Cyber Security Predictions for 2021
CIOREVIEW >> Security >> NEWS

Cyber Security Predictions for 2021

CIO Review

Pravin Madhani, CEO, <a href='https://www.k2io.com/' rel='nofollow' target='_blank' style='color:blue !important'>K2 Cyber Security</a>

Pravin Madhani, CEO, K2 Cyber Security

As 2020 comes to a close, we can only look back with amazement at everything that has happened this past year.  It was certainly a year no one could have predicted.  Yet every year around this time, we try to predict what is in store for us in the coming year.  Here at K2 Cyber Security, we are no different, and we are going to take a stab at what we think will happen in the world of cyber security in 2021.

First, we know that the pandemic rages on, and in many parts of the world, we have gone back to more restrictive lockdowns as we approach the end of the year.  That means “Work From Home” is not going to go away any time soon and that very fact provides a lot of the basis for the predictions we have for 2021.  We have also seen some unprecedented attacks in 2020, including most recently the breaches involving SolarWinds and the SUNBURST vulnerability. The scope and depth of this attack naturally leaves an impression on our predictions for 2021. 

Here are our top 5 predictions for 2021:

1. The move of business applications to cloud will continue to accelerate.  Organizations will continue to have a need to cut costs so moving from CAPEX to OPEX will continue and public infrastructure clouds will help with this.

2. Major security breaches will continue and cyber criminals will have more targets than ever.  Organizations are continuing to rush their applications to production using legacy code, open source code, and 3rd party code, all of which have more vulnerabilities than the average, enabling these breaches to continue.

3. We will see a major breach in an organization using an application hosted in one of the major cloud vendors.  This seems inevitable given the continued move to cloud, which typically has less security; the rush to get applications out (resulting in more vulnerabilities); and the increased cybercriminal activities we are seeing because of the pandemic.

4. Runtime Application Self-Protection (RASP) and Interactive Application Security Testing (IAST) will start gaining traction in 2021.  With the inclusion of RASP and IAST in the NIST SP800-53 Revision 5 final document(if you have not started planning for these, 2021 is the time to start).  RASP and IAST, while not common words in security circles, should see pick up, now that they are included as requirements in the security framework outlined by the finalized release of SP800-53 Revision that came out on Sept 23, 2020.  These technologies should start to help to reduce breaches based on the exploit of vulnerabilities in web applications.

5. Overall, we will see an increase of attacks on web applications, phishing attacks and ransomware attacks, and we expect these to hit record highs in 2021.  These types of attacks have already hit record highs in recent years, and are the most prevalent types of attacks being used by cybercriminals. Specifically, web applications will continue to be breached, the breaches will use more sophisticated exploit methods, including new zero day attacks that target multiple applications simultaneously, and we will see increased numbers of attacks with the prevalence of exploit kits that let attackers who are not sophisticated cyber criminals create attacks on web applications. Attacks will get more sophisticated in part because easily targeted vulnerabilities will now be discovered in development by IAST and better testing methodologies along with move to shift left as part of DevSecOps. 

And with these predictions we wish you the best for the coming year. May some of these predictions spur you and your organization to take another look at your security posture, and inspire a move to strengthen your security and defense-in-depth posture for better protection in 2021.

