Cybersecurity experts warn that organisations face a more volatile threat landscape in 2026, as geopolitical tensions drive state-linked attacks and enterprises revisit older storage technologies in response to ransomware.UK lawmakers have introduced the Government Cyber Action Plan, which sets out measures that aim to strengthen cyber defences across vital public services. Security specialists say the move reflects a broader shift in both the nature of cyber threats and the types of defensive tools that enterprises now consider.Vendors and analysts expect cyber warfare, critical infrastructure risk and long-tail ransomware recovery to dominate board agendas through 2026.Geopolitics shiftSecurity leaders describe a growing overlap between traditional cyber crime and state-aligned campaigns. They say this blurs the line between criminal extortion and geopolitical disruption and raises the likelihood that organisations become unintended victims."The introduction of the Government Cyber Action Plan is an acknowledgement that as geopolitical tensions heighten, elevated levels of cybersecurity vigilance are required from every organisation, especially those involved in the delivery of key public services. For example, geopolitics has long been a driver of DDoS attack activity, but threat actors are targeting more intelligently, moving on from targeting government websites directly to hitting supporting service enablers and digital supply chains."A big change we have seen in 2025 is the immediacy of the relationship between real-world tensions and cyber activity. Attacks are now launched to coincide with individual political speeches or specific military operations. Private and public sector organisations can easily become collateral damage in geopolitically motivated attack campaigns."More sophisticated attack tools and the emergence of next-generation 'DDoS-as-a-Service' capabilities have removed barriers to entry to sophisticated attack capabilities, giving threat actors the ability to easily orchestrate complex campaigns. For defenders, this makes real-time intelligence** and adaptive defences more critical than ever," said Darren Anstee, Chief Technology Officer for Security, NETSCOUT.Enterprises that run critical national infrastructure and essential services face heightened scrutiny from regulators. They also face growing exposure to spill-over attacks that target suppliers and online intermediaries rather than government assets directly.DDoS evolutionSecurity professionals report an increase in distributed denial-of-service activity linked to political flashpoints and regional conflicts. Adversaries now combine higher volumes of traffic with more complex techniques that aim to exhaust both network capacity and security controls.Specialists say that so-called DDoS-as-a-service offerings on criminal marketplaces give less skilled actors access to attack tools and rentable botnets. These services automate aspects of reconnaissance and attack orchestration. They also reduce the cost and expertise required to launch disruptive campaigns.Defenders respond by investing in real-time telemetry and automated mitigation tools that adjust to changing attack patterns. They also seek better visibility across their own environments and their external service providers.Supply chain riskThe growing focus on digital supply chains reflects a pattern in which attackers bypass primary targets. They do this by compromising upstream or downstream entities such as managed service providers, hosting platforms or specialist software vendors.Security teams now assess risk beyond their own networks. They review contractual obligations on security controls. They also push for clearer incident reporting and joint response planning with partners.Industry observers say this trend places additional weight on the Government Cyber Action Plan and similar frameworks. These initiatives encourage baseline security practices and information sharing across public and private sectors.Ransomware responseWhile geopolitical campaigns draw attention, ransomware remains a persistent threat to enterprises of all sizes. Breaches that destroy or encrypt backups are prompting some organisations to re-evaluate their storage strategies and recovery processes."Companies are realising they can't do ransomware with a point product. There is no magic wand or silver bullet to deploy against a threat that can come from anywhere. IT teams and their organisations will need a deep defence, including building layers of security and using different protocols, processes, platforms and tech, and this means relying on tape," said Andrew Dodd, HPE Storage Worldwide Marketing Communications Manager, the LTO Programme.Security architects now talk about layered defence models that combine network controls, endpoint protection, identity security and data resilience measures. They separate data storage decisions from threat detection tooling. They also revisit offline or air-gapped backup methods that reduce the risk of simultaneous compromise.Return of tapeTape storage features in many of these discussions. Technology teams argue that offline, removable media reduces the attack surface during a ransomware incident because it is not continuously accessible over the network.Organisations in regulated sectors, such as financial services and healthcare, have used tape for long-term archiving. Some of these enterprises now extend its role into cyber recovery plans. They implement tiered backup architectures with a mix of disk, cloud and tape. They also test restore procedures from each tier.Vendors in the Linear Tape-Open ecosystem report increased interest from customers that experienced ransomware incidents. They say these customers often reassess the balance between rapid restore times and isolation from online threats.Resilience focusThe combination of state-linked attacks, commodity criminal tools and long dwell times inside networks pushes organisations to treat cyber incidents as an operational risk rather than only an IT issue. Boards ask for clearer metrics on recovery times and data loss. They also demand evidence of scenario planning that includes both disruptive DDoS events and destructive malware.Security consultants expect this year to bring more regulatory attention on incident reporting and resilience testing. They say this will affect not only critical infrastructure operators but also suppliers that connect to those environments."More sophisticated attack tools and the emergence of next-generation 'DDoS-as-a-Service' capabilities have removed barriers to entry to sophisticated attack capabilities, giving threat actors the ability to easily orchestrate complex campaigns. For defenders, this makes real-time intelligence** and adaptive defences more critical than ever," said Anstee.

