An overwhelming 98% of chief information security officers (CISOs) expect a surge in cyber-attacks over the next three years as organisations face an increasingly complex digital threat landscape.

A new report from cybersecurity firm CSC, CISO Outlook 2025: Navigating Evolving Domain-Based Threats in an Era of AI and Tightening Regulation names cyber-squatting, domain and Domain Name System (DNS) hijacking, as well as distributed denial-of-service (DDoS) attacks as the top three global cyber threats facing firms, with risks projected to escalate as cybercriminals leverage new techniques using AI.

AI-powered domain generation algorithms (DGAs) are particularly worrisome, with 87% of CISOs identifying them as a direct threat, while 97% of security leaders voiced concerns about the potential risks associated with granting third-party AI systems access to company data.

With concerns spiralling, only 7% of CISOs expressed being ‘very confident’ in their ability to mitigate domain-based attacks, and just 22% believe they have the right tools in place. 

These worries may reflect deeper gaps in preparedness, and with CSC claiming the data could show that many organisations still underestimate the complexity of domain security and the speed at which threats are evolving.

That’s despite 67% of CISOs rating DNS cyber-threats as either significant or critical, and a staggering 99% of firms admitting that they’re concerned about their domain registrars not following Know Your Customer policies to verify the identities of clients and suppliers.

Added to that, just half (50%) of CISOs said that their company has developed and regularly tests its incident response plans, or uses an AI-based monitoring and enforcement solution.

Recommended reading

• 87% of Firms Hit By AI Cyber-attacks
• ‘Shadow AI’ Use Is Threatening Enterprise Data Security
• CISOs Seeing More Impact from AI Cyber Threats

The study shows that part of the issue is that CISOs are still struggling with menial budgets, with only 7% reporting their overall budget for cybersecurity, information security, and management had increased significantly between 2024 and 2025, despite the rise in AI-powered threats. 

“DNS and domain-related infrastructure are prime targets for cybercriminals,” says Ihab Shraim, chief technology officer for CSC’s digital brand services division. 

“With the growing availability of AI-driven tools and off-the-shelf attack kits, these threats are only going to accelerate. 

“A single DNS compromise can take down email, websites, customer portals, and even phone networks. Companies that don’t act quickly may find themselves navigating not just technical fallout, but reputation and regulatory consequences as well.”