Cybersecurity: what are the biggest unsolved problems?

Why does cybersecurity still look broken after decades of spending?

Cybersecurity still looks broken today because companies are improving their defenses while attackers are finding more ways in and moving much faster once they get access.

The latest Verizon Data Breach Investigations Report captures the contradiction unusually well. Vulnerability exploitation has become the leading initial breach vector in its dataset, accounting for 31% of breaches. Third-party involvement reached 48%. Ransomware appeared in 48%. CrowdStrike, meanwhile, measured an average eCrime breakout time of only 29 minutes, down sharply from the previous year.

At the same time, some defenses are clearly working better. Mandiant found that organizations themselves discovered malicious activity first in 52% of the investigations it handled, up from 43% a year earlier. Verizon found that 69% of ransomware victims in its payment dataset did not pay. IBM calculated that organizations making extensive use of security AI and automation suffered about $1.93 million less in average breach costs than organizations using none.

A company may have stronger endpoint protection than five years ago while relying on more SaaS applications, more cloud identities, more APIs, more external vendors and more software dependencies than ever before. Attackers only need one of those paths to work.

Current indicator	What it tells us
Vulnerability exploitation: 31% of breaches	Internet-facing software has become a major entry point
Third parties involved in 48% of breaches	More attacks depend on systems the victim does not fully control
Average eCrime breakout: 29 minutes	Response increasingly has to happen at machine speed
Internal detection: 52%	Defensive visibility is genuinely improving
Ransomware victims refusing payment: 69%	Better resilience can weaken criminal economics
Heavy security automation: ~$1.93M lower breach cost	Automation already has measurable value

If you want more recent data on this point, please see our latest cybersecurity market report.

Are hackers getting more mileage from software bugs than stolen passwords now?

Yes. Exploitable software has become one of the most important ways hackers get into organizations today, and the shift looks bigger than a one-year anomaly.

Verizon found that vulnerability exploitation accounted for 31% of breaches in its latest dataset, compared with 13% for credential abuse. Mandiant independently found exploits were the most common initial infection vector in its investigations for the sixth consecutive year, representing 32% of cases.

Zero-day activity reinforces the same picture. Google’s Threat Intelligence Group tracked 90 zero-days exploited in the wild during 2025, up from 78 the year before. Enterprise technologies accounted for 43 of those vulnerabilities, a record for that category.

The location of these flaws is especially worrying. Google found that almost half of the observed zero-days affected enterprise technologies, including security appliances and other systems sitting close to the edge of corporate networks. CrowdStrike separately reported that 40% of vulnerabilities exploited by China-linked threat actors targeted edge devices.

Passwords are still a huge weakness. Microsoft found that 97% of the identity attacks in its telemetry involved password spraying. Companies now have to fight industrial-scale credential attacks and very fast software exploitation at the same time.

Can companies patch serious vulnerabilities fast enough anymore?

Often, no. Attackers are increasingly exploiting important vulnerabilities before normal enterprise patching processes can catch up.

Mandiant’s current vulnerability-management analysis estimates mean time-to-exploit at minus seven days, meaning exploitation can begin before a patch is available. CrowdStrike found another brutal timing gap during the first half of 2026: for vulnerabilities with public proof-of-concept code, 88% of the exploitation it observed happened within 48 hours of publication. Some China-linked actors moved within 24 hours.

Enterprise remediation works on a very different clock. Verizon’s analysis of third-party cloud exposures found that resolving half of weak-password and permission-misconfiguration findings took almost eight months. Even missing or improperly configured MFA was often left unresolved.

Part of that delay is completely rational. Hospitals cannot reboot critical clinical systems whenever a severe CVE appears. Manufacturers cannot casually shut production lines. Large enterprises have to test patches, check dependencies, get approvals and plan rollback procedures.

AI may widen the gap further before it helps close it. Google has already reported a threat actor it believes used AI to develop a zero-day exploit. GitHub also saw a remarkable surge in vulnerability reporting, publishing 1,560 reviewed advisories in a single month of 2026, more than five times its typical monthly volume.

The realistic goal now is prioritization: identify which flaws are reachable, actively exploited and connected to important systems, then reduce that exposure first.

If you want more recent data on this point, please see our latest cybersecurity market report.

Have passwords and MFA basically failed?

Passwords are still failing badly, while basic MFA is becoming easier for attackers to work around.