The amount of data being produced is exploding, and storage needs greater attention

Sophos’ latest annual study explores the real-world ransomware experiences of 332 manufacturing and production organizations hit by ransomware in the past year. The report examines how the causes and consequences of these attacks have evolved over time.This year’s edition also sheds new light on previously unexplored areas, including the organizational factors that left firms exposed and the human toll ransomware takes on IT and cybersecurity teams within the sector.Download the report to explore the full findings.Exploited vulnerabilities and expertise shortfalls fuel ransomware incidentsExploited vulnerabilities are the leading root cause of ransomware attacks on manufacturing and production organizations, responsible for 32% of incidents. Malicious emails ranked second, with their share declining from 29% in 2024 to 23% in 2025.Multiple organizational factors contribute to manufacturing and production organizations falling victim to ransomware, with the most common being a lack of expertise (i.e., insufficient skills or knowledge available to detect and stop the attack in time) named by 42.5% of victims. It is followed in very close succession by unknown security gaps (i.e., weaknesses in defenses that respondents were unaware of), which contributed to 41.6% of attacks.Organizational root cause of attacks in manufacturing and productionData encryption sharply declines but extortion rates soarData encryption in the sector has dropped to its lowest level in five years, with 40% of attacks resulting in data being encrypted — the third lowest percentage recorded in this year’s survey and close to half the 74% reported by manufacturing and production organizations in 2024. In line with this trend, the percentage of attacks stopped before encryption reached a five-year high, indicating that manufacturing and production organizations are strengthening their defenses.However, adversaries are adapting: The proportion of manufacturing and production organizations hit by extortion-only attacks (where data wasn’t encrypted but a ransom was still demanded) surged to 10% of attacks in 2025 from just 3% in 2024 — the second highest rate reported in this year’s survey. This is likely due to the high value of intellectual property, complex supply chains, and the operational impact of downtime in manufacturing environments.Data encryption in manufacturing and production | 2021 – 2025Ransom payments persist while reliance on backups hold steadyWhile the proportion of manufacturing and production organizations paying the ransom to recover data has declined in the last year, over half (51%) still paid — well above 2022 (33%) and 2023 (34%) levels. Meanwhile, backup use remains steady at 58% in 2025, reflecting strong confidence in this data recovery method.Recovery of encrypted data in manufacturing and production | 2021 – 2025Ransom demands, payments and attack recovery costs fallRansomware economics in manufacturing and production shifted in 2025, with average ransom demands falling 20% to $1.2M (from $1.5M in 2024) and payments dropping from $1.2M to $1.0M. The decline was largely driven by fewer mid-range ($1M–$5M) demands and payouts, while extreme cases ($5M+) saw a slight uptick.At the same time, the mean cost of recovery (excluding any ransoms paid) has dropped nearly a quarter (24%) over the past year to $1.3M, down from $1.7M in 2024 and below the $1.5M global average in this year’s report.Collectively, these findings indicate that the sector is becoming more resilient and efficient in its ransomware response but still faces high-value outliers that skew the overall risk landscape.Ransomware takes a human toll, driving stress and anxiety among IT/cybersecurity teams within the sectorThe survey reveals that ransomware incidents have profound repercussions for IT and cybersecurity teams in the manufacturing and production sector. Nearly half of respondents (47%) reported increased anxiety or stress about future attacks, underscoring the lasting psychological impact of such events.Other common consequences include a shift in team priorities or focus (45%), heightened pressure from senior leadership (44%), and a sustained increase in workload (41%). Notably, the proportion of manufacturing and production respondents reporting these effects was higher than the cross-sector average across nearly all areas, highlighting the exceptional strain faced by teams in this industry. Download the full report for more insights into the human and financial impacts of ransomware on the retail sector.What Sophos is seeing in the manufacturing sectorIn addition to the findings of the report, over the past twelve months, Sophos X-Ops has observed ransomware activity across leak sites and found that 99 distinct threat groups targeted manufacturing organizations. The most prominent groups targeting manufacturing organizations based on leak site observations are GOLD SAHARA (Akira), GOLD FEATHER (Qilin) and GOLD ENCORE (PLAY).  