Artificial intelligence (AI) may have dominated news headlines this year—and that's true in the cyber world as well—but at the same time, the security community's concerns extend far beyond the risks posed by fully autonomous technologies, as Computer Weekly's annual Top 10 Technologies survey reflects.
Five years on from Covid-19, it's fair to say the pandemic has transformed security from a niche topic to something everyone has an opinion about, and some of the biggest topics to emerge during the dark days of lockdown – remote working and supply chain security – remain the talk of the town in 2025.
Another theme has been the emergence of quantum computing and, in particular, the threat it poses to encryption, while in the US, sweeping policy changes under the new presidential administration have had major implications for the industry.
Here are Computer Weekly's top 10 cybersecurity stories in 2025.
Let's start with one of the most interesting and long-lasting stories of the past year – the scandal around North Korean operatives given positions as remote IT contractors with American companies to obtain funds for the isolated regime. By the end of January, the US Department of Justice (DoJ) announced charges against five men – two North Koreans, a Mexican and two American citizens – in the case.
The prevalence of remote workers, especially in the wake of the Covid-19 pandemic, has made virtual job interviews a fact of life, and even as more organizations issue return-to-office (RTO) orders, many continue to hire employees for fully remote positions where their employees can rarely, if ever, physically meet. Attackers were quick to spot this gaping corporate security loophole, and HR departments scrambled to respond.
Growing speculation around the potential of quantum computing and its impact on the security world has become a huge topic of conversation this year. In March, the UK's National Cyber Security Center (NCSC) published guidance to help support organisations. while they prepare for quantum.
While its capabilities seem fantastic, in the medium term the advent of quantum computing will make existing encryption methods used to protect sensitive data obsolete, and the race is now on to develop efficient post-quantum cryptography, or PQC. According to the NCSC, organizations should already be planning for PQC ahead of a technical upgrade in the early 2030s. The Cyber Agency wants the UK's most at-risk organizations to fully adopt PQC by 2035 at the latest.
Supply chain security has become an integral part of the cyber world over the past few years, and the topic still dominates the headlines in 2025. In May, NHS digital chiefs wrote to their suppliers ask them to sign a cyber agreement.
The NHS has a long and worrying history of cyber-attacks and data breaches, with attacks on partners such as OneAdvanced and Synnovis disrupting services and highlighting the supply chain risks facing healthcare organisations. The health service has asked providers to adhere to higher standards for maintaining and patching systems, deploying multi-factor authentication (MFA), ongoing cyber monitoring and logging of critical infrastructure, and immutable backups, among other things.
Although the US Cybersecurity and Infrastructure Security Agency (CISA) was created during his first administration, it was not immune to deep and sweeping cuts enacted by President Donald Trump as his second term entered its peak.
In 2025, the US cyber establishment has been shaken to its core, with consequences spreading beyond America's borders.
Since Microsoft's longest-running operating system, Windows 10, finally ended support in October, there were warnings for users across the UK summer 2025 – prepare to upgrade now or your safety will be at risk.
NCSC technical director Ollie Whitehouse said not updating was akin to “taking on high-interest debt with the threat of being forced to repay at a later date” and urged organizations to update their PCs. In addition to the difficulties users will face due to lack of support, the agency warned that outdated and no longer updated Windows 10 systems will become prime targets for attackers – recalling the WannaCry incident in 2017, which involved unpatched versions of Windows XP.
The UK government has made progress on the Cybersecurity and Resilience Bill 2025 and was finally able to introduce it to Parliament in November. This was preceded by the usual round of consultations, debates and evidence meetings, and in July the Home Office announced that legal ban on paying for ransomware – hospitals and other public health authorities, public sector organizations such as councils and schools, and critical national infrastructure (CNI) operators, including data centres, will be included.
Introducing a ban on ransomware payments has broad support nationally – the majority of responses to a consultation on the issue supported it – but the issue remains controversial, with some skeptical that the ban will make critical UK organizations less attractive targets for cybercriminals and could actually make it harder for some of them to recover if and when they are hit.
The annual Black Hat cyber fair in Las Vegas brings together security professionals and hackers of all stripes and always brings out a few oddities. This year, Cisco Talos researchers have identified a number of vulnerabilities – dubbed ReVault – Impact on firmware security software and associated application programming interfaces (APIs) in Dell laptops.
During their research, the Talos team discovered that if a vulnerable system was configured to allow biometric fingerprint logins, it was possible to tamper with the firmware so that the fingerprint reader would accept non-human physical input. In what is certainly a first for the security industry, researchers posted a video online in which they bypassed a laptop's biometric security measures using green onions.
Returning to the quantum space, two years after the debut of its Quantum Safe Program (QSP), Microsoft reported steady progress in the field. enabling PQC algorithms into some of the fundamental components underlying the security of its suite of products in August.
For a tech company as ubiquitous as Microsoft, quantum security is non-negotiable—getting it wrong could spell disaster—so Redmond wants to act quickly and hopes to have its core services secure before the end of the 2020s. Its overall strategy is based on three main pillars: updating Microsoft's own and third-party services, supply chain and ecosystem to ensure quantum security; supporting its customers, partners and ecosystems in achieving this goal; and advancing global quantum security research, standards, and services.
In October, political chaos in Washington, D.C. spilled over into the security realm when the federal government was forced to shut down following temporary funding measures. failed to pass through a deeply divided Congress. Unfortunately, this has stalled progress on extending or replacing the Obama-era threat intelligence sharing law CISA 2015, which expired at the end of September.
CISA 2015 established a framework for information sharing and offered liability protection to organizations that share threat intelligence and cyber intelligence in the public interest. Experts fear that its absence will not only harm cooperation between the public and private sectors, but also reduce the US's ability to act as an effective counterweight to cybercriminals and other threat actors on the global stage. Although CISA 2015 has now been extended, the possibility of another shutdown in early 2026 could see this story rear its head again very soon.
Security professionals need only look at the monthly Update Tuesday alerts to see how Microsoft's technology dominance puts it at the center of many cybersecurity stories, and the firm is often criticized by those who believe it doesn't do enough to meet its security obligations. Such voices were in full flow in late 2025 when Australian, Canadian and US cyber intelligence agencies took the step of signing an emergency warning and issuing guidance. to protect Microsoft Exchange server instancesa key factor in many of the most influential cyber incidents in history.
The document outlines several proactive defense techniques that will be applied to on-premises Exchange servers as part of hybrid environments, and American called it a “critical resource” for Microsoft users. But one observer, a former White House cyber policy expert, said the fact that a multilateral coalition felt obligated to create such a resource was a “devastating commentary on Microsoft's security posture.”
