Malik Haidar has spent years in the trenches of cybersecurity, navigating the high-stakes environment of multinational corporations where a single oversight can lead to a catastrophic breach. With a background that spans deep technical intelligence and high-level business strategy, he has become a leading voice on how organizations can survive a digital landscape that is rapidly shifting under the weight of emerging technologies. In this discussion, Haidar breaks down the converging threats of 2026—from the explosion of health data theft to the looming shadow of quantum decryption—offering a blueprint for resilience in an era where the traditional perimeter has all but vanished.
We have witnessed a staggering surge in health data breaches this year, with figures from the first six months alone already eclipsing the totals for all of 2025. What does this massive scale of exposure tell us about the current state of our digital defenses and the vulnerabilities inherent in the healthcare sector?
The numbers we are seeing are not just high; they are historic and deeply concerning for anyone in the industry. In the first half of 2026, the United States logged a record 471.2 million health data breach victim notices, a figure that is already higher than what we saw in the entire previous year. If we continue at this blistering pace, we could see over 3,600 total breaches by the end of December, setting an all-time record that exposes the fragility of our current systems. One of the most striking examples is the Instructure Canvas incident, which alone accounted for roughly 275 million notices, representing about 58% of the total compromises for the first half of the year. This tells us that our conventional, perimeter-focused frameworks are failing to protect the most sensitive data we have, especially as the financial services and healthcare sectors lead the way in compromises with 387 and 281 incidents respectively. Perhaps even more terrifying is the lack of transparency, as a record 76% of breach notices now omit any information about how the attack actually happened, which is a massive drop from the 93% disclosure rate we saw back in 2021.
The rise of autonomous, or “agentic,” AI has shifted the battlefield from human-led attacks to machine-speed maneuvers. How are these AI systems changing the way intruders investigate and capitalize on vulnerabilities, and what does it mean for defenders who are still relying on human-operated responses?
We have entered an era where AI is no longer just a supportive tool; it has become the primary battleground for both offense and defense. These autonomous “agentic” systems operate with little to no human oversight, allowing attackers to conduct reconnaissance, move laterally through networks, and exfiltrate data at a speed that humans simply cannot match. AI-assisted malware engines are now capable of dynamic code mutation and real-time evasion strategy optimization, meaning they can learn from every unsuccessful screening attempt to bypass security. This creates a polymorphic threat environment where static defenses are rendered obsolete almost instantly. To counter this, organizations have to stop seeing AI as a mere enhancement and start treating it as the core architecture of their security, focusing on behavior-based detection and AI-powered telemetry. We are moving toward a reality where we must monitor not just what we told an AI agent to do, but the specific actions the agent elects to take on its own initiative in the wild.
Quantum computing has been discussed as a future threat for years, but the concept of “harvest now, decrypt later” makes it a present-day danger. How should organizations be preparing for “Q Day,” and what specific risks do legacy encryption techniques face right now?
The threat is far more immediate than many realize because adversaries are already stealing and storing encrypted personal data today with the intention of decrypting it once quantum computers reach operational maturity. This “harvest now, decrypt later” strategy means that the window for a safe transition to post-quantum cryptography is rapidly shrinking. Standard legacy encryption techniques like RSA and ECC are fundamentally vulnerable to these future capabilities, and any organization that has failed to monitor its cryptographic presence is essentially leaving a time bomb in its archives. Q Day should not be viewed as a single, sudden event where all encryption breaks, but rather as a strategic turning point where quantum capabilities transcend classical operational limits. We are urging enterprises to conduct a thorough “crypto inventory” right now to identify every system, key, and protocol that relies on vulnerable schemes. Implementing hybrid cryptographic systems and ensuring secure procedures for key destruction are the first lines of defense against a future where today’s secrets become tomorrow’s open books.
With deepfakes and synthetic media becoming nearly indistinguishable from reality, we are seeing a rise in sophisticated identity fraud. How can companies protect themselves against counterfeit audio and video that convincingly mimics their own executives or service providers?
