Security Boulevard

As December 2025 comes to a close, Sonrai’s latest review of newly released AWS permissions highlights a continued expansion of cloud privilege. This month’s updates span identity, observability, AI, and managed service infrastructure, with changes across CloudWatch, CloudFront, Bedrock, EKS, SageMaker, and emerging agent-based platforms. Together, these permissions reinforce a core reality of cloud security: […]

The post Dec Recap: New AWS Privileged Permissions and Services appeared first on Security Boulevard.

Ray Canzanese said that increased reliance on managed corporate accounts should provide cybersecurity teams with more visibility.

The post Report: Increase Usage of Generative AI Services Creates Cybersecurity Challenge appeared first on Security Boulevard.

From Contrast’s threat researchers: Proof that Contrast detects zero-days. The Contrast agent doesn’t require signatures or extensive framework knowledge; it identifies vulnerabilities by monitoring how untrusted data flows through a live application. 

The post Detecting Zero-Day Vulnerabilities Without Signatures | Contrast Security appeared first on Security Boulevard.

Introduction Code signing is no longer an optional process – Windows, antivirus engines, and enterprise security tools all expect executables to be digitally signed. Previously, developers purchased an EV Code Signing Certificate, stored it on a USB token or HSM, and had to maintain it for years. Azure Trusted Signing reimagines the process with cloud-based… Read More How to Set Up Azure Trusted Signing to Sign an EXE?

The post How to Set Up Azure Trusted Signing to Sign an EXE? appeared first on SignMyCode - Resources.

The post How to Set Up Azure Trusted Signing to Sign an EXE? appeared first on Security Boulevard.

Behavioral analytics, or BA, is becoming increasingly useful in the world of cybersecurity. With cyberthreats ever-evolving and with businesses of all shapes and sizes striving to keep up, BA is helping companies future-proof their data, networks, and other assets with greater confidence BA uses artificial intelligence (AI) and machine learning (ML) to train on threat..

The post The Role of Behavioral Analytics in Enhancing Cybersecurity Defense appeared first on Security Boulevard.

AI, Quantum, and the New Threat Frontier: What Will Define Cybersecurity in 2026?
madhav
Tue, 01/06/2026 - 04:44

If we think 2025 has been fast-paced, it’s going to feel like a warm-up for the changes on the horizon in 2026. Every time this year, Thales experts become cybersecurity oracles and predict where the industry is heading in the next twelve months. And, unlike the vague messages received by ancient Greeks, our predictions for 2026 are backed by our extensive experience and understanding of the cyber environment.

Data Security

Thales | Security for What Matters Most
More About This Author >

If we think 2025 has been fast-paced, it’s going to feel like a warm-up for the changes on the horizon in 2026. Every time this year, Thales experts become cybersecurity oracles and predict where the industry is heading in the next twelve months. And, unlike the vague messages received by ancient Greeks, our predictions for 2026 are backed by our extensive experience and understanding of the cyber environment.

In the first part of this two-part series, we focus on what 2026 means for AI, quantum cryptography, and threats at all levels.

AI Becomes the Battleground

“In 2026, AI security will emerge as a formal discipline, much like application security did a decade ago.” - Nadav Avital, Senior Director, Threat Research

With three good years of AI exploration behind us, it’s time that AI security finally has its day. Organizations can no longer afford to operate in the AI space without security built in from the start. The attack surface created by AI systems introduces a new class of bespoke threats, such as prompt injection, data poisoning, model evasion, and unpredictable or rogue model behavior that can’t be effectively addressed with traditional security approaches. These challenges are distinct enough that they demand a dedicated, purpose-built security discipline of their own.

Failing to secure AI as its own entity leaves AI-driven tools vulnerable to supply-chain compromise, automated sabotage, and sensitive data leakage. While many organizations have attempted to extend existing controls or “bolt on” protections as AI evolves, this approach will not suffice. Only purpose-built, AI-focused security measures can provide the level of resilience these systems now require.

