What the research shows
The World Economic Forum's Global Cybersecurity Outlook 2026, published in January, puts AI at the centre of cyber risk. 94% of respondents expect AI to be the most significant driver of change in cybersecurity in the year ahead, and 87% identified AI-related vulnerabilities as the fastest-growing cyber risk over 2025. The share of organisations assessing the security of AI tools nearly doubled, from 37% to 64%.
Geopolitics remains the top factor in risk strategies. 64% of organisations account for geopolitically motivated attacks, such as disruption of critical infrastructure or espionage, and 91% of the largest organisations have changed their cybersecurity strategies because of geopolitical volatility. 31% of respondents have low confidence in their country's ability to respond to a major incident, up from 26%.
Fraud has reached the boardroom. 73% of respondents said they or someone in their network had been affected by cyber-enabled fraud during 2025. Chief executives now rank fraud as their top cyber concern, while security chiefs remain more focused on ransomware and supply-chain resilience. In PwC's 2026 CEO Survey, 31% of CEOs cite cyber risk as a major threat, up from 24% a year earlier.
Supply chains are the largest exposure for big companies: 65% of large firms name third-party and supply-chain vulnerabilities as their greatest challenge, up from 54% in 2025. Verizon's 2026 Data Breach Investigations Report, covering incidents from November 2024 to October 2025, finds that 31% of breaches now start with an exploited software vulnerability, overtaking stolen passwords as the main way in, and that 48% of breaches involve ransomware, even as payouts shrink.
What comes next
- Attackers will keep using AI to scale fraud, phishing and vulnerability discovery, while defenders use agents for detection and response.
- Customers and regulators will ask for more evidence of third-party and supply-chain controls.
- AI agents will need identities and permissions managed like any privileged account.
What it means for leaders
- Assess the security of every AI tool and agent before deployment.
- Treat cyber-enabled fraud as a board-level risk alongside ransomware.
- Map critical third-party and cloud dependencies, and rehearse recovery from their failure.
- Shorten patching cycles for internet-facing systems, now the most common entry point.
