We’re already into the second half of 2026, and it’s worth pausing for a second. Not to recap headlines, but to understand what actually changed in terms of security.
Spoiler alert…. A lot.
Because 2025 wasn’t just another year of breaches. The scale was larger, and the impact was more visible.
The attack on Jaguar Land Rover brought that into focus. Production stopped for months. The losses were estimated at £1.9 billion. The disruption moved straight into operations and revenue.
In the education sector, Kido International faced a ransomware incident that exposed personal data linked to thousands of children and staff. The impact here sat around safeguarding and trust.
Retail saw a similar strain. The ShinyHunters group claimed breaches across multiple brands, including Marks & Spencer. Some platforms lost the ability to trade online during the disruption.
Alongside these cases, a large pool of over 16 billion credentials circulated across criminal forums. Those datasets fed ongoing account takeover attempts throughout the year.
None of this felt isolated. The same weaknesses appeared again and again.
Constant Pressure on Infrastructure
Attacks moved closer to systems that support daily life.
The incident in Poland’s energy sector showed how attackers can move across IT and operational environments. That overlap creates a different kind of exposure.
In the UK, water utilities faced continued pressure from ransomware incidents. These systems often rely on older industrial controls with limited visibility.
At the consumer level, compromised IoT devices formed large botnets. Devices that sit in homes became part of wider attack infrastructure without the user being aware.
The surface area kept expanding.
The Supply Chain Problem is Getting Bigger
Across these incidents, the supply chain kept appearing in the background.
Attackers focused on software providers, cloud platforms, and third-party tools. Access at that level opens the door to many organisations at once.
This approach scales efficiently. One weakness can affect a large number of systems downstream.
For most organisations, this sits outside direct control. That makes it harder to track and harder to manage.
What’s Changing in 2026? A lot
The direction for the coming year is already visible.
Attack workflows are becoming faster. Automation plays a larger role. AI is being used to scan systems, prepare phishing content, and identify weak points.
The targets remain consistent. Local government systems, supply chains, and infrastructure continue to attract attention.
These environments often operate with limited resources and older technology. That combination creates exposure that is difficult to close quickly.
The Open Source Reality
Most systems depend on open source components.
That dependency runs deep. Many components sit several layers down, out of sight during routine checks.
Over time, vulnerabilities build up in those layers. Without active monitoring, they remain unnoticed.
Periodic reviews miss changes that happen between audits. New vulnerabilities appear regularly, and attackers move quickly once they are public.
Continuous monitoring becomes part of day-to-day security, rather than an occasional task.
Read our full list of open source security predictions for 2026 – Is your security team considering all of these threats?
What Needs to Change
The events of 2025 point to a clear shift in approach.
Security needs to keep pace with how quickly vulnerabilities appear and spread. That requires visibility into dependencies and a way to respond without delay.
The focus moves toward shorter response times and better awareness of what sits inside each system.
Small gaps tend to expand quickly when left unattended.
Closing Thought
The past year showed how cyber incidents now reach into operations, services, and public systems.
The same patterns are already carrying into 2026.
The difference will come from how quickly organisations detect and respond to what is already present in their environment.
What can you do? Start with visibility. Continuous monitoring of your open source components is non-negotiable.
