This article is based on analysis and predictions originally published by SDxCentral in December 2019. It is presented here as a record of industry thinking heading into 2020, with context added for technical readers.
Introduction: Why Cybersecurity Predictions Matter
Cybersecurity is defined by a constantly shifting threat landscape. Attack vectors evolve, tooling matures, and threat actors adapt faster than most organizations can respond. Heading into 2020, several important trends were converging: accelerating cloud adoption, the early rollout of 5G networks, increasing use of artificial intelligence by both defenders and attackers, and a wave of industry consolidation. The following five predictions capture where security practitioners and analysts believed the industry was heading — and why each area deserved attention.
1. More Security M&A Activity
Consolidation in the cybersecurity market was already well underway by the end of 2019. According to Momentum Cyber’s Cybersecurity Market Review for Q3 2019, the third quarter of that year reached a record high, comprising 146 transactions valued at more than $15.5 billion. This included 39 mergers and acquisitions worth approximately $13 billion, plus 107 financing transactions totalling $2.5 billion.
The prediction for 2020 was straightforward: niche and emerging security vendors would continue to be acquired by larger, more established players seeking to fill capability gaps quickly rather than build internally. The strategic rationale was clear — buying proven technology accelerates time-to-market and eliminates a competitive threat in a single move.
A prominent example from late 2019 was VMware’s acquisition of Carbon Black, a move that signalled the intent of major infrastructure vendors to embed security directly into their core platforms rather than treat it as an add-on. VMware projected that the Carbon Black business would contribute approximately $1 billion in revenue in the near term. This “security baked in” philosophy — rather than bolted on — represented a meaningful architectural shift in how enterprise security is delivered.
2. Open Source Security Takes Hold
The security industry has historically been slower to adopt open source practices than other technology sectors, often citing concerns about exposing vulnerability information or undermining commercial differentiation. By the end of 2019, however, several significant open source security initiatives suggested that attitude was changing.
Google and a coalition of partners launched OpenTitan, an open source project focused on silicon root of trust (RoT). The project aimed to produce a reference design for a RoT silicon chip, along with integration guidelines for use in data center servers, storage hardware, and other devices. Establishing a hardware-level root of trust is fundamental to supply chain security — if you cannot verify the integrity of the silicon, you cannot fully trust anything running above it.
Separately, IBM Security and McAfee co-founded the Open Cybersecurity Alliance (OCA), an initiative organized under OASIS (the Organization for the Advancement of Structured Information Standards). The OCA’s stated goal was to create interoperable security technologies through shared open source code and content, reducing the friction caused by siloed, vendor-specific security tooling. Interoperability remains a genuine pain point in enterprise security stacks, where teams often manage dozens of tools that do not natively communicate.
The prediction was that 2020 would see broader industry adoption of open source security frameworks, driven by growing customer demand for transparency, collaboration, and vendor-neutral tooling.
3. Security Moves to the Edge
As workloads have moved from centralized data centers to distributed cloud and edge environments, the traditional perimeter-based security model has broken down. Routing all traffic through a central security stack introduces latency and becomes a bottleneck — an unacceptable tradeoff when low-latency connectivity is a core business requirement.
The emerging answer in 2019 was to distribute security capabilities closer to where users, applications, and devices actually operate. Several vendors were already building in this direction:
- Netskope launched its NewEdge infrastructure to deliver cloud security services with lower latency by positioning security closer to cloud on-ramps.
- Forcepoint rearchitected its Web Security platform with edge delivery in mind.
- Palo Alto Networks positioned its Prisma Cloud platform as a cloud-delivered security service spanning multiple environments — what analyst firm ESG described as an “elastic cloud gateway” model.
Palo Alto Networks also announced a partnership with Google Cloud to develop a multi-cloud security framework using Prisma Cloud. The prediction for 2020 was that edge-delivered security would shift from a differentiator to a baseline expectation, especially as 5G and IoT deployments expanded the number of endpoints requiring protection.
