Cybersecurity in 2026: Predictions vs. Reality

TL;DR

The 2026 forecasts were right about the direction and wrong about the target. Attackers did get smarter with AI, but the year was defined by attacks on the things we trust most: edge appliances, tokens, and security tools themselves. Below: the scorecard, and five calls for Q4.

Every December, the security industry publishes hundreds of predictions for the year ahead. Almost nobody goes back to check them. It is October now, three quarters of 2026 are behind us, and we have enough real incidents to grade the forecasts instead of repeating them.

I work in offensive security, so I read these reports with one question in mind: if I were the attacker, is this what I would actually do?

What the industry predicted for 2026

The forecasts published in late 2025 and early 2026 agreed on six themes. If you read ten of those reports, you read the same list ten times.

AI becomes the default attacker tool. Google's Cybersecurity Forecast 2026 expected threat actors to move from occasional AI use to using it across the whole attack lifecycle, with prompt injection against enterprise AI systems rising sharply.
Supply chain becomes the main way in. Reporters on Dark Reading's prediction panel expected attackers to hit small embedded vendors to reach thousands of downstream environments. Sonatype added that maintainers of popular open source packages would be targeted harder.
Ransomware and extortion keep growing. Google called the mix of ransomware, data theft and extortion the most financially disruptive category of cybercrime.
AI agents and MCP servers become a new attack surface. TechTarget's roundup listed weak access controls, misconfigured permissions, tool poisoning and command injection as the expected problems.
Deepfakes and identity fraud go mainstream. ABI Research named deepfake oversight a core security challenge for the year.
Quantum and critical infrastructure reach a turning point. Several reports called 2026 the year quantum threats accelerate, and CIS experts predicted a high-impact incident against operational technology.

Notice what is missing from that list. Very few forecasts put VPN gateways, SD-WAN controllers and mail appliances at the top. That is exactly where the worst news of the autumn came from.

The scorecard: Q1 to Q3

Five of the six themes held up, one is still waiting, and the biggest story of the year was underrated by almost everyone.

✅ CONFIRMED · AI as the default attacker tool

AI now helps attackers write malware and find gaps faster. Late September brought reports of an AI-driven botnet hijacking Docker servers (CyberPress).

✅ CONFIRMED, WITH A TWIST · Supply chain as the main way in

Attacks moved from network breaches to stolen OAuth tokens (Fidelis mid-year review).

✅ CONFIRMED · Ransomware keeps growing

The Gentlemen went from 40 victims in Q4 2025 to 166 in Q1 2026 (Fidelis). Police still landed a hit: the KillSec takedown seized its leak site and five core servers (NetworkTigers).

✅ CONFIRMED, EARLY STAGE · AI agents and MCP as attack surface

A flaw in the MCP Python SDK exposed OAuth tokens (GBHackers).

✅ CONFIRMED · Deepfakes go mainstream

Millions of non-consensual images and videos were published between late December 2025 and January 2026 (ABI Research).

⏳ NOT YET · Quantum reaches a turning point

No publicly known break of real-world encryption. The realistic threat is still "harvest now, decrypt later".

⚠️ UNDERRATED · Edge devices as the top target

Citrix NetScaler, Cisco SD-WAN, WSO2 and FortiMail were all hit within weeks of each other (DIESEC).

The story the forecasts underrated: the edge

The Citrix NetScaler zero-days (CVE-2026-88771 and CVE-2026-88772) are the incident I would show to any management team. Attackers planted web shells that survived firmware updates on more than 1,200 devices whose owners had already patched.

Patching closed the door, but the intruder was already inside.

In the same weeks:

Cisco fixed an actively exploited authentication bypass in Catalyst SD-WAN Manager (CVE-2026-76504, CVSS 9.8).
WSO2 API Manager had a CVSS 10.0 JWT bypass exploited since September.
FortiMail had a critical flaw allowing unauthenticated code execution on mail gateways.

From a red team view this is logical. Edge appliances face the internet, rarely run EDR, hold credentials and session data, and are trusted by everything behind them. One exploit gives you a foothold that most SOC teams cannot see.