Reflecting the trends in the report, over half of the ransomware incidents handled by Sophos Emergency Incident Response involved both data theft and data encryption, underscoring the continued rise of double extortion tactics where stolen data is held to ransom and threatened with publication on a leak site.About the surveyThe report is based on the findings of an independent, vendor-agnostic survey commissioned by Sophos of 3,400 IT/cybersecurity leaders across 17 countries in the Americas, EMEA, and Asia Pacific, including 332 from the manufacturing and production sector. All respondents represent organizations with between 100 and 5,000 employees. The survey was conducted by research specialist Vanson Bourne between January and March 2025, and participants were asked to respond based on their experiences over the previous year.

Ransomware targets small firms, but they're still not buying. Despite rising threat levels, new customer acquisition has stalled - one of the key ...

The LTO Program Technology Provider Companies (TPCs), Hewlett Packard Enterprise, International Business Machines Corporation and Quantum Corporation, today announced specifications for a new generation of LTO Ultrium data cartridges with 40 TB native capacity (up to 100 TB compressed, assuming 2.5:1 compression), extending the industry's most widely adopted open tape format for long-term, cyber-resilient, and energy-efficient data preservation. At the same time, the TPCs are optimizing the technology roadmap for future LTO products to better align with customer priorities regarding reliability, affordability and efficiency for managing colossal amounts of data.As organizations generate and retain unprecedented volumes of data to power AI, analytics, data insight, and compliance, the 40 TB LTO-10 cartridge offers enterprises and other large-capacity users superior storage density to efficiently archive greater amounts of information. This leap in capacity is made possible by innovations in the LTO-10 drive head design and a new, highly stable base film material, which together unlock the increased native media capacity of 40 TB. This new 40 TB cartridge is compatible with the same LTO-10 drive organizations are using for the 30 TB cartridge. "AI has turned archives into strategic assets," said Stephen Bacon, Vice President, Data Protection Solutions Product Management, HPE. "The new 40 TB LTO-10 cartridge will help enterprise-class organizations—across healthcare, financial services, media, research, manufacturing, the public sector and beyond—consolidate petabytes efficiently, strengthen cyber resiliency with true offline air-gapping, and keep long-term retention affordable and sustainable."Built for AI-Era Archives and Enterprise Scale The 40 TB LTO-10 cartridge achieves its breakthrough capacity by using an advanced base film technology known as Aramid. Aramid permits the manufacture of significantly thinner and smoother media, enabling longer tape lengths in a standard LTO Ultrium cartridge form factor. This material innovation provides an extra 10 TB of native capacity than the currently available 30 TB LTO-10 cartridge, which is manufactured using different materials.Built for AI-Era Archives and Enterprise ScaleOnce 40 TB LTO-10 cartridges are available, customers will be able to choose between the two different LTO-10 media types based upon their individual cost and capacity requirements, allowing for greater flexibility in media deployment. "Enterprises are moving from ad-hoc retention to intentional 'archive architectures' that serve AI, legal, and sustainability goals," said Jon Brown, Senior Analyst at Omdia. "This new 40 TB LTO-10 capacity point advances that architecture: fewer cartridges, fewer frames, lower energy and a stronger security posture."Roadmap OptimizationIn conjunction with the Aramid announcement, the TPCs are also optimizing the capacity roadmap for future generations of LTO technology, from Generation 11 through Generation 14. This will result in a new outlook for the projected capacities to be delivered in each generation, peaking with a 913 TB cartridge at Generation 14. The revised