5 CISOs Share Their Top Security Predictions for 2024

2023 demonstrated some significant changes to the cybersecurity threat landscape, particularly in the realm of AI. For instance, following the release of ChatGPT in November 2022, SlashNext’s 2023 State of Phishing report found that phishing emails increased by 1,265%.

Just as artificial intelligence has helped many employees streamline their workflows, threat actors are using it to enhance their ability to launch offensive attacks. This can be as simple as using a chatbot to write more convincing phishing emails or developing AI-generated malware.

As 2024 kicks off, Techopedia reached out to some of the top Chief Information Security Officers (CISOs) in tech to find out what they saw as the top security trends to watch in 2024. The comments below have been edited and shortened for brevity.

5 CISOs Top Security Trends for 2024

5. Understanding cybersecurity responsibility

“There are three top priorities for CISOs and security professionals in 2024. For one, they need to ensure that everyone within the organization understands their responsibility in cybersecurity, not just the security team, which can be accomplished by implementing robust training programs.

Additionally, they need to continuously educate employees about phishing scams and the importance of not clicking on suspicious links by incorporating tools to minimize spam and phishing attempts.

Finally, security experts need to employ queryable encryption to protect sensitive data even if it is compromised by ransomware.”

Lena Smart, CISO of MongoDB

4. The rise of polymorphic malware

“There isn’t any bigger impact to our society than the advent of AI, and that is no different in cybersecurity. In 2024 and beyond, we anticipate a rise in polymorphic malware, a sophisticated form of malware developed using AI.

This type of malware is particularly concerning because it has the ability to learn and adapt to the security systems it encounters. After analyzing and understanding these security defenses, the malware can then discreetly infiltrate and spread within these systems, often evading detection by standing security measures.

The second biggest cybersecurity challenge IT leaders will continue to face is the increase in data breaches caused by employees’ negligent behavior. This often involves the improper handling or sharing of sensitive and confidential business information.

Without realizing it, employees might inadvertently expose these confidential data through various means, such as mishandling emails, utilizing unsecured networks, or falling prey to phishing scams.

This kind of data breach can be especially damaging as it involves internal access and may lead to the unauthorized disclosure of critical business secrets of personal data of customers and employees.”

Tyler Young, CISO of BigID

3. Attacks on the supply chain, data supply chain, and rise of security automation

Attacks on the open-source software supply chain will accelerate

“Expect attacks focused on ungoverned open-source ecosystems to accelerate in 2024. We’ve already seen how attackers have learned to seed open-source repositories with malicious Python packages that have names that closely resemble popular legitimate packages.

Given the reliance of software developers on these packages, this kind of attack is likely to persist – and result in serious vulnerabilities – for the foreseeable future.

And since over 90% of the world’s software is built on top of open-source code and open-source languages, this will have broad implications. As a partial solution, I expect to see more companies and teams using AI to assess the risk of open-source packages.”

Data governance and the data supply chain will become critical issues

“CISOS will need to take a stand on data governance in 2024: Either in favor of strict discipline and control of private/protected data or in favor of its open use with an acceptance of the associated risk that comes with it. Data, like software, has supply chains.

For example, in a supply chain, if someone deletes data or a customer requests its removal and that data has already been used to inform a large language model (LLM), it may be difficult or impossible to unwind it.

For companies building machine learning models, data supply chains require operational discipline, which falls under the domain of the CISO to manage.”

AI will replace “shift left” security with security automation

“Shifting security left aimed to fix security flaws earlier in the software development lifecycle by bringing it closer to the developer. However, the consequence of this increase in responsibility has burdened developers beyond reason.

In 2024, shift left security will be placed by automating security out of the developer’s workflow, something I call shifting down, as it pushes security not automated and lower-level functions. AI will help automate the identification and remediation of security issues by reducing developers’ security burden with less and more actionable feedback.”

Josh Lemos, CISO of GitLab

2. Data breach disclosure requirements will tighten

“In 2024, the stakes for CISOs will skyrocket, particularly in light of developing incident disclosure rulings. In 2023, the SEC introduced a major incident disclosure ruling for public cybersecurity companies that shook up cybersecurity leadership across multiple industries.

In late July, it was announced that public companies were required to disclose any material breach within four business days of discovering that the incident had material impact.

Given the relatively vague language of the ruling – even after the recent week’s clarification from the SEC – CISOs are on edge about how these regulations will impact their work and turn their jobs into potential areas in which they can be prosecuted.

It’s common knowledge that the full impact of a breach can take months, if not years, to become known after rigorous investigation. Because of this, in 2024, we will see an increase in CISOs seeking D&O insurance, and many more will seek their own personal lawyers in order to protect themselves.

The security community has also always been characterized as an open ecosystem of information sharing, CVE disclosure, and best practices. It’s what has made us a rich and close community over the years.

However, I anticipate there to be more of a culture of secrecy among CISOs and the security community since the developing SEC rulings may discourage information sharing. CISOs will be more likely to keep potentially incriminating details close to the chest, holding off until it seems safe to share.”

Devin Ertel, Chief Information Security Officer at Menlo Security

1. The regulatory landscape will become more complex

“In 2024, the landscape of cybersecurity compliance is expected to evolve significantly, driven by emerging technologies, evolving threat landscapes, and changing regulatory frameworks.

Privacy regulations like the GDPR and CCPA have set the stage for stricter data protection requirements. We can expect more regions and countries to adopt similar regulations, expanding the scope of compliance requirements for organizations that handle personal data.

Artificial intelligence and machine learning will play a more prominent role in cybersecurity compliance. These technologies will be used to automate threat detection, analyze vast datasets for compliance violations, and provide real-time insights, making it easier for organizations to stay compliant.”

Joseph Carson, chief security scientist, and advisory CISO at Delinea

The Bottom Line

Enterprises, employees, and security leaders will need to remain vigilant in 2024 if they are to confront growing complexity in the regulatory and cyber threat landscapes if our top security trends are correct.

While there are no simple answers to protecting against next-generation threats, building a security-conscious company culture and implementing basic best practices from zero trust access controls to multi-factor authentication can help to reduce exposure in the future.