Experian's annual data breach forecast identifies five threat trends security teams should factor into their planning this year. The report points to evolving attacker incentives, ongoing pandemic disruption, and the growing appeal of digital assets as key drivers shaping the threat landscape.
For professionals tracking active campaigns, several of these predictions align with patterns already visible in incident response data. The infrastructure targeting forecast, in particular, echoes what we saw with high-profile supply chain attacks in recent years.
The short version
- Cyber attacks increasingly targeting power grids, transportation, and supply chain infrastructure
- Criminal interest in cryptocurrency and NFT ecosystems growing alongside mainstream adoption
- Remote and hybrid work arrangements continuing to expose attack surface
- Natural disasters creating opportunities for charitable fraud and phishing campaigns
- Online gambling legalization attracting social engineering campaigns
Infrastructure targeting: the Colonial Pipeline precedent
The report cites the Colonial Pipeline attack as a defining example of infrastructure vulnerability. Last May, a criminal hacking group disrupted fuel supplies to the US East Coast, triggering panic purchasing and price spikes. The incident demonstrated how quickly infrastructure disruption translates to real-world impact and media attention.
This creates a problematic incentive structure. Threat actors see infrastructure targets as high-value. They also see infrastructure modernization spending—such as the US infrastructure bill—as potential funding sources and attack surfaces simultaneously. Defence teams need to account for this interest in their threat models.
Digital asset targeting: cryptocurrency and NFTs
As cryptocurrency and NFT markets gain legitimacy, they attract the kind of opportunistic crime that follows any valuable, poorly secured ecosystem. Sophisticated investment scams, exchange compromises, and wallet draining operations all tend to increase when entry barriers drop and asset values climb.
The practical implication: security teams whose organizations interact with digital asset platforms—whether as investments, payment mechanisms, or NFT-related initiatives—should apply heightened scrutiny to these touchpoints. The security controls at crypto exchanges and NFT marketplaces vary widely.
Remote work vulnerabilities persisting
Pandemic-era infrastructure changes created attack surface that hasn't fully stabilized. Distributed work arrangements require expanded VPN capacity, cloud service proliferation, and home network exposure that many organizations haven't fully addressed. The report flags this as an ongoing vulnerability vector rather than a resolved issue.
What this means for your planning
Threat intelligence forecasts aren't crystal balls. They represent informed hypothesis about where attacker attention and capability will concentrate. The value lies in stress-testing your own threat models against these predictions.
Say your organization operates industrial control systems or manages critical infrastructure. The infrastructure targeting forecast suggests elevating OT security investment and reviewing incident response procedures specifically for scenarios involving operational technology disruption.
For most organizations, the cryptocurrency and remote work vectors deserve review regardless of industry. If your finance team handles crypto holdings or your organization supports hybrid workers, those areas warrant explicit assessment.
What to watch next
Watch for incident reporting on infrastructure sectors as modernization projects move forward. New systems bring new vulnerabilities; attacker interest tends to follow.
Key takeaways
- Infrastructure targeting forecasts align with observed trends in critical sector incidents
- Cryptocurrency and NFT ecosystem growth attracts opportunistic crime alongside legitimate adoption
- Remote work attack surface remains incompletely addressed at many organizations
- Forecasts should inform threat model review, not replace incident-specific intelligence
- Critical infrastructure operators should prioritize OT security investment and incident response readiness
Frequently asked questions
Why are infrastructure targets attractive to cybercriminals?
Infrastructure disruptions produce immediate, visible real-world impact. This creates use for ransom demands and generates publicity that attackers can weaponize for future operations.
How can organizations assess their exposure to cryptocurrency-related threats?
Inventory all crypto holdings and NFT positions, evaluate the security practices of exchanges and wallets used, and apply multi-factor authentication everywhere. If your organization accepts cryptocurrency payments, review those payment processing relationships.
What remote work security gaps remain at most organizations?
Home router security, personal device policies, and inconsistent MFA adoption on cloud services remain common weak points. Organizations that expanded cloud footprints during the pandemic often added complexity faster than they added security controls.
How reliable are annual threat forecasts?
Forecasts reflect trends and patterns; they don't predict specific events. Treat them as one input among many when reviewing your threat model. Verify that your controls address the underlying risk patterns rather than reacting to specific named threats.
What should critical infrastructure operators prioritize?
Asset inventory for operational technology, network segmentation between IT and OT environments, incident response plans specific to OT scenarios, and monitoring for threats targeting infrastructure sectors.