure of sensitive information such as customer names, phone numbers, email addresses, and billing information.

Stolen data has a long tail of impact, not just on the companies, but also on the trust customers place in them. Data breaches of increasing impact and size are happening more often, making it critical that organizations rethink their approach to data security and protection. Rather than protecting around the data with traditional security measures, they need to adopt data de-identification methods to protect the actual data while retaining its value internally and rendering it useless to attackers even when stolen.

The AT&T breach highlighted the growing threats faced by telecommunications companies, which are prime targets for cybercriminals due to the vast amount of personal data they manage. The breach also raised concerns about the security of telecommunications infrastructure and the need for stronger defenses against increasingly advanced cyber threats.

Clyde Williamson, Senior Product Security Architect at Protegrity, says,“Records of calls and texts from nearly all of [AT&T] wireless customers being exfiltrated is not only a violation of trust on the customer’s end, but it showcases how thoroughly out-of-date current cybersecurity strategies are. The inferences that can be made from different types of data matter just as much as stolen PII.”

AT&T collaborated with federal authorities and cybersecurity firms to investigate the incident and secure its systems in response to the breach. Affected customers were notified through emails and text messages, providing guidance on protecting their accounts and monitoring for suspicious activity.

AT&T implemented additional security measures, including enhanced encryption for customer data, multi-factor authentication for account access, and stricter access controls for sensitive information.

Cristescu says the AT&T breach teaches us to“double down on access controls. Not having them is like leaving the front door to your house wide open.”

What else can you do?“If you’re not already using Multi-Factor Authentication (MFA), start today. Combine it with role-based access controls to ensure only authorized people see sensitive data,” says Cristescu.

Dell Data Breach

In March 2024, Dell suffered a significant data breach that exposed the personal information of over 180 million customers. The breach resulted from a vulnerability in Dell’s customer support systems, which hackers exploited to gain unauthorized access to customer names, addresses, email addresses, and phone numbers.

The breach underscored the importance of securing customer support systems, often targeted by cybercriminals seeking to exploit weak points in a company’s infrastructure. Dell’s breach also highlighted the risks associated with third-party vendors, as the vulnerability was linked to a third-party software component used in their support systems.

In response to the breach, Dell took immediate action to contain the incident and secure affected systems. It worked with cybersecurity experts to identify the source of the vulnerability and implement patches to prevent further exploitation. Dell strengthened internal cybersecurity policies, conducted regular security audits, and enhanced employee training to recognize and prevent potential security threats.

The Dell breach taught us that “a ‘trust but verify’ approach with vendors just doesn’t cut it anymore,” according to Cristescu. Instead,“Embrace Zero Trust. This means limiting access for everyone and everything – even systems and people you usually trust,” especially when relying on third-party software components.

Dell and AT&T likely highlight vulnerabilities in large, interconnected systems. Mitigating these requires enhanced endpoint security and visibility across sprawling IT landscapes. Subscribe to global threat intelligence feeds and participate in cross-industry threat-sharing communities to stay ahead of emerging attack vectors. For instance, using platforms like FS-ISAC in financial services enables organizations to prepare for known exploits.

National Public Data Breach 

National Public Data (NPD), a major government database, experienced one of the largest data breaches this past April, affecting approximately 2.9 billion Social Security records. The breach exposed sensitive personal information, including SSNs, dates of birth, and addresses, impacting nearly every American citizen. The incident led to multiple class-action lawsuits and raised serious concerns about data security practices.

The attackers exploited a vulnerability in the system’s access controls, gaining unauthorized entry and extracting massive amounts of data over a prolonged period.

“While they have not confirmed it, the common consensus is that National Public Data’s publicly exposed source code was archived on one of NPD’s subsidiaries, RecordCheck’s main website,” says Gaëtan Ferry, security researcher at GitGuardian.“Exposing an archive containing an application’s source code on the application’s site is a long-known mistake predating the invention of version control software. It is believed the archive contained a default password that was still used by multiple user accounts and used as an initial access vector.”

The consequences of the breach were profound, with significant risks of identity theft and fraud affecting millions of individuals. Many victims faced the potential of unauthorized financial activity, and the incident led to a surge in calls for improved data protection and oversight of government databases.

