The future of cybersecurity: what actually changes by 2030

Cybersecurity coverage alternates between doom and vendor marketing. Let me do it plainly: what's actually changing by 2030, what isn't, and what you should do this year if you build or defend software — no fear, no hype, no panic-buying.

What is genuinely changing

• AI vs AI is the new fight — agents probing for exposed RCE, drafting phishing that passes, and triaging alerts on defense. The asymmetry is brutal: offense needs one hole, defense needs every hole closed. Expect agentic attack tools to get commoditized.
• Identity is the new perimeter — passwords are dying; passkeys and device-bound credentials win because they're both better UX and better security. If your auth plan is still 'long password + SMS code', redesign it.
• Deepfakes and voice fraud — finance and ops teams get socially engineered by cloned voices of their own CFO. Verification over the phone dies; out-of-band confirmation (approval in a separate signed channel) becomes normal.
• Supply chain attacks — npm/PyPI/CI running as code execution with your secrets sitting inside. SBOMs, pinned dependencies, and CI with minimal credentials stop being compliance theater and become table stakes.
• Agent-permission creep — AI agents with write access to your repos, your cloud, your email. Scoping agent permissions like production service accounts is this decade's most skipped control.

What doesn't change

Humans click things. Phishing remains the #1 initial access vector in every honest dataset — the content of the lures gets smarter, the psychology doesn't. Patching, MFA, least privilege, backups you actually test: 90% of real-world wins still come from doing the boring basics reliably.

What I'd do this year, practically

• Replace password+SMS with passkeys on everything you own; TOTP as the floor for the rest.
• Turn on MFA everywhere — especially email, which resets everything else.
• Audit your CI/agent tokens: least privilege, short lifetimes, no long-lived secrets in repos.
• Backups: 3-2-1, one offline — and restore once, see if it works.
• If you run software for others: dependency review (Dependabot on), pin actions, SBOM for the serious stuff.

Career notes for the curious: the winning defenders in 2030 will combine security fundamentals with automation fluency — Python, detection-as-code, agent orchestration — not rote memorization of 400 CVE numbers. Learn the craft, then teach the machines to assist it.