Cybersecurity threats are expected to grow more automated and complex in 2026, with experts warning that attackers are changing tactics as organisations strengthen traditional defences such as passwords and basic authentication.
One key shift is the growing use of stolen authentication cookies and tokens to bypass multi-factor authentication (MFA). Ian Pratt, Global Head of Personal Systems Security at HP, said threat actors are increasingly targeting these session credentials instead of passwords, allowing them to gain persistent access once a system is compromised.
He warned that such attacks are particularly serious for privileged users, including system administrators who access high-value platforms through web browsers, as compromised credentials can lead to major enterprise breaches.
Artificial intelligence is also expected to play a larger role in cybercrime. Alex Holland, Principal Threat Researcher in the HP Security Lab, said organised crime groups are likely to automate more stages of their attacks using AI tools.
“In 2026, we expect to see organized crime groups automate workflows and outsource more tasks using AI agents in their attacks, especially preparatory tasks like researching victims to target,” he said.
Holland added that AI assistance will help attackers scale operations, making campaigns more efficient by reducing the resources and skills needed to breach targets.
Beyond software-based threats, researchers warned that hybrid work is increasing the risk of physical attacks on devices. Boris Balacheff, Chief Technologist for Security Research and Head of the HP Security Lab, said employees working in public places and using shared infrastructure create more opportunities for tampering.
He said tools used for device exploitation are becoming cheaper and easier to obtain, enabling attackers to steal data, gain broader access to networks or even disable devices.
Connected devices and printers are also emerging as security weak points. Steve Inch, Global Senior Print Security Strategist at HP Inc., said organisations are expected to place greater focus on securing devices at the network edge after a series of attacks exploiting poorly secured printers and other endpoints.
“For too long, printers have been the lowest priority on every security team’s list,” he said, noting that weak configurations, outdated firmware and limited visibility often create security blind spots.
Looking further ahead, organisations are also being urged to prepare for the impact of quantum computing on encryption. Thalia Laing, Principal Cryptographer at HP Security Lab, said planning for quantum-resistant cryptography is expected to accelerate, particularly among public sector bodies and critical infrastructure operators, as traditional encryption standards face future risks.
Security strategies are also expected to evolve toward more unified identity and data-centric models. Peter Blanchard, Document Workflow Security Strategy Principal at HP Inc., said organisations are likely to move away from fragmented identity systems and place greater emphasis on tracking how data is used, shared and accessed throughout its lifecycle.
Overall, the outlook suggests that while organisations are improving their defences, cybercriminals are adapting quickly, using AI, new techniques and emerging tools to exploit weaknesses in devices, identity systems and enterprise infrastructure.