“We see a lot of vendors heading this way and we do see this as the way all should or will move in the future.”
Doug Cahill, Senior Analyst and Director of Cybersecurity Practice, ESG
4. AI Will Accelerate Both Security Response and Attacks
Artificial intelligence and machine learning were already being applied to security operations by 2019, primarily for threat detection and anomaly identification at a scale and speed that human analysts cannot match. The volume of telemetry generated by modern cloud environments, endpoint agents, and network flows makes manual triage effectively impossible without automation.
However, the same capabilities that make AI valuable for defenders also make it valuable for attackers. The prediction heading into 2020 was that AI-enabled offensive techniques would become more prevalent. Specifically, security vendor Blue Hexagon forecast that malware using AI models to evade sandbox analysis would emerge. Traditional sandbox evasion relies on static rules to detect a sandbox environment — for example, checking for signs that the malware is running in a virtual machine rather than on real hardware. AI-based evasion would allow malware to more accurately analyze its execution environment, making sandbox-based detection less reliable.
Blue Hexagon CTO Saumitra Das wrote: “As a result of these malware author innovations and existing limitations, the sandbox will become ineffective as a means to detect unknown malware.”
The broader implication for security teams is that AI is not a silver bullet. As defenders adopt AI-assisted tooling, adversaries adapt. Security operations need to treat AI as one layer of a defense-in-depth strategy, not a replacement for other detection and response mechanisms.
5. 5G Security Becomes a Real Concern
Commercial 5G network deployments began rolling out at scale in 2020, and with them came a new and significantly larger attack surface. Unlike previous generations of mobile networks, 5G is built on a more complex, software-defined architecture. This introduces both the flexibility of software-driven networking and the corresponding security risks of software vulnerabilities, misconfiguration, and supply chain exposure.
Key concerns identified by security researchers and vendors heading into 2020 included:
- Expanded attack surface: 5G networks are designed to connect billions of IoT devices. Each additional endpoint is a potential entry point for attackers. IoT devices are notoriously difficult to patch and often remain in service for years beyond their intended security support window.
- IoT traffic interception: Vulnerabilities in 5G protocols could allow attackers to snoop on IoT traffic or remotely compromise IoT devices — including, in some scenarios, reprogramming them entirely.
- Supply chain risk: The hardware and software components that make up 5G infrastructure come from a broad set of vendors, each with their own security posture. CEO Saryu Nayyar of Gurucul noted: “The vast 5G supply chain is susceptible to the introduction of vulnerabilities such as malicious software or hardware and poor designs.”
- Confidentiality and availability impacts: Compromised network assets can affect both the confidentiality of data in transit and the availability of services, with downstream consequences for enterprises and consumers relying on 5G connectivity.
Saumitra Das of Blue Hexagon summarized the architectural challenge: “This new architecture means services will operate within a more complex environment with a broader attack surface that requires more security diligence on the part of the service providers.”
Key Takeaways for Security and DevOps Teams
Looking at these predictions together, several themes are relevant for DevOps and platform engineering teams responsible for securing their organizations:
- Consolidation creates integration opportunities — as vendors merge, watch for improved native integrations between security tooling and infrastructure platforms.
- Open source security frameworks reduce lock-in — initiatives like OCA and OpenTitan create vendor-neutral foundations worth tracking for enterprise adoption.
- Security architecture must follow workload architecture — if your workloads run at the edge or in multiple clouds, your security controls need to follow them there.
- AI-assisted detection requires adversarial thinking — assume attackers will probe and probe your detection models; build for resilience, not just detection accuracy.
- 5G and IoT demand explicit security design — connected devices should be treated as untrusted endpoints by default, with network segmentation and least-privilege access enforced at the infrastructure level.
Originally sourced from SDxCentral (December 2019). Quotes and statistics are attributed to their original sources as cited in the SDxCentral article.