The phrase “seeing is believing” is becoming a dangerous relic in the face of synthetic realism and highly convincing identity fabrications. Cybercriminals are now using counterfeit audio and video to supercharge Business Email Compromise, or BEC, making it incredibly difficult for employees to distinguish a legitimate request from a fraudulent one. When an executive’s voice and face can be replicated with terrifying accuracy, traditional one-time identity verification methods are no longer sufficient. Organizations must transition toward continuous identity verification and incorporate anomaly detection that can flag atypical vocal conduct or subtle inconsistencies in video streams. Training employees to recognize the hallmarks of synthetic realism is critical, but the technical layer must also evolve to include legal and insurance considerations for these digital replicas. If we rely solely on human validation in an age of perfect counterfeits, we are essentially inviting attackers to walk through the front door using the face of a trusted leader.
The proliferation of 5G, IoT, and edge computing has expanded the attack surface to a degree that was unimaginable a decade ago. What are the primary risks associated with these billions of interconnected devices, particularly those located at the periphery of the network?
The expansion of the attack surface means that every single interconnected device is now a potential entry point into the heart of an enterprise. We are seeing a significant trend where major assaults no longer target the primary data center directly but instead originate from vulnerable embedded devices at the edge, such as those in manufacturing or logistics centers. These edge computing clusters often serve as “lateral pivot zones,” allowing attackers to gain a foothold and then move into more sensitive areas of the network. The scale of this threat is immense; for example, the global scale of botnets observed by Lumen Black Lotus Labs is currently approaching 60 million victim IP addresses. Many of these devices lack straightforward firmware upgrades or ship with weak default passwords, making them easy prey for those looking to build botnets or launch DDoS attacks. A zero-trust approach must be applied to the device tier, treating every piece of hardware as potentially compromised and utilizing micro-segmentation to prevent a breach at the periphery from taking down the entire system.
Cybercrime has evolved from loose groups of hackers into highly organized, corporate-level enterprises. How does the professionalization of these malicious actors, including their use of affiliate programs and victim “customer support,” change the way we must approach crisis response?
We have to stop thinking of threat actors as clandestine gangs and start viewing them as sophisticated business rivals who are systematically arranged and globally focused. The modern cybercriminal ecosystem mirrors legitimate corporate structures, offering “ransomware-as-a-service” with full affiliate programs, subscription models, and even branding and marketing efforts. They have developed such a high level of professionalism that some groups even provide “customer assistance” to help victims navigate the payment of ransoms through encrypted money laundering channels. This shift means that our response to a breach can no longer be limited to technical fixes; it must involve business continuity, reputation management, and legal strategy from the very beginning. Sovereign nations and hybrid entities often use these corporate-style groups for surrogate actions, providing them with credible disavowal while pursuing diverse incentives. When your adversary has a better customer support desk than some legitimate companies, your defense strategy must be equally professional, resilient, and strategically aligned.
Given these complex and converging threats, many leaders are struggling to keep pace. What practical steps must the C-suite take to transform cybersecurity from a technical expense into a fundamental component of their overall corporate strategy?
The most critical step is to stop treating the CISO as a technical silo and start treating them as a strategic business ally who is involved in every major corporate decision. The designation may change, but the responsibilities must expand to include a deep understanding of how digital risks impact the bottom line, legal standing, and brand trust. Prudent leadership teams are now incorporating “threats blocked” and “cyber resilience metrics” into their regular reporting, focusing on recovery duration and event management flexibility rather than just trying to prevent every single attempt. We need a cultural transformation where every employee understands they are the first line of defense, especially as attackers pivot toward human and identity vectors. This also requires a shift toward public-private partnerships and the sharing of threat intelligence, because in the current digital ecosystem, no entity can survive by operating in isolation. Resilience is the ultimate priority for the remainder of 2026 and beyond; the enterprises that flourish will be those that build security into their very culture rather than treating it as an afterthought.
What is your forecast for the future of digital trust in an age where AI and quantum technologies are becoming ubiquitous?
My forecast is that digital trust will become the most valuable currency a company can own, but it will be harder to earn and easier to lose than ever before. We are moving into a future where the distinction between authentic and counterfeit will be a constant struggle, and the organizations that survive will be those that prioritize transparency and adaptability over rigid, old-world defenses. By 2027, I expect that “quantum-resilient” will be a standard requirement for insurance and regulatory compliance, and any firm that hasn’t addressed its digital legacy risk will find itself uninsurable. The convergence of agentic AI and quantum computing is not just a technological shift—it is a transformation of power and security. We must stop building walls and start building robust, security-oriented organizations that can thrive amidst complexity, using mobility and advanced detection to stay one step ahead of adversaries who are innovating just as fast as we are.