The twist: your security tools are part of the attack surface

Bitget reported a theft of $387.5 million after attackers used zero-days in two third-party security products to reach its wallet environment (Ncontracts). They then placed malware on a production wallet server. The products bought to reduce risk became the entry point.

The boring one that keeps working: leaked secrets

A scan of 224 million GitHub repositories found 543,699 exposed credentials that were still valid. The median secret had been exposed for 784 days (NetworkTigers). No zero-day is needed when the keys have been public for two years.

Five predictions for Q4 2026

These are my own calls, based on the signals above. I will come back in January and grade them the same way.

1. At least one more major edge device zero-day before New Year

Citrix, Cisco, WSO2 and Fortinet were all hit in a single autumn. Attackers have working research pipelines for this class of device, and the return on one bug is enormous. I expect another mass-exploited flaw in a VPN, firewall or gateway product before December ends.

Red team view: the holiday period is the best time to use it. Change freezes delay patching, and on-call teams are thin. An attacker who lands a web shell in mid-December can have weeks of quiet access.

2. "We patched" stops being an acceptable answer

The 1,200 backdoored NetScaler devices will change how incident response is done. I expect vendors and regulators to start asking for proof of a compromise check, and not only a patch date. Expect new guidance that treats every exploited edge bug as a presumed breach.

Red team view: persistence that survives an update is the goal of every serious operator. Once one group shows it works at scale, others copy the technique.

3. OAuth tokens become the new passwords

The Fidelis review expects future breach disclosures to name dormant or over-permissioned OAuth grants as the root cause. I agree, and I think Q4 will bring at least one large SaaS breach where no password and no MFA prompt was involved at all.

Red team view: a token skips MFA entirely. An integration that someone approved three years ago and forgot is a better target than any employee. Nobody monitors it and nobody rotates it.

4. The first widely reported breach through an AI agent

Companies spent 2026 connecting AI agents to email, code repositories and internal tools. The MCP SDK token flaw shows the plumbing is still young. I expect a public incident where an agent, and not a human, is the tricked party: a poisoned document or tool description that makes the agent leak data or run an action.

Red team view: an agent with broad tool access is a privileged user that reads everything it is given and cannot always tell data from instructions. Prompt injection against it is social engineering without the social part.

5. Ransomware volume stays high despite takedowns

KillSec lost its infrastructure, but The Gentlemen grew fourfold in one quarter. Takedowns remove brands, not affiliates. I expect Q4 victim counts to stay at or above Q3 levels, with new group names appearing to replace the ones that were seized.

Red team view: the affiliates keep their access, their tooling and their skills. Only the logo on the leak site changes.

What to do before year-end

None of this needs a new budget. It needs a few focused days before the holiday change freeze starts.

List every internet-facing appliance. VPNs, gateways, SD-WAN controllers, mail filters. If you cannot name the owner and firmware version of each one, start there.
Hunt, then patch. For any device with an exploited bug this year, check for web shells, new accounts and modified files. A patch date is not evidence of a clean device.
Audit OAuth grants and service tokens. Remove integrations nobody uses, cut permissions on the rest, and set an expiry on everything that allows one.
Scan your repositories for secrets and rotate what you find. Deleting the commit is not enough. If a key was ever public, treat it as stolen.
Give AI agents the least access that works. Separate read access from write access, log every tool call, and require a human approval for anything destructive.
Agree on a holiday response plan. Who is on call, who can approve an emergency patch during the freeze, and how fast can you isolate an edge device.

The bottom line

2026 did not surprise us with a new kind of attack. It punished old assumptions:

that a patched device is a clean device,
that a security product is safe because it is a security product,
that a token approved years ago is still harmless.

The last quarter will test those assumptions again, at the time of year when defenders are slowest to respond. I will revisit these five predictions in January and score myself as strictly as I scored the industry.

If you disagree with any of them, tell me which one and why. I would rather be corrected in October than proven wrong in December.