Affected individuals were notified through official channels and offered free credit monitoring services to mitigate potential identity theft risks.

“Notably, this breach wasn’t announced for a week; it only came to light and led to a lawsuit earlier because the company didn’t disclose it,” shares Clyde Williamson.“Further, it’s still unclear whether they intentionally avoided sharing details of this breach or just discovered it themselves.”

Williamson thinks this underscores the insufficiency of U.S. laws in protecting citizens’ personal data, which are outdated and ill-suited for the challenges of the 21st century.“Data brokers like the NPD aren’t held to the same regulatory standards as institutions like the Payment Card Industry (PCI), which mandates annual audits and stringent controls for credit card data. As things stand now, the US has no such obligations.”

It’s also possible, Williamson believes, that a significant portion of the stolen data belongs to one of the most vulnerable groups: senior citizens and their families. “A popular scam has a threat actor pretending to be a lawyer with bad news for the senior – their family member is in trouble and needs money. And why wouldn’t a grandparent believe them if they had valid PII to validate their credibility? These scammers don’t have to open credit in someone’s name to ruin lives. They just need to know how to use the information stolen to empty a caring family member’s bank account.”

Williamson suggests that relying on class action lawsuits to address negligence is insufficient.“Organizations must prioritize transparency and enhance their efforts to de-identify sensitive data to protect consumer information. They must move beyond traditional defense mechanisms and adopt regulator-recommended data protection strategies like encryption and tokenization. These methods render data useless to attackers, making it impossible to steal and use maliciously.”

Businesses can reduce the value of stolen data and significantly mitigate the long-term impact of ransomware attacks and fraud.

Further emphasizing the importance of vendor oversight, Matthew DeChant, CEO of Security Counsel, says, “CTOs and leadership teams must maintain strong oversight of third-party vendors’ security practices, especially when dealing with highly regulated, private data. Contracts should include the right to assess and audit vendors’ security programs. Don’t take security claims at face value—if a vendor touts a SOC 2 Type II attestation, request and review the report to ensure their scope covers your needs.”

The National Public Data breach served as a stark reminder of the challenges governments face in safeguarding citizens’ data in an era of escalating cyber threats. As Cristescu puts it,“Holding on to too much data is like stockpiling fireworks in your garage; sooner or later, it will blow up.”

In this case, ask yourself, “Do we really need to keep this data?” If the answer’s no, delete it. Also, consider encrypting the data you must keep so it’s useless if stolen,” urges Cristescu.

Change Healthcare Data Breach

In August 2024, Change Healthcare, a leading healthcare technology company, suffered a major data breach that compromised the personal and medical information of over 4 million patients. The breach was attributed to a sophisticated phishing attack that targeted internal systems, allowing unauthorized access to sensitive records, including patient names, addresses, dates of birth, and medical history.

Hackers exploited gaps in Change Healthcare’s security infrastructure, particularly in employee awareness and email security protocols.

This breach underscores the need for a comprehensive and layered approach to cybersecurity. “Implementing security isn’t about a single solution, but building multiple layers of defense,” says Shrav Mehta, CEO of Secureframe. “From secure coding practices to automated testing and continuous monitoring, we need a holistic approach that anticipates and mitigates potential threats before they emerge.”

One significant consequence of the Change Healthcare breach was the disruption to healthcare services. Several hospitals and medical facilities that relied on Change Healthcare’s systems experienced delays in critical patient care. This incident highlights the high stakes of cybersecurity in the healthcare sector, where vulnerabilities can jeopardize data integrity and service continuity.

Beyond the immediate technical failure, the Change Healthcare breach’s aftermath – with healthcare providers unable to process payments or pay staff – shows why healthcare CTOs must treat payment infrastructure with the same criticality as patient care systems. For healthcare tech leaders, the key takeaway is ruthlessly simple: gaps in basic security hygiene, even in a single service, can bring down an entire healthcare ecosystem.

This breach also underscored the need for stronger regulations and expanded accountability within the healthcare industry.