Next year, “enterprises will deploy agent-governance layers to monitor, sanitize, and sandbox AI models, enforcing identity, access, and data integrity while detecting misuse and model drift,” Avital says. Organizations that fail to do so will quickly fall behind competitors who invest early. Those that embrace these controls will not only gain an immediate security advantage but also shape the first generation of AI-defense standards, talent, and technologies that the rest of the industry will ultimately follow.

Zero Trust Goes Inside the Application Layer

“By 2026, organizations will recognize that internal traffic is no longer inherently trusted and begin applying Zero Trust principles inside their networks. Application security will evolve beyond perimeter defense into continuous, context-aware protection within every service boundary.” - Nadav Avital

As more businesses adopt advanced agent-style AI and it becomes more embedded in internal business processes, it generates new patterns of ingress-egress API traffic and lateral system-to-system communication. Much of this activity happens behind the scenes, slipping beneath the visibility of WAFs and traditional AppSec security controls.

This shift will also force zero-trust security deeper into internal processes, causing Zero Trust Network Architecture (ZTNA) efforts to effectively double in scope and include:

• Monitoring of all API traffic
• Service-mesh-integrated WAFs
• Agent-aware analytics that can scour behavioral analytics for malicious patterns coming from compromised agents

Predator Bots and AI Scrapers Reshape AppSec

“Attack surfaces made up of multiple cloud environments, hyper-connected systems, and thousands of dynamic entry points are creating the perfect conditions for a new class of predators to thrive as self-learning, adaptive bots that evolve with every interaction.” - Tim Chang, Vice President, Application Security

The next step in AI weaponization will be the transformation of AI agents into predator bots that can teach themselves to hunt, unleashing an abnormally powerful force against current AppSec tools.

As a result, defensive application security must shift to a more proactive stance. According to Chang, “In 2026, bot defense will shift from passive detection to active disruption to spot intent, fingerprint behavior, and intercept malicious automation before it ever reaches the application layer.”

This means that organizations are going to have to increase investments in:

• Runtime bot analytics
• Anomaly detection
• AI-against-AI countermeasures

Chang concludes that AI-powered bots will force “APIs... to finally receive the scrutiny they’ve long deserved.”

AI-Accelerated Zero-Days and Supply Chain Chaos Zero-Days

“The Imperva Threat Research team uncovered multiple high-severity zero-days in 2025, proving that even mature systems remain exposed to AI-accelerated discovery and exploitation. In 2026, the gap between disclosure and weaponization will shrink to minutes, unleashing a surge in zero-day attacks targeting application frameworks, open-source components, and APIs.” – Nadav Avital

Previously, well-established cybersecurity postures were sufficient as a defense against most low-level threats. Now, that’s not necessarily the case. AI has given low-level attackers the technological leverage they need to break down those barriers, and at a low-effort cost. With minimal skills and in record time, LLMs are now used to help attackers:

• Reverse-engineer patches
• Chain exploits
• Find logic flaws

Supply Chains

“2026 will be a year of reckoning for suppliers and OEMs as they rush to meet the Cyber Resilience Act vulnerability management requirements. The biggest challenge won’t be the intent of the regulation, but the supply chain’s uneven readiness to comply. CISOs and product leaders will realize they’re only as compliant as their least-prepared vendor.” - Bob Burns, Chief Security Officer

If highly mature systems can still be compromised by AI-driven attacks, the risk is even greater for the uneven, developing security practices found across most supply chains. When AI-automated attacks inevitably target the weakest third-party links, non-compliance will quickly become a serious and costly problem.

The new threat and legal reality “will permanently elevate secure development lifecycle (SDL) practices from 'best practice' to legal obligation, reshaping how products are built, tested, and supported,” explains Bruns. “2026 is the year when security engineering becomes regulatory engineering.”

AI-Powered Countermeasures: “Resilience Through Efficiency”

“In 2026, efficiency will become the defining metric of cyber resilience.” - Romain Deslorieux. Associate Vice President, Channel Sales, Global System Integrators

The growing need for scalable, intelligent defenses highlights another prescient trend: “resiliency through efficiency.”

