How Has Cyber Risk Changed Over the Past 12–18 Months?

Over the past 12 to 18 months, cyber risk has become more dynamic, more complex, and increasingly interconnected with broader business operations . From the adoption of AI to the growing speed of cyber incidents and legal action, organizations are facing new challenges that require both strategic planning and strong fundamentals.

To better understand what's changing and how organizations should respond, we asked four cyber professionals the same question:

What has changed the most about cyber risk over the past 12–18 months, and what should businesses be doing differently because of it?

Their answers highlight why organizations should continue strengthening the fundamentals while adapting to new risks and realities.

AI is Accelerating Threats and Creating New Risks

Michael Spinks, CFC, Head of SME Cyber, US

According to Michael Spinks, the biggest change has been the speed and scale at which threat actors can operate.

"The aforementioned change is the speed and scale at which threat actors can now operate. A lot of the legwork previously involved reconnaissance, vulnerability research, phishing content, translation, and impersonation.

Threat actors now don't necessarily have to be smarter or better than before; they simply need less time and effort to achieve the same results.

This has effectively shortened the window businesses have to detect and respond to threats.

Moreover, businesses are creating more new risks through their own adoption of AI. The use of prompt injection techniques or over-permissioned AI agents is leading to new attack surfaces that many organizations haven't had time to fully assess.

AI brings not solely attacker-related issues, but also governance issues, with more visibility needed for what AI tools are being used, what data is being shared with them, and who has responsibility for accessing systems and overseeing them.

It is likely businesses that fare best are those that regularly strengthen identity verification, acceleration patching, permissions, and governance around the use of AI across the business."

As organizations embrace AI, they should consider not only how cybercriminals may use technology, but also how their own AI adoption could introduce new risks that require oversight and governance.

Focus on Facts, Not Fear

William Altman, CyberCube, Director of Cyber Threat Intelligence Services

While AI has become a dominant topic in cybersecurity discussions, William Altman encourages businesses to separate real risk from industry hype.

"The biggest shift has been in the narrative around threat actors, with terms like 'agentic ransomware' and frontier-level AI hacking capabilities entering the discourse.

There's real signal underneath the noise, but there's also considerable marketing-driven fear.

Most real-world attacks still rely on established techniques. AI just makes them faster and more scalable.

Businesses should stay sharp in separating substantiated threat intelligence from hype-driven messaging, so that resources go toward the fundamentals that are addressing most of the risk rather than speculative scenarios."

New threats deserve attention, but organizations should remain focused on the controls and security practices that continue to prevent the majority of cyber incidents.

Cybersecurity Is a Continuous Process

Matt Massino, Coalition, Inc., Business Development Team Lead - North East

For Matt Massino, AI has made cyber risk more dynamic and reduced the amount of time organizations have to respond to emerging threats.

"AI has made cyber risk more dynamic and shortened the window between vulnerability and exploitation. It is also helping threat actors scale existing tactics and make social engineering more convincing.

Businesses should shift from annual compliance checklists to continuous risk monitoring and regular testing.

Businesses need to treat cyberattacks as inevitable, not hypothetical.

Cybersecurity and cyber insurance need to work together as part of a broader resilience strategy, not as separate conversations."

As threats evolve more quickly, businesses may benefit from moving beyond periodic reviews and adopting a more continuous approach to monitoring, testing, and risk management.

Litigation Is Moving Faster

Carolyn Purwin Ryan, Mullen Coughlin LLC, Partner

While much of the cybersecurity conversation centers around attackers, Carolyn Purwin Ryan points to another significant shift: the speed and unpredictability of litigation following cyber incidents.

"The biggest change is the speed and unpredictability of the risk, both from threat actors and from litigation.

There are more threat actors, more ways to attack, and no reliable playbook for predicting who will be targeted next.

At the same time, plaintiffs' attorneys are racing to the courthouse, sometimes before the investigation is even complete.

That means businesses can't treat litigation as an afterthought. From day one, incident response needs to anticipate the lawsuit: preserve privilege, control communications, understand what data you actually have, and make decisions knowing they may later become exhibits.

The breach may be unpredictable. The litigation shouldn't be."

Her perspective serves as a reminder that incident response plans should account for both operational recovery and potential legal exposure from the very beginning.

How Businesses Can Move Forward with Confidence

Throughout this Cybersecurity Awareness Month series, our experts highlighted a common reality: cyber risk is no longer confined to technology alone. It affects how businesses manage people, processes, data, communications, governance, and decision-making.

As you reflect on the insights shared throughout this series, consider whether your current cybersecurity strategy is keeping pace with the risks your business faces today. Working with a trusted advisor can help you assess potential exposures, identify opportunities for improvement, and develop a cyber risk strategy that supports your broader business goals, helping you move forward with confidence.