More in News

AI agents are exposing a problem that conventional workflow software has rarely solved. Many enterprises run essential work across SaaS platforms, integration tools, local scripts and shared spreadsheets. Agents are then expected to work across all of them, gather enough context and make safe decisions. The difficulty lies in the gap between what an agent can infer and what the business can actually control. Point-to-point integrations move data but do not preserve the history of a process. iPaaS platforms connect systems, yet long-running work can still end up scattered across queues, callbacks, approvals and exceptions. For buyers, introducing agents is only part of the challenge. They also need a process that can show exactly what happened. Workflow orchestration can provide that structure when it carries context along with the work instead of simply routing it from one system to another. Agents still need room to exercise judgment, but that judgment needs boundaries. A model might classify an email, interpret intent, retrieve missing context and recommend what should happen next. It should not have to work out the refund procedure or customer verification process from scratch every time a request comes in. Repeatable steps are less expensive to execute through deterministic logic and easier to audit. The agent can then handle the parts that require interpretation while established actions remain within versioned process logic. “Agents can make decisions where judgment is required while the workflow handles repeatable actions.” That separation is useful only if the business can see what happened in each workflow. Executives need a way to inspect the process template, runtime history, agent decision and failure path in one place. Once APIs, agents, human reviewers and external events are involved, ordinary system logs do not provide the whole picture. Buyers need to know which action ran, what data moved, what decision was made and what happened when a step timed out or had to be retried. Keeping that information with the process also makes automation easier to improve because performance data remains connected to the work that produced it. The amount of engineering required to get there matters too. An orchestration platform has limited practical value if a company needs to build a large specialist team before it can put a useful process into production. Existing services and SaaS APIs should be composable into business logic that people can understand and change without rebuilding the entire integration map. A code-first approach is useful when software teams get version control, business reviewers can see the workflow as a visual graph, auditors can trace what happened and agents have a stable process map to work within. The larger issue is ownership of the process, not simply how many tasks can be automated. Long-running workflows need to retain state, and agent decisions need to remain visible without requiring a model call at every step. Once the process is running, event-driven feedback can show where it needs improvement. The platform also has to work for organizations with different levels of software maturity. One team may be coordinating a large collection of microservices, while another needs custom workflow logic around ERP, CRM, field-service and workforce systems without having to wait for a vendor to add the functionality to its roadmap. LittleHorse takes this approach with Saddle Command Center and its Business-as-Code model for building workflows across microservices, SaaS platforms, agents and human-in-the-loop steps. Agents can make decisions where judgment is required while the workflow handles repeatable actions. Individual instances remain traceable, and workflow event data can be published to Apache Kafka for analysis. Support for Java, Python, Go and C# also allows engineering teams to maintain the business logic without having to adopt a specialist workflow language. For enterprises working across disconnected SaaS environments or complex microservice estates, LittleHorse provides a practical way to give AI agents room to make decisions while keeping the surrounding process visible and controlled. ...Read more
Sage migration decisions often begin with a contradiction. Finance and IT teams want the subscription feel of SaaS, yet the applications they rely on still carry custom workflows, connected databases, reporting routines and partner-managed changes. A generic cloud host can move the server, but it may leave the business managing every handoff when access breaks or latency appears during a critical task. Month-end close, warehouse workflows, payroll access and reporting cycles leave little room for cloud experiments that behave well only under ideal conditions. The weak point is usually not migration itself. It is the support chain that follows. Servers sit somewhere, a hosting provider manages the platform, the software publisher owns the application, a Sage consultant handles business logic and the internal team is left to coordinate the room. A single interruption then becomes a routing problem. Executives should favor a hosting model that reduces escalation layers without stripping away control over the ERP. Control matters because Sage environments rarely behave like standard SaaS tenants. Updates, integrations, VPN links, reporting tools and adjacent applications may need business-specific treatment. Shared resources can look efficient until they limit troubleshooting or change windows. Dedicated virtual environments, network isolation, clear backup design and documented availability standards give leadership a firmer basis for risk decisions. The point is not more infrastructure for its own sake. It is a service model that keeps customization possible while making ownership clearer. Ransomware risk and phishing exposure have changed the due diligence standard for hosted ERP. Sage access cannot be separated from identity controls, recovery routines, monitoring practices and response authority. A provider that only hosts the application may still leave security teams stitching together evidence after an incident. Before renewal terms are signed, buyers should test how backup frequency, network segmentation, disaster recovery design and incident escalation work in practice. Cloud economics create a second trap. Public cloud flexibility can turn into variable outlay when workloads are poorly matched to the platform. Licensing shifts and Microsoft choices make architecture a finance issue as much as an IT issue. Lowest monthly price can be misleading when internal staff must manage exceptions or pull multiple suppliers into every problem. A stronger decision weighs contract predictability, application performance, recovery posture and the cost of internal coordination. Sage projects also require a provider that can work alongside ERP partners rather than displace them. Against that buying logic, Cloud at Work is a premier choice for Sage cloud hosting. It model is built around Sage end users and fewer support handoffs, then extended that base into Azure and managed technology services where the customer environment demands it. Its portfolio spans Virtual Private Cloud, Infrastructure as a Service, Desktop as a Service, Managed Services and Managed Cybersecurity, giving buyers a path from hosted Sage to broader cloud management without changing accountability every time the environment expands. Dedicated resources, virtual firewalls, backup design and Sage-aware support match the pressures that matter most. For leaders who want Sage to feel closer to a managed service while preserving customization, Cloud at Work warrants serious consideration. ...Read more
