Google Cloud’s Cybersecurity Forecast 2026 warns of new AI-supplemented threats

Shadow agents and state-backed espionage also feature

The annual report predicts a new era of cyber risk driven by AI-supplemented attacks, ransomware evolution, and the rise of “shadow AI agents,” as nation states and cybercriminals exploit cloud, crypto, and virtualisation blind spots.

Google Cloud has released its Cybersecurity forecast for 2026, and it doesn’t make for a relaxing read.

The report sets out three areas which security leaders across Google Cloud think, based on current data, the greatest risks are likely to emanate from. These areas are AI, cybercrime and nation states although, in reality, threats are likely to be blended.

Leading the report is the prediction that threat actors will fully embrace AI, launching prompt injection attacks, and AI-enabled social engineering, with multimodal generative AI tools capable of manipulating voice, text and video fuelling a new wave of business email compromise and hyper-realistic phishing and vishing.

The report also identifies what it terms the “AI Agent Paradigm Shift” which explores the implications of the repaid adoption of AI agents for executing workflows – including security deployments. The report suggests that identity and access management (IAM) is going to have to evolve to treat AI agents as “distinct digital actors, each with its own managed identity.”

Another emerging threat highlighted by the report is the risk of shadow AI agents. Shadow agents are unauthorised AI agents, deployed by employees seeking workarounds, to automate tasks that create invisible data pipelines which then expose organisations to security and compliance risks.

Cybercrime and nation states

The report also highlights ransomware and data-theft extortion following a year when cyberattacks have featured heavily in the news cycle. The scale of the problem is growing. The report notes: “The 2,302 victims listed on data leak sites (DLS) in Q1 2025 represented the highest single quarter count observed since we began tracking these sites in 2020, confirming the maturity of the cyber extortion ecosystem.”

The report predicts that the widespread adoption of cryptocurrency and tokenized assets will expand the attack surface for cybercriminals, and that decentralised finance platforms and crypto exchanges are likely to be targeted. Speaking at an event to launch the report, Stuart McKenzie, MD of Mandiant Consulting said:

“Blockchains are immutable, so once you have information in the blockchain, it gives you resilience and a way to hide. Infrastructure can be taken down, and we can do things to disrupt cyber criminals but if you’re in the whole Web 3 stack, it makes attacks and attackers more resilient.”

Jamie Collier, Lead Advisor, Google Threat Intelligence Group said that the impact of digital transformation has been profound.

“If you look at the anatomy of a 2025 ransomware incident these are now threat actors who are far more comfortable targeting cloud, supply chains, SaaS providers. As organisations move to further digital transformation, we’re seeing cyber criminals very clearly following organisations into those spaces.”

Related to this point within the report is virtualization infrastructure. The report notes that the foundational layer, long considered a pillar of strength, is now emerging as a critical blind spot, The report asserts that as many organisations have focused on end users and in-guest defences, the core virtualisation fabric underlying the enterprise has remained largely unmonitored.

The report also anticipates increased cyber espionage from Russia and China targeting European governments, defence and Critical National Infrastructure (CNI). European supply chains are likely to be targeted for access to downstream targets, perhaps years in advance.

Fake North Korean IT workers are likely to become more of a threat in Europe and the UK, as awareness of their activities has grown in the US, and their need to maintain a revenue stream for the North Korean regime remains. Due to their work in the US, these threat actors have developed high-quality English-speaking skills and therefore are more likely to pose a threat in countries where business is conducted in English.