For 2026, leaders should fund controls that make AI use safer, keep critical services running through disruption, reduce fraud and identity risk, and speed remediation of high-risk vulnerabilities. They should also make secure-by-design requirements and executive accountability part of procurement and incident planning. The World Economic Forum’s 2026 findings explain the urgency; CISA guidance and goals provide practical U.S. examples for turning those concerns into action.
What are leaders most concerned about in 2026?
The World Economic Forum’s 2026 survey points to three connected pressures: AI-related change, geopolitical disruption, and cyber-enabled fraud. These figures describe respondents’ views and reported experiences; they are not counts of attacks or estimates that one factor caused another.
- AI: 94% of respondents identified AI as the most significant driver of cybersecurity change in 2026. Separately, 64% reported having processes to assess AI-tool security, up from 37% in 2025. The WEF also reported that 87% identified AI-related vulnerabilities as the fastest-growing cyber risk during 2025.
- Geopolitics and resilience: 64% of organizations said they account for geopolitically motivated cyberattacks in mitigation strategies. Among public-sector organizations, 23% reported insufficient cyber-resilience capabilities.
- Fraud: 73% of respondents said they or someone in their network was personally affected by cyber-enabled fraud in 2025. CEOs ranked fraud as their leading concern, while CISOs continued to rank ransomware and supply-chain resilience near the top.
Those findings come from the World Economic Forum’s 2026 cybersecurity outlook. They show perceived shifts in risk and reported personal exposure, not the probability that a particular organization will be attacked. As WEF Managing Director Jeremy Jurgens put it, “Cybersecurity risk in 2026 is accelerating, fuelled by advances in AI, deepening geopolitical fragmentation and the complexity of supply chains.”
What should the board fund first?
There is no universal ranking: a payment processor, a public agency, and a manufacturer will have different critical services and exposures. A practical starting point is to compare proposed investments against business impact, coverage, delivery time, recovery value, accountability, supplier dependence, and measurable progress against NIST Cybersecurity Framework (CSF) outcomes or CISA goals.
#1 Best Overall
- Likely loss reduction: Which important failure or fraud scenario does the investment address?
- Coverage: Does it protect critical systems, identities, data, or dependencies—or only a narrow part of the environment?
- Time to protection: How soon can the control be deployed and used consistently?
- Resilience and recovery: Does it help keep a critical function available or restore it after disruption?
- Ownership and evidence: Who is accountable, and what measure will show whether the control is operating?
- Supplier dependence: Does the investment rely on a vendor or service whose security, support, or continuity needs scrutiny?
Use that comparison to agree on a short list of funded outcomes, named owners, and measures—not just a list of tools. CISA’s executive guidance emphasizes critical business functions, continuity testing, lower reporting thresholds, and response exercises that include senior leaders and board members.
1. Secure AI adoption before usage outpaces oversight
AI security is a governance and asset-management issue as well as a technical one. The WEF’s finding that 94% of respondents see AI as the leading driver of cybersecurity change, alongside the increase in organizations reporting AI-security assessment processes, makes the gap between adoption and oversight a board-level concern.
Actions to take
- Inventory AI tools and data flows. Identify approved services, embedded AI features, owners, the data they receive, and the business processes that depend on their output.
- Assess before deployment. Require a security review before an AI tool or significant new use is approved. Consider data handling, access controls, supplier practices, and how the organization will detect and respond to changes in the service or its risks.
- Set continuing oversight. Assign responsibility for monitoring changes to models, features, vulnerabilities, and vendor practices; reassess when the use or data flow changes materially.
- Connect the review to established controls. Map relevant safeguards and outcomes to the NIST CSF and applicable CISA goals rather than treating an AI review as a separate, unmeasured exercise.
The WEF percentages are survey findings, not proof that AI caused a particular incident. They support making AI use visible and assessable; they do not justify assuming every AI tool presents the same risk.
2. Plan for geopolitically driven disruption as a continuity problem
Geopolitical risk matters to organizations beyond government and critical infrastructure because cyber disruption can affect suppliers, services, and business operations. The WEF reported that 64% of organizations account for geopolitically motivated cyberattacks in mitigation strategies, while 23% of public-sector organizations said their cyber-resilience capabilities were insufficient. These are survey responses, not a forecast of which organization or sector will be hit.
Rank #3
Actions to take
- Identify critical functions. Specify the services the organization must sustain, the systems and people they depend on, and the external providers whose interruption could stop them.
- Exercise degraded operations. Test how critical work continues when a system, supplier, or communications channel is unavailable—not only how a team restores normal operations.
- Rehearse escalation early. Set reporting thresholds that encourage prompt internal escalation, and include executives and board members in incident exercises.
- Test continuity plans. Verify that the systems supporting critical functions have been identified and that continuity procedures work under realistic disruption scenarios.
