iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The four cyber threats that Steve Durbin identifies as harboring big plans for the future are AI-enabled attacks, third-party and supply-chain exposure, quantum computing’s threat to public-key encryption, and geopolitical conflict. Durbin sets them out in an expert commentary piece published by SecurityWeek on September 29, 2026. His core advice is that no single tool or policy will remove these risks, so organizations need to prepare across technology, governance, operations and people.
The four threats at a glance
The table below summarizes what each threat changes for an organization and the first readiness step the article recommends. Where the article gives no timeframe, the table says so.
| Threat | What changes | Time horizon | Assets most exposed | First step the article recommends |
|---|---|---|---|---|
| AI-enabled attacks | Faster reconnaissance and vulnerability scanning; more convincing phishing, voice and video impersonation, and synthetic identities | Not stated | Staff identity checks, detection and incident handling | Review whether existing security capabilities can keep pace |
| Third parties and supply chains | Vendor software backdoors and unmanaged APIs that inherit trusted access | Not stated | Vendor-held data and systems reached through trusted access | Continuous vendor monitoring, with suppliers ranked by data sensitivity |
| Quantum computing | Future attacks on RSA and ECC public-key encryption, and “harvest now, decrypt later” collection of data today | Migration estimates of five to seven years (small enterprises) and 12 to 15+ years (large organizations), as reported in the article | Data that must stay confidential for a long time | Inventory where cryptography is used, then build a phased post-quantum migration plan |
| Geopolitical conflict | Nation-state actors and proxies threatening critical infrastructure; conflict-driven disinformation and deepfakes | Not stated | Energy, transport, finance and industrial operations | Crisis simulations and response plans that work during system outages |
1. AI-enabled attacks
The article’s point is about speed and persuasiveness rather than a wholly new class of attack. AI can shorten the time an attacker needs for reconnaissance and vulnerability scanning. It can also make phishing, voice and video impersonation, and synthetic identities more convincing.
The author’s response is to test whether existing security capabilities can keep pace with that tempo. He points to two measures: AI-enabled anomaly detection, and stronger incident management, so that an alert turns into a fast and coordinated response. These are the author’s observations and recommendations, not measured findings.
#1 Best Overall
The article’s main example is a deepfake scam. It associates a SGD 4.9 million loss with a May 2026 AI-generated Zoom impersonation involving Singapore’s prime minister. Independent confirmation of the incident and the amount was not established when this article was written, so treat the figure as the article’s own account rather than a verified loss.
2. Third parties and supply chains
The article describes two routes into an organization through its partners. The first is software backdoors introduced through vendors. The second is unmanaged APIs, which connect systems to outside services. Both inherit trusted access. A compromise at a supplier can therefore reach your environment using the trust your systems already extend to that supplier, with possible downstream operational impact. The article cites an operational impact at Mackay Sugar as an example. That case is reported in the article and is not independently established here.
The recommended actions are:
- Monitor vendors continuously, rather than only at contract renewal.
- Rank suppliers by the sensitivity of the data they handle.
- Limit each vendor’s access to what it needs to do its job.
- Write stronger security terms into contracts.
- Measure oversight, so that vendor security rests on metrics rather than assumptions.
A practical starting point is a list of every API and integration that connects to an outside party, along with the permissions each one holds.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match3. Quantum computing and cryptography
The article warns that future quantum computers could threaten public-key encryption based on RSA and ECC. The concern is sharpest for “harvest now, decrypt later” collection: an adversary captures encrypted data today and decrypts it once it has the capability. Data that must stay confidential for many years is the most exposed, because its value outlasts the encryption protecting it. The article does not give a date for when a quantum threat to these algorithms becomes practical.
Rank #3
The recommended path has two steps:
- Inventory where cryptography is used across applications, network connections, certificates, vendor-hosted services and devices.
- Build a phased migration plan toward post-quantum cryptography (PQC), starting with the data that has the longest confidentiality requirement.
The article gives migration estimates that are useful for planning, but they are not a forecast of when an attack becomes possible:
| Organization type | Estimated PQC migration duration | Attribution |
|---|---|---|
| Small enterprises | Five to seven years | Estimate reported by Steve Durbin in SecurityWeek (2026). The article does not identify the study or organization behind it. |
| Large organizations | 12 to 15+ years | Estimate reported by Steve Durbin in SecurityWeek (2026). The article does not identify the study or organization behind it. |
Treat these numbers as assumptions to test against your own inventory, not as an industry consensus.
4. Geopolitical conflict
The article says nation-state actors and their proxies can threaten critical infrastructure, including energy, transport, finance and industrial operations. Conflict also fuels disinformation and deepfake campaigns, which can disrupt an organization through false information as well as through intrusion. The article attributes some activity to Iran-affiliated actors. That attribution is the article’s claim and has not been independently established here.
The recommended measures are:
- Run crisis simulations that include operational and communications decisions, not only technical containment.
- Strengthen threat intelligence so that warnings about a specific conflict reach the teams that act on them.
- Cooperate with external agencies before an incident, so that contacts and information-sharing arrangements already exist.
- Keep response plans accessible during system outages, for example through offline copies, so they can be used when the systems they describe are down.
How the four areas connect
The article treats the four threats separately, but they share dependencies. Three intersections matter most in practice:
Best Value
- A vendor compromise and an AI-generated impersonation can combine. A convincing request from a supplier’s staff member can travel over a trusted integration.
- Vendors often hold data with long confidentiality requirements. Supplier ranking and cryptographic inventory should therefore cover the same records.
- Conflict-driven disruption tests whether a response plan still works when the vendors and systems it relies on are unavailable.
These connections are an interpretation of the article’s four sections, not points the author makes in these terms. Durbin’s own framing is that organizations that build a future-ready cybersecurity posture pursue resilience as a core capability on a continuous basis. He writes this as Chief Executive of the Information Security Forum, as identified by SecurityWeek.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
