Predicting next year’s threats is mostly a matter of reading this year honestly. Little of what will matter in 2027 is new. What changed in 2026 is speed, quiet, and scale, and that changes what a SOC should spend its hours on. This is what I took from this year’s events on the AI-driven threat landscape.
Attackers got faster
AI-assisted attacks stopped being a conference slide this year. Phishing in fluent Thai, Burmese or English, reconnaissance that used to take days, exploit code adapted within days, sometimes hours, of a disclosure. None of it is magic. It compresses the time between “a weakness is public” and “someone is using it.”
The quieter risk is our own agents. Teams are wiring AI into ticketing, cloud consoles and chat, often with service credentials broader than any human analyst would get. An agent that can read a mailbox and act on what it reads can be steered by whatever lands in that mailbox. Treat every agent as a privileged identity: scoped permissions, logged actions, an owner who can switch it off.
Our own AI agents
In my view, as of Q4 2026, security AI agents are getting good at writing queries on behalf of human analysts and triaging low-fidelity, noisy alerts to pinpoint threats that need to be prioritised and investigated. However, they are still limited in correlating events across different log sources and in the ability to mimic the thought process of senior (Tier 3) analysts. The next move will be SOC AI that digs into logs and metadata directly.
The edge is where it starts
VPN gateways, firewalls and remote-access appliances kept getting hit with zero-days and newly disclosed bugs in 2026, often chained, often leaving little on the device worth collecting. In several public cases defenders patched and still lost, because sessions, credentials or persistence were already taken.
So the patch is the middle of the response, not the end. When an edge device is exposed to a known exploited bug, assume compromise until shown otherwise. Kill active sessions, rotate credentials that passed through it, review admin accounts, and compare outbound traffic against what that device normally does. If the appliance cannot give you useful logs, collect what you can upstream and downstream of it, and make that part of the buying criteria next time.
Attackers can map your whole internet-facing estate from public routing data, so know every range you announce.
Identity is the perimeter you actually have
Much of this year’s damage needed no malware. Unauthenticated APIs returning data they should not, API keys and tokens left in repositories and build logs, session tokens replayed past MFA. Inside Windows estates, attackers who reached directory access went after local admin passwords and disk-recovery keys, which turns one foothold into the whole fleet.
The work here is unglamorous. Inventory who and what can read those secrets, and alert on the reads. Scan code and pipelines for keys before attackers do. Bind and shorten token lifetimes where you can. Put internal and partner APIs on the same review list as public websites, because attackers already treat them that way.
Shared platforms, shared breaches
File-transfer and shared SaaS platforms keep producing breach waves on the same pattern as the big file-transfer breaches: one flaw in a widely used platform, then hundreds of victims who never had a bad day of their own. For a telecom operator the list of those platforms is long: billing partners, roaming hubs, outsourced support, managed service providers.
A SOC cannot patch a supplier, but it can know which suppliers hold what data, what normal looks like on those connections, and who to call at 2 a.m. Hardware deserves the same suspicion. Firmware and software persistence on network gear is well documented, and supply-chain tampering is a credible risk, so firmware baselines and acceptance checks on new equipment are part of detection, not only procurement.
Buildings and plants are online too
Exposed OT and facility controllers, from cooling in data centres to power and access systems at cell sites, show up regularly in internet scans. Hacktivists in particular like them because a screenshot of a defaced control panel spreads faster than any denial-of-service claim. Know what is reachable from the internet, put it behind something, and make sure someone watches it, even if that someone sits outside the SOC.
Volume is a threat of its own
Monthly patch releases now routinely carry dozens of fixes, often with several already exploited. No team patches everything at once, and pretending otherwise produces a backlog no one trusts. What helps is a written rule for what jumps the queue: exploited in the wild, exposed to the internet, sitting on the edge or on identity infrastructure. Everything else goes through the normal cycle, and the exceptions get a name and a date.
The regional picture
APAC had a heavy 2026. Data breaches across the region, telecom and government targets among them, plus hacktivist campaigns that rise and fall with political news. Many hacktivist claims are exaggerated, but some carry real leaks, and the reputational hit lands either way. Have a playbook for verifying a claim quickly and talking to communications before the screenshot trends.
Where the attention goes
Pull these threads together and the plan for 2027 is less about new tools than about discipline. Treat edge devices as already suspect. Treat identities, human and machine, as the real perimeter. Know your suppliers’ blast radius. Decide in advance what gets patched first. Give every AI agent an owner and a leash.
The attackers in 2027 will be faster than this year’s. The question for a SOC is whether its decisions are written down well enough to keep up. When the attack leaves no trace and no malware, there is no excuse for an undecided plan.
Written in October 2026; I may revisit it in January 2027.