LTO roadmap is tightly aligned with anticipated storage requirements in the coming years and gives the technology space to grow should users require it. The new capacity points will prioritize reliability and compelling value in terms of cost per terabyte, and ensure everyday LTO Ultrium tape solutions will remain a practical and affordable storage choice for every type of business or workload. Meanwhile, the new maximum capacity of 913 TB for LTO-14 will reduce the time needed to store and recover data, while preserving exabyte-scale growth paths for tape libraries. The roadmap ensures LTO tape technology will remain the most reliable, affordable, and efficient way to archive AI-scale data for the next decade.40 TB Cartridge AvailabilityMedia qualification and interchange testing will begin directly after this announcement, with the expectation that 40 TB products will be available for shipment in the first calendar quarter of 2026. Buyers seeking LTO Ultrium format-compliant products should look for the LTO Ultrium format verification trademarks on both tape drives and data cartridges. Storage and media manufacturers interested in licensing LTO formats may obtain information by contacting the LTO Program at www.lto.org/contact-us/. Organizations can evaluate multi-year Total Cost of Ownership and sustainability impacts using the LTO Ultrium TCO Tool and by consulting their preferred solution providers.

LTO’s 40TB cartridge pushes tape storage into the AI-driven futureAramid film gives magnetic tape the strength to expand its lifespanMagnetic tape storage remains the cheapest offline safeguard for critical enterprise dataLong dismissed as outdated technology, magnetic tape storage continues to defy predictions of extinction.The LTO Program, a collaboration between HPE, IBM, and Quantum, has unveiled a new generation of LTO Ultrium cartridges offering 40TB of native capacity.The development coincides with a renewed roadmap stretching to Generation 14, which targets a 913TB capacity milestone.A new approach to tape materialsThe 40TB LTO-10 cartridge’s capacity increase is largely driven by “Aramid,” a new base film material that enables thinner and smoother tape, allowing for longer tape lengths without expanding the cartridge’s size.Combined with refinements to drive head design, the new media achieves an additional 10TB over the 30TB model while remaining compatible with existing LTO-10 drives.“Enterprises are moving from ad-hoc retention to intentional ‘archive architectures’ that serve AI, legal, and sustainability goals,” said Jon Brown, Senior Analyst at Omdia.“This new 40TB LTO-10 capacity point advances that architecture: fewer cartridges, fewer frames, lower energy, and a stronger security posture.”Are you a pro? Subscribe to our newsletterSign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!The upgrade targets enterprises that need to store large datasets over decades, from scientific research to financial records, while keeping power and maintenance costs low.Alongside the 40TB announcement, the Technology Provider Companies have adjusted their roadmap for upcoming LTO generations, spanning from LTO-11 to LTO-14.The roadmap now peaks at an ambitious 913TB per cartridge, aligning with projected increases in storage demand from AI and data-intensive applications.“AI has turned archives into strategic assets,” said Stephen Bacon, Vice President, Data Protection Solutions Product Management, HPE.“The new 40TB LTO-10 cartridge will help enterprise-class organisations—across healthcare, financial services, media, research, manufacturing, the public sector and beyond—consolidate petabytes efficiently, strengthen cyber resiliency with true offline air-gapping, and keep long-term retention affordable and sustainable.”By prioritizing cost per terabyte, reliability, and long-term scalability, the revised plan aims to keep tape competitive in a landscape increasingly dominated by solid-state performance.The roadmap also accounts for faster storage and retrieval processes, supporting exabyte-scale infrastructure growth across industries.Testing for the new 40TB cartridges will begin shortly, with availability expected in early 2026.Despite Elon Musk’s public dismissal of older storage formats, tape continues to serve a specific function that neither flash drives nor SSD systems can replace.Its offline nature provides a defence against cyberattacks and data loss from hardware failure.This new roadmap suggests that tape will not only survive the AI era but continue adapting to it.Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.