CISA’s Shields Up: Guidance for Corporate Leaders and CEOs says, “Cyber incident response plans should include not only your security and IT teams, but also senior business leadership and Board members.” CISA also advises leaders to identify systems supporting critical business functions and test continuity so those functions can remain available after an intrusion. The guidance is a U.S. government source; organizations elsewhere can adapt the operational practices to their own obligations and threat context.
3. Reduce fraud exposure with stronger identity and payment processes
The WEF’s finding that 73% of respondents or someone in their network experienced cyber-enabled fraud in 2025 helps explain why CEOs ranked fraud first. For an organization, anti-fraud work should join process safeguards to identity protection: strong authentication matters, but it cannot substitute for sound procedures around consequential requests and transactions.
Actions to take
- Review high-impact workflows. Identify where an attacker could misuse an account or influence a sensitive request, then establish a reliable way to validate the request before acting.
- Prioritize phishing-resistant MFA. CISA’s cybersecurity performance goals point to phishing-resistant multifactor authentication (MFA). FIDO2 security keys are one physical way to implement phishing-resistant authentication.
- Keep the control’s limits clear. A security key can strengthen authentication, but it does not eliminate social engineering, fraud through other channels, or every form of account takeover. Maintain transaction checks and incident reporting processes.
These are complementary safeguards: authentication helps establish who is signing in, while a well-designed business process helps determine whether a request should be trusted and acted on.
4. Give high-risk vulnerabilities owners and deadlines
Vulnerability programs need to prioritize exposure, not merely count open findings. CISA’s Binding Operational Directive 26-04 is a dated example of risk-prioritized remediation requirements for U.S. federal agencies. It is not a blanket directive for every private organization or every country, but it illustrates why high-risk findings need clear ownership and rapid attention. CISA warns that AI may compress the time between vulnerability disclosure and exploitation.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Best Value
Actions to take
- Prioritize by exploitation risk and business impact. Consider whether a vulnerability is high risk and what the affected asset enables; do not let an undifferentiated backlog obscure urgent exposure.
- Name an accountable owner. Assign responsibility for remediation or an approved risk decision, with a deadline appropriate to the exposure.
- Track completion and exceptions. Report overdue high-risk items and unresolved exceptions to the leaders accountable for the affected service.
- Revisit urgency as conditions change. A change in exploitation activity, asset exposure, or business importance can change the order of work.
Federal agencies should follow the directive’s applicable requirements. Other organizations can use its risk-prioritized approach as an example while setting remediation obligations suited to their own regulatory and operational context.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Make secure-by-design procurement measurable
Procurement decisions can either reduce or deepen dependence on products whose security and support are difficult to assess. CISA’s strategic plan emphasizes secure defaults and lifecycle accountability. The White House strategy calls for coordination between government and the private sector. Microsoft’s Secure Future Initiative (SFI) is a vendor example of mapping security work to Zero Trust and the NIST CSF; it is not independent validation of the vendor or its products.
Questions to ask vendors
- Are secure settings enabled by default, and what settings must the customer configure?
- What security support and updates are provided across the product’s lifecycle?
- What information does the supplier provide about security practices, dependencies, and incident handling?
- How will the supplier and customer measure whether agreed security outcomes are being achieved?
- What happens to the organization’s critical function if the product or provider becomes unavailable?
Use answers to assess both the product and the dependency it creates. CISA’s and the White House’s documents reflect U.S. policy priorities; Microsoft’s SFI is one company’s implementation example, not a neutral assessment of industry-wide performance.
How to turn the priorities into a 2026 plan
Translate the priorities into a small set of funded outcomes that connect security work to services leaders are responsible for sustaining. A usable plan gives each outcome an accountable owner, a delivery point, and evidence of progress.
Recommended Free Tools
- Choose the critical services and scenarios. Identify the business functions most important to keep available and the AI, fraud, geopolitical, supplier, and vulnerability scenarios that could disrupt them.
- Assess current controls and gaps. Review AI oversight, authentication, fraud-sensitive workflows, high-risk remediation, supplier practices, and continuity capability against the outcomes you expect.
- Rank investments consistently. Compare proposals by likely loss reduction, asset and identity coverage, deployment time, resilience benefit, accountable reporting, supplier dependence, and measurable alignment with NIST CSF or CISA goals.
- Assign owners and evidence. Make responsibility explicit and decide what proof leaders will review—such as completion of a security assessment, remediation of a prioritized finding, or a continuity exercise that demonstrates the function can operate.
- Exercise and adjust. Include security, IT, business leadership, and board members in response exercises; use the results to revise plans, ownership, and funding where a critical function remains exposed.
Jeremy Jurgens’ observation that cybersecurity’s future “depends on the choices we make today” is a useful framing for these decisions: the practical test is whether the organization can identify its priorities, execute the controls, and demonstrate that critical work can withstand disruption.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
