Cyber security risk is entering a new phase—one where the threat landscape is not just getting more sophisticated, but also more chaotic. The latest reporting on how organisations are being hit suggests that AI is acting like an accelerant: it can compress the time between idea and execution for attackers, scale up experimentation, and lower the barrier to entry for people who previously lacked the patience or expertise to carry out complex intrusions. But what’s striking is that the most damaging changes aren’t only about “better hacking.” They’re about how attacks are being packaged, delivered, and disguised—so that defenders face threats that look familiar, arrive faster, and spread wider than expected.
Across industries, three pressure points keep showing up: a new wave of reckless hackers, attacks that mimic insider activity through fake remote workers, and persistent supply-chain weaknesses that turn one compromised vendor into many compromised customers. Together, these trends are reshaping how risk teams think about controls, incident readiness, and vendor governance. And they’re forcing a shift from “protect the perimeter” thinking toward “assume compromise and design for containment.”
A new wave of “reckless” hackers: speed, spectacle, and the erosion of discipline
For years, cybercrime has been driven by profit, ideology, or state objectives. Increasingly, however, organisations are seeing attackers who behave differently—less like careful operators and more like fast-moving experimenters. The reporting points to a growing number of “reckless” hackers who target systems with the goal of speed, notoriety, and peer attention rather than disciplined tradecraft. In practice, this can mean more probing, more trial-and-error, and less concern for stealth.
AI changes the economics of this behaviour. When tooling becomes easier to obtain and faster to adapt, attackers can iterate quickly: scan, test, pivot, and attempt exploitation without spending as much time on manual research. That doesn’t automatically make every attack successful—but it increases the volume of attempts and the variety of techniques used. Defenders then face a problem that is harder than it sounds: not just more alerts, but alerts that don’t follow a neat pattern.
There’s also a subtle operational risk for organisations: when attackers are experimenting, they may trigger unusual behaviours in systems—odd authentication patterns, unexpected service restarts, repeated access attempts across multiple accounts, or sudden bursts of traffic that don’t match typical threat actor profiles. Security teams can be trained to recognise known campaigns, but “reckless” activity can blur those signatures. It becomes less about identifying a specific adversary and more about detecting intent: are these actions consistent with legitimate user behaviour, or are they exploratory?
This is where risk management becomes practical. If you assume attackers will move quickly and unpredictably, you need controls that don’t rely on perfect detection. You need systems that limit blast radius even when something slips through. Segmentation, least privilege, and strong logging aren’t just compliance checkboxes—they’re the difference between a contained incident and a full-scale compromise.
Fake remote workers attacking from the inside: identity becomes the battlefield
Remote work didn’t just expand the network; it expanded the identity surface area. As organisations adopt more flexible access models—VPNs, zero trust approaches, cloud-based productivity suites, remote desktop tools, and identity providers—the “inside” is no longer a location. It’s a set of permissions granted to an account.
The reporting highlights a particularly dangerous trend: fake remote workers. This can involve compromised accounts, impersonation, or weak onboarding practices that allow attackers to appear legitimate long enough to do real damage. The key point is psychological as much as technical. Once an attacker’s activity looks internal—because it originates from a valid session, a known device, or an account that already has access—defenders may treat it as routine until evidence forces a reassessment.
AI can intensify this dynamic. Social engineering becomes more convincing when attackers can generate tailored messages, mimic writing styles, and respond quickly to follow-up questions. But even without advanced social engineering, identity attacks remain effective because they exploit the friction between security and operations. Organisations often want onboarding to be fast. They want employees to have access to tools immediately. They want helpdesk workflows to be efficient. Attackers exploit those priorities by targeting the gaps: temporary credentials, overly broad roles, shared accounts, weak verification during password resets, and insufficient monitoring of identity anomalies.
What makes “fake remote workers” especially risky is the speed of lateral movement once access is established. If an attacker gains a foothold through identity, they can often skip the early stages of intrusion that defenders are best at catching. Instead of exploiting a vulnerability in a public-facing system, they start with something that already has permission. From there, the attacker can access internal applications, read sensitive data, modify configurations, or plant persistence mechanisms that blend into normal administrative activity.
Risk teams should therefore treat identity not as a single control, but as a layered system. Strong authentication matters, but so does how permissions are granted, reviewed, and revoked. A mature approach typically includes:
1) Tight onboarding and offboarding processes
If access is granted too easily or removed too slowly, attackers benefit. Offboarding delays are a quiet driver of risk.
