With 2026 only days away, I wanted to put together my list of what I think will matter most in technology and security going into the new year.

1. AI is growing fast – and so are the risks

In 2025 we’ve seen huge growth in AI. New models are being released constantly, updates and breakthroughs are happening all the time, and the overall AI market has climbed into the hundreds of billions of dollars. Some estimates put it around $230B–$290B, with others suggesting even higher numbers.

AI isn’t just a buzzword anymore; it’s something everyone is using, from individuals to large organizations. Because of that, there are two big things I think people should focus on:

• AI security.
  With all the benefits of AI, one piece that doesn’t get talked about enough is the security side. People are pasting sensitive information into AI chats every day—PII, medical details, internal project notes, even legal or financial data. Even when platforms say this data isn’t used for training, it’s still being stored somewhere. That means it can potentially be accessed by people inside the organization or targeted by attackers.
  For 2026, I’d put AI security at the top of the list: be intentional about what you share with hosted AI tools, and treat anything sensitive as data that needs protection.

• Being smart about how you use AI.
  For simple, non-sensitive questions, using ChatGPT or other hosted AI tools is fine. But when the information is sensitive—like a new application you’re building, internal documentation, or anything you don’t want logged forever—you’re better off controlling the data yourself.
  That might mean running a smaller AI model locally or in a tightly controlled environment so that you own the repository of data and logs instead of handing it all to a third party.

2. Phishing, malware, and account takeovers aren’t going away

The second big area is one we’ve all heard about, but that still causes damage every single day: phishing, malware, and account takeovers.

Even with better security awareness and tools, phishing volumes and related attacks have continued to rise. We’re seeing very large year-over-year growth, with millions of phishing attempts in a single quarter, and that doesn’t even include other forms of malware or social engineering.

Going into 2026, I’d focus on two things here:

• Visibility and logging.
  Phishing, malware, and account takeovers all depend on finding a way in—usually through a person. Sometimes that’s an employee; sometimes it’s a partner with access. The only way to really see what happened is to have good visibility:

  • Logins are tracked.

  • Password changes are logged.

  • Security settings changes are recorded.

  • Logs are stored long enough and protected so they can’t be quietly altered.

  If something does go wrong, solid logging is what lets you detect it early and figure out what actually happened before the damage spreads.

• MFA and solid basics.
  Right behind visibility is basic account security: MFA, strong passwords, and good day-to-day habits. Ideally, every important account should have MFA enabled. But not all MFA is equal:

  • Best: app-based authenticators or hardware keys

  • Second: codes sent by SMS

  • Last resort: codes sent by email

  Email is the weakest place to send MFA codes, because phishing and fake password-reset emails can trick people into giving up both their password and the code in one shot. The simpler rule: enable MFA everywhere you can, use strong passwords, and slow down before you click on anything that feels off.

3. Resilience, efficiency, and backups

The last area on my list is about resilience—how well you can take a hit and keep going—and how backups and efficiency fit into that.

• Resilience and backups.
  By resilience, I mean how prepared you are for something to go wrong: ransomware, a bad update, someone accidentally deleting data, or losing access to key accounts or email.
  A resilient setup has:

  • A clear plan for “What happens if we lose this data?”

  • Backups of critical systems and accounts.

  • Tested recovery steps so you’re not figuring it out mid-crisis.

  With attacks increasing and AI making phishing and social engineering more convincing, spending a bit of time now on resilience and backups is just as important as anything else on this list.

• Efficiency that actually helps security.
  Efficiency might not sound like a security topic, but it absolutely is. When security is painful, people avoid it. When it’s simple and organized, people stick with it.
  One example I’ve been working on is a simple account dashboard—something that pulls together your important accounts and surfaces key security info in one place. The goal is to make it easier to see what you have, what’s protected, and what still needs work, instead of leaving security up to memory or scattered notes.

So that’s my list for 2026:
AI security and responsible AI use, phishing/malware and account protection, and building real resilience with good backups and efficient security practices.

Would you add anything? Change the order? I’d be interested to hear what you think.

If you want help with any of this—from AI security to incident response or overall cybersecurity planning—you can email me at ryan@cenegi.com.

Thanks for reading, and have a great 2026.

Sources:
AI Growth: https://explodingtopics.com/blog/ai-statistics
Phishing: https://ssojet.com/news/2025-phishing-trends-rising-threats-and-cybercriminal-strategies