Mid-sized companies often reach a point where data volume has outgrown the reporting habits built around it. Sales systems, finance platforms, customer records and workforce tools accumulate information, yet decision-makers still wait for manually assembled reports or rely on partial views. The buying problem is rarely a shortage of software. It is the cost and coordination burden of connecting systems, preparing reliable data and turning it into useful action without building a large specialist team. Platform selection should begin with the data foundation. Dashboards and AI models cannot compensate for inconsistent definitions, missing records or poorly governed pipelines. Executives need to know how a platform profiles and cleans data while preserving traceability from source to output. Integration also matters beyond the initial connection. A workable platform must support existing databases and business applications while reducing the amount of custom code required to keep those links current. Migration demands, refresh frequency and access controls deserve scrutiny before implementation begins. The next pressure is time to proof. Many firms cannot justify a large upfront investment in engineers and data scientists before a use case has shown credible returns. A platform should let a business test a narrow problem and measure model accuracy before committing to broader deployment. Low-code workflow design can shorten that cycle, but ease of configuration must not remove oversight. Buyers should examine how knowledge bases and semantic layers are managed when model outputs affect staff decisions or customer-facing processes. Access to insight presents a separate test. Static reports remain useful for recurring review, yet business leaders increasingly need answers that were not anticipated when a dashboard was built. Natural-language querying can reduce dependence on report backlogs, provided the platform grounds responses in governed company data and shows enough context for users to judge the result. Predictive functions should be assessed in the same manner. Forecasts are valuable only when teams can understand the inputs and monitor performance before connecting a prediction to a defined next step. The final buying concern is service depth. Mid-sized firms may adopt a capable platform and still lack the people to design data models or maintain AI workflows. A provider should be able to supply targeted support without turning every change into a consulting project. Subscription or usage-based pricing can lower the entry barrier, though buyers should compare consumption controls and support terms carefully. The strongest fit will combine self-service tools with practical help around implementation and model tuning, backed by ongoing maintenance when internal capacity is limited. Aidas Technologies  is a premier choice for firms that need this combination without assembling separate platforms and specialist teams. Its AI-powered data and analytics platform brings data preparation, reporting, predictive modeling and workflow automation into one environment through low-code tools. The company also offers professional services for setup and custom development, plus model support and continued maintenance, allowing buyers to test focused use cases before scaling. A usage-based subscription model further suits mid-sized organizations that need tighter control over upfront cost. For executives prioritizing faster proof and guided adoption, Aidas Technologies merits serious consideration. ...Read more
AI projects often reach production with more model capability than data discipline. The problem becomes visible after deployment, when a customer-facing agent returns plausible but weak answers or a decision model relies on context that is incomplete or poorly curated. For executives funding AI-powered strategic data work, model selection matters less than whether the information feeding that model is fit for the task. Better inputs can determine whether an application produces dependable results or merely polished responses. Data quality is rarely a one-time cleanup exercise. Useful input needs to be collected and refreshed in ways that preserve subject matter judgment without turning every update into a manual project. That makes the underlying data process an important buying issue. A capable partner should be able to combine automation with human review, and then design ingestion and curation workflows that can be maintained after the initial build. Ownership also matters. Internal experts often understand the material better than technical teams, so the process should make their knowledge usable without requiring them to become engineers. “Numantic Solutions combines data engineering with product planning, while supporting ingestion pipelines and curated datasets for AI and machine learning applications.” More data does not automatically improve an AI application. Irrelevant context can crowd out the material a model actually needs. The harder question is what information belongs in the dataset and how it should be enriched for the task at hand. External sources may add useful context, while metadata can make unstructured material easier to retrieve. Buyers should look closely at whether a provider can make those decisions deliberately rather than treating data volume as a proxy for quality. Testing creates another dividing line. Generative systems do not always produce answers that can be marked simply right or wrong, which makes evaluation harder than conventional software testing. Production use therefore requires test data that reflects the questions and content the application is expected to handle. Repeatable test suites are especially useful because they let teams measure performance as usage changes and new information enters the pipeline. A provider that can connect curated input data to ongoing evaluation gives buyers a clearer way to judge whether an AI application is improving. The strongest engagements begin before engineering. Product goals should be translated into a practical roadmap that identifies what should be built now and what can wait, while leaving room to change direction after early use. That discipline helps prevent technical work from outrunning the business problem it is meant to address. Numantic Solutions emerges as a premier choice for organizations that need AI-powered strategic data work centered on input quality rather than model novelty. It combines data engineering with product planning, while supporting ingestion pipelines and curated datasets for AI and machine learning applications. Its approach supports human-in-the-loop curation and the use of relevant external data where that improves the dataset. Numantic Solutions connects curated input data with repeatable testing, enabling clients to measure whether production AI is meeting its intended performance goals. That fit is especially practical for teams building differentiated AI applications from proprietary knowledge. ...Read more