Jon France, CISO of ISC2, wanted to share a handful of predictions on what to expect in the upcoming year.
When it comes to AI, France is confident deepfakes will be a defining characteristic of the cybersecurity landscape in 2025 … which is pretty unsettling. However, he also believes the industry will get more clarity on what skills are needed to secure and manage AI/ML technology as it’s being used today. He also predicts sustainability and energy consumption will take center stage in quantum computing and genAI discussions, we’ll see the successful prosecution of a CISO, and we’re due for more regulation around emerging technologies and supply chains.
Jon France 2025 Predictions
2025 will be the year of deepfakes
The examples of deepfakes that we’ve seen in 2024 have been terrifying to say the least. From AI-generated images of faux Taylor Swift fans claiming their support for US President Elect Donald Trump to fake videos of Ukrainian President Volodymyr Zelenskyy bowing his head in surrender, deepfakes have largely targeted major celebrities and world leaders. In 2025, I predict we’ll see the use of deepfakes taken to the next level and used as a core tactic in financially-motivated cyber attacks on companies large and small. While business email compromise (BEC) certainly isn’t going anywhere anytime soon, we can expect to see the use of deepfakes to accomplish similar goals.
I also expect that deepfake technology will become increasingly commoditized in order for adversaries to use it on a larger scale and to target more “everyday” people. Deepfakes in the form of audio, video and image manipulation are on the rise and it’s imperative that organizations plan accordingly. How? Educating employees on what deepfakes are and what they look or sound like, clearly outlining processes for employees to report incidents, and exploring the use of deepfake detection tools are all solid starting points. All in all, deepfakes got a decent amount of “screen time” throughout 2024, but the impact on businesses is going to skyrocket in 2025 as deepfake technology becomes commoditized.
We’ll see increased regulation around emerging technologies and supply chain
I predict that the hot regulatory landscape we’ve seen in cybersecurity in 2024, specifically around emerging technologies like AI, will stay hot well into 2025. The usage of genAI (and not always for innocent purposes) has sparked an outcry for placing meaningful regulations on the technology and how it’s used. We’ve seen household name brands like X/Twitter and LinkedIn face backlash for training AI models on user content, and that trend of heightened scrutiny around how AI models are trained will absolutely continue into the new year. That backlash and increased focus will likely spark additional legislation worldwide.
In addition to AI, we can expect to see heightened legislative attention on an area we know and love – the supply chain. Protecting critical national infrastructure has always been a top priority, but our world as it relates to technology is pulled across all compass points. If you think of North and South being the depth of which digital technologies have penetrated operations, and East and West as being the spread between legacy technologies and emerging tech, everything we do is rooted now in some sort of digital environment…meaning everything in our world at some point touches a digital supply chain. That depth and breadth will only continue to expand and spark the need for additional protections through regulation.
I also predict that we will see a cascade or major failure due to a supply chain at a depth greater than N+1 (i.e. not just an immediate supplier, but a supplier of a supplier) and it will have a large area effect. Supply chains remain 'brittle' and digital chains can become hyper converged in terms of relying on a few larger suppliers as well as sometimes having convergence relying on small proprietary pieces of technology.
We’ll see the successful prosecution of a CISO
Just about everyone in cyber, especially the CISOs, know about the conviction of Joe Sullivan, former CSO of Uber, and the SEC lawsuit against Tim Brown, the CISO of SolarWinds. While the repercussions for Joe weren’t solely because of his role at Uber, the charges against Tim Brown really were because he was the CISO and he was being held accountable for 'doing CISO things' so to speak. This demonstrates two main things: there’s an appetite for authorities to prosecute security leaders (specifically CSOs and CISOs) and the usual corporate protections such as D&O insurance may not cover security leadership and aren’t as sophisticated or established as they are for say a CFO. The SEC guidelines in the US stopped short of requiring cybersecurity expertise at the board level, but the general consensus is that cyber is an important part of business and business leadership…and prosecutors aren’t afraid to go after those who are tasked with keeping their organizations secure.
However, whether a CISO is actually successfully prosecuted or not, the immense pressures they’ll continue to face in 2025 will cause a renewed push for cybersecurity 'smarts' or expertise to be required at the board level. The more buy-in at the executive level that CISOs can secure, the more shared responsibility cybersecurity becomes. And we all know shared responsibility makes it significantly less likely to be overlooked and harder to label one person as being at fault for specific incidents.
Energy consciousness around AI and quantum will come to the forefront
We’ve heard rumblings about the environmental impact of generative AI and quantum computing, but conversations have been relatively quiet as society grasps what these technologies do in the first place and what they mean for organizations, governments, data security, etc… I predict that will change in 2025. As genAI makes its way into becoming a core pillar of business’ strategies for innovation and efficiency, we’ll start to see a lot more conversations around the energy spend that genAI requires. To set the stage for what this energy consumption looks like, ChatGPT's daily power usage is equal to about 180,000 U.S. households. To harken back to deepfakes, creating an AI-generated image uses about the same amount of energy as powering a phone.
When it comes to quantum computing, the supercooling required for many types of quantum computers to run successfully is where immense amounts of energy is used. Most quantum computers need to be kept at a temperature of near absolute zero to run accurately. Warm temperatures introduce errors in quantum calculations and correcting such errors requires additional energy. There will need to be some breakthroughs in energy use if quantum is to reach widespread commercial viability.
Needless to say, between AI and quantum computing, the energy and environmental impact conversation surrounding emerging technologies is going to be forced to the forefront.
The industry will get clarity on what AI skills practitioners need
Over the past year, as AI has risen to the top of every organization’s mind, we’ve been getting questions about whether people who want jobs in cyber should be focusing on up-skilling in AI. While it’s certainly not a bad idea to get up to speed on AI and ML and securing these technologies, our 2024 Workforce Study revealed that the majority of hiring managers are unsure what to look for when it comes to “AI skills.”
The uncertainty around what skills are valuable when it comes to working with AI and ML is pushing hiring managers – and current cybersecurity workers for that matter – to prioritize transferable, less-technical skills like problem solving and communication. However, in 2025, I believe we’ll start to see requirements firm up around what recruiters are looking for and what prospective cybersecurity professionals should focus on. This clarity may be gleaned from the regulatory landscape, additional research into the security of AI/ML tools or simply more experience with how these tools get folded into businesses’ strategic frameworks. Regardless, I expect the cloudiness around what makes someone a qualified AI specialist/professional to clear up in the new year.
