Accenture shares 9 cybersecurity predictions for 2023

With a recession potentially looming in 2023, enterprises are feeling the squeeze to bolster their cyber resilience to avoid unpleasant surprises, with cybersecurity experts anticipating an uptick in cybercrime.

Recently, VentureBeat caught up with some of Accenture’s top cybersecurity experts, who outlined their security predictions for 2023.

Accenture’s predictions include growth in: destructive and non-financially motivated cyberattacks; the cybersecurity talent pool; automated response technology; and “steal now, decrypt later” quantum threats.

Below is an edited transcript of their responses.

1. Geopolitics, economic uncertainty and destructive cyberattacks will challenge leads to step up 

“Economic uncertainty and heightened global tensions will fuel a resurgence of cyberattacks from groups that are becoming increasingly structured, organized and destructive,” said Paolo Dal Cin, global lead at Accenture Security. “While the ransomware trend will continue, we believe it will be less focused on profit and more on wreaking havoc and destroying data.”

Also unfortunately, the barrier to entry for would-be threat actors is now even lower, because the malware is being written through natural language processing (NLP) supported by artificial intelligence (AI), he said. 

The seeds of some of these trends were planted with Russia’s invasion of Ukraine, when Accenture’s cyber threat Intelligence team uncovered a significant increase in hacktivist activity targeting Western entities. 

“The good news: We believe this geopolitical unrest and the nature of destructive cyberattacks should, and likely will, accelerate allied countries’ efforts to share more threat intelligence information,” said Dal Cin.

Furthermore, the ability and willingness to share information on zero-day vulnerabilities and third-party cyber incidents will become foundational to security as attackers focus on national infrastructure, he said.

2. Evolving threat tactics require renewed focus on digital identity 

“With more organizations armed with strong endpoint protection software, cyberattack techniques will likely evolve to evade sophisticated detection technologies,” said Robert Boyce, global cyber resilience lead at Accenture. “As detection technology becomes a standard, threat actors are thinking outside the box.” 

In 2023, he expects to see more tactics that involve legitimate access to a corporate network that no longer involve deploying malware. The focus will be on living-off-the-land techniques to exploit what is already available in the victim environment. 

“Threat actors will either buy access or use social engineering techniques to gain access to a network and avoid detection [by] leveraging a standard user profile for the company to pass off as an employee,” said Boyce.

Significant damage can be done without sophisticated malware, he said. So organizations need to be thinking ahead about their identity fundamentals, and how they can implement more detection and protection controls. 

“It will be more critical than ever to have a baseline understanding of typical user behaviors associated with users or groups of users to identify the anomalies,” said Boyce.

3. Broader talent pools will strengthen cybersecurity

“Given our work, we know well the challenges of hiring skilled professionals to meet market demand, and have learned to adapt what we do to attract and retain the best cybersecurity talent,” said Ryan LaSalle, North America security lead at Accenture. “To widen the talent pipeline in 2023, employers will expand beyond degrees to evaluate candidates based on their skills, experience and potential.” 

He expects that employers will modify job descriptions to reflect what is truly required to enter the cyber workforce. He predicts leading organizations will invest more in programs connecting to higher education and other industry partners that can work together to identify untapped sources of talent and develop cyber professionals where they may not already exist. 

Apprenticeship programs, upskilling programs and public-private partnerships will also play a major role in unlocking cyber talent in the new year, he said. “This will improve diversity in cybersecurity, which in turn will drive increased innovation and better protect our communities.” 

4. Protecting people: Cybersecurity for critical infrastructure will take a central role 

“In 2023, critical infrastructure will remain a prime target for cyber adversaries and individual bad actors,” said Jim Guinn, global cyber industry (including OT/IoT) lead at Accenture. “Plain and simple, this means more lives will be at stake.” 

Critical infrastructure organizations will need to sharpen their focus on regulatory compliance, he said, including creating an enduring program to understand and comply with a growing list of regulations across a growing number of jurisdictions.

“This will require organizations to lean in and work collaboratively with governments and regulators, including advising working groups and policymakers on industry-specific needs to ensure that regulations are as effective as possible without over-burdening organizations,” said Guinn.

5. Increasingly automated responses will become core tech for the cyber-resilient business 

“As the cyber threat landscape evolves, we will see the number of cyber events and organizations held to ransom continue to rise,” said James Nunn-Price, growth markets security lead at Accenture. “With this increase, organizations will continue to make significant investments in their situational awareness, threat-based security monitoring, incident response and crisis management practices.”

However, many organizations, including those with mature practices, are still overly reliant on people, and that can slow detection and responses, he said. For example, Accenture found that even when security monitoring teams took action to mitigate attacks, it was still too late to stop data exfiltration. 

Attackers are using the latest tools and automated technologies to strike fast and hard — to exfiltrate key data and damage infrastructure within minutes. 

“In 2023, more organizations will prioritize fully automated response technology, as the impacts from a successful breach now far outweigh the risks of these newer technologies, which in turn, frees their people up to focus on how the business can become more cyber resilient, said Nunn-Price.

6. Bring on the boards: Those at the very top will dive more deeply into cyber oversight and reporting 

“As we head into 2023, we expect the expanding cyber risk environment and increasingly complex regulatory environment to energize boards,” said Valerie Abend, global cyber strategy lead at Accenture. “They’ll become much more persistent and intentional, moving from quarterly or annual updates to routinely contemplating cyber risk across all areas of the business and management’s efforts.” 

In turn, she said, this will prompt other members across the C-suite to “up-level their knowledge and active involvement in managing this risk environment.”

7. Locking down cloud security: Look for more innovation and cooperation 

“Cloud service providers are providing more security service features that meet compliance standards, and at the same time, third-party cloud security providers are going the extra mile by focusing on product innovation and integration with cloud platforms,” said Dan Mellen, global cloud and infrastructure security lead at Accenture.

A practical example, he said, is the cloud service provider driving easy, natural consumption of cloud security services and expanding many native security services into a commodity state causing acceleration of third-party security product feature backlog through development roadmaps to remain competitive. 

“These complimentary trends will result in improved security and control coverage — with the added bonus of increased flexibility,” said Mellen.

8. Quantum realities: New computing capabilities will require new levels of security 

“Progress in quantum computing is bringing adversaries ever closer to a ‘cryptographically relevant quantum computer’ able to crack all — yes, all — of the public key encryption that protects most everything in government, industry and the internet,” said Tom Patterson, global quantum and space cybersecurity lead at Accenture.

The growing danger in 2023 will be more “steal now, decrypt later” thefts of fully encrypted sensitive information, he said. The idea is that even if the stolen information can’t be deciphered now, advances in quantum computing will soon crack the keys. 

“Fortunately, 2023 will also see the early development and adoption of new post-quantum encryption algorithms, thus enhancing resilience, integrity and privacy even in the quantum computing age ahead,” said Patterson.

9. Cybersecurity training will be applied to specific roles and business environments 

“Fundamentally, the industry is struggling to connect the realities of adult learning best practices for cybersecurity with how organizations need to run their businesses efficiently and effectively,” said Shelby Flora, cyber resilience talent and organization lead and UK cyber protection at Accenture.

The industry needs to shift toward identifying the pockets of the organization that need a bit more attention — including focused education and re-skilling — and then reduce friction and give time back to the business in the pockets that are showing a lower human risk, said Flora.

“In 2023, more organizations will start to shift cybersecurity training content and approaches to a more customized training experience geared toward the trainee’s role and their business responsibilities,” said Flora. “This means moving beyond ‘how to spot a phishing email‘ training to more sophisticated education to better build employee awareness.”