Kiran Chinnagangannagari, Chief Product and Technology Officer at Securin stresses the critical role of medical device manufacturers in mitigating these vulnerabilities:“Personally, I would like to see new regulations extend beyond just healthcare providers to include medical device manufacturers as the vulnerability risks associated with them are a growing concern as well.

Securin research showed a 59% year-over-year increase in vulnerabilities across healthcare products, with 43 vulnerabilities enabling remote control execution—a critical threat to patient safety. Medical devices, such as infusion pumps and monitoring systems, are essential for patient care, and without proper cybersecurity measures, these vulnerabilities could lead to dangerous disruptions, possibly even life-threatening. We must prioritize both securing these medical providers and devices and providing the financial means to do so.”

Chinnagangannagari also stresses the importance of third-party risk management.“Organizations must actively verify that every entity within their supply chain is capable of preventing devastating breaches. Stricter regulations and enhanced enforcement are now necessary, and security teams, as well as developers, must implement CISA’s Secure by Design principles in their systems and products. Companies should be made responsible not only for their own cybersecurity measures but also for those of all organizations they engage with. The stakes are too high—we cannot allow this type of negligence to continue.”

Dr. Sean Kelly, MD, Chief Medical Officer and VP of Customer Strategy at Imprivata, adds,“Building a comprehensive cybersecurity strategy is almost like building a house, and most healthcare organizations have only laid the foundation. Their approach is often reactive, with a focus on cleaning up the bad guy’s mess rather than keeping them out from the start.”

Change Healthcare pledged to adopt more stringent data protection practices and to work closely with regulatory bodies to prevent future incidents. This incident teaches us that,“Legacy systems are a hacker’s playground,” says Cristescu.“Keeping outdated tech around is a risk we can’t afford.”

Cristescu recommends that organizations “upgrade to modern, cloud-based systems that include advanced threat detection” and “don’t skimp on backup strategies. Ransomware can’t hold you hostage if you’ve got secure, isolated backups ready to go.”

Across all these breaches, we see the common element of the attacker finding and using hardcoded credentials. For human identities, the lack of phishing-resistant multifactor authentication seems to be a theme, and for non-human identities, the plaintext secrets involved were long-lived, long enough to be helpful to an adversary. This really should call attention to the fact that large organizations need to get a handle on secrets observability, where they can manage and automate rotating credentials at scale to make any leaked secrets useless by the time they are found.

What’s Next

As we look ahead to 2025, the cybersecurity landscape will likely be shaped by the increasing sophistication of both threats and defenses. Cybercriminals are expected to lean more heavily into AI-powered attacks, using machine learning to bypass traditional security systems and create more convincing phishing attempts.

Larry Zorio, CISO at Mark43, thinks, “Organizations should brace themselves for a surge in AI-driven attacks—sophisticated threats that adapt their signatures to evade detection. Exploited by bad actors looking for payouts, these attacks target sectors with weak defenses and inadequate resources. Hackers use tools like ChatGPT to create malware and craft phishing emails nearly indistinguishable from legitimate communications.

Are these fears justified? Absolutely. However, we can take measures to protect ourselves and our companies, including staff training to prevent phishing, ongoing monitoring with behavioral analytics to detect anomalies, and partnering with trusted vendors to address security gaps. Proactive investments now will strengthen defenses and save costs in the long run.”

This rise in offensive AI will demand that organizations adopt equally advanced defensive tools, such as AI-driven threat detection and response systems capable of analyzing vast data sets in real time to identify anomalies and mitigate risks. Additionally, supply chain attacks will remain a significant concern, with attackers exploiting third-party vendors to gain access to sensitive systems.

On the defensive front, expect to see more widespread adoption of Zero Trust Architecture, in which no user or device is trusted by default and access is continuously verified.

Cloud security will take center stage as organizations grapple with the complexities of securing multi-cloud environments, emphasizing the need for real-time visibility and threat management across these infrastructures.

To reduce the number of cloud-based attacks, organizations should consider bringing a real-time cloud perspective to security operations centers (SOCs) to ensure consistent threat detection and response across your entire infrastructure. This will reduce costs, mean-time to respond (MTTR), and significantly lower the risk of material breaches.

Regulatory changes, particularly around data privacy and security standards, will likely tighten globally, prompting organizations to align their practices with stricter compliance requirements.

