Cyber threat rankings should start a boardroom debate, not settle one

A list of the year’s biggest cyber threats promises something that risk management rarely provides: a clear order. Place artificial intelligence, geopolitics and fraud near the top, then distribute attention and money accordingly. The appeal is obvious. The trouble is that no global ranking can tell an organisation which failure would hurt it most, which dependency is least visible or which recovery plan will collapse under pressure.

The World Economic Forum’s Global Cybersecurity Outlook 2026 is valuable, but not because it supplies a universal shopping list. Its deeper lesson is that cyber risk changes with perspective, organisational capacity and exposure. Boards should use its findings to ask sharper local questions, not to outsource judgement to an annual league table.

A survey is not an incident ledger

The report, produced with Accenture and published in January 2026, draws primarily on a survey conducted between 25 August and 1 October 2025. After qualification, it included 804 participants across 92 countries, among them 316 chief information security officers, 105 chief executives and 123 other C-suite executives. Focus groups, workshops and event polling supplemented that work.

That is substantial evidence about what informed leaders perceive, prioritise and report about their organisations. It is not, however, a comprehensive measurement of attack frequency, financial loss or technical exploitation around the world. The distinction does not diminish the research. It tells readers what kind of conclusions the research can support.

For example, 94 per cent of survey respondents expected AI to be the most significant driver of cybersecurity change in 2026, while 87 per cent identified AI-related vulnerabilities as the fastest-growing cyber risk over 2025. Those figures demonstrate extraordinary concern about AI among respondents. They do not establish that AI has produced the greatest measured harm for every sector, country or organisation.

This is where the language of threat rankings can become misleading. A strategic concern, a fast-changing technology and a frequently experienced loss are different categories. Combining them into one countdown makes the result easy to communicate but harder to use responsibly. The more useful question is not which subject sits at number one globally. It is why a particular risk matters here, to this organisation, under these operating conditions.

The disagreement is the useful part

The divergence between executives in the survey illustrates the point. Chief executives ranked fraud and phishing as their leading concern, while CISOs continued to put ransomware first and supply-chain disruption second. That need not mean one group understands cyber risk and the other does not. It may reflect different views of consequence.

A chief executive may focus on customer trust, direct financial harm and the broad reach of fraud. A CISO may give greater weight to operational disruption, technical recovery and dependencies that can transmit failure. The survey does not establish conflict between those roles or show that organisations are spending badly. Yet the different rankings reveal why a single hierarchy cannot replace governance.

The right response is to combine those perspectives into one portfolio. Fraud, ransomware and supplier disruption can demand different controls, owners and recovery arrangements. If leaders simply convert an external ranking into a budget order, they could overfund the most visible theme while neglecting a less fashionable exposure with more serious local consequences. That is a possibility, not a result demonstrated by the survey, which did not examine how respondents allocated budgets.

Rankings still have a legitimate purpose. They create a common vocabulary and can bring technical concerns into executive discussion. A headline about AI or geopolitics may secure attention that a detailed control review would struggle to attract. But attention is an opening, not an investment case. The list should begin the conversation rather than decide its outcome.

AI is both tool and dependency

AI particularly resists treatment as a single threat category. The WEF reported that 77 per cent of organisations had adopted AI for cybersecurity. At the same time, respondents identified insufficient knowledge or skills, the need for human oversight and uncertainty about risk as leading implementation barriers.

That combination matters. AI is not merely an external force to defend against. It is also a capability organisations are putting inside their own security operations. Its risk therefore depends on the system involved, the data it can reach, the authority delegated to it and the people responsible for reviewing its behaviour. Treating all of that as one budget line labelled AI would conceal more than it clarifies.

The survey found that 64 per cent of respondents reported processes for assessing AI security, up from 37 per cent in the previous edition. That increase is encouraging as a measure of reported process adoption. It should not be mistaken for audited readiness. The research does not independently establish the quality of those assessments. If evaluation becomes a one-off compliance exercise, a higher adoption figure could coexist with weak oversight in practice.

