Why Identity Protection Will Define Cybersecurity in 2026

In a new VMblog video feature on 2026 cybersecurity predictions, rf IDEAS President David Cottingham warns that AI-generated phishing messages are now nearly indistinguishable from legitimate communications, rendering traditional “red flag” spotting obsolete.

Cottingham explains that while some organizations feel they’ve “checked the box” on phishing training, attackers are using AI to automate identity theft at scale. This shift makes it critical to reduce reliance on human judgment alone and implement phishing-resistant authentication methods such as FIDO2 and smart card-based access.

He predicts that the next frontier in cybersecurity isn’t just data protection, it’s identity protection. Organizations must validate not only that a credential is valid, but that the person behind it is real. Cottingham outlines how the fusion of digital credentials, encrypted physical tokens, and biometric authentication will define trust in 2026, and why those who can achieve this without creating friction will be set up for success.