Every day, dealerships manage sensitive customer and business information across numerous systems, applications, and cloud platforms. That creates a complex environment built on trust — one cybercriminals continue to target.
Over the past year, the cybersecurity landscape has shifted toward identity-based attacks and AI-enabled tactics that move faster and appear more convincing than ever. These changes are reshaping ransomware, phishing, vulnerability management, and the broader conversation around cybersecurity effectiveness.
If there’s one takeaway from the 2026 cybersecurity landscape, it’s this: Attackers would rather log in than break in.
Big Shifts Are Changing Cybersecurity
Today’s cybercriminals are finding ways to blend into trusted systems and move quickly once they gain access.
Rather than relying solely on traditional malware, attackers seek ways to appear as legitimate users operating within trusted systems. A stolen credential, hijacked session, or legitimate administrative tool can give access without triggering the warning signs typically associated with malware. Identity-based approaches now account for 79 percent of ransomware attacks, while malware was absent from 82 percent of detections.
That shift creates a different challenge for defenders. Detecting something obviously malicious is one thing. Recognizing when seemingly normal activity is being performed by an attacker is far more difficult.
As identities become a preferred entry point, visibility into who accesses critical systems, how they access them, and what activity is legitimate has become increasingly important.
Another important trend is the growing role of operational constraints. Industry research points not only to technical gaps, but also to challenges related to visibility, staffing, and cybersecurity expertise. As threats become more difficult to detect, interpreting alerts and responding quickly can be just as important as the technologies generating them.
Ransomware Has Changed, But So Has Recovery
Ransomware continues to evolve alongside these broader trends.
Attackers move through trusted systems while minimizing contact with heavily monitored endpoints. And the financial impact remains significant. The average recovery bill, excluding ransom payments, has reached $1.7 million, an 11 percent year-over-year increase.
But there is encouraging news: Backup-based recovery climbed to 66 percent, while paying to recover dropped to 48 percent, its lowest level in three years. That suggests investments in recoverable backups are improving organizational resilience.
Backups can help reduce the damage after an attack, but they can’t prevent the compromised identity that allowed an attacker in. That’s why recovery and prevention are two distinct sides of the cybersecurity equation.
Phishing Is Becoming Harder to Spot
The inbox remains one of the easiest ways for attackers to reach the identity layer.
Malicious email (26 percent) and phishing (24 percent) are now the two most common root causes of ransomware incidents, accounting for half of incidents combined.
AI can help attackers create phishing attempts that are more personalized, polished, and convincing. Familiar warning signs like spelling mistakes, strange formatting, or poorly written messages are less reliable indicators of malicious activity. A
phishing email can now closely resemble the routine communications employees receive every day.
Even multi-factor authentication isn’t the finish line. MFA was enabled in 97 percent of breaches that began with credentials. Some attacks target authenticated sessions after a user has already logged in, meaning the initial authentication control may have worked even though the session was later compromised.
Vulnerability Management Still Matters
While identity-based attacks dominated many cybersecurity headlines this year, vulnerabilities remain an important part of the story. Exploited vulnerabilities fell from 32 percent to 18 percent of ransomware root causes, reflecting progress in patching and vulnerability management efforts.
At the same time, several security researchers have warned that AI may allow attackers to discover and weaponize vulnerabilities more quickly in the future. As a result, the decline may reflect a shift in attacker preference rather than a permanent reduction in risk.
What Trends Suggest Moving Forward
The trends shaping cybersecurity in 2026 point toward a threat landscape increasingly centered on trust, identity, and speed. As attackers continue adapting their methods, organizations are placing greater emphasis on visibility, resilience, and the ability to distinguish suspicious behavior from normal activity before significant damage occurs.
The dealerships that appear best positioned for the year ahead are those that pair strong cybersecurity technology with the expertise to deploy, configure, monitor, and respond to it effectively.
Read the
Proton Cybersecurity 2026 Whitepaper for a deeper look at how ransomware, phishing, AI, identity-based attacks, and cloud risk are evolving, and what dealerships can do to stay ahead.
