Global Cybersecurity Outlook 2025
Opportunities and Risks in Cybersecurity Derived from the World Economic Forum (WEF)
Today's cyberspace is more complex than ever before. Following decades of relative stability, the world is now marked by increased geopolitical conflicts, the growing prowess of cybercriminals, and rapid advances in emerging technologies. This escalating complexity presents a profound challenge to achieving cyber resilience, with significant consequences for organizations and nations. Cyber insecurity is identified as a global risk across multiple time horizons, threatening supply chains, financial stability, and democratic systems. The financial toll is staggering, with losses from cybercrime estimated to have exceeded $12.5 billion in 2023 according to the FBI. Recent incidents, such as a global IT outage that disrupted numerous critical sectors and caused an estimated $5 billion in losses, starkly underscore the vulnerabilities inherent in our increasingly interconnected digital world. Leaders must adopt a security-first mindset in this complex environment.
Why should I care as a business owner?
Business leaders today face a confluence of compounding factors driving this complexity, presenting significant pain points. A key challenge is the increased integration of and dependence on complex supply chains, leading to a more opaque and unpredictable risk landscape. Supply chain challenges are the leading cybersecurity risk for organizations, with 54% of large organizations identifying them as the biggest barrier to achieving cyber resilience. Concerns centre on software vulnerabilities introduced by third parties and the propagation of attacks throughout the ecosystem. Lack of visibility and oversight into the security levels of suppliers is a major issue. Adding to this, dependence on a limited number of critical providers can create systemic points of failure, with cyberattacks or outages causing far-reaching consequences. Managing third-party compliance with security requirements is also a significant challenge.
Another major concern stems from the rapid adoption of emerging technologies, particularly AI, which contributes to new vulnerabilities. While 66% of organizations expect AI to have the most significant impact on cybersecurity in the coming year, only 37% have processes in place to assess the security of AI tools before deployment. This creates a paradox where organizations race to adopt AI without necessary security safeguards, potentially introducing vulnerabilities. Small organizations are particularly exposed, with 69% lacking adequate safeguards for secure AI deployment, exacerbating cyber inequity. Furthermore, cybercriminals are harnessing AI effectively to enhance the sophistication and scale of attacks. Adversarial advances powered by Generative AI are a primary concern for nearly 47% of organizations. These tools lower the cost and required expertise for cybercrime, enabling sophisticated attacks like deepfake impersonations of senior leaders used for fraud. Phishing and social engineering attacks have seen a sharp increase, partly due to AI augmentation.
The proliferation of regulatory requirements around the world adds a significant compliance burden. Over 76% of CISOs report that the fragmentation of regulations across jurisdictions greatly affects their organizations' ability to maintain compliance. Many respondents find regulations too complex, too numerous, or struggle to verify third-party supplier compliance. This intricate "regulatory jigsaw puzzle" can sometimes detract from developing customized, risk-based strategies.
These challenges are exacerbated by a widening cyber skills gap. Two out of three organizations report moderate-to-critical skills gaps, including a lack of essential talent and skills. Only 14% of organizations are confident they have the necessary people and skills today. This shortage leaves organizations vulnerable to sophisticated attacks. The demand for professionals skilled in operating AI and defending against it is growing, yet 67% of leaders noted a shortfall in investments in AI skills within their organizations. Furthermore, burnout among cybersecurity professionals poses a significant retention challenge.
Escalating geopolitical tensions are also a major factor, influencing the cybersecurity strategy of nearly 60% of organizations. Geopolitical turmoil affects the perception of risks, with CEOs citing cyber espionage and loss of sensitive information/IP theft as top concerns. State-sponsored attackers are increasingly targeting not just governments but also economies and critical infrastructure, with organizations risking becoming collateral damage. The spillover from nation-state threats into the cybercriminal domain further complicates the landscape. Critical infrastructure, including energy, water, telecommunications, and space technologies, is increasingly targeted.
This complexity fuels cyber inequity, widening the gap between organizations with sufficient resources ("cyber haves") and those struggling ("cyber have-nots"). Some 35% of small organizations believe their cyber resilience is inadequate, a proportion that has increased sevenfold since 2022. By contrast, the share of large organizations reporting insufficient cyber resilience has nearly halved. 71% of cyber leaders believe small organizations have reached a critical tipping point where they cannot adequately secure themselves against rising cyber risks. This inequity extends to regions, with less confidence in critical infrastructure preparedness in Africa and Latin America compared to Europe and North America. The public sector is also disproportionately affected by insufficient resilience and workforce shortages compared to medium-to-large private organizations. Since the overall resilience of the ecosystem is determined by its weakest links, this inequity creates systemic vulnerabilities.