Deslorieux observes that as tools are being consolidated into unified platforms, “Human expertise will shift from triage to strategy, transforming cybersecurity from a cost center into a competitive advantage built on trust and innovation.” AI enables organizations to be able to make this change, as AI-powered unification and efficiency contribute directly to the speed and scale at which teams can respond to AI-powered threats.

Quantum Readiness Goes from Optional to Forced

“Quantum computing and AI are advancing faster than most organizations can adapt. Sectors such as finance, healthcare, and critical infrastructure face the earliest deadlines, with cryptographic deprecation expected by 2030 and disallowance by 2035.” - Blair Canavan, Director, PKI & PQC Alliances 

“Quantum computing’s timeline is collapsing faster than anyone expected. Quantum readiness won’t be optional in 2026; it will be policy.” - Todd Moore, Global Vice President, Encryption 

“The quantum countdown has begun. Organizations that haven’t started planning for a post-quantum world are already behind.” - Haider Iqbal, IAM Director 

All three quotes above lead to the same conclusion: Quantum will become the new hype cycle in 2026. Not because quantum computing is new, but because we are finally approaching the inflection point at which “post-quantum readiness” moves from theoretical to existential. 

Organizations should adopt post-quantum readiness because adversaries have already begun preparing. “Even without a commercially viable quantum computer,” Iqbal says, “‘harvest-now, decrypt-later' attacks make post-quantum authentication a present-day imperative.”

Governments, standardization bodies, and enterprises are preparing for quantum’s potential now. 

• “Governments and critical industries are already conducting [PQC] pilot programs but 2026 will be the year those pilots become requirements...” - Todd Moore
• "Standards bodies like NIST are finalizing post-quantum algorithm recommendations for public key infrastructure (PKI), setting the stage for widespread adoption.” - Bob Burns
• “By 2026, forward-leaning enterprises will pilot post-quantum authentication frameworks as part of broader crypto-agility programs. These efforts will shift from experimental labs to real-world pilots designed to safeguard identity systems before the next generation of cryptographic threats arrives.” - Haider Iqbal

While critical industries and government bodies are already conducting post-quantum pilot programs, “2026 will be the year those pilots become requirements,” Moore states. He concludes that next year, “quantum-safe migration will no longer be optional.”

The Bottom Line: 2026 Will Redefine Security

This list highlights some of the forward-looking predictions from our Thales experts. Drawing on years of experience tracking security trends, they expect several meaningful shifts to emerge in 2026.

As organizations prepare for the post-quantum crossover, secure APIs against AI-driven attacks, leverage AI against AI techniques, and elevate zero-trust everywhere, they can be on the cutting edge of change.

In the next part of this series, we’ll examine what these trends mean for the business and outline practical ways organizations can get ahead of the associated risks.

Schema {
"@context": "https://schema.org",
"@type": "BlogPosting",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://cpl.thalesgroup.com/blog/data-security/ai-quantum-cybersecurity-threats-2026"
},
"headline": "AI, Quantum, and the Cybersecurity Threats Defining 2026 | Thales",
"description": "Explore 2026 cybersecurity predictions covering AI security, zero trust inside applications, predator bots, supply chain risk, and quantum readiness.",
"image": "",
"author": {
"@type": "Person",
"name": "Thales",
"url": "https://cpl.thalesgroup.com/blog/author/thales"
},
"publisher": {
"@type": "Organization",
"name": "Thales Group",
"description": "The world relies on Thales to protect and secure access to your most sensitive data and software wherever it is created, shared, or stored. Whether building an encryption strategy, licensing software, providing trusted access to the cloud, or meeting compliance mandates, you can rely on Thales to secure your digital transformation.",
"url": "https://cpl.thalesgroup.com",
"logo": "https://cpl.thalesgroup.com/sites/default/files/content/footer/thaleslogo-white.png",
"sameAs": [
"https://www.twitter.com/ThalesCloudSec",
"https://www.linkedin.com/company/thalescloudsec",
"https://www.youtube.com/ThalesCloudSec"
]
},
"datePublished": "2025-01-06",
"dateModified": "2025-01-06"
} studio THALES BLOG AI, Quantum, and the New Threat Frontier: What Will Define Cybersecurity in 2026?