Microsoft’s latest security data shows just how persistent the password problem remains: 97% of the identity attacks it observed were password-spray attacks. Attackers are still making money from one of the oldest techniques in cybersecurity because enormous numbers of accounts remain protected by passwords that can be guessed, reused or bought.

MFA helps, sometimes enormously. But criminals have learned to attack the process around MFA instead of defeating the cryptography itself.

Mandiant has documented groups calling employees and IT help desks, convincing them to grant access, registering attacker-controlled authentication methods and stealing long-lived sessions. In its latest investigations, voice phishing jumped to 11% of intrusions while conventional email phishing fell to 6%. CrowdStrike separately found vishing intrusions doubling between the second half of 2025 and the first half of 2026.

Session theft creates another problem. Google has warned that adversary-in-the-middle phishing can capture credentials and the authenticated session cookie created after MFA succeeds. The attacker then inherits an already authenticated session.

Phishing-resistant passkeys close off much of this because the credential is cryptographically tied to the legitimate service. But companies still have account recovery, old applications, help desks, session tokens, OAuth approvals and privileged service accounts to protect.

The authentication problem has moved beyond proving who someone is once. Companies increasingly need to keep checking whether the person or machine using an authenticated session still looks legitimate.

Why is cloud identity so hard to secure?

Cloud identity is one of the hardest cybersecurity problems right now because a stolen account can give an attacker access to huge amounts of data without requiring obvious malware.

Google’s Cloud Threat Horizons analysis found identity problems involved initial access in 83% of investigated compromises affecting major cloud and SaaS environments. Attackers targeted data in 73% of those incidents. Third-party or software-supply-chain relationships accounted for another 21% of initial access cases.

That changes what a breach looks like. An attacker no longer needs to infect a laptop and move through an internal network if a stolen SSO session already opens Salesforce, SharePoint, OneDrive, Slack or administrative consoles.

Mandiant has documented this in recent ShinyHunters-linked campaigns. Attackers compromised identities through vishing and then moved directly into connected SaaS applications. In other investigations, they searched repositories for terms such as “confidential” and “SSN” and streamed files from SharePoint or OneDrive using valid session cookies.

Some of that activity looked almost normal in the logs because attackers were using legitimate accounts and legitimate application interfaces.

The hard part is deciding whether a valid account performing a permitted action is behaving like the person or machine that normally owns it.

Is software supply-chain security becoming a systemic problem?

Yes. Software supply-chain risk is becoming systemic because one trusted vendor, package or identity provider can spread a compromise across many customers at once.

Verizon found third-party involvement in 48% of breaches, up sharply from the preceding dataset. The World Economic Forum separately found that 65% of large organizations considered third-party and supply-chain vulnerabilities their biggest cyber-resilience challenge, compared with 54% a year earlier.

Open-source software shows how quickly this can propagate. GitHub has documented repeated campaigns in which attackers compromise maintainer credentials or CI/CD workflows, steal secrets, publish malicious packages and then use those newly compromised projects to reach more targets.

One poisoned npm campaign affected packages whose legitimate versions collectively received more than two billion downloads per week. The malicious releases were removed after roughly two hours. That sounds fast until we remember how much software is installed automatically during a two-hour window.

GitHub has responded with staged npm publishing, stronger two-factor approval, tighter restrictions on install-time scripts and a default three-day cooldown before routine Dependabot version updates. Those changes are designed around the assumption that maintainers sometimes will be compromised.

There is also a concentration problem hiding inside the same issue. A modern company may depend on one identity provider, two or three hyperscale clouds, a few endpoint-security vendors and hundreds of external software components.

The World Economic Forum describes these digital supply chains as deeply interconnected and often incompletely mapped. A customer cannot inspect every line of code inside every SaaS provider or fully audit every transitive dependency inside an application.

Dependency	Why the exposure spreads
Compromised package maintainer	Malicious code arrives through a trusted distribution channel
CI/CD credential theft	Automation often holds powerful unattended credentials
SaaS integration token	One compromised vendor account can expose connected customers
Shared edge appliance	The same exploitable product may sit inside thousands of networks
Identity provider	One account system can sit in front of dozens of business applications

If you want more recent data on this point, please see our latest cybersecurity market report.

Why does ransomware keep spreading if more victims refuse to pay?

Ransomware is still spreading because criminals can cause enormous disruption even when payment rates fall.

Verizon found ransomware in 48% of breaches in its latest dataset, up from 44%. Yet 69% of victims in the payment data refused to pay, and the median ransom payment fell from $150,000 to $139,875.

