9 critical cybersecurity trends for 2024

As we enter the new year, we step into an environment teeming with emerging threats, evolving tech, and broader attack surfaces. This brings new opportunities and challenges (along with some inflated trends) for security pros to be aware of. 

Amidst the sea of trends and priorities, which ones truly matter for your team in 2024?

With the rapid development of AI introducing new vulnerabilities and the alarming rise in ransomware attacks, cybersecurity professionals need to evaluate plenty of risks and trends.

But it’s not all about threats. There’s a notable shift in how leaders and teams view “the world of work” in cybersecurity. Among the thousands of security teams who train with HTB, we’ve observed a growing trend of leaders placing greater emphasis on the well-being and retention of their staff. 

In fact, in our Cyber Attack Readiness Report, which surveyed 803 active cybersecurity professionals, we found that over 60% see upskilling as a solution to burnout. 

So it’s clear that cybersecurity leaders are considering upskilling programs and retention strategies to bolster team performance and security posture. 

All of this and more are covered in our top cybersecurity trends for 2024.

Cybersecurity trends for 2024

1. Generative AI for analysts

The release of generative AI dominated the industry in 2023, so it’s no surprise that we can expect a significant impact on cybersecurity in 2024. While many organizations are considering AI from an offensive security perspective, there’s plenty to explore for analysts. 

We spoke to Sabastian Hague (sebh24), our Defensive Content Lead at Hack The Box, on the role of generative AI for analysts in 2024:

Why is generative AI important for analysts, and what’s its role?

“Let's make one thing clear–understanding the intricacies of AI is really complex, requiring specialized knowledge akin to a PhD level. Recent technologies have, however, completely transformed this space. 

The advent of user-friendly platforms has made these powerful tools accessible to a much broader audience, for example, analysts.”

Analysts no longer need to be experts to leverage the capabilities of AI, meaning it can assist in the response and analysis of security incidents.

 

Sabastian Hague (sebh24), Defensive Content Lead at Hack The Box.

How does generative AI impact cybersecurity? 

Generative AI is slowly becoming an indispensable ally to blue teams across the globe. If used correctly, generative AI may have a net positive impact allowing defenders to streamline processes, save time, and further fortify our defenses. 

 

Sabastian Hague (sebh24), Defensive Content Lead at Hack The Box.

“However, it's crucial to remember that AI is a tool to augment, not replace, the expertise of seasoned cybersecurity professionals. The nuanced judgment and experience of these professionals are irreplaceable, especially in interpreting complex threat landscapes and making critical security decisions.”

What are generative AI use cases in 2024? 

“The use cases of generative AI have expanded rapidly in 2023, meaning this will likely only increase in 2024. Some of the use cases I can see occurring in 2024 within the context of analysts and DFIR are detailed below:

• Enhanced Incident Response Automation.

• Assistance in automating routine SOC tasks.

• Automated Reporting and Documentation.

• Large Data Analysis Assistance.”

2. Addressing cybersecurity burnout (a surprising solution) 

The significant cybersecurity talent shortage leads to more issues than a lack of skills. It places additional pressure on existing cybersecurity teams who are stretched thin in an already demanding environment. 

This is set to continue in 2024, but we expect to see a general culture shift towards addressing burnout and supporting the wellbeing of cybersecurity teams.

Yet increasing pay or offering more vacation time isn’t always the solution. Instead, providing opportunities for cybersecurity professionals to develop and learn new skills is a highly effective way to keep them engaged. 

This was proven in our Cyber Attack Readiness report after speaking to 803 active cybersecurity professionals. More than 70% of managers view team events like Capture The Flag (CTFs) as a viable way to boost employee engagement. Showing there are plenty of ways we can address burnout in 2024 (without raising salaries). 

Recommended read: A cybersecurity reskilling guide for leaders.

3. Cloud security will be a key priority

After surveying 400 active cybersecurity professionals in the HTB database, we found that over 40% believe cloud security skills will be a key priority for SOC analysts over the next five years. 

We spoke to Dave Elliott (Blitztide), Senior Content Engineer at Hack The Box, about the trending risks to cloud security in 2024 and what organizations can do about it:

The largest security risks in the cloud environment are misconfigured Identity and Access Management (IAM), poor key lifecycle management, and poor cloud asset management.

 

Dave Elliott (Blitztide), Senior Content Engineer at Hack The Box

“Misconfigured IAM can lead to greater exposure to phishing/vishing attacks, as without proper Multi-Factor Authentication (MFA) for services, a keen attacker can get instant access to an account with high privileges and lock the original user out. 

