Cybersecurity 2019 vs. 2025 – Predictions and Realities

In 2019, cybersecurity experts identified key risks and developments that would dominate the industry. Some of the most notable predictions included:

1. Rise of Ransomware

Prediction: Ransomware was expected to become more targeted and sophisticated, posing a major challenge to businesses.
Reality: This prediction held true. By 2025, ransomware attacks have evolved, with attackers leveraging AI to automate and personalise attacks. Double extortion techniques—where data is both encrypted and threatened with public exposure—became widespread. Australian businesses, particularly in critical infrastructure and healthcare, have been heavily targeted.

2. Phishing Attacks Surge

Prediction: Phishing attacks would grow more sophisticated, tricking users with better-crafted scams.
Reality: Phishing remains a dominant attack vector in 2025. AI-powered phishing campaigns, including Adversary-in-the-Middle (AiTM) attacks, are now bypassing traditional security measures, such as multi-factor authentication (MFA). The Australian Cyber Security Centre (ACSC) has issued repeated warnings about highly sophisticated phishing attacks targeting businesses and government agencies.

3. Remote Work Security Challenges

Prediction: The rise of remote work would lead to increased endpoint security concerns.
Reality: The prediction was accurate. The COVID-19 pandemic accelerated remote work adoption, and by 2025, hybrid work environments remain standard. Endpoint security solutions, such as zero-trust architecture, have become essential for businesses, with a strong focus on securing remote access and mitigating risks from unmanaged devices.

4. Cloud Vulnerabilities and Hijacking

Prediction: Cloud security threats, including data breaches and hijacked accounts, would become more prevalent.
Reality: Cloud security remains a priority in 2025. Australian businesses have invested in robust cloud security measures, but misconfigurations and API vulnerabilities continue to be significant risks. Data sovereignty concerns have also led to increased scrutiny of cloud providers handling Australian data.

5. Identity as the New Perimeter

Prediction: Identity security was not a primary focus in 2019.
Reality: By 2025, identity has emerged as the backbone of cybersecurity. The shift to cloud-based applications, hybrid work, and increased remote access have made Identity and Access Management (IAM), Privileged Access Management (PAM), and Identity Governance and Administration (IGA) essential security components. Multi-factor authentication (MFA) is no longer enough—businesses now prioritise continuous authentication and identity verification to mitigate risks.

6. IoT Security Risks

Prediction: The growing number of IoT devices would introduce new attack surfaces.
Reality: IoT threats have intensified. In 2025, supply chain attacks often target IoT ecosystems, and security standards are struggling to keep pace with device proliferation. Industrial IoT deployments are particularly vulnerable.

7. Deepfake Technology Exploited for Cybercrime

Prediction: Deepfake technology would be used for fraud, misinformation, and impersonation.
Reality: AI-generated deepfakes are now being leveraged in sophisticated social engineering campaigns, including voice and video impersonation for financial fraud and business email compromise (BEC) scams. Financial institutions have seen an uptick in such attacks.

8. Third-Party Risk Becomes a Top Priority

Prediction: Supply chain security was a concern, but not a top focus in 2019.
Reality: Third-party breaches have become one of the largest sources of cyber risk. Attackers increasingly exploit vulnerabilities in vendors, service providers, and suppliers to gain access to organisations. The Australian government has introduced stricter cybersecurity regulations for third parties handling sensitive data.