Expect a regulatory tsunami. In the EU, ecommerce-focused regulations have rippled through social media and online marketplaces. The US will see fragmented approaches, with state-level consumer privacy laws creating complexity for businesses operating across jurisdictions.

Morey Haber, Chief Security Advisor at BeyondTrust, says, “What we have learned from these attacks is that no one’s personal information is safe, regardless of the company or its size.” If companies want to protect themselves against threats, Haber proposes the following:

• Don’t use cell phone numbers for accounts or personal information. A phone number is often a unique identifier, easily tied to an individual across multiple platforms. In the event of a breach, attackers can link it to other compromised data to build a detailed profile, making it as risky as a Social Security number. Avoid using phone numbers for logins or authentication whenever possible to reduce exposure and safeguard your identity.
• Avoid using the same email address for all accounts. Instead, create separate addresses for correspondence, banking, and other sensitive activities. This way, if one email is compromised, it won’t expose your entire digital identity.
• For businesses, it’s often easier for attackers to log in than hack in. Prioritize identity security and privileged access management by regularly reviewing entitlements and permissions to block lateral movement and unauthorized access.

2025 will also see a greater push for collaboration across industries and governments, with threat intelligence sharing becoming a critical component in staying ahead of attackers.

Ultimately, the key to navigating these challenges will be combining cutting-edge technologies with a culture of vigilance and accountability at every organizational level.

Final Thoughts

The data breaches of 2024 are a sobering reminder that even the best defenses aren’t impenetrable. But they’re also a call to action—an opportunity to refine strategies, prioritize proactive monitoring, and build stronger, more adaptable security postures. Transparency and collaboration play a critical role in this process.

“We must embrace radical transparency by openly sharing vulnerability insights, version adoption rates, and lessons learned,” says Shrav Mehta.“This collaborative approach helps the entire tech ecosystem become more resilient.”

If we’re to outpace the ingenuity of bad actors, we need to share knowledge, scrutinize our vulnerabilities, and hold ourselves accountable as stewards of the systems and data we protect.

As we move into 2025, let’s take the hard-earned lessons of this year to heart. Whether adopting zero-trust principles, investing in better threat intelligence, or fostering a culture where security is everyone’s job, the goal is clear: companies must adapt their strategies, invest in emerging security technologies, and foster a culture of awareness and vigilance.

Original Story: https://thectoclub.com/topics/2024s-worst-data-breaches-stay-secure-in-2025/

By: Gary S. Miliefsky, CISSP, fmDHS

As the publisher of Cyber Defense Magazine, I have a great honor and pleasure to meet with many of the market leaders and innovators in the space.  Here’s what I discovered this year:

Geopolitical Tensions Spur Living Off the Land Attacks

In 2025, we can expect a rise in ‘living off the land’ attacks, where attackers exploit legitimate tools and processes within an organization’s network to avoid detection. As geopolitical tensions rise, cybercriminals from nations like Russia, China and Iran may increase their use of this technique, spreading across networks, establishing multiple backdoors and ensuring they can re-enter if initial access points are cut off. As these attacks grow more sophisticated, organizations will need to refine their ability to distinguish between normal operations and subtle deviations, focusing on baseline behavior and anomaly detection. Law enforcement and cybersecurity agencies, including CISA, the FBI and the NSA, will need to bolster their efforts to counter these evolving threats, ensuring they can anticipate and mitigate such stealthy incursions. –Kevin Kirkwood, CISO at Exabeam

Widespread Adoption of Zero-Trust Architecture

The shift to a zero-trust model will accelerate, driven by the need to protect increasingly complex, distributed networks. Organizations will adopt zero-trust as the default security posture, ensuring that no device, user, or system is inherently trusted, especially in cloud and hybrid environments.