Further issues with poor IAM would be the increased risk of insider threat. Handing out keys and credentials that have overreaching permissions may be simple in the short term, however, it allows disgruntled employees to tear down your organization’s cloud real-estate.

This leads to key management, each access key should be short-lived (up to your risk profile) and be regularly audited and regenerated to ensure attackers cannot use keys that get exposed at a later date.

Proper asset management in the cloud can be hard, but you cannot fix what you cannot see. Tools such as Amazon CloudWatch show you which services are still in use, or if they are using more resources.”

Dave recommends bolstering your cloud defenses by doing the following in 2024:

• IAM: granular permissions should be granted only to necessary users, credentials managed promptly, and the removal of credentials ensured upon termination of employment.

• Asset identification: requires regular reconciliation of cloud assets for accuracy. Granularity in logs is essential for extracting key security and business information, but it should be measured to avoid unnecessary costs and fatigue for analysts.

• Costs associated with cloud security must be considered, while applying all available controls and having a vigilant Security Operations Center (SOC) team can enhance security, compromises may be necessitated by the reality of costs. 

• Decision-making on enabling or disabling specific cloud services should be guided by a robust risk management process to strike an optimal balance between security and financial considerations.

Put your team’s cloud defensive skills to the test with our Sherlocks Labs:

Nubilum 1	Nubilum 2
Scenario: Our cloud administration team recently received a warning from Amazon that an EC2 instance deployed in our cloud environment is being utilized for malicious purposes.	Scenario: A user reported an urgent issue to the helpdesk: an inability to access files within a designated S3 directory. This disruption has not only impeded critical operations but has also raised immediate security concerns. The urgency of this situation demands a security-focused approach.
Play Nubilum-1	Play Nubilum-2

4. Upskilling and reskilling will be more important than ever

Upskilling is no longer a “nice to have”. It’s necessary to build effective cybersecurity teams that remain loyal to your organization. 

Due to the ever-widening skills gap, cyber talent is highly sought-after, meaning leaders need to offer more than just a salary to keep employees engaged. 

In our Cyber Attack Readiness report, we interviewed 803 cybersecurity professionals. We found that 68% of security team members rated “opportunities to learn skills” as the most successful way of staying engaged at work.

Reskilling is a significant trend we expect to see in 2024. Companies will use existing talent to fill gaps within their cybersecurity team and improve their security posture. For example, companies may reskill their developers to vet third-party code to avoid supply chain attacks.

I think oftentimes we get caught up in "cyber" being a completely separate industry from anything else. But there is cyber everywhere! In finances, healthcare, even education.

 

Use your strengths from whatever experience you have, and simply level them up. Don't think about cyber as a brand new domain.

 

IT could be networking experience, so think network security! Software development is self explanatory, but think DevSecOps. Then begin bridging those gaps once you've found stability in the skills you're already bringing to the table.

 

Bailey Marshall, Senior Security Consultant at Mandiant.

5. More value placed on Identity and Access Management (IAM)

Identity and Access Management (IAM) is essential to manage and control digital identities. 

In 2024, we expect the value of IAM to expand beyond simply granting or revoking access. Instead, the emphasis will be placed on data security, regulatory compliance, insider threats, and operational efficiency.

An IAM trend that’s growing in popularity is the zero-trust security model. This believes that no user or device, no matter their location, can be trusted. 

As a result, strict authentication and authorization are required. As hybrid work continues to become the norm, this is more important than ever. 

A layered approach to IAM is another trend we expect to see in 2024. Relying solely on passwords as a security measure is insufficient with today’s complex cyber threats. Instead, multi-factor authentication (MFA) and single sign-on (SSO) will become the norm, staying ahead of emerging threats and safeguarding sensitive information.

💡 Upskill your team with the most common ways to attack and defend Active Directory (AD), including IAM, in our Academy module!

6. Blurring the lines between red and blue 

In our SOC Analyst report, we found that hybrid blue and red teamers are on the rise, with many cybersecurity professionals wishing to pursue a career in both roles:

Proactively strengthen your defenses for 2024

To proactively improve security posture and implement successful cybersecurity workforce development plans, leaders need to filter through the noise and focus on what’s important in a sea of trends. 

By shifting our focus from buzzwords to the real threats, both to our security and our teams, we’ll be in the best position to anticipate risks, strengthen defenses, and allocate resources and budget effectively in 2024.