January 06, 2026

The post AI, Quantum, and the New Threat Frontier: What Will Define Cybersecurity in 2026? appeared first on Security Boulevard.

Learn how to implement post-quantum cryptographic agility within Model Context Protocol (MCP) tool definition schemas to secure AI infrastructure against quantum threats.

The post Post-Quantum Cryptographic Agility in MCP Tool Definition Schemas appeared first on Security Boulevard.

What Is Corporate Governance? Corporate governance refers to the system of rules, practices, and processes used to direct and control an organization. It establishes how decisions are made, who has the authority to make them, and how those decisions are reviewed over time. Corporate governance defines the relationship between the board of directors, executive leadership, […]

The post The Key Principles of Corporate Governance appeared first on Centraleyes.

The post The Key Principles of Corporate Governance appeared first on Security Boulevard.

With AI taking the top spot for 2026 government CIO priorities, what are the next-level questions that leaders must focus on regarding AI projects and trends in the new year?  

The post 10 Tough AI Questions for the 2026 Public-Sector CIO appeared first on Security Boulevard.

Are You Guarding Your Machine Identities Effectively? The management of Non-Human Identities (NHIs) is a critical component of cybersecurity strategies for organizations operating in cloud environments. NHIs, essentially machine identities, represent a fusion of encrypted credentials, such as passwords or tokens, and their corresponding permissions. To draw an analogy, think of an NHI as a […]

The post Why being proactive in NHI management is critical for security appeared first on Entro.

The post Why being proactive in NHI management is critical for security appeared first on Security Boulevard.

How Can We Ensure Non-Human Identities Remain Protected? Are your organization’s Non-Human Identities (NHIs) secure from the impending cyber threats lurking in digital corners? While we delve into the intricacies of NHI security, the crucial aspects of managing these machine identities become apparent. Ensuring the safety of NHIs is a multidimensional effort involving end-to-end protection […]

The post What makes Non-Human Identities safe? appeared first on Entro.

The post What makes Non-Human Identities safe? appeared first on Security Boulevard.

What Makes Agentic AI a Game Changer in Cloud Security? How can organizations ensure the seamless protection of their digital assets when transitioning to the cloud? It’s a question that many industries such as financial services, healthcare, travel, and more are grappling with. Where enterprise systems increasingly leverage cloud environments, the role of Agentic AI […]

The post How can Agentic AI enhance cloud security? appeared first on Entro.

The post How can Agentic AI enhance cloud security? appeared first on Security Boulevard.

Nisos
How OSINT Strengthens Executive Threat Intelligence

High-profile leaders face risks that often start online and can lead to real-world consequences. Personal information exposed across public sources can be used for...

The post How OSINT Strengthens Executive Threat Intelligence appeared first on Nisos by Nisos

The post How OSINT Strengthens Executive Threat Intelligence appeared first on Security Boulevard.

Securonix is detailing a multi-stage campaign that starts with a bogus Booking.com message that runs through a ClickFix technique and a fake Blue Screen of Death before dropping the DCRat malware that gives the attackers full remote control of the victim's system.

The post Malware Campaign Abuses Booking.com Against Hospitality Sector appeared first on Security Boulevard.

Session 7D: ML Security

Authors, Creators & Presenters: Ruyi Ding (Northeastern University), Tong Zhou (Northeastern University), Lili Su (Northeastern University), Aidong Adam Ding (Northeastern University), Xiaolin Xu (Northeastern University), Yunsi Fei (Northeastern University)

