2027’s black swans are already visible: will it be cyber security’s worst year yet?

Black swans and grey rhinos

Nassim Nicholas Taleb gave the industry the black swan: a rare event with enormous impact that nobody predicted and everyone explains afterwards. By definition it cannot go on a risk register. Any list of 2027’s black swans is a list of things the author has already thought of, which means they are something else.

Michele Wucker named that something else the grey rhino. It is the large, probable, visible threat that people can see coming and still fail to move out of the way of. It is charging in plain sight. The reason it does damage is inattention.

Read the cyber security publications of the last few weeks and the grey rhinos are easy to count. Each risk below is documented by a government agency, a vulnerability catalogue or a named research team. None requires a forecast. Each comes with what organisations can do about it before the new year starts.

1. AI finding old weaknesses at scale

On 3 November 2026 the NCSC published its annual review, The State of the Cyber Nation. Its headline judgement is specific: “It is also highly likely that between now and 2028, AI-powered malware will have been used in a ransomware attack on UK CNI.” The review puts the cost of malicious cyber activity to UK organisations at an estimated £14.7 billion every year, citing UK government research.

What matters most is how NCSC chief executive Richard Horne framed it. The threat, he said, is “not because AI has invented new ways to attack us.” It is that “vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable.” He was blunt about the cause: “For decades, we have collectively got away with doing tech on the cheap.”

That is a grey rhino in its purest form. The weaknesses are known. Many of them are old. What has changed is the cost of finding them. The NCSC’s own advice follows from that: address underinvestment, stop connecting technology to the internet when it does not need to be, and treat Cyber Essentials as “the starting point for cyber security, not the end goal.”

What to do: list the legacy systems that have been carried for years on the assumption that nobody would bother attacking them. Take off the internet whatever does not need to be there. For what remains, assume it will be found.

2. The gap between patch and exploit is now measured in hours

Verizon’s 2026 DBIR, published in May, found that 31% of breaches now start with vulnerability exploitation, the first time in 19 years it has overtaken stolen credentials as the leading entry point. Verizon says AI is “shrinking the window for defense from months to mere hours.”

The first week of November gave two clear examples. WordPress released version 7.1.4 on 28 October to fix CVE-2026-119977, a race condition in the core upgrade process that can allow unauthenticated code execution during the upgrade window. CISA added it to the Known Exploited Vulnerabilities catalog on 3 November, and BleepingComputer reported that Wordfence blocked 13,095 attacks against it in a single 24-hour period. Days later, Help Net Security reported that threat intelligence firm Previdian saw the first attempt to exploit the OpenSSH flaw CVE-2026-123158, nicknamed sshole, less than nine hours after the CVE was published, and confirmed root access on an Alpine Linux honeypot. That flaw is narrow: it affects musl-based systems such as Alpine that do not check passwords through PAM. Previdian’s observation came from a single sensor and one source address. The speed is still the point.

What to do: know which internet-facing systems you run before the advisory lands, so patching starts with a lookup. Measure how long it takes you to patch an exposed system once a fix exists, and set a target in hours for anything on the KEV catalog. For sshole, note that installing the update does not restart a running sshd; the service has to be restarted.

3. Identity attacks that step around MFA

On 6 November CISA added CVE-2026-19868 to its KEV catalog. The flaw in SonicWall SonicOS SSLVPN “may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls”, and CISA notes that successful exploitation “may also bypass SAML-enforced multi-factor authentication.” The Canadian Centre for Cyber Security’s advisory the same day says SonicWall indicates the flaw is being exploited.

The human route to the same outcome is better documented still. The executive summary of the 2026 DBIR records the human element in 62% of breaches, up from 60% a year earlier. Pretexting, which Verizon describes as building a trusted relationship through invented scenarios, “frequently by voice communications”, reached 6% of all breaches and has become a more common way into ransomware and extortion attacks. In phishing simulations, the median success rate of voice and text lures was 40% higher than email.

An organisation can have MFA enrolled for every user and still lose an account to a convincing phone call to its own service desk, or to a VPN that accepts a second authentication method nobody remembered was switched on.

What to do: patch SonicOS if you run it, and audit which authentication methods each remote access service will actually accept. Write down how your helpdesk verifies a caller before it resets a password or enrols a new MFA device, then test that process with a realistic call.

4. AI agent credentials on developer machines

Developer laptops have always held valuable secrets. In 2026 they hold a new kind. SpyCloud reported on 30 October that logs from WardenStealer, a Windows infostealer sold as a service, contained the OAuth credentials file Claude Code writes to disk, with access and refresh tokens and tokens for connected MCP servers. The Codex CLI authentication file held an OpenAI API key alongside access and refresh tokens. SpyCloud has recaptured more than 130,000 unique WardenStealer infections since August 2026. A separate stealer, Aoki, sorts what it takes into an AISessions folder with a subfolder for each AI tool.

An AI agent token can carry the permissions of the developer who granted it, and through MCP connections it can reach the systems that agent was wired into. That makes it an identity in its own right.

What to do: follow SpyCloud’s recommendations. Treat AI tool credentials as in scope for every infostealer investigation on a developer machine, rotate exposed API keys and OAuth tokens, revoke active sessions, and watch for unusual API usage. Give agents the narrowest scopes that let them do their job.

5. Cyber attacks with physical consequences

Overnight into Monday 2 November 2026, refrigeration and freezer systems failed in more than 115 shops across Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia, according to BleepingComputer’s reporting. Chains including ICA, Coop, Ahold Delhaize, Carrefour and SuperValu confirmed incidents. One ICA store manager said settings had been changed to +50°C and could not be modified. A refrigeration contractor told RTL the attacker used the same vulnerability as in attacks on French supermarkets the month before. Who was behind it has not been confirmed.