Business leaders also face challenges in quantifying cyber risks and their economic impacts, making it difficult to assess the required investment and balance it with competing priorities. While leaders increasingly integrate cyber-risk management into enterprise risk management, fewer than half of CEOs believe their organizations invest enough.
Despite these formidable challenges, there is a compelling case for prioritizing cybersecurity. Framing cybersecurity as a critical investment for the future rather than a mere expense is essential. Leaders have the opportunity to build resilient ecosystems and safeguard the benefits of digitalization for all. Achieving cyber resilience ensures the organization's ability to minimize the impact of significant cyber incidents on its primary goals and objectives. Proactive security measures, while costly, are negligible compared to the financial consequences of an attack. Effective cybersecurity is not just about technical defence; it's about safeguarding the business's bottom line, long-term viability, market share, brand trust, and customer confidence. It supports business continuity and digital trust. Organizations that embrace proactive risk management and collaborative approaches can reduce disparities and address systemic vulnerabilities. Leaders who have the resources to help those without them can enhance the resilience of the entire ecosystem. Ultimately, building resilience demands a shift in perspective, recognizing cybersecurity as a collective responsibility.
What can you do?
To navigate the increasing complexity and build resilience, business leaders can take several actionable steps:
Adopt a Security-First Mindset and Integrate Cyber Risk into Business Strategy: View cyber risk not purely as an IT problem but as an overall business risk. Translate technical risk into business impact, quantifying risks and their economic effects to align investments with core business objectives. Ensure leadership engagement and oversight, with boards receiving regular updates on cyber risks and trends.
Strengthen Supply Chain Cybersecurity: Recognise that supply chain interdependencies are a top risk. Enhance visibility into third-party dependencies and work to enforce security standards on suppliers. Implement secure software development practices and explore standardization or certification for greater trust. Invest in your own business resilience strategies, not relying solely on critical providers like SaaS partners.
Adopt AI Securely: Implement processes to assess the security of AI tools before deployment. Foster a strong cyber culture as central to integrating AI safely. Define the right risk tolerance for AI technologies, govern their deployment, and ensure consistency with organizational policies and regulations. Understand organization-specific vulnerabilities related to AI adoption.
Address the Cyber Skills Gap: Acknowledge the critical workforce shortage. Invest in upskilling current employees and recruiting from non-traditional backgrounds beyond traditional cyber degrees. Leverage AI to augment human capabilities, focusing on training the workforce to harness AI for positive outcomes. Rethink recruitment practices and prioritize retention strategies, including addressing burnout and promoting employee well-being.
Foster Collaboration and Information Sharing: Recognize that sophisticated, borderless cybercrime demands a unified response. Engage in stronger collaboration between public and private sectors. Participate in information-sharing and threat intelligence initiatives, for example, through CERTs or ISACs. Embrace an ecosystem-based approach for collective defence.
Improve Incident Response Capabilities: Accept that 100% security is unattainable; focus on developing adaptable strategies to minimize impact. Foster a security culture that incentivises incident reporting through training, support teams, anonymous channels, and non-punitive policies. Develop and utilize cyber-incident response playbooks tailored to incident types.
Contribute to Reducing Cyber Inequity: Larger, more resilient organizations have an incentive to support smaller, less-capable entities to enhance ecosystem resilience. This can involve sharing knowledge or supporting initiatives aimed at capacity building and providing resources to struggling sectors or regions. Advocate for government incentives for SMEs to adopt proactive security measures.
Maintain Foundational Cyber Hygiene: Amid rapid technological change, do not neglect the basics. Continuously prepare to respond to threats by focusing on foundational practices and vulnerability management.
Integrate IT and OT Security: Recognize that organizational resilience requires addressing IT and OT security holistically, as they can no longer be treated in isolation. Implement "security by design" and "security by operations," including continuous monitoring and regular assessments for operational environments.
Prepare for Quantum Threats: While the full impact is uncertain, quantum security risks are present. Begin conducting risk assessments and develop a quantum-readiness strategy. Stay informed about and consider adopting post-quantum cryptography standards and related technologies.
Addressing complexity requires decisive leadership action and treating cybersecurity as a strategic imperative rooted in its economic implications. By implementing these actions, leaders can build resilience that permeates the entire organization and contributes to a more secure digital ecosystem for all.