Artificial intelligence and cybersecurity: our experts' predictions for 2026

📑

Beyond images, videos, and audio, large language models (LLMs) are also subject to attacks involving poisoning of training data to skew or falsify responses.

However, “trust in AI tools can only be the result of technological safeguards, transparency measures, clear rules, independent controls, and open debates involving society as a whole. If even one of these pillars is missing, yesterday’s discreet vulnerabilities will undoubtedly become tomorrow’s systemic risks,” as Pierre Delcher, Head of Threat Research at HarfangLab, points out.

What about the challenges of AI in 2026, and more specifically in cybersecurity, givent that it is already omnipresent, both on the attack and defense sides? What could be the future uses and development prospects for security solution providers? We asked our AI team.

Information and data poisoning

Unsurprisingly, the manipulation of information using GenAI will remain prevalent in 2026, as will that of LLMs. Studies by Palo Alto Networks and Pillar Security have already reported attacks targeting code generated by LLMs in 2025, making AI agents malicious accomplices in attacks that rely on injecting malicious code and exploiting the resulting vulnerabilities. These practices are set to continue and increase in the coming year.

Increasingly credible scams

AI facilitates the industrialization and personalization of attacks, particularly through phishing (via email), smishing (via SMS), and vishing (messages or voice calls) – the variations are numerous.

Technologies continue to improve, creating deep fakes that look increasingly real and spreading them in ever-greater numbers. In short, online scams will also continue and become more sophisticated in 2026.

The development of malware for all, and attacks by agentic AI

Artificial intelligence allows attackers, as unscrupulous as they are experienced, to develop tools to execute their plans. Take the Funksec ransomware group, for example. This trend is likely to persist.

Beyond cybercrime, expect sophisticated attacks to also develop. In 2025, the first cyber espionage campaign reported to be 100% orchestrated by AI will likely have set the tone.

The explosion of “Non-Human Identity Attacks”

Non-human identities such as API keys, tokens, and AI agents will far outnumber human identities in 2026. Autonomous AI agents will be able to generate their own identities and assign themselves privileges. As a result, security teams will have to hunt down accesses they did not create, making investigations to attribute the origin of attacks even more tedious.

“Based on our observations regarding the use of artificial intelligence tools, 2026 should not see a major shift: AI will still be ubiquitous in cybersecurity, both on the threat side and on the defense side.

Nevertheless, the implementation of the AI Act next summer will add an important compliance component for all organizations developing or using AI. The aim will then be to ensure that existing AI models comply with the ethics imposed by the AI Act. It is also our role as a software provider to guarantee the transparency of models, the accuracy of use cases, and user awareness.”

Hugo Michard, AI Lead at HarfangLab

We’ve seen the attack trends, now let’s take a look at what’s on the horizon for AI defense.

Automation and advanced AI assistance

As we’ve seen, artificial intelligence offers the possibility of speeding up processes, especially by automating a multitude of actions. This is true for attackers, but also for defense!

Artificial intelligence is set to become a real assistant for analysts, both in detecting threats – as has already been the case for several years with detection engines that integrate AI to identify unknown threats – and in responding to them.

As threats diversify and intensify, understanding and limiting the number of alerts to be processed is becoming a priority. Software providers will therefore need to continue improving their AI copilots to include:

Playbook generation
Search within the console
Translation of rules into natural language
Assistance with triage, prioritization, and automation of incident response tasks
Translation and summary of attack campaigns and vulnerabilities in natural language
Correlation of sources to ease and speed up investigation
And so much more…