TL;DR
The cybersecurity trends that matter today are not buzzwords. They change the budget and where the controls go. Here is the view from inside Brixio, an Authorized Cloudflare Service Delivery Partner (ASDP) running Cloudflare in production for regulated industries.
The 10 trends:
- AI-driven threats: LLM weaponisation and deepfakes are now mainstream.
- Shadow AI has overtaken shadow IT as the main data-leak vector.
- Zero Trust is the default architecture for new builds.
- Data sovereignty and localisation drive vendor and region choices.
- Application and API security are where most attacks now land.
- Secure Access Service Edge (SASE) consolidation cuts vendor sprawl.
- NIS2, DORA, EU AI Act and GCC data laws lift the compliance baseline.
- IT/OT convergence security has become a board-level topic.
- Operational maturity, not new tooling, separates resilient teams.
- Post-quantum cryptography is already live on the Cloudflare edge.
Why these trends matter for operations
A trend list only matters if it tells you what to buy, what to drop, and where to spend the next euro.
Two reports anchor the macro view this year:
- The Verizon Data Breach Investigations Report 2026, covering incidents from November 2024 to October 2025, finds that 31% of breaches start with a software vulnerability, 48% involve ransomware, and 15% of attack techniques are bolstered by generative AI.
- The ENISA Threat Landscape 2024 ranks threats against availability, ransomware, and threats to data as the three most prevalent categories observed across Europe.
We read those numbers through one lens: what Brixio sees on live Cloudflare deployments in banking and finance, government, healthcare, retail and e-commerce and aviation and transport. As a Cloudflare partner holding both the Application Security and Cloudflare One ASD specialisations, the angle is operational, not analyst. Every figure is sourced inline.
AI security, agentic workloads, MCP governance, and Zero Trust aren't future topics anymore. They're live customer challenges.
The 10 cybersecurity trends transforming enterprise security
1. AI-driven threats: LLM weaponisation and deepfakes
Attackers use LLMs to generate phishing tuned to the target's language, sector and role, at a volume legacy email gateways were never built for. Voice deepfakes now power CEO fraud and helpdesk impersonation. Verizon's DBIR 2026 measures the move at 15% of attack techniques already bolstered by generative AI.
While generative AI was about writing, agentic AI is about doing, and that same autonomy introduces risks we have never seen before.
LLM security has become a discipline of its own. The OWASP Top 10 for LLM Applications lists the main attack categories on the model side:
- Prompt injection.
- Insecure output handling.
- Training-data poisoning.
- Sensitive information disclosure.
What to do. Web application firewall (WAF) rules need to flag AI-driven scraping and credential abuse. Bot management has to separate legitimate AI agents from adversarial ones. Security awareness training should cover voice and video deepfakes, not only email phishing. The full posture is covered in the AI Security solution.
2. Shadow AI in the enterprise
Shadow AI is AI used outside approved policy: public LLMs, browser plug-ins, AI features baked into SaaS.
A Gartner figure shared at the May 2026 Brixio × Cloudflare cyber morning puts the scale at 73% of employees using AI tools their IT department has not approved.
People paste source code, contracts and strategy into public LLMs, with no traceability and no governance, every day.
The risk is direct: sensitive content lands in systems that may log it, train on it, or expose it. ENISA tracks the pattern in its evolving threat landscape.
What to do. Three layers, working together:
- Inventory AI usage at the network layer (DNS, secure web gateway).
- Policy on which models may be used, for which data class.
- An AI gateway that applies data loss prevention (DLP) on prompts and outputs.
Franck-Emanuel Goguer, Lead Solutions Architect at Brixio, published a public lab he calls Kyson: an ordinary AI chatbot placed behind Cloudflare AI Gateway, with the same prompt injection attempted before and after. Guardrails, rate limiting and DLP sit at the gateway, not inside the application. The AI Security solution packages this approach.
3. Zero Trust becomes the default
Zero Trust is not new. The change visible on recent rollouts is that it has stopped being a project and become the default architecture for new builds, with identity as the perimeter.
Three patterns now ship on Zero Trust Network Access (ZTNA) rather than on legacy remote-access virtual private networks (VPN):
- VPN replacement programmes.
- Third-party and partner access.
- Contractor onboarding.
Cloudflare documents the pattern in Cloudflare Zero Trust.
What to do. Route every new connectivity request through identity-aware access, not a tunnel. If legacy VPN is still in place, plan a coexistence phase and prioritise the highest-risk populations first: contractors, privileged admins, third parties.
4. Data sovereignty and localisation
Sovereignty is no longer just a French objection. In the EU, it sits inside NIS2, DORA and the EU AI Act. In the Gulf, it lives in the PDPL frameworks (KSA, UAE) and in explicit data localisation rules for critical sectors.
Three decisions that used to be legal are now technical:
- The cloud and content delivery network (CDN) regions you use.
- The contractual model for processors.
- The keys-management strategy (BYOK, hold-your-own-key).
