Excite Cyber makes cybersecurity predictions for 2026

Cybersecurity company Excite Cyber has released some trends and predictions for the coming year heading into 2026.

Among the key trends, the company highlights new AI regulations and stronger governance over LLM development. It predicts cyber risks will become encompassed in comprehensive enterprise-wide business risk registers and demand will surge for digital forensics training.

Excite Cyber also anticipates that Australia will see rapid adoption of international AI and cybersecurity standards, and adopt a greater focus on basic cyber hygiene and human risk management.

Human oversight will become a critical factor in LLM governance

In 2026, Excite Cyber expects a surge in demand for cybersecurity strategies specifically tailored to AI-assisted software development. Organisations will increasingly adopt multi-layered protective measures including code validation layers to verify AI-generated code before deployment, access controls to limit the potential for misuse of AI tools and continuous monitoring to detect anomalies or malicious activity in real time.

As Australian businesses increasingly integrate large language models (LLMs) into software development, the need for robust cybersecurity measures has never been more urgent. While LLMs offer remarkable efficiencies, such as automating coding tasks, generating documentation and even identifying bugs, they also introduce new attack surfaces that can be exploited by malicious actors.

“Without the right safeguards, LLMs can be manipulated to inject malware, propagate misinformation, or introduce vulnerabilities into otherwise legitimate applications,” said Excite Cyber CEO Bryan Saba. “This represents a timely warning for the Australian market as we head towards 2026: AI-driven development can accelerate innovation, but it can also become a new attack vector if left unchecked.”

Excite Cyber stresses human oversight will remain a critical factor in AI governance in 2026.

“While LLMs can accelerate development, Australian organisations that combine AI capabilities with skilled cybersecurity professionals will be better positioned to mitigate risk, safeguard data, and maintain trust with clients and stakeholders,” Saba said.

Cyber risk registers will be encompassed in enterprise-wide business risk registers

Excite Cyber predicts that in 2026 we’re going to see a big shift in how Australian organisations approach cyber risk. Just a few years ago, many company risk registers were light on detail, sometimes barely populated. In 2026 organisations will encompass cyber risks in enterprise-wide comprehensive business risk registers and treat registers as living documents, not compliance exercises. The shift will be driven top-down by boards — no longer will cyber risks just be the domain of technical teams.

“In 2026, an acceleration will happen in Australia, with more organisations building detailed asset inventories, mapping how information flows through their business, and linking physical, administrative and technical security controls,” Saba said. “The more assets a business has, the greater the potential risk, and boards and senior leaders are investing more in thorough due diligence.

“This means business risk registers will be expanded to capture real-world cybersecurity scenarios: what happens if a door system fails, if a laptop goes missing or if remote access isn’t tightly managed. That level of thinking shows risk identification is maturing.”

Demand will increase for digital forensics experts and upskilling

As Australia heads into 2026, Excite Cyber predicts demand for digital forensics skills will continue to surge. Organisations across both public and private sectors are already recognising that rapidly evolving cyberthreats, ransomware, insider risk and advanced persistent attacks require staff with up-to-date technical knowledge and practical experience.

“The number of qualified cybersecurity and digital forensics professionals in Australia is well below market needs, with a shortfall of about 30,000 professionals forecast for 2026,” Saba warned. “This is driving strong interest in training programs as people seek to upskill and enter the field to fill demand.

“Many practitioners have theoretical knowledge but limited hands-on experience with forensic tools, incident response processes and compliance with frameworks such as ISO 27001 or the ACSC Essential Eight, and are expected to increase their willingness to upskill and cross skill in this area.”

Courses that replicate real-world investigations, from evidence collection to analysis and reporting, will increase in demand. Digital forensics training will become a core focus for Australian organisations seeking to strengthen their cyber resilience. Professionals will increasingly pursue upskilling pathways, while training providers will expand hands-on, scenario-based programs to meet both regulatory requirements and the operational realities of modern cyber investigations.

“Australia’s cyber workforce of the future will be defined not just by qualifications, but by practical capability to respond to complex threats in an increasingly connected environment in 2026 and beyond,” Saba added.

Increasing AI regulation in Australia

In 2026, Excite Cyber predicts more Australian organisations will voluntarily adopt ISO 42001 to ensure they are prepared for increasing AI regulation. With the Australian Government currently examining AI regulation frameworks, Australian organisations that are rushing to integrate AI into products and services face heightened risks if they don’t follow recognised standards.

ISO 42001, the global standard for Artificial Intelligence Management Systems, offers a clear framework to manage AI responsibly, securely and transparently. By adding ISO 42001 to AI governance frameworks, forward-thinking organisations will ensure they are well prepared for future strengthening of AI regulation in 2026 and beyond.

The Australian Government has also published the Voluntary AI Safety Standard to help organisations develop and deploy AI systems safely and reliably.

Excite Cyber expects more Australian organisations will act in 2026 to stay compliant and build trust and resilience in an increasingly AI-powered economy. As more AI systems are built and deployed, it will become increasingly important for these systems to be built to a minimum acceptable standard to ensure the risk of biases is reduced and that information security is not compromised.

A greater focus on basic cyber hygiene

While zero-day exploits and so-called ‘sophisticated’ attacks make the headlines, Excite Cyber expects Australian businesses to embrace a ‘back to basics’ approach to cybersecurity in 2026. Data from the Australian Signals Directorate, Office of the Australian Information Commissioner and dozens of international studies highlights phishing attacks and compromised user accounts remain the most used and potent tool in the hands of cyber criminals.

“It might not sound cutting-edge, but more organisations will focus on the fundamentals: rolling out multi-factor authentication, encouraging the use of password managers to support stronger, unique passwords, and prioritising recovery tools such as backups. These steps remain some of the most effective ways to reduce everyday risks and to speed up recovery after an incident,” Saba said.

Increased focus on human risk management

Cybersecurity has firmly shifted from being viewed as a technical issue to being recognised as a core business risk, with boards and executives taking greater accountability. Yet despite this progress, the focus has remained heavily weighted towards technology controls. The three pillars of effective security are people, process and systems, but in practice, systems have dominated, processes follow, and people remain the weakest link.

In 2026, Excite Cyber predicts this imbalance will change with the rise of human risk management (HRM). HRM puts people at the centre of security by going beyond tick-box training and phishing simulations. Instead, it uses smart technology to support employees in real time, helping them make better security decisions in the flow of their daily work.

Over the coming year, Excite Cyber expects organisations to shift away from reliance on traditional awareness training and towards HRM-driven models that embed security into daily workflows. By making people active participants in cyber resilience, not passive recipients of annual training modules, organisations will reduce risk, improve response and strengthen their overall security posture.

Image credit: iStock.com/hirun