The same night, the Établissement français du sang, France’s blood service, found temperature and defrost settings raised in cold storage at three of its sites, through an attack on a refrigeration equipment provider. Its alarms caught the change in time. The EFS reports no health impact and no loss of blood products, and it is working with ANSSI and the Ministry of Health.

Both cases follow the same pattern: remote management of physical equipment, reached through a supplier, with consequences measured in spoiled stock and, in the worst case, patient safety.

What to do: list every piece of physical equipment a contractor can manage remotely, and how. Ask suppliers how their remote access is secured. Keep the alarms independent of the controllers they monitor, and make sure someone can answer them out of hours.

6. Regulatory deadlines that will not move

Three sets of rules shape the next 14 months for organisations that build or run digital products in Europe and the UK.

• EU Cyber Resilience Act. Since 11 September 2026, manufacturers of products with digital elements sold in the EU must report actively exploited vulnerabilities and severe incidents through the ENISA Single Reporting Platform, with an early warning within 24 hours and a fuller notification within 72 hours. The European Commission confirms that the main obligations apply from 11 December 2027.
• EU AI Act. The Digital Omnibus on AI, given final approval by the Council of the EU on 29 June 2026, moved the high-risk obligations to 2 December 2027 for standalone systems listed in Annex III and to 2 August 2028 for AI embedded in regulated products.
• UK Cyber Security and Resilience Bill. The Bill reached report stage in the House of Lords this autumn. Law firms expect Royal Assent between the end of 2026 and early 2027. It brings more digital and managed service providers into scope and strengthens incident reporting, with much of the detail left to secondary legislation.

What to do: if you ship products with digital elements into the EU, check that your vulnerability handling can meet a 24-hour early warning today. Map which AI systems you run might fall under Annex III. If you supply managed services to UK essential services, read the Bill now rather than waiting for the guidance.

7. Encrypted data that can be read later

The NCSC warns of “an attacker collecting and storing data today and decrypting it at some point in the future”, once a cryptographically relevant quantum computer exists. It does not give a date for that, and says it is “hard to predict when this may happen.” Any article that names a year for Q-Day is guessing.

The planning dates exist even though the threat date does not. NIST published the first three post-quantum standards, FIPS 203, 204 and 205, in August 2024. The NCSC’s migration timeline asks organisations to define goals, complete discovery and build an initial plan by 2028, carry out the highest-priority migration by 2031 and complete migration by 2035. Discovery is the slow part, because most organisations do not have an inventory of where they use public key cryptography.

What to do: start the inventory in 2027. Identify data that must stay confidential for ten years or more, since that is where collection today pays off for an attacker later. Ask your main suppliers for their post-quantum roadmaps.

One practitioner’s view

The risks above come from agencies, catalogues and research teams. It is worth hearing how someone who tests these paths for a living would rank the first steps, as one voice among those sources.

Attackers will automate the cheapest paths first: the internet-facing system that was patched late, the helpdesk that resets a password on a convincing phone call, the AI agent token sitting on a developer laptop. Test those three paths before 2027, with someone trying to get through them, and fix what they find.

Zia Bharwani, CEO of Red Team Partners, an offensive-security firm that runs red team and penetration-testing engagements internationally

Red Team Partners is a sponsor of the Cyber Security Awards.

So, the worst year yet?

The honest answer is that the evidence points to a harder year, and that “worst” will be decided organisation by organisation. None of the seven risks above is a surprise. Each has a government judgement, a catalogue entry or a research report behind it, and each has a known first step. A genuine black swan may still arrive in 2027. If it does, the organisations best placed to absorb it will be the ones that have already dealt with what was in plain sight.

That work rarely makes the news. It is a patch applied on a Friday night, a helpdesk script rewritten, a token revoked before anyone abused it. The people who do it are the ones the independent panel exists to recognise, and nominations for the 2027 Awards open on 1 December 2026. If you watched a colleague do this work in 2026, put them forward.

Sources

• NCSC: annual review announcement and Richard Horne’s remarks (3 November 2026).
• NCSC Annual Review 2026, cyber threat to the UK: the 2028 CNI judgement and the £14.7 billion annual cost estimate.
• Verizon, 2026 DBIR announcement and 2026 DBIR executive summary: vulnerability exploitation, human element, pretexting and mobile social engineering figures.
• Help Net Security: exploitation of OpenSSH CVE-2026-123158 (6 November 2026).
• BleepingComputer: CISA flags WordPress CVE-2026-119977 as actively exploited (4 November 2026).
• CISA Known Exploited Vulnerabilities catalog: entries for CVE-2026-119977 (3 November 2026) and CVE-2026-19868 (6 November 2026).
• Canadian Centre for Cyber Security, advisory AV26-1133: SonicWall SonicOS exploitation (6 November 2026).
• SpyCloud: infostealers now target AI tokens and API keys (30 October 2026).
• BleepingComputer: refrigeration disruption at European supermarkets (2 November 2026).
• BleepingComputer: cyberattack disrupts blood storage refrigeration in France (4 November 2026).
• European Commission: Cyber Resilience Act reporting obligations and the December 2027 application date.
• Lewis Silkin: Council of the EU gives the AI Omnibus final approval, with revised high-risk dates.
• Gowling WLG: status of the UK Cyber Security and Resilience Bill (September 2026). Current stage: UK Parliament.
• NCSC, PQC migration timelines and next steps in preparing for post-quantum cryptography.
• NIST: first three finalised post-quantum standards, FIPS 203, 204 and 205 (August 2024).
• Red Team Partners: practitioner commentary (Zia Bharwani).