What to do. Align Cloudflare region routing, the Data Localisation Suite and bring-your-own-key (BYOK) with the regulatory scope of each business unit. For French-regulated workloads, validate against SecNumCloud expectations even when the certification itself is not the target. The Data Sovereignty solution covers the end-to-end posture.
5. Application and API security
The attack surface has moved from the network to the application and the API. Microservices and partner integrations multiply API endpoints, often without the controls applied to the public web frontend.
The OWASP API Security Top 10 (2023 edition) ranks the risks clearly:
- API1, broken object level authorisation (BOLA).
- API2, broken authentication.
- API3, broken object property level authorisation.
What to do. Run WAF, API Shield, bot management and rate limiting as one combined control plane. Make API discovery continuous, not a yearly audit.
Brixio was recognised as a Cloudflare Product Specialized Partner for Application Security in 2026, which materialises the discipline in a structured engagement model.
We don't just implement tools; we build resilient digital foundations.
6. SASE and consolidation of the edge security stack
The multi-vendor edge stack is being dismantled. The old model used a different vendor for each control:
- One for the WAF.
- One for the secure web gateway (SWG).
- One for the cloud access security broker (CASB).
- One for ZTNA.
The new model collapses these into one platform per organisation. Secure Access Service Edge (SASE) is the architectural model behind that consolidation, and the driver is operational: fewer integration seams, fewer policy drifts, fewer blind spots.
Consolidation also lifts auditability and reaction time, two attributes that NIS2 expects explicitly. Less architectural entropy means less to defend during an audit, and faster mobilisation during an incident.
What to do. Before procuring a new control, check whether the existing edge platform can already deliver it. Cloudflare One is one such consolidated platform.
7. Regulatory pressure: NIS2, DORA, EU AI Act, GCC data laws
Four moving parts now run in parallel:
- NIS2. Transposition is in force across most EU member states, with mid-sized entities now in scope in essential and important sectors.
- DORA. Effective since January 2025 for financial entities, with full third-party ICT risk management required.
- EU AI Act. Obligations phase in through 2026.
- GCC data laws. PDPL frameworks now apply across KSA, UAE and Bahrain.
The official text sits on the NIS2 directive page of the European Commission.
What to do. Re-audit existing Cloudflare configurations against current scopes. Map controls explicitly to NIS2 and DORA articles where they apply. Third-party assessment by an ASDP delivers the most leverage here. See the dedicated NIS2 Compliance and DORA Compliance solutions.
Wait and see is no longer an option.
8. IT/OT convergence security
IT/OT convergence merges two worlds onto shared networks and observability stacks: IT business systems on one side, operational technology (OT) on the other (programmable logic controllers, supervisory control and data acquisition (SCADA) systems, industrial sensors).
The benefit is efficiency. The risk is structural: OT environments that used to be isolated are now exposed to internet-borne threats, on equipment with a 10 to 20 year lifecycle and no realistic patching window.
Regulated sectors are hit first: energy and utilities, manufacturing, transport, water, healthcare. NIS2 covers most of them as essential entities, and IEC 62443 frames the technical baseline for industrial control systems.
What to do. Three patterns deliver immediate value:
- Extend Zero Trust segmentation to IT/OT gateways.
- Control contractor and integrator access through identity-aware proxies (Cloudflare Access).
- Monitor flows between IT and OT zones, instead of trusting the historical air gap.
Brixio packages this work as IT/OT Convergence Security, focused on regulated industries.
9. Operational maturity and the talent gap
ENISA and the World Economic Forum's Global Cybersecurity Outlook both document the cybersecurity talent gap. In mid-market structures, hiring senior security engineers has become unsustainable in many regions.
The answer is not more tooling. It is operational maturity:
- Runbooks for the recurring events.
- On-call rotations with explicit ownership.
- Follow-the-sun coverage when the business demands it.
- Managed security services where the math works.
What to do. Assess the security operations centre (SOC) on three questions: can it remain in-house, should it be partially augmented, or should it be fully delegated? The answer depends on the size of the engineering team, not on the revenue of the company.
Brixio recently delivered a Zscaler-to-Cloudflare migration covering 22,000 users and more than 200 tunnels, compressed by the client from a three-month plan into 24 days. In that kind of acceleration, the differentiator is rarely the technology. It is the operational discipline behind it.
10. Post-quantum cryptography, the 2030 horizon already covered
Quantum computing gets dismissed as a distant problem. It is closer than that.
NIST finalised the first post-quantum cryptographic standards in August 2024:
- ML-KEM in FIPS 203.
- ML-DSA in FIPS 204.
- SLH-DSA in FIPS 205.
National agencies now converge on migration horizons of 2030 to 2035, depending on the jurisdiction.
The exposure is already live, through the "harvest now, decrypt later" pattern: an adversary captures encrypted traffic today, then decrypts it once a cryptographically relevant quantum computer becomes available. Long-confidentiality data is therefore already exposed: health records, defence files, intellectual property.
For Cloudflare customers, the situation is concrete. Since 2024, Cloudflare has deployed hybrid post-quantum TLS (X25519+Kyber, now standardised as ML-KEM) by default on its edge for supported connections. Customers behind Cloudflare benefit from this protection on eligible paths, with no configuration change.
