Top cybersecurity trends for 2025 reflect the need for more focused cybersecurity programs that emphasise business continuity and collaborative risk management.
- Gartner client? Log in for personalized search results.
Cybersecurity Trends: Resilience Through Transformation
Evolve cybersecurity as a business enabler
Relentless tech and business disruption test the limits of security programs and team performance. CISOs must enable business value and double down on embedding organisational, personal and team resilience to prove security program effectiveness in 2025. Download our 2025 Cybersecurity Trends infographic to learn:
Which nine capabilities cybersecurity leaders are prioritising this year
How organisations can balance the need to embed cyber resilience while enabling transformation
2025 top trends in cybersecurity focus on resilience, transformation
Cybersecurity leaders, take note of these cybersecurity trends: Educate, collaborate and prevent burnout to embed resilience in your cybersecurity programs.
Cybersecurity Trends in 2025
Cybersecurity and Resilience
Enabling Transformation
A fast-evolving threat environment is changing the focus of cybersecurity
“What is cybersecurity?” It’s the practice of deploying people, processes, policies and technologies to protect organisations, their critical systems and sensitive information from digital attacks.
How organisations do that is changing radically.
Staying current on cybersecurity trends and best practices is critical for cybersecurity leaders to effectively manage the fast-evolving daily threats and exposures the organisation faces — without constraining business ambitions.
The Gartner Top Trends in Cybersecurity 2025 survey finds emerging pressure from:
The continued emergence of generative AI (GenAI) use cases (and risks)
Burnout as a result of the continued gap between security-talent supply and demand
Relentless growth in cloud adoption, which is altering the composition of digital ecosystems
Increasing regulatory obligations and government oversight of cybersecurity, privacy and data localisation
Continued decentralization of digital capabilities across enterprises
The challenge of embedding a culture of collaborative risk management
Demand for business stability/security in a constantly evolving threat environment
CISO and security team wellbeing
Collaborative cyber risk management
Managing machine identities
In response, cybersecurity leaders are working to equip their functions with agile and responsive capabilities. The 2025 trends report shows their actions and priorities center on nine practices, technical capabilities and structural reforms — each helping cybersecurity leaders to achieve:
Secure, AI-enabled business transformation by formalising cybersecurity risk accountability, fostering cyber judgment, reinvigorating data security management programs and extending enterprise IAM strategies to include machine identities.
Resilience by planning and regular review of technological and human-driven capabilities by optimizing tech investment and use, integrating AI into workflows, and addressing signs of burnout in security teams.
Secure business transformation by developing clear, actionable third-party risk policies and fostering targeted collaborative engagements with IT and the business.
How cybersecurity programs make the organisation more resilient
Security and risk management leaders are tasked with improving organisational resilience in a world of increasing risk. Several interconnected factors are driving this focus on resilience, including:
Digital ecosystems continue to sprawl due to increasing cloud adoption.
The threat environment continues to evolve as new capabilities embolden attackers.
It’s not feasible to remediate every potential vulnerability in the organisation, given how they are exploding in today’s digital environments. Among the resources to protect are:
Facilities
Equipment
Workers
Third parties
Business process outsourcers
Technology providers (such as cloud/IT services)
Transitioning to cyber resilience
Board directors and C-suite leaders now widely view cyber risk as a core business risk to manage — not a technology problem to solve. SRM leaders are pivoting cybersecurity from a prevention mindset to a resilience focus. Cyber resilience embraces a “when, not if” mentality, and seeks to minimise the impact of cyber incidents on the enterprise and enhance adaptability, rather than engage in misguided notions of outright prevention.
Cybersecurity technology optimisation
SRM leaders are shifting focus to tool optimisation rather than vendor consolidation. This shift allows organisations to find the right mix of platform and point solutions and creates a balance between reducing complexity and providing flexibility in deploying tools to meet cybersecurity objectives.
CISO and security team well-being
Evidence is emerging that unmanaged stress has adverse effects on enterprise security posture and program sustainability. SRM leader and security team burnout is a key concern for an industry already impacted by a systemic skills shortage. Cybersecurity leaders who embrace burnout prevention and remediation head on have the opportunity to boost their team’s and program’s effectiveness and improve workforce resilience.
Make way for new practices and processes
Transformation is par for the course for SRM leaders who must constantly adapt to an ever-shifting threat landscape to ensure the stability of business operations. These challenges provide opportunity for a more proactive and comprehensive approach that embeds resilience into technological and human-driven capabilities.
