Geopolitics and the cyber resilience gap belong in your threat model
In this Help Net Security interview, Akshay Joshi, Head of the Centre for Cybersecurity at the World Economic Forum, talks about how AI, geopolitics and industrialized fraud are changing cyber risk. He discusses findings from the Global Cybersecurity Outlook 2026, including that CEOs now rank cyber-enabled fraud above ransomware as their top concern.
Joshi explains the widening resilience gap between large and small organizations and between regions, the role of skills shortages, and what public-private cooperation needs to work at scale. He also offers advice for CEOs and boards.
How would you describe the current cybersecurity landscape in one or two sentences, and what has changed most over the past year?
Cybersecurity is entering a new phase: AI is accelerating the threat landscape, geopolitical fragmentation is increasing systemic exposure, and cyber-fraud has become industrialized. This trifecta is changing the speed and scale at which cyber risk unfolds, calling for better governance; stronger collaboration and the ability to turn emerging technology into a source of resilience as speed and control are what have changed most.
What findings from the Forum’s recent cybersecurity research surprised you most, and what should leaders take from them?
One of the most striking findings in the Global Cybersecurity Outlook 2026 is the scale at which cyber-enabled fraud has become part of everyday life. 73% of respondents said they or someone in their network had been personally affected by cyber-enabled fraud in 2025, while 77% reported an increase in fraud and phishing. Unsurprisingly, CEOs now rank cyber-enabled fraud and phishing as their top cyber concern, ahead of ransomware.
Cyber-enabled fraud directly affects customers, employees and organizations, eroding trust in the digital economy. Addressing it therefore requires leaders to look beyond protecting their own networks and strengthen prevention, response, and collaboration across technology companies, financial institutions, telecommunications providers, governments and law enforcement.
How is AI changing the balance between attackers and defenders? Where do you see the biggest risks and the biggest opportunities?
AI is accelerating cyber offence and defense, driving a shift from human-paced operations towards autonomous, machine-speed activity. Frontier AI models are reshaping not only the cybercrime landscape and the capabilities available to attackers and defenders, but also how we think about security, governance and oversight.
According to our research, 87% of respondents identify AI-related vulnerabilities as the fastest-growing cyber risk. This concern is compounded by the emerging possibility of AI agents operating as independent threat actors, exhibiting goal-directed behaviors such as self-preservation and resource acquisition, and coordinating complex cyber operations in ways that challenge existing approaches to governance and defense.
In times when technological progress raises a critical security question, the opportunity is significant and it depends on getting the fundamentals right. Governments, regulators and industry must work together to put security at the heart of how AI is designed and deployed, ensuring that humans are making and accountable for high-impact decisions. For frontier AI developers, this means building internal controls to ensure AI is developed safely, complemented by credible external review and oversight. For adopters, it means harnessing AI to strengthen the defender’s advantage: as attackers automate and scale reconnaissance, exploitation and fraud, defenders can use AI to detect threats, investigate incidents and respond with greater speed and efficiency.
How are geopolitical tensions shaping the threat environment for businesses and critical infrastructure?
Geopolitics has become one of cybersecurity’s defining variables, while cyber capabilities are increasingly part of geopolitical competition itself. Our research finds that 91% of the largest organizations have changed their cybersecurity strategies in response to geopolitical volatility, while 64% of organizations now factor geopolitically motivated attacks into their risk mitigation strategies.
At the same time, confidence in national preparedness is eroding. 31% of respondents report low confidence in their country’s ability to respond to a major cyber incident. That confidence is also highly uneven: 84% of respondents in the Middle East and North Africa express confidence in their country’s ability to protect critical infrastructure, compared with just 13% in Latin America and the Caribbean.
For businesses and governments, this means cyber resilience can no longer be assessed solely through technical vulnerabilities. Leaders must understand geopolitical exposure, critical infrastructure dependencies, supply-chain concentration and national response capacity, particularly as digital infrastructure itself increasingly becomes a strategic target.
The gap in cyber resilience between large and small organizations, and between regions, appears to be widening. Why is that, and what can be done to close it?
The cyber resilience gap is fundamentally a capability and investment gap. Our research finds that smaller organizations are twice as likely as larger ones to report insufficient cyber resilience, while significant regional disparities persist, with the highest levels of resilience reported in the Middle East and North Africa and the lowest in Latin America and the Caribbean and sub-Saharan Africa.
The reason is access to skills, resources and institutional capacity. For example, 85% of insufficiently resilient organizations report lacking the workforce needed to meet their cybersecurity objectives, compared with just 22% of highly resilient organizations. Highly resilient organizations are also much more likely to integrate security into procurement, regularly assess AI tools, monitor operational technology and exercise incident response with ecosystem partners.
Closing that gap means investing in the foundations of resilience which are skills, shared capabilities, recovery capacity and sustained financing as well as directing resources to where vulnerability is greatest. Ultimately, it is important to see that this is not just an equity issue. It is a systemic resilience issue. In an interconnected digital economy, underinvestment in one part of the ecosystem can create risk for everyone.
How serious is the cybersecurity skills shortage today, and which approaches are proving effective?
Cyber skills shortages as a key driver of inequity. Our research shows that skills are one of the differentiators between resilient and insufficiently resilient organizations: 85% of organizations reporting insufficient resilience also face critical skills and talent gaps, compared with just 22% of highly resilient organizations.
Organizations need to broaden the talent pipeline, continuously upskill existing employees and embed cybersecurity capabilities across business and technology functions. There is also an opportunity to use AI to augment scarce expertise, helping human detect and analyze threats, automate repetitive tasks and respond faster. Ultimately, closing the skills gap is essential to closing the resilience gap. If advanced cyber capabilities remain concentrated in organizations and economies that can afford talent, technological progress risks widening rather than reducing existing cyber inequities.
Several leaders argue that more than a skills gap, the cybersecurity industry has an experience gap. It is crucial to ensure we focus on training and provide exposure to the workforce to complex challenges.
What does effective public-private cooperation look like in practice, and where is it still falling short?
Effective public-private cooperation means moving from sharing information to shared commitment and coordinated action. The Global Cybersecurity Outlook 2026 shows that highly resilient organizations are already doing this: 48% of CEOs of highly resilient organizations are increasing collaboration with government agencies and information-sharing groups. We’ve seen public-private partnerships through the Partnership Against Cybercrime initiative that combines intelligence, technology and steady collaboration with law-enforcement authorities to disrupt cybercrime in ways no actor could achieve alone.
Where we still fall short is in making that cooperation systematic, scalable and accessible. As pointed above that collaboration remains easier for large, well-resourced organizations, while smaller organizations and less-resourced ecosystems often lack access to the same intelligence, expertise and partnerships. The priority now is to build trusted mechanisms for intelligence sharing, joint preparedness and coordinated response before a crisis occurs, while raising the collective baseline so that cooperation strengthens the whole ecosystem rather than only its strongest participants.
If you could give one piece of advice to a CEO or board member reading this piece, what would it be?
Treat cybersecurity as an enabler of business resilience. Our research shows that the most resilient organizations distinguish themselves through stronger CEO engagement, greater collaboration and more proactive approaches to emerging risks such as AI, geopolitics and supply-chain dependencies.
For CEOs and boards, that means understanding organizational dependencies, knowing what disruption would cost, and investing to safeguard against real exposure rather than simply meeting compliance requirements. In an environment where cyber disruption can affect operations, supply chains, customers and trust, resilience has to be part of business strategy and leadership accountability.
Download eBook: Identity-First Threat Intelligence
