A cloud provider experiences an outage, and dozens of client companies lose access to their business tools for several hours. This increasingly common scenario illustrates a major shift in cybersecurity: the threat no longer comes solely from a direct attack, but from the digital dependencies between organizations. The cybersecurity trends of 2026 confirm that protecting one’s own perimeter is no longer sufficient.
Digital Dependencies and the Domino Effect on Business Resilience
The Threat Landscape 2026 report from ENISA, published on September 22, 2026, places the interconnection of services and providers at the center of risks. An organization can be affected without being directly targeted, simply because a critical vendor or platform has been compromised.
Specifically, imagine a company that uses a billing tool hosted by a cloud provider. If this provider suffers a ransomware attack, the company can no longer issue invoices, even if its own systems are intact. An attack on one link affects the entire chain.
This reality changes the way security teams must operate. Mapping out technical dependencies (who hosts what, who has access to what) becomes as strategic as updating firewalls. Organizations that follow the news from Cyber sPass regularly find this type of analysis applied to current real-world cases.
ENISA also confirms that ransomware remains the most impactful threat in the short term in Europe. Their effectiveness relies precisely on these interdependencies: encrypting the data of a key vendor can paralyze dozens of downstream clients.
AI-Assisted Manipulation Campaigns: Beyond Classic Phishing
When discussing AI and cybersecurity, phishing and deepfakes immediately come to mind. However, a less publicized phenomenon is gaining alarming momentum: foreign manipulation and interference campaigns (referred to by the acronym FIMI).
According to ENISA, European campaigns of this type assisted by AI have increased from 41 to 147 in one year, representing a 259% increase in manipulated influence operations. Here, AI is not used to steal a password. It generates credible content on a large scale to influence opinion, destabilize institutions, or sow confusion around sensitive events.
Why is this a cybersecurity issue and not just a political one? Because these campaigns also target businesses. A fake press release generated by AI, disseminated on social media, can cause a stock price to plummet or trigger panic among a brand’s customers. The line between misinformation and cyberattack is blurring.
Authorization Flow Phishing: A Technique That Bypasses Passwords
On the side of direct attacks, phishing is also evolving. Recent techniques of authorization flow phishing allow attackers to obtain persistent access tokens without ever stealing the victim’s password.
The principle: the user receives a fake authorization request, similar to those generated by legitimate applications. By validating this request, they grant the attacker a token that remains active even after a password change. Classic multi-factor authentication does not block this scenario, since the attacker does not need the second factor.
For IT teams, this means monitoring active tokens and permissions granted to devices, not just suspicious login attempts.
Regulatory Compliance in Europe: NIS2 and DORA Change Obligations
Two European regulations are concretely changing what companies must do regarding IT security:
- The NIS2 directive expands the scope of organizations subject to cybersecurity obligations. Sectors such as waste management, agri-food, or postal services are now covered, whereas they were not before.
- The DORA regulation imposes specific operational resilience requirements on financial actors (banks, insurers, payment service providers), including regular penetration testing and formalized risk management related to third-party vendors.
- The EU AI Act adds an additional layer for AI systems considered high-risk, with documentation, human oversight, and incident management obligations.
Compliance is no longer a topic reserved for large companies. A small or medium-sized enterprise providing digital services to a financial actor may find itself indirectly subject to DORA’s requirements through its service contract.
Concrete Protection Measures for Organizations in 2026
In light of these developments, certain actions stand out for their effectiveness. They do not all require a significant budget, but they do require a real commitment from management.
Map Critical Dependencies
List every vendor, every cloud service, every interconnection with a partner. For each, assess what happens if that link fails. Companies that know their dependencies react faster in the event of an incident.
Monitor Permissions and Active Tokens
A password alone no longer provides adequate protection. It is necessary to regularly audit active OAuth tokens, permissions granted to third-party applications, and devices connected to business accounts. An overlooked session on an unmanaged device can become a silent entry point.
Train Beyond Email Phishing
Awareness training must incorporate new forms of manipulation: fake authorization requests, audio deepfakes during phone calls, misinformation campaigns targeting the company. An informed employee can also spot manipulations that do not come through email.
The cybersecurity threats of 2026 share a common trait: they exploit trust. Trust in a vendor, trust in a familiar voice on the phone, trust in an apparently legitimate authorization request. Strengthening data security and organizational resilience now requires a systematic questioning of this trust that is given by default.