Deepfakes Will Unleash a Devastating New Wave of Social Engineering Attacks

No longer just a theoretical risk, video-based deepfakes will become highly realistic and imperceptible from reality. This technology will be weaponized in social engineering attacks, allowing criminals to impersonate executives, forge high-stakes transactions, and extract massive payouts from unsuspecting victims. With AI making deepfakes accessible at the push of a button, the potential for financial fraud will explode, forcing organizations to rethink how they verify identity in an increasingly deceptive world. – Steve Povolny, Senior Director, Security Research & Competitive Intelligence at Exabeam

AI and Machine Learning as Core Components of Cyber Defense

Artificial Intelligence (AI) and machine learning will become integral to cybersecurity, automating threat detection, response, and even prediction. These technologies will enhance SOC (Security Operations Center) capabilities by quickly analyzing vast amounts of data, identifying patterns, and reacting to threats faster than human capabilities.

“The artificial intelligence market is expected to surpass 826 billion U.S. dollars in 2030. While immensely transformative for enterprise tech developments, AI and other over-the-top solutions present an opportunity for government agencies to reinforce the resiliency of their emergency communications systems and other critical infrastructure.  Across the public safety sector, implementing resilient, compliant tech infrastructure is a must for agencies looking to bolster their cybersecurity efforts against external threats. There’s probably a misconception in the market that on-premises solutions are somehow more secure than cloud-based solutions. They are not. Cloud-based solutions — including the latest AI tech — do what the next-generation 911 movement has been trying and not always succeeding to do for a couple of decades, which is to improve the resiliency, redundancy, geodiversity and efficiency of emergency communications systems. Investing in these technologies should be at the forefront of local and federal law enforcement agendas.” – Tim Perry, Head of Strategy at Prepared

“The growth of automation and AI in cybersecurity will augment the professional shortage and speed up responses, but it’s a double-edged sword. Cybercriminals will also use these tools to craft more complex threats.”
– Chris Spargen, Associate Director, Solutions Engineering, Fortra

Public Safety Agencies Under Attack

“As we look ahead to 2025 and beyond, public safety agencies will increasingly use modern technologies, such as cloud-native software, to enhance mobility and resilience. It’s crucial that public safety agencies continuously evaluate their cybersecurity posture, especially as malicious actors become more skilled and sophisticated at digital attacks.   Where should law enforcement agencies begin? To effectively manage organizational risk tolerance, start by identifying the most valuable assets through an inventory of “crown jewels.” Then, build a risk strategy by asking key questions and prioritizing investment in secure, resilient technology, as it will save time and cost in the long run.  In addition, public safety agencies should adopt a recognized framework like the NIST Cybersecurity Framework (CSF) to provide a structured approach to managing cybersecurity risks. Tactical items to include are vulnerability management, regular backups, monitoring, and audit functions, and incident response tabletop exercises to ensure built-in muscle memory for seamless mitigation in the event of breach.” – Larry Zorio, Chief Information Security Officer at Mark43

Expedited Exploitation Cycles

With AI’s ability to identify weaknesses faster than humanly possible, the time from vulnerability discovery to exploitation will shrink significantly. Attackers will leverage AI to automate the assembly and deployment of exploits, building on more complex attack strategies and rapidly escalating threats. To stay ahead, organizations must adopt predictive AI capabilities within their cybersecurity frameworks. Leveraging tools that utilize AI to simulate attack vectors will enable teams to proactively identify and patch vulnerabilities, staying a step ahead of threat actors. – Steve Wilson, CPO at Exabeam

Convergence of IT and OT Security

As operational technology (OT) becomes more connected to IT systems, cyber threats targeting critical infrastructure will increase. This will push organizations to integrate IT and OT security strategies, protecting systems like industrial control systems (ICS) and SCADA from increasingly sophisticated attacks.

Increased Focus on API Security

With the explosive growth of cloud services and microservices architectures, API security will become a top priority. Attackers will target APIs as weak links in the security chain, leading organizations to adopt specialized tools to secure these crucial connections.

Ransomware Resilience and Recovery Measures

Ransomware attacks will continue to rise in frequency and sophistication, prompting organizations to not only enhance prevention strategies but also focus heavily on resilience and recovery. Backup systems, incident response plans, and multi-layered defenses will become critical to minimizing ransomware impact.

Quantum Computing Threats and Post-Quantum Cryptography

As quantum computing progresses, the potential to break traditional encryption algorithms will become a looming threat. Organizations will start adopting post-quantum cryptography to safeguard sensitive data against future quantum-based attacks, laying the groundwork for long-term data security.