Chainalysis found a similar split between attack volume and criminal revenue. Ransomware operators received about $820 million on-chain in 2025, roughly 8% below its updated estimate for 2024, while claimed attacks increased by around 50%.

That combination points to worsening economics per victim: more attacks are required to generate roughly the same pool of money.

Victims can still suffer badly without paying a ransom. Verizon’s insurance-claims analysis found business interruption represented roughly a quarter of total ransomware losses across the period it studied. IBM puts the average cost of a data breach across all breach types at $4.99 million.

For now, ransomware looks more like an industry under margin pressure than an industry close to disappearing.

Can security teams react fast enough when hackers move in minutes?

Increasingly, no. The fastest cyberattacks today can move through an organization before a human incident-response process has properly started.

CrowdStrike measured average eCrime breakout time at 29 minutes in 2025, 65% faster than the previous year. It recorded one breakout in just 27 seconds. In another intrusion, data exfiltration started four minutes after initial access. During the first half of 2026, CrowdStrike documented a SaaS compromise moving from account takeover to data theft in under five minutes.

Long-running attacks still exist. Mandiant measured global median attacker dwell time increasing from 11 days to 14 days. Espionage and North Korean IT-worker cases lasted far longer, with a median dwell time of 122 days.

Those figures describe two very different enemies. A financially motivated attacker may race from access to theft before anyone can join a response call. An espionage operator may try to look normal for months.

Security teams therefore need rapid automated isolation and long-term behavioral monitoring at the same time. The unresolved trade-off is how aggressively those systems can act without constantly disrupting legitimate work.

Is AI making cyberattacks move faster than defenders can keep up?

Yes. AI is already making familiar cyberattacks faster and cheaper while also accelerating vulnerability discovery beyond what many organizations can safely remediate.

CrowdStrike says attacks associated with AI-enabled adversaries increased 89% year over year. Verizon found generative AI augmenting 15% of the attack techniques it tracks. IBM found that one in four malicious breaches in its latest study were AI-enabled, up 56% from the previous year.

Most of those attacks still use recognizable techniques: reconnaissance, phishing, impersonation, credential theft, malware development and vulnerability research.

Where AI changes the picture is the amount of skill and time required. Google says it has identified a threat actor using a zero-day exploit that it believes was developed with AI. CrowdStrike has observed legitimate generative-AI tools at more than 90 organizations being abused through malicious prompts to generate commands for credential or cryptocurrency theft. IBM found deepfake impersonation and AI-enabled malware among the largest categories of AI-assisted malicious breaches.

Vulnerability discovery is accelerating too. GitHub published 4,101 reviewed security advisories during 2025, while newly reported advisories rose 19% year over year. Then, in one month of 2026, the GitHub Advisory Database published 1,560 reviewed advisories, more than five times its usual monthly throughput, and still accumulated work faster than it could process it.

More discovered bugs only help if teams can identify which ones actually matter. A company with 100,000 findings needs to know which handful are internet-accessible, exploitable, sitting on critical systems and likely to be attacked soon.

AI can help with that triage as well. Mandiant is already using agentic source-code analysis to identify exploit paths during security reviews and incident response.

The harder step is remediation. Automatically proposing a patch is much easier than safely pushing that patch into a production banking system, factory or cloud platform.

For now, AI is accelerating discovery and attack execution faster than trustworthy automated fixing.

Can we actually secure AI agents against prompt injection?

Not reliably enough today. Prompt injection becomes a serious cybersecurity problem once an AI agent can read untrusted content and also take actions with real permissions.

OWASP continues to rank prompt injection among the leading risks for LLM applications and separately highlights excessive agency: giving an AI system enough authority to call tools, retrieve data or execute actions that an attacker may indirectly influence.

The underlying difficulty is unusual. An LLM is deliberately built to interpret language. A malicious instruction hidden inside an email, webpage, document or database entry may therefore enter the same reasoning process as legitimate instructions from the user or developer.

The consequences depend heavily on what the model can do.

A chatbot manipulated into producing a bad answer creates an information problem. An agent that can send email, alter a database, execute code, approve a refund or retrieve confidential files creates a security problem with much higher stakes.

CrowdStrike’s observation of malicious prompts being used against legitimate AI tooling at more than 90 organizations shows that this has already left the lab.

The safer architecture currently assumes that models can sometimes be manipulated. High-impact actions then sit behind narrow permissions, deterministic policy checks, isolated credentials and, where necessary, human approval.

