Top 7 Cybersecurity Predictions for 2022

While the entire world seemed to slow down over the past year and a half, technology adoption accelerated at a record pace. Microsoft CEO, Satya Nadella said it best: “We have seen two years' worth of digital transformation in two months.”

Have you ever heard the oft-quoted sentiment that the pace of change will never be as slow as it is today? It seems like each day brings about new technology innovations faster than ever before. Based on that, we can assume that the cybersecurity landscape will change at an equally fast pace, from policy and governance to operations and intelligence.

In 2022, I believe that chaos and opportunities for threat actors will reach an all-time high.

By sharing my predictions for the coming year, I hope companies will seriously consider and adapt to the emerging risks generated from the evolving threat landscape.

For example, if you don’t already have a cybersecurity risk committee, I’d suggest establishing one that meets on a regular basis to discuss evolving threats and how the organization is best suited to react and respond. This adds a layer of accountability as well as an organized cadence for stimulating action.

Here are my top predictions for 2022:

1. In 2022, we will see a cybersecurity attack that is the first of its kind

The year 2021 brought us the SolarWinds attack. It was not technically the first of its kind, but the size, scale, reach and impact of that hack made it unique. And while the SolarWinds breach was definitely one of the most eye-opening breaches in recent history, there were also several other attacks that were fairly unique in terms of sophistication, size and scale.

In 2022, I believe we will experience a cybersecurity breach of equal or greater proportions that uses tradecraft unlike anything that we’ve ever seen or experienced before.

Update: Log4j really decided to throw us a curve ball during our publishing process. While that technically happened in 2021—and it is a biggie—I still think we surpass the scale and reach of Log4j with something new in 2022.

2. In 2022, supply chain attacks will increase by more than 650%

Here’s another prediction based on the SolarWinds breach. Supply chain attacks—if carried out successfully—can be wide-ranging and span across multiple customers of a software or hardware product or service. In 2021, Sonatype reported that open-source code supply chain attacks rose more than 650%, and I believe we will surpass that in 2022.

While these attacks require careful planning, detailed execution, and sustained effort, the potential return on investment for a sophisticated threat actor—especially nation states—is truly off the charts.

3. In 2022, cyber insurers will deny coverage to more than 25% of currently insured companies

In recent years, many businesses saw cyber insurance as a cheap and easy way to cover for their lack of cyber-resilient practices. But as losses mount and cyber insurers pay out one sizeable claim after another, they will declare that enough is enough.

In 2022, cyber insurers will continue to aggressively manage their loss ratios through increased premiums, decreased coverage, additional exclusions, and even outright denial of coverage.

4. In 2022, our way of life will be disrupted by at least one major cyber incident

2021 showed us some major chinks in the armor of business and other institutions that we rely on in our day-to-day lives. Our lives were disrupted by gas shortages on the east coast due to the Colonial Pipeline attack and by meat price hikes due to fear over production shortfalls as a result of the JBS Meats ransomware incident.

I believe 2022 will show us just how fragile some of our most critical businesses and infrastructure are on a large scale, and the impact will hit us in our homes, not just in the workplace.

5. In 2022, technological advances will continue to be abused in nefarious ways

In the last few years, we have seen some major technological advances that have been transformational in many respects. Unfortunately, every technological advancement that advances society seems to also enable threat actors in their nefarious pursuits.

In 2021, we’ve seen artificial intelligence enable next generation phishing attacks and deepfake audio and video, and we’ve seen cryptocurrencies used and abused by ransomware gangs.

Next year, we’ll see the bad guys continue to use technological advances to carry out attacks and attribute to their gains.

6. In 2022, ransomware attacks will accelerate by 200% as threat actors innovate their methods

As organizations find ways to become resilient to traditional ransomware attacks, ransomware gangs will continually change up their methods, routines, malware, and even find innovative new ways to extort their victims.

I predict that the ingenuity of ransomware gang R&D departments will prevail against traditional ransomware defenses. We’ve already seen how solid backup plans are met with stolen data, along with public posting / name and shame threats and/or distributed denial of service attack (DdoS) threats.

In 2022, I believe that threat actors will continue to get crafty and creative in their ways.

7. In 2022, insider-driven breaches will rise by 4X

When you combine the work-from-home trend with accelerated cloud adoption and an increasingly global workforce that can be influenced by political regimes, you have a recipe for malicious insider threats.

Couple these facts with advanced tools for data rights management, and new breach reporting rules from the SEC and other governmental watchdogs, and I believe we will see a sharp spike in reported data breaches stemming from insider threats.

The FBI signaled the warning bell for U.S.-based tech companies earlier this year about the real risk of insider threats, and I believe that 2022 will illustrate this to an extent that we’ve never seen before.

2022: The Challenge and the Promise

As I thought deeply about what 2022 may bring from a cybersecurity perspective, I kept asking myself if I was being too negative. But looking back on prior years and what has transpired, I don’t believe negative is the right word for it.

At the end of the day, it is not all doom and gloom. These thoughts and predictions are simply facts of life that present new challenges and obstacles for us as cybersecurity risk professionals to overcome.

We all love a great challenge in this line of work, otherwise we wouldn’t do what we do. I believe that our continued evolution as cyber professionals will help us meet new challenges head-on, and that we’ll be able to thwart many of the attacks coming our way.

So here’s to 2022! Bring on the challenges—we are ready for them!