The remaining work sits elsewhere in the chain:
- Virtual private networks.
- Code signing.
- Certificates.
- Internet-of-things (IoT) and operational technology (OT) protocols.
References: NIST Post-Quantum Cryptography project, NIST FIPS 203 (ML-KEM), and Cloudflare's deployment notes in Post-Quantum for all and PQ 2024.
What to do. Inventory the data assets whose confidentiality must hold beyond 2030. Identify the network paths not yet post-quantum protected. Schedule the cryptographic migration on those paths first.
Quantum-safe in 2030 starts with what you ship today.
What operations teams should do now
Five concrete actions, in order:
- Inventory AI usage across the organisation, including browser plug-ins and embedded SaaS AI features.
- Re-audit the current Cloudflare configuration against the target posture, through a structured Cloudflare Assessment.
- Activate baseline Zero Trust controls: Cloudflare Access for internal apps, WARP for endpoints, universal MFA.
- Map NIS2 and DORA scope to existing controls, with gap closure planned by sector.
- Decide between in-house run and managed service for the SOC. Base the decision on team size and on-call burden, not on company revenue.
Frequently asked questions
Ten trends change operational decisions today:
- AI-driven threats.
- Shadow AI.
- Zero Trust as the default architecture.
- Data sovereignty.
- Application and API security.
- SASE consolidation.
- Regulatory pressure (NIS2, DORA, EU AI Act, GCC).
- IT/OT convergence security.
- Operational maturity.
- Post-quantum cryptography.
Each one maps to a specific control change in the security stack.
AI lowers the cost of attacks. It raises their quality. Concretely:
- Phishing is generated in any language.
- Voice deepfakes are used for fraud and helpdesk impersonation.
- Large language models are themselves attacked through prompt injection and sensitive information disclosure.
Defenders use AI symmetrically for detection and response. For now, the asymmetry still favours attackers on volume and personalisation.
Shadow AI is the use of AI tools outside approved policy. It happens through public LLMs, AI-enabled browser plug-ins, and AI features embedded in SaaS products.
It matters because sensitive content gets pasted into systems that may log or expose it. The control is a combination of three things: an AI inventory, a policy on the data classes allowed per model, and an AI gateway with DLP on prompts.
Yes, and more than before. Zero Trust has stopped being a project and started being the default for new builds. VPN replacement, third-party access and contractor onboarding now ship on Zero Trust Network Access (ZTNA) rather than on legacy remote access.
NIS2 expands the scope of essential and important entities. It mandates risk management, incident reporting, and supply-chain controls.
DORA has been in effect for financial entities since January 2025. It requires third-party ICT risk management and operational resilience testing.
Existing Cloudflare configurations should be re-mapped to NIS2 and DORA articles where applicable, with explicit gap closure planned.
Because the operational benefits of merging IT and OT come with a security cost. Industrial environments that used to be isolated are now exposed to the same threat actors as enterprise IT. Worse, the equipment cannot always be patched on the same cadence.
Three controls work at the entry point: Zero Trust segmentation, identity-aware access for contractors, and IT/OT flow monitoring.
The 2030 horizon applies to full migration deadlines set by national agencies. The exposure, on the other hand, starts today, through the "harvest now, decrypt later" pattern.
If your traffic transits Cloudflare on a supported path, hybrid post-quantum TLS is already in place. The remaining work is to inventory long-confidentiality data and to plan the migration on the other links of the chain (VPN, signatures, IoT, OT).
When to call Brixio
Brixio is an Authorized Cloudflare Service Delivery Partner (ASDP). The full lifecycle of Cloudflare operations is covered: assessment, deployment, managed operations, reactive support, and emergency incident response.
The following situations are common entry points:
- The current Cloudflare configuration has not been reviewed for more than 12 months and underused licences are suspected. [Book a Free Cloudflare Assessment](/cloudflare/assessments/).
- A NIS2 or DORA programme is under way and the security stack alignment must be validated. Professional Services.
- An IT/OT convergence programme is on the roadmap and the security perimeter has to follow. IT/OT Convergence Security engagement.
- Cloudflare licences are owned but technical capacity is missing internally. [See Brixio Managed Services](/cloudflare/managed-services/).
- An incident is in progress and rapid Cloudflare deployment is needed. Emergency Incident Response, engagement in under 60 minutes.
- An Akamai or other CDN migration to Cloudflare has to land without service interruption. Professional Services with zero-downtime migration plan.
For background reading:
- The Cloudflare setup guide for beginners covers the initial configuration.
- The Cloudflare bot management production guide covers application protection at scale.
- The case studies hub gathers anonymised deployments across regulated sectors.
Brixio runs Cloudflare for clients across Europe, the Gulf and Asia Pacific, with hubs in Luxembourg, Paris, Dubai and Singapore. The same operations team handles 24/7 follow-the-sun coverage.
Deployment is not the challenge. Operations are.