We still do not have a dependable way to let general-purpose AI agents consume arbitrary untrusted information while also giving them broad authority. That is one of the clearest genuinely new cybersecurity problems in this article.

If you want more recent data on this point, please see our latest cybersecurity market report.

Why are old industrial and medical systems still so hard to secure?

Legacy and operational technology remain stubborn cybersecurity problems because many of these systems cannot be patched, restarted or replaced as casually as ordinary business software.

The World Economic Forum found 31% of organizations naming legacy infrastructure among their biggest barriers to cyber resilience. The problem goes far beyond old office computers. Industrial equipment, hospital systems, building controls and public infrastructure can stay in service for decades.

The FBI and U.S. Environmental Protection Agency recently warned that attackers had remotely accessed internet-facing programmable logic controllers used by water utilities in at least seven U.S. states. The attackers changed IP addresses and passwords and caused some degradation of water operations.

The recommended fixes were strikingly basic: remove the controllers from direct internet exposure, use stronger passwords and restrict communications through access-control lists.

That tells us how uneven cybersecurity still is across physical infrastructure. Some critical systems remain exposed in ways that would be considered unacceptable in a modern cloud environment.

Replacing them can require capital expenditure, shutdowns, safety certification and specialist engineering. A vulnerable laptop might be updated overnight. A controller operating a water process or production line may require weeks of planning.

We already know many of the technical fixes. Getting them deployed across infrastructure that society cannot casually turn off is the part we still struggle with.

Can secure-by-design software finally eliminate whole classes of cyber bugs?

Yes, and secure-by-design engineering is one of the strongest long-term ways to make cybersecurity materially easier.

Memory safety is the clearest example. A U.S. government technical review of industry evidence found that in some major codebases, roughly 70% of vulnerabilities receiving CVEs were related to memory-safety problems. CISA and other security agencies have consequently pushed critical software toward memory-safe languages.

That approach can eliminate whole families of use-after-free, out-of-bounds and similar bugs before software reaches production.

Supply-chain platforms are moving in the same direction through safer defaults. GitHub’s staged npm publishing, stronger approval requirements, restrictions around install-time behavior and delays before routine automated upgrades all reduce the amount of damage one compromised maintainer can cause.

These changes have an advantage over security training: they keep working even when somebody eventually makes a mistake.

The catch is the installed base. Critical C and C++ systems cannot all be rewritten quickly, and organizations still have decades-old applications embedded in their operations.

Post-quantum cryptography has a similar migration problem. NIST has already standardized the first post-quantum cryptographic standards, so organizations can begin moving away from algorithms that a sufficiently capable future quantum computer could break. The difficult part is finding and replacing cryptography buried inside browsers, VPNs, certificates, databases, hardware modules, embedded devices and old protocols.

U.S. policy now assumes this will take years. Recent federal requirements point covered contractors toward post-quantum compliance by the end of 2030.

In both cases, the technical destination is becoming clearer. Getting billions of existing systems there is going to be much slower.

Is the cybersecurity talent shortage still the real problem?

The bigger problem today is having the wrong skills in the wrong places, especially as cloud and AI infrastructure change faster than security teams can retrain.

ISC2 recently stopped publishing its traditional global cybersecurity “workforce gap” estimate because respondents were increasingly emphasizing missing capabilities rather than simple headcount. Fifty-nine percent reported critical or significant skills needs, up from 44% the previous year, while 95% reported at least one skills deficiency.

The specific gaps tell us more than the headline number. AI ranked first at 41%, followed by cloud security at 36%, risk assessment at 29% and application security at 28%. Twenty-one percent said their organization was adopting technology faster than the security team could acquire the skills needed to protect it.

The World Economic Forum found a similar divide. Among organizations describing themselves as insufficiently cyber-resilient, 85% also reported missing critical skills or people. Among highly resilient organizations, only 22% saw skills gaps as a major problem.

Smaller organizations are particularly exposed. Forty-six percent of small organizations cited missing cybersecurity skills and expertise as a major challenge, compared with 29% of large organizations. The figure reached 57% in the public sector and 51% among NGOs.

That matters beyond those organizations themselves because small suppliers, local governments and service providers often connect into much larger companies. A billion-dollar company can still inherit risk from a vendor that cannot hire a cloud-security specialist.

Cybersecurity therefore has both a skills problem and a distribution problem: the expertise exists, but far too little of it sits where the weakest systems are.

Why can’t police just shut down the cybercrime economy?