PAPER
Probe-Me-Not: Protecting Pre-Trained Encoders From Malicious Probing

Adapting pre-trained deep learning models to customized tasks has become a popular choice for developers to cope with limited computational resources and data volume. More specifically, probing--training a classifier on a pre-trained encoder--has been widely adopted in transfer learning, which helps to prevent overfitting and catastrophic forgetting. However, such generalizability of pre-trained encoders raises concerns about the potential misuse of probing for harmful applications, such as discriminatory speculation and warfare applications. In this work, we introduce EncoderLock, a novel applicability authorization method designed to protect pre-trained encoders from malicious probing, i.e., yielding poor performance on specified prohibited domains while maintaining their utility in authorized ones. Achieving this balance is challenging because of the opposite optimization objectives and the variety of downstream heads that adversaries can utilize adaptively. To address these challenges, EncoderLock employs two techniques: domain-aware weight selection and updating to restrict applications on prohibited domains/tasks, and self-challenging training scheme that iteratively strengthens resistance against any potential downstream classifiers that adversaries may apply. Moreover, recognizing the potential lack of data from prohibited domains in practical scenarios, we introduce three EncoderLock variants with different levels of data accessibility: supervised (prohibited domain data with labels), unsupervised (prohibited domain data without labels), and zero-shot (no data or labels available). Extensive experiments across fifteen domains and three model architectures demonstrate EncoderLock's effectiveness over baseline methods using non-transferable learning. Additionally, we verify EncoderLock's effectiveness and practicality with a real-world pre-trained Vision Transformer (ViT) encoder from Facebook. These results underscore the valuable contributions EncoderLock brings to the development of responsible AI.

ABOUT NDSS
The Network and Distributed System Security Symposium (NDSS) fosters information exchange among researchers and practitioners of network and distributed system security. The target audience includes those interested in practical aspects of network and distributed system security, with a focus on actual system design and implementation. A major goal is to encourage and enable the Internet community to apply, deploy, and advance the state of available security technologies.

Our thanks to the Network and Distributed System Security (NDSS) Symposium for publishing their Creators, Authors and Presenter’s superb NDSS Symposium 2025 Conference content on the Organizations' YouTube Channel.

Permalink

The post NDSS 2025 – Probe-Me-Not: Protecting Pre-trained Encoders From Malicious Probing appeared first on Security Boulevard.

On December 12, 2025, the MongoDB Security Engineering team disclosed a high-severity vulnerability in MongoDB that allows unauthenticated memory disclosure. The issue is tracked as CVE-2025-14847 and has a CVSS score of 8.7 and was quickly nicknamed MongoBleed in the security community due to the way it exposes server memory. Technical Details MongoDB uses a…

The post MongoBleed: unauthenticated memory disclosure in MongoDB (CVE-2025-14847) appeared first on Sentrium Security.

The post MongoBleed: unauthenticated memory disclosure in MongoDB (CVE-2025-14847) appeared first on Security Boulevard.

Artificial intelligence is transforming business models and competitive advantage. Leadership teams agree AI matters, but far fewer know how to turn AI potential into real,...Read More

The post What the CEO and C-Suite Must Ask Before Building an AI Enabled Enterprise appeared first on ISHIR | Custom AI Software Development Dallas Fort-Worth Texas.

The post What the CEO and C-Suite Must Ask Before Building an AI Enabled Enterprise appeared first on Security Boulevard.

AWS CISO Amy Herzog urges security leaders to invest in visibility and automation to counter increasingly AI-driven cyberattacks in real time.

The post AWS CISO: Need for Continuous Observability is Now Critical appeared first on Security Boulevard.

The encryption protecting billions of dollars, which experts once called unbreakable, no longer works. Hackers don’t need passwords. They don’t brute-force keys. They simply walk through digital vaults that were supposed to last for decades. This is the future quantum computing is pulling toward us quietly, steadily, and faster than most organizations realize. Quantum computersRead More

The post Quantum Computing Stats, Trends & Future 2026: Crucial Year for Quantum Security appeared first on EncryptedFence by Certera - Web & Cyber Security Blog.

The post Quantum Computing Stats, Trends & Future 2026: Crucial Year for Quantum Security appeared first on Security Boulevard.

New research reveals how ransomware groups like LockBit and Black Basta exploit visibility gaps, leaving security teams struggling to keep pace.

The post Inside 2025’s Top Threat Groups: Why Familiar Actors Still Have the Upper Hand  appeared first on Security Boulevard.