2) Privilege minimisation and role hygiene
Over-privileged accounts are the fuel for insider-style attacks. Regular access reviews and automated detection of anomalous privilege changes reduce the chance that a compromised account becomes a crown-jewel key.
3) Behavioural monitoring tied to identity context
It’s not enough to log authentication events. Teams need to correlate them with device posture, geolocation, session characteristics, and application usage patterns. The goal is to detect “impossible” or “unlikely” behaviour, not just failed logins.
4) Resilience against account takeover
Password reset flows, MFA fatigue, and session token theft are common paths. Controls must be designed so that a single stolen credential doesn’t become a permanent pass.
In other words, the “inside” is now a moving target. Your security model must assume that identity can be abused—and then ensure that abuse doesn’t automatically translate into unrestricted access.
Supply-chain weaknesses: the multiplier effect of third-party risk
If identity attacks represent the “front door” of modern cyber risk, supply-chain weaknesses represent the “amplifier.” The reporting underscores a reality that many organisations already know but struggle to operationalise: attackers continue to focus on third parties—vendors, software dependencies, and service providers. When one link is weaker, the blast radius can spread to many organisations at once.
Supply-chain risk is difficult because it’s not confined to one vendor relationship. It’s embedded in the entire ecosystem: libraries included in applications, plugins used by internal teams, managed services that handle authentication or data processing, and outsourced IT functions that manage endpoints or backups. Even when a vendor is reputable, the risk can shift over time due to changes in their security posture, staffing, patching cadence, or incident response maturity.
AI can contribute indirectly here. Faster development cycles and automated code generation can increase the likelihood of introducing vulnerable components if secure coding practices and dependency scanning aren’t rigorous. Meanwhile, attackers can more efficiently identify which third parties have exposed services, outdated dependencies, or weak access controls. The result is a threat environment where the “weakest link” is not always obvious until it fails.
From a risk management perspective, supply-chain security requires two parallel efforts: visibility and leverage.
Visibility means knowing what you depend on, where it runs, and how it connects to your environment. Many organisations can list major vendors, but struggle to map transitive dependencies—what a vendor’s product depends on, what their integrations require, and what credentials are shared behind the scenes.
Leverage means using contractual and technical requirements to enforce security outcomes. That might include:
– Security attestations and evidence-based assessments
Not just questionnaires—proof of patching timelines, vulnerability management processes, and incident reporting.
– SBOM and dependency transparency
Software Bill of Materials helps teams understand what’s inside and track vulnerabilities across versions.
– Segmentation and restricted integration paths
Even if a third party is compromised, the architecture should limit how far the attacker can go.
– Monitoring for third-party anomalies
If a vendor integration suddenly starts behaving differently—new API calls, unusual data access patterns, unexpected configuration changes—that should trigger investigation.
The unique challenge today is that supply-chain incidents can be both fast and contagious. When a widely used component is compromised, defenders may not have time to wait for perfect information. They need playbooks that allow rapid triage: identify affected systems, isolate integrations, and communicate internally and externally without waiting for complete certainty.
The common thread: reducing single points of failure and designing for containment
Across all three pressure points, the same lesson emerges: organisations can’t rely on any single control to prevent compromise. Reckless attackers increase unpredictability. Fake remote workers exploit identity trust. Supply-chain weaknesses multiply impact. The combined effect is that defenders must assume that something will eventually slip through—then focus on limiting damage.
That’s why the recommendations in the reporting resonate: reduce single points of failure, tighten identity and access controls, and pressure-test vendor risk with the same seriousness as internal systems.
But “reduce single points of failure” needs to be translated into concrete architecture and operational habits. It’s not only about network segmentation. It’s also about:
– Limiting credential reuse and enforcing short-lived access where possible
If credentials are stolen, the window for misuse shrinks.
– Building redundancy into critical workflows
If one system fails or is manipulated, backups and alternate paths prevent total loss.
– Ensuring logging and detection are resilient
If attackers can disable monitoring, containment fails. Detection must survive partial compromise.
– Practising incident response with realistic assumptions
Teams should rehearse scenarios that involve identity compromise and third-party involvement, not just malware outbreaks.
A unique angle for 2026: the threat is becoming “operationally messy”
One of the most interesting shifts in the current threat narrative is that the attacker’s behaviour is becoming operationally messy. Reckless hackers may not be stealth-first. Fake remote workers may blend