Law enforcement can hurt cybercrime groups, but shutting down the wider economy is extremely difficult because cybercrime now operates through replaceable specialists, infrastructure providers and brokers spread across many jurisdictions.

Microsoft describes an increasingly specialized market involving access brokers, malware developers, ransomware affiliates, data-extortion groups and infrastructure providers. Chainalysis has separately found ransomware operators sharing bulletproof hosting and residential proxy infrastructure with state-linked actors.

That specialization makes individual takedowns less decisive.

Microsoft and law-enforcement partners, for example, seized or blocked more than 2,300 domains connected to Lumma Stealer. The operation disrupted a major infostealer, but the wider market for browser credentials, session cookies and cryptocurrency information remained intact. Other operators could still sell similar services.

The financial incentives are also strong. Microsoft gives an illustrative comparison in which a vulnerability researcher might receive around $10,000 for responsibly disclosing an exploit while a cyber-mercenary buyer could pay more than $100,000 for the same capability. Prices vary widely, but the incentive gap is obvious.

The FBI received more than one million internet-crime complaints for 2025, with reported losses approaching $21 billion. Cybercrime has grown far beyond a collection of a few famous hacking groups.

It behaves much more like an international illicit services market.

Police can make that market more expensive and dangerous to participate in. Eliminating it would require much deeper coordination across cryptocurrency infrastructure, hosting providers, domain registrars, financial institutions and governments.

So what are cybersecurity’s biggest unsolved problems?

The biggest unsolved cybersecurity problems today are cloud identity and authorization, vulnerability remediation that cannot keep up with attacker speed, software and third-party dependencies, AI agents with dangerous levels of access, and legacy systems that are extremely difficult to modernize.

The current evidence does not support a story in which defenders are simply losing everywhere. Organizations detect more incidents themselves. More ransomware victims refuse to pay. Passkeys can remove much of the phishing risk attached to passwords. Memory-safe software can eliminate large bug classes. Security automation measurably reduces breach costs.

Malware-free activity represented 82% of CrowdStrike’s detections in 2025. Attackers increasingly operate through legitimate accounts, session cookies, SaaS applications, administrative tools, APIs and trusted software rather than obviously malicious files.

That changes what “good security” has to detect. Seeing malware is comparatively easy. Deciding whether an authenticated employee suddenly downloading 20,000 files through a valid cloud API is actually that employee is much harder.

As we saw above, software exploitation adds another speed problem: attackers may move within hours of disclosure or even before a patch exists. Third-party dependencies then multiply the impact because a flaw in one widely used product can expose thousands of companies at once.

AI-agent security deserves its own place near the top because agents combine several of these weaknesses in one system. They use machine identities, consume untrusted information, connect to external services and may receive authority to perform real actions.

Some problems look more solvable. Secure-by-design software, memory-safe languages, passkeys and post-quantum standards all have credible technical paths forward. Their difficulty lies mainly in replacing the enormous installed base.

That is where cybersecurity remains genuinely unsolved today.

Rank	Biggest unsolved problem	Why it is still hard	Where things stand
1	Cloud identity and authorization	Valid accounts and sessions can be abused without obvious malware	Technical controls are improving, attacker abuse is still rising
2	Vulnerability remediation	Exploitation can begin before or within hours of disclosure	Attackers currently move faster
3	Software and third-party dependencies	Companies cannot fully inspect or control their dependency graph	Exposure is becoming more systemic
4	AI-agent security	Untrusted inputs can influence systems with real permissions	Still architecturally immature
5	Legacy and operational technology	Upgrades conflict with uptime, cost and physical safety	Progress remains slow
6	Cybercrime economics	Specialists and infrastructure can be replaced after takedowns	Disruptions help, the market persists
7	Cybersecurity skills	Cloud, AI and application-security needs are changing quickly	Skills are badly distributed
8	Secure software migration	Better technical approaches exist but legacy code remains everywhere	Strong long-term path
9	Post-quantum migration	Huge amounts of embedded cryptography have to be replaced	Technically solvable, operationally slow

If you want more recent data on this point, please see our latest cybersecurity market report.

Who is the author of this content?

NEW MARKET PITCH TEAM

We track new markets so founders and investors can move faster

We build living "market pitch" documents for emerging markets: AI, synthetic biology, new proteins, and more. Instead of outdated PDFs or hallucinated LLM answers, our clients get a clean, visual, always-updated view of what's really happening: key players, deals, regulations, and signals that matter. Learn more about us.