A better approach is to govern AI simultaneously as a defensive tool and an organisational dependency. That means connecting assessment with accountable ownership, periodic review and human oversight. The exact balance will differ according to what an AI system can access and do. The category alone cannot supply the answer.

Resilience lives in the dependencies

The supply-chain findings make the same argument in a different way. Among large companies by revenue, 65 per cent identified third-party and supply-chain vulnerabilities as their greatest resilience challenge, up from 54 per cent. Yet only 33 per cent of organisations comprehensively mapped their supply-chain ecosystems, and 27 per cent conducted simulations or recovery exercises across them.

These numbers expose a gap between recognising a broad danger and understanding how it might become an organisational crisis. Naming supply-chain risk does not identify which supplier supports a critical operation, what alternatives exist or how long restoration might take. Those answers come from mapping dependencies, involving security in procurement and exercising recovery across organisational boundaries.

Respondents from organisations classed as highly resilient reported extensive board involvement, security participation in procurement, regular AI tool reviews, supplier assessment and ecosystem-wide exercises. These are self-reported associations, not proof that any one practice causes resilience. Even so, they point towards a more useful reading of the report: governance and execution distinguish preparedness more clearly than the ability to name the year’s most prominent threat.

The broader self-assessment remains sobering. Only 19 per cent said their resilience exceeded minimum requirements, while 64 per cent said they met those requirements. Meeting a baseline has value, particularly when resources are limited. But a minimum standard cannot determine which local dependency deserves the first recovery exercise or which executive owns the consequences of its failure.

Do not turn sophistication into a prerequisite

Customised risk analysis also has a counterargument. Smaller organisations may find simple, standardised guidance more usable than an elaborate framework demanding specialist staff and extensive supplier leverage. The WEF found that small organisations were twice as likely as large ones to report insufficient resilience. It also recorded insufficient-resilience rates of 37 per cent for NGOs, 23 per cent for the public sector and 11 per cent for the private sector.

That disparity should constrain the advice attached to any global ranking. A prescription built around abundant expertise, funding and procurement power may be realistic for a large company and impossible for a small or public-interest organisation. If governance demands expand without accessible expertise, funding or shared support, responses to AI and supplier risk could deepen the inequity the report identifies. The survey does not model that future outcome, but the possibility deserves attention.

Standard baselines and local judgement are not opposites. Baselines can establish a workable floor. Local analysis decides where scarce effort above that floor will reduce the most consequential exposure. The aim should not be to make every organisation reproduce the machinery of the largest companies. It should be to make priorities explicit enough that limited capacity is not consumed by whatever topic currently dominates discussion.

Replace the ranking with five questions

Boards can translate broad threat reports into decisions by applying five tests. First, what consequence matters: financial loss, operational interruption, harm to customers or another outcome? Second, which systems, suppliers and AI tools create the exposure? Third, how much control does the organisation actually possess, rather than assume it possesses? Fourth, who is accountable for reducing the risk and accepting what remains? Finally, has recovery been practised across the relevant dependencies?

This is an editorial synthesis, not a WEF model, and it cannot produce a universal answer. That is its virtue. It forces a ranking to compete with the organisation’s own evidence. A prominent global concern may still emerge as the top priority, but it will do so because leaders have connected it to consequences, ownership and recoverability, not because it occupied first place in someone else’s survey.

Annual outlooks are most useful when read as maps of changing concerns and capacity gaps. They show what leaders are noticing, where reported practices are advancing and where resilience remains uneven. They cannot tell every board what to fund next. The mature response is neither to dismiss the ranking nor obey it. It is to turn its categories into local questions, reconcile competing executive perspectives and test whether the organisation can recover from the failures that would matter most.

The column’s emphasis on questioning the systems and dependencies behind broad rankings points towards the value of technical grounding. With The Hack Academy’s online cybersecurity training programme, you can study cybersecurity fundamentals and networking at your own pace, using practical exercises alongside theory.