Getting Ready for 2026

In addition to all the promise and potential a new year holds, 2026 also offers some unique challenges for the industrial cybersecurity sector. Below are predictions from leading voices throughout the industry.

Frank Balonis, CISO and SVP of Operations at Kiteworks

Predictions:

• Cross-border data transfer compliance will shift from back-office review to point-of-exchange enforcement. Manufacturing runs on global supply chains, and that means data is constantly crossing borders—design files to contract manufacturers in Asia, quality data to partners in Europe, compliance documentation to customers everywhere. The old approach of moving data first and sorting out transfer mechanisms later is a liability waiting to happen.
• I think 2026 is when manufacturers finally embed compliance checks directly into their exchange workflows. When engineering sends CAD files to a supplier, the system validates the transfer mechanism before the file leaves—not three months later when legal is scrambling for audit documentation. The pressure is real: GDPR enforcement isn't slowing down, the EU AI Act adds new wrinkles around where training data can travel, and U.S. state privacy laws keep multiplying. For manufacturing CISOs managing data flows across dozens of countries and hundreds of partners and automating cross-border compliance into the actual tools, isn't optional anymore. 

George Prichici, VP of Products, OPSWAT

Predictions:

• Files are evolving—security isn’t. Security teams remain focused on productivity files such as Office documents and PDFs, in which embedded hyperlinks and encrypted content continue to pose real risks. But this focus can leave blind spots elsewhere. Today’s “files” increasingly include Python scripts and malicious npm packages – many of which slip past traditional content inspection tools. Attackers are aware of this gap and are actively exploiting it.
• Trust emerges as a primary vulnerability. Third-party vendors and “trusted” integrations remain soft targets. CISOs are realizing that focusing budgets solely on endpoints, identity, or edge security creates imbalance: a fortified front door, but an open side entrance. The path forward is not zero trust for everything, but smarter, consistent processes that elevate defenses across all channels, including partners, APIs and supply chains.

Bottom Line: Security leaders must redefine what constitutes a threat, scrutinize every data exchange, and enforce AI governance before innovation turns into exposure.

Asha Kalyur, VP of Marketing, Zenarmor

Prediction: The next frontier is invisible MFA, trust that just happens. Your device, location, and behavior become your key. You won’t “log in”, you will simply exist in a continuously verified state. Security won’t feel like a checkpoint anymore, it will feel like air: always there, always working, completely effortless. That is where Zero Trust transcends security: secure by design, invisible by default.

Almog Apirion, CEO and Co-Founder, Cyolo 

Predictions:

• Shadow AI and compromised AI agents will emerge as a new insider-threat class. With the growing reliance of engineers, operators, and third party vendors on AI co-pilots, AI agents with OT system access will use shared credentials to perform autonomous actions with minimal oversight.
• Organizations will need to govern AI the same way they govern humans, with enterprises ensuring the same levels of identity oversight, network segmentation, and strict session supervision for AI agents as for high-risk human users.
• Hard segmentation between OT and IT within OT will become non-negotiable. Breaches in 2025 highlighted lateral movements across IT and OT without boundaries. AI-driven automation and unmanaged AI tools increase this risk significantly. In 2026, identity-based separation, isolated vendor zones, and controlled machine-to-machine access in addition to supervised pathways will shift from ‘best practice’ to operational necessity for any remote or automated action.
• Downtime will be caused more by access weaknesses than direct OT intrusions. Over 75 percent of OT incidents now originate in IT environments, with ransomware threat-actors exploiting remote access and identity control gaps. In 2026, enterprises will prioritize securing remote access, vendor connectivity, and identity-based controls to OT assets.
• Legacy systems and reactive maintenance will cause unplanned downtime. Manufacturers logged an average of 360 hours of downtime in 2025. In 2026, modernization will be prioritized as an operational necessity with supervised access and oversight of remote diagnostics to improve maintenance workflows that enable operational continuity in legacy OT.

Josh Taylor, Lead Security Analyst, Fortra

Predictions:

• Attacks on critical infrastructure will accelerate. Nation-state and criminal actors will target energy, healthcare and transportation systems with cyber-physical impacts, turning outages and disruptions into strategic weapons. Enterprises in these sectors must treat cybersecurity as a safety imperative and plan for worst-case operational scenarios.
• The line between APTs and criminal gangs will disappear. State-backed groups and cybercriminal gangs will blend tactics, share infrastructure, and obscure attribution, creating hybrid threats that defy traditional classifications. Defenders will need to focus on behavior, intent, and impact rather than relying on actor labeling.
• Nation-state operations will expand to target commercial enterprises. Advanced persistent threat actors will increasingly target private-sector companies for economic disruption, IP theft, and espionage aligned with geopolitical goals. Enterprises must adopt nation-state-grade defenses and treat geopolitical risk as part of their cyber threat model.