Regulatory Pressure and Data Privacy Enhancements

Global and national governments will introduce stricter data privacy and cybersecurity regulations, compelling organizations to prioritize compliance. Regulations like the GDPR and CCPA will expand, and new frameworks will emerge, focusing on securing sensitive data, mitigating risks, and addressing cybersecurity accountability.

“Service providers will be forced to raise their security and operational standards to meet increased customer expectations and comply with regulations like GDPR, DORA, and CCPA. The evolving digital landscape and rising risks from natural disasters and public crises highlight the need for resilient, cloud-based communication channels and advanced systems to ensure operational continuity.”
– Theo Zafirakos, Cyber Risk and Information Security Expert, Fortra

Cyberattacks on Critical Infrastructure will Reach Crisis Levels, Threatening to Destabilize Entire Nations

Large-scale cyberattacks on critical infrastructure—such as power grids, utilities, and healthcare systems—will reach unprecedented levels. As geopolitical tensions rise and cybercriminals become more emboldened, attackers will increasingly target essential services that can cripple entire nations. These attacks will be designed to maximize disruption and force victims into paying massive ransoms. – Gabrielle Hempel, Customer Solutions Engineer, Exabeam

Supply Chain Security as a Key Focus Area

Supply chain attacks, such as the infamous SolarWinds breach, will lead to increased scrutiny of third-party vendors and supply chain security. Organizations will implement stricter vetting processes, continuously monitor vendor risks, and adopt security frameworks designed to protect against these growing threats.

Software Bill of Materials (SBOMs) Adoption and Evolution in 2025

In 2025, the adoption of SBOMs will expand beyond traditional software, with AI and ML applications driving demand for more advanced BOM frameworks. Concepts like ML-BOMs (as defined by CycloneDX) will need rapid evolution to address the intricacies of modern LLM applications. These models rely on dynamic and often opaque supply chains, where each ML component, data set, and algorithm may introduce unique vulnerabilities. For government and defense organizations, effectively managing this complexity will require an expanded ML-BOM standard that can account for continuous updates, complex dependencies, and provenance tracking across AI and ML systems. Achieving interoperability across ecosystems will remain critical, but automation, coupled with emerging regulatory standards, will play a pivotal role in maintaining compliance and security across increasingly complex AI supply chains. – Steve Wilson, CPO at Exabeam

Rise of Offensive Security and Threat Hunting

The industry will see a significant rise in offensive security measures, with threat hunting and red teaming becoming critical components of cybersecurity programs. Proactively identifying vulnerabilities, simulating attacks, and uncovering weaknesses before malicious actors exploit them will become common practice.

Cloud Security and Multi-Cloud Solutions

As businesses adopt multi-cloud environments, the need for robust cloud security solutions will intensify. Organizations will increasingly look for tools that offer consistent security policies across multiple cloud platforms, ensuring visibility, compliance, and threat protection for cloud-native applications.

“Hyperscalers will turn increasingly toward developing native cybersecurity solutions to drive revenue growth. As cloud services mature, cloud providers will release a myriad of security features promising seamless integration and management within their ecosystems. We’ll likely see hyperscalers making strategic acquisitions of cutting-edge security companies to strengthen their offerings.”
– Nick Franklin, Global AWS Technology Alliance Director, Fortra

2025 Will Bring a Wave of Triple Extortion Attacks Targeting Partners and Subsidiaries

Hackers are getting greedier and more sophisticated. In 2025, companies won’t just face the theft of their data and ransom demands—they’ll see attackers extort their partners, suppliers, and even customers. After locking systems and stealing data, hackers will squeeze not just the victimized company, but the entire ecosystem they work with, demanding ransoms from any organization with a connection. Triple extortion will become the latest method to maximize profits from a single attack, wreaking havoc across entire supply chains. – Gabrielle Hempel, Customer Solutions Engineer, Exabeam

These predictions reflect the key directions cybersecurity is heading towards, addressing both emerging threats and the innovative solutions that will define the future of digital protection.

Original Story: https://www.cyberdefensemagazine.com/the-future-of-cybersecurity-predictions-for-2025-and-beyond/