Cybersecurity vendor Netwrix released key IT security trends that will affect organizations of all sizes in 2023. This analysis from Dirk Schrader, vice president of security research, and Michael Paye, vice president of research and development, is based on Netwrix’s global experience across a wide range of verticals, including technology, finance, manufacturing, government and healthcare. 

Here are five specific trends for 2023 that you need to be aware of: 

1. The business of cybercrime will be further professionalized. The return of malware strains like Emotet, Conti and Trickbot indicates an expansion of cybercrime for hire. In particular, the growth of ransomware-as-a-service is enabling criminals without deep technical skills to make money, either by extorting a ransom for decryption keys or selling stolen data on the dark web or to a victim’s competitors. Accordingly, organizations should expect an increase in phishing campaigns. Vital defense strategies include timely patching and updating of software, as well as locking down network access with multifactor authentication (MFA) and privileged access management (PAM) solutions.
   
   
2. Supply chain attacks will intensify. Modern organizations rely on complex supply chains, including small and medium businesses (SMBs) and managed service providers (MSPs). Adversaries will increasingly target these suppliers rather than the larger enterprises knowing that they provide a path into multiple partners and customers. To address this threat, organizations of all sizes while conducting a risk assessment need to take into account the vulnerabilities of all third-party software or firmware.  
   
   
3. Understaffing will increase the role of channel partners. Demand for cybersecurity professionals is far outpacing supply. This shortage of cybersecurity talent will increase risks for businesses as attacks become even more sophisticated. To overcome this challenge, organizations will rely more on their trusted security partners, such as channel partners, system integrators, MSPs and MSSPs. 
   
   
4. The human factor will become a top security concern. Users have long been a weak link in IT security, prone to opening infected email attachments, clicking malicious links and other risky behavior. Now, rapid advancements in social engineering and easy-to-use deep fake technology are enabling attackers to trick more users into falling for their schemes. Accordingly, comprehensive auditing of user activity will become even more crucial for spotting abnormal behavior in time to prevent serious incidents. In addition, implementing a zero standing privilege (ZSP) approach will help organizations prevent abuse of their most powerful accounts, either unintentionally by their owners or by adversaries who compromise them.
   
   
5. Vendor consolidation will continue gaining momentum. To combat cybercrime, organizations keep investing into IT security. But more tools doesn’t always mean better security — point solutions from different vendors operate separately, offer overlapping or conflicting functionality, and require organizations to deal with multiple support teams. To minimize the security gaps caused by this complexity, organizations are now looking to build a security architecture with a select, smaller group of trusted vendors, which offers the additional benefit of reduced costs from loyalty pricing. In turn, it leads to a faster return on investment (ROI), which is increasingly important in the current economic climate.

“It’s not getting any easier for IT professionals to secure their environments. Indeed, cybercriminals keep inventing new attack tactics and techniques,” Paye said. “To respond effectively, it is vital to identify what really matters and concentrate on protecting the most critical assets. Organizations should regularly reassess their risks to address the most likely and potentially damaging threats, and focus on increasing their cyber resilience to be able to operate even under an ongoing attack.”