Cyberthreats: why 2025 is not just a repeat performance
Every year, the cybersecurity news seems to repeat itself. The reports are full of the same terms: ransomware, phishing, supply-chain attacks, cloud misconfigurations. Yet 2025 feels different. Not because the threats are new, but because the scale, speed and interconnectedness with which they occur have changed dramatically.
We are on the eve of the upcoming Cyber Security Image of the Netherlands 2025 (CSBN) by the NCSC, and although the report is not out yet, the contours are already visible. If you read the threat assessments by Mandiant or Check Point, among others, you will see it immediately: we are one stage ahead.
Update: What the CSBN 2025 report confirms
The CSBN 2025 confirms my analysis: 2025 is not a repeat of the past, but a fundamentally new playing field. The threat landscape is growing more intense, more diverse, and less predictable. Ranging from cybercriminals to state-sponsored actors. Supply-chain risks, vulnerable edge devices, and increasing reliance on cloud and SaaS services all raise the likelihood of successful attacks. As a result, strong digital hygiene remains essential: robust access control, timely patching, continuous monitoring, and effective incident response. As threats grow in complexity, organizations that have their fundamentals in order remain agile and resilient.
Peter Mesker
Solution Architect
Threats remain, but scale tilts
Ransomware, for example, remains the most visible form of attack, but the business model is shifting. In fact, Check Point’s recent State of Global Cyber Security 2025 report reports a 44% year-on-year increase in cyber attacks worldwide.
Other shifts also stand out. According to Mandiant’s M-Trends 2025 report, for initial access, the share of stolen credentials was now 16% , passing phishing attacks (14%) in this position for the first time. So that means: attackers are increasingly using legitimate credentials rather than just malware drops or classic phishing.
AI speeds everything up – on both sides
AI was the buzzword of 2024, but by now it has become a reality in the attack domain. The Check Point AI Security Report (2025) shows how generative AI is already being deployed by attackers for impersonation, deepfakes, data-poisoning and automating malware campaigns. On the defender side, we see that AI and machine-learning are increasingly being deployed, but that, once again, it is a “cat-and-mouse game”: “if they deploy AI, we must also deploy AI to keep up”.
From protection to resilience
What strikes me in many recent analyses is that the tone is changing from “protection” to resilience. Not just “how do we prevent the attack”, but more “how do we recover quickly, and how do we build on stronger again”. In line with observations we mentioned earlier around Detection and Response and building a resilient organisation.
This means that CISOs need to invest in scenarios, exercise, detection capability and recovery mechanisms, meaning that incident response is no longer a closing item, but a core component of your continuity strategy.
2025 already promised no quieter year
Whether it is geopolitical tensions, digitalisation of critical infrastructure or the rise of AI-driven attacks, 2025 will be anything but a repeat performance. The threats remain largely the same in type, but the context in which they occur is substantially different.
The CSBN 2025 will no doubt confirm this. Until then, we know enough: those who base their security strategy on yesterday’s patterns are missing tomorrow’s dynamics.
Next month, I will look ahead to the key developments for 2026. But one thing I dare say right now: the pace of change is not slowing down, it is accelerating.
Action points to be realised by 2025
I recommend some concrete actions you can implement before this year to increase resilience and go into 2026 stronger later:
- Credential hygiene and MFA ▪ Invest in strict password rules, MFA, and periodic credential audits. Ensure old accounts are closed and service accounts have minimal privileges.
- Zero-Trust and segmentation ▪ of course you already have this in place
- AI-aware detection policies ▪ With AI in the hands of both attackers and defenders, it is essential to integrate AI-based monitoring and threat intelligence. Think user behavioural analysis, anomaly detection and predictive analytics for attack scenarios.
- Scenario exercises and incident response ▪ Do another incident-response exercise this year, including tabletop simulation of either ransomware, cloud-breach or a supply-chain incident. This way, the team is trained, and procedures are not just on paper.
These actions are relatively quick to implement still this year, and lay a solid foundation for 2026. Not to prevent everything at once, but to build resilience and react smarter if things do go wrong unexpectedly.
Peter Mesker
Solutions Architect