Cybersecurity Threat Trends of 2023

Cybersecurity threat trends of 2023 follow a path similar to the years before, however this year AI boomed in a big way that benefits both cyber criminals and threat hunters.

It is perhaps the most unifying goal of the cybersecurity industry to keep up with each year’s evolving cyber threats and tactics. Trends in technology are often primarily shaped by the cybersecurity threats that imperil our networks and systems in any given year. As new vulnerabilities, attack vectors, and malware variants emerge, cyber threat actors develop more sophisticated attacks. Trending cybersecurity threats of 2023 include:

Ransomware

Ransomware has been trending for multiple years, with no signs of slowing down in 2023. According to a Q3 2023 Global Ransomware Report, global ransomware attack frequency is up 11% between quarters 2 and 3, soaring to an increase of nearly 95% over the past year.

Attackers are perfecting techniques, escalating ransom amounts, and reimagining the weapons of their attacks. For example, threat actors increasingly favor extorting companies with threats to release private data over locking data away with encryption. More prevalent than ever in 2023 was the use of Ransomware-as-a-Service (RaaS) platforms, which make ransomware easy and accessible to even unskilled attackers.

Supply Chain Threats

The year 2023 saw one of the most significant supply chain attacks in recent history with the MOVEit breach. TechCrunch reported that the event impacted at least 60 million people and more than 1000 businesses. The cost to these businesses was estimated at over $9.9 billion, while the total cost to individuals could reach over $65 billion.

Supply chain threats exploit employee privileges and other trust relationships between organizations to manipulate vulnerabilities. As supply chain attacks escalate, they could lead to data breaches, DDoS (Distributed Denial of Service) attacks, and more.

Geopolitical conflict and global turmoil are often catalysts for increasing supply chain threats. Businesses also become more interconnected and dependent on each other, making attacks more likely to replicate and amplify across the supply chain. Multi-vector attacks that combine multiple techniques into a single campaign make attacks more difficult to detect and increase their success rate.

Expanding Attack Surface

The expanding attack surface is not one specific type of attack. Instead, the threat stems from the issue that it is susceptible to all other attack trends, including ransomware, APT campaigns, supply chain threats, and more. In 2022, Gartner’s Security Trends for 2022 report listed attack surface expansion as the top concern. As networks have matured and adopted more cloud and IoT technologies, businesses encounter more attack vectors and exponentially increasing threats.

Vulnerabilities in typical endpoints, mobile devices, IoT systems, and remote work infrastructure create a wider cyber attack surface each year. Businesses require a more expansive range of potential solutions to address these growing attack vectors and risks.

AI in Cyberattacks

Generative AI has multiple applications for cyber threat actors. ChatGPT and similar tools can quickly write convincing emails for phishing attacks. It’s also possible for an attacker to use these technologies to write malicious code, invent new attacks, or create malware that adapts its behavior to bypass traditional security software.

In 2023, Securance Consulting released a range of resources, including a webinar and whitepaper, on securing AI and ChatGPT for enterprise use. Businesses that want to harness the potential of ChatGPT should strive for a balance between innovation and security. Both of these resources are highly advised for getting started with this process.

Insider Threats

Insider threats continue to be a significant concern for organizations. According to Ponemon Institute, the cost of such an attack rose from $15.4 million in 2022 to $16.2 million in 2023.

Detecting and responding to insider threats is more difficult as networks and attack surfaces expand, particularly as remote and hybrid work continues to be normalized. Securing internal networks and employee training remains vital in fending off insider threats.

Mitigating Threats in 2024 and Beyond

In 2023 especially, cyber-attacks have become increasingly easy for bad actors to employ and require fewer skills to succeed. The security strategies of businesses must evolve to catch up. Whether your business needs fundamental cybersecurity assessments, an IT risk assessment, or help with compliance, we can help. Contact us today for a free consultation.