Even as cybersecurity leaders recognize the folly of trying to fully protect against every risk, they are still under pressure to improve security without constraining the business or spending an exorbitant amount of resources. High and ever-improving performance is a key priority.
At the same time, the themes of distributed threat exposure and increasingly decentralized decision making raise an ongoing question: Who is responsible for cybersecurity? The answer is: Everyone. Accountability still falls mostly on the shoulders of cybersecurity leaders. Yet given the spreading nature of risk, there is a growing role for boards of directors and business unit partners to ensure they share responsibility, accountability and governance.
Given those goals of increasing performance within an environment of distributed responsibility, the Gartner Top Cybersecurity Trends for 2024 highlights five investments that promise to help meet the organization’s cybersecurity needs according to its risk appetite. They include:
GenAI driving data security programs
The rise of GenAI is transforming data security programs, in three notable dimensions:
A preference for synthetic data vs. obfuscated data in AI training to preserve privacy, address the challenges of insufficient data and prevent bias
Shift from structured to unstructured data security as the latter becomes more prevalent and valuable
Increased need to assess the data security posture of GenAI to ensure that data is not unknowingly accessed or shared with third parties
Collaborative cyber-risk management
As technology investment decisions are increasingly made by business technologists in lines of business, and transformative technology such as GenAI rapidly evolves the cyber-risk environment, traditional centralized cyber-risk management processes fail to scale, introduce friction and inhibit agility. Cyber-risk management requires a scalable approach with risk decisions made by informed business technologists. Centralized, flexible oversight supports local decisions through collaborative, agile, cyber-risk management.
Managing machine identities
The importance of managing (nonhuman) identities and access for machines (devices and workloads) is growing. Cloud services, automation and DevOps, and the emergence of AI, have led to the use of machine accounts and credentials for physical devices and software workloads. Because machine accounts and credentials are frequently created and used by different teams in organizations, they are often uncontrolled and unmanaged, making them a target for cyber adversaries seeking unauthorized access to IT systems.
Tactical AI
Inflated expectations based on GenAI hype led SRM leaders to reprioritize their initiatives and focus on narrower use cases with direct measurable impacts. These more tactical implementations of AI align AI practices and tools with existing metrics, fitting them into existing initiatives, and enhancing visibility of the real value of AI investments.
Extending the value of security behavior and culture programs
Security behavior and culture programs (SBCPs) have become a prominent approach to addressing cyber-risk comprehension and ownership at the human level, reflecting a strategic shift toward embedding security into the organizational culture. This trend is gaining traction due to increasing recognition that human behavior is a critical component of cybersecurity.
Managing third-party cybersecurity risks
Organizations heavily rely on vendors to expand their GenAI capabilities. Progressive SRM leaders prioritize establishing policies for pausing and exiting third-party relationships to build resilience against unexpected events. They collaborate with business sponsors to co-manage risks emanating from third parties using GenAI and, consequently, inform control implementation.
Experience IT Security and Risk Management conferences
Join your peers for the unveiling of the latest insights at Gartner conferences.
Related cybersecurity resources
Gartner clients: Log in for a complete suite of actionable insights and tools on cybersecurity.
Frequently asked questions on cybersecurity
Why does cybersecurity fail?
Cybersecurity fails because of a lack of adequate controls. No organization can be 100% secure. Cybersecurity teams must decide where, when and how to invest in IT controls and cyber defense. To do that, benchmark your security capabilities and identify gaps to fill and priorities to target.
Do not overlook the human element. Cybercriminals have become experts at social engineering to trick employees. Making sure employees have the information and know-how to defend against attacks is critical.
How much should I spend on cybersecurity?
The question is not how much to spend, but rather what level of protection your organization wants to achieve based on its risk appetite.
To determine that, use ODMs applied to the controls that address each threat. For example, in the event of a ransomware attack, an organization has three critical controls: backup and restore, business continuity and phishing training. The ODMs of these three controls reflect how well the organization is protected and what it costs.
Take a cost optimization approach to evaluate the cost (investment), value (benefit) and level of risk managed for each control.
The Top 3 Priorities for Enterprise Risk Management Leaders in 2024
What is the future of cybersecurity?
The environment is evolving in several key ways:
Growing network, infrastructure and architectural complexity
Increasing sophistication of threats and poor threat sensing
Third-party vulnerabilities
Cybersecurity debt
Cyber-physical systems