Cybersecurity Trends in 2026: Shadow AI, Quantum & Deepfakes

Jeff Crume, in his annual tradition, delves into cybersecurity predictions for 2026 and beyond, focusing heavily on the evolving role of AI and other technological shifts. Drawing from previous forecasts and the IBM Cost of a Data Breach Report, he assesses past predictions and unveils new concerns.

AI’s Dual Impact on Cybersecurity

Crume notes that AI presents both positive and negative implications for cybersecurity, with negatives currently dominating the threat landscape.

Negative AI Security Trends:

• Shadow AI: Unsanctioned AI instances downloaded into cloud environments are proving costly. The IBM Cost of a Data Breach report found that incidents involving Shadow AI incurred an additional $670,000 in costs. Compounding this, 60% of organizations lack AI governance or security policies to address this risk.
• Deepfakes: The use of generative AI to create fabricated images, audio, and video of individuals doing or saying things they never did poses a significant threat. Instances of deepfakes escalated from 500,000 in 2023 to 8 million in 2025—a 1,500% increase. While entertaining, their misuse in cyberattacks is a growing concern.
• AI-Generated Exploits and Polymorphic Malware: AI is increasingly used to generate sophisticated exploits for vulnerabilities and to create polymorphic malware that can change over time, making it harder to detect and defend against. This lowers the bar for attackers while increasing the difficulty for defenders.
• Expanded Attack Surface: Organizations integrating AI for productivity inadvertently expand their attack surface. The Open Worldwide Application Security Project (OWASP) identified prompt injection as the number one vulnerability for large language models in both 2023 and 2025, indicating its persistent and growing threat.

Positive AI in Cybersecurity:

• Enhanced Incident Response: AI is being leveraged to improve cybersecurity defenses, particularly in identifying and responding to incidents. IBM, for example, has developed AI-powered solutions to detect and defend against prompt injections, demonstrating AI defending against AI-based attacks.
• Real-time Adaptability: AI systems are crucial for real-time adaptation to rapidly changing attack vectors, as they can be infused into cybersecurity tools to provide dynamic protection.

The Rise of AI Agents

AI agents, autonomous AIs designed to achieve goals, are poised to amplify both productivity and risk. Crume categorizes their impact into attacks on agents and attacks by agents.

Attacks On AI Agents:

• Risk Amplification: If hijacked, agents can execute malicious actions at light speed, significantly amplifying risk. Their access to extensive tools, intended for effectiveness, also increases their potential for harm.
• Indirect Prompt Injection: Agents processing emails or other communications can be vulnerable to indirect prompt injections, where malicious instructions embedded in content cause them to exfiltrate data without human intervention—a “zero-click” attack.
• Non-Human Identities and Privilege Escalation: The proliferation of agents creates a surge in non-human identities requiring privileged access. Managing these identities becomes complex, increasing the risk surface. Agents operating with the same privileges as users can perform actions thousands of times faster, escalating potential damage. Moreover, agents could be subject to privilege escalation attacks.

Attacks By AI Agents:

• Hyper-Personalized Phishing: Agents can craft highly personalized phishing emails, increasing the likelihood of successful social engineering attacks.
• Advanced Malware Generation: Agents can rapidly generate numerous polymorphic malware samples, constantly testing and adapting to evade detection, making traditional signature-based defenses less effective.
• Automated Ransomware Chains: The entire ransomware attack chain, from writing the ransomware and exploit to sending demands and collecting payments, can be automated by agents, drastically lowering the skill level required for attackers while increasing effectiveness.
• Automated Kill Chain: Agents can autonomously conduct end-to-end cyberattacks, including reconnaissance, vulnerability scanning, exploit generation and execution, data exfiltration, effectively reducing complex hacking to a “click-here to-hack” operation.
• Enhanced Social Engineering: Leveraging deepfake information and collected data, agents can make social engineering attacks far more convincing and insidious.

Deepfakes and Their Future

Crume predicts deepfakes will continue to improve, rendering deepfake detection mechanisms largely ineffective. He advises shifting focus from detection to user education, training individuals to question the content and intent behind deepfake-driven requests rather than attempting to recognize the fakes themselves.

Broader AI Impact and Non-AI Trends

AI’s influence extends beyond cybersecurity:

• Education: Educational institutions must embrace AI, integrating it into curricula to prepare students for an AI-driven workforce, rather than attempting to outlaw or detect its use.
• Arts and Music: AI will increasingly generate art and music, with entire groups created by AI. While quality varies, this trend is irreversible.
• Marketing: AI is already widely used for generating copy, business ideas, and marketing campaigns.
• Coding Jobs: As AI improves at writing code, the demand for human coders will decrease, requiring a shift in skill sets.

Non-AI Security Innovations:

• Passkeys: Crume is a strong advocate for passkeys, a phishing-resistant replacement for passwords developed by the FIDO Alliance. Major companies like Amazon, Google, Microsoft, and IBM internally are adopting them. 93% of accounts from FIDO Alliance members are eligible for passkeys, with one-third of users already enabling them. Passkeys address phishing, the number one cause of data breaches.
• Post-Quantum Cryptography (PQC): Based on a “confession” about finding a future IBM Cost of a Data Breach Report, Crume highlights that “quantum cracking of conventional cryptography” will be a top cause of data breaches. While the exact “Q-Day” is unknown, he stresses the urgent need to implement quantum-safe (post-quantum) cryptography algorithms now, as widespread deployment is lagging despite increasing awareness.

• Tags:
• AI Agents
• AI Security
• Prompt Injection
• Cybersecurity
• AI Governance
• Feature
• Quantum Computing
• Data Breach
• Phishing
• LLM Security
• Ransomware
• Social Engineering
• Passkeys
• Post-Quantum Cryptography
• Deepfakes
• Shadow AI
• Polymorphic Malware
• FIDO Alliance
• Cyber Threat Predictions