Artificial Intelligence & Machine Learning
,
Fraud Management & Cybercrime
,
Fraud Risk Management
Findings From WEF’s 2026 Report Show Shifting Cyber Priorities as AI Reshapes Risk
Cyber-enabled fraud has overtaken ransomware as the top cybersecurity concern for CEOs heading into 2026, according to the World Economic Forum’s Global Cybersecurity Outlook 2026, released ahead of the Davos annual meeting.
See Also: AI Browsers: the New Trojan Horse?
The report found that boards are increasingly preoccupied with the direct financial and reputational impact of fraud, with 73% of respondents reporting that they or someone in their network experienced cyber-enabled fraud in 2025. Ransomware, which topped CEO concerns in 2025, has dropped out of the top three for business leaders, but CISOs continue to name it as their primary concern, followed by supply chain disruption.
“This suggests CEOs are prioritizing financial loss prevention and preparing for new threats, while CISOs remain focused on operational resilience,” the report said.
AI Becomes the Dominant Risk Accelerator
The report found that artificial intelligence will be the dominant factor influencing cybersecurity in 2026. According to 87% of respondents, AI-related risks increased faster than any other category in 2025.
The report described AI as a force multiplier across three dimensions: expanding the attack surface as organizations embed AI into core processes, enhancing defensive capabilities through automation and analytics, and enabling attackers to operate at greater scale and speed.
“Implemented well, these technologies can assist and support human operators in detecting, defending and responding to cyberthreats. However, they can also pose serious risks such as data leaks, cyberattacks and online harms if they malfunction or are misused,” said Josephine Teo, minister for digital development and information and minister-in-charge of cybersecurity and Smart Nation Group in Singapore.
Thirty-seven percent of respondents said data leaks are the most significant security concerns related to generative AI for CEOs, followed by the advancement of adversarial capabilities at 29%. Last year, the advancement of adversarial capabilities topped the list at 47% compared to only 22% for data leaks.
“While the ‘AI arms race’ between attackers and defenders continues to intensify, attention is pivoting from purely offensive innovation with AI toward the unintended exposure and misuse of sensitive data through generative and agentic systems,” the report said.
More Organizations Are Prepared
The 2026 findings point to a measurable, though incomplete, improvement in how organizations are managing AI-related cyber risk. In 2025, nearly half of surveyed organizations identified generative AI as a top concern – citing its role in enabling large-scale phishing, deepfakes and other automated attacks – yet only a small number of respondents had formal mechanisms to assess the security of AI tools before deployment.
That’s changing in 2026. Sixty-four percent of organizations now say they have processes in place to evaluate AI security prior to rollout, compared to 37% last year.
Organizations have accelerated defensive use of the technology. Seventy-seven percent now deploy AI for cybersecurity purposes, most commonly for phishing detection (52%), automated intrusion response (46%) and user-behavior analytics (40%). Sector patterns are visible: Energy companies lead in intrusion-focused applications at 69%, while materials and infrastructure organizations prioritize phishing protection at 80%.
Still, the WEF warns that progress is fragile. Skills shortages remain the principal barrier to broader adoption, reported by 54% of respondents, followed by requirements for human oversight and uncertainty about emerging risks.
Geopolitical Pressures and Regional Divides
Although the number of organizations changing their cybersecurity strategy because of geopolitics declined from 93% in 2023 to 66% in 2026, “geopolitics remains the top factor influencing overall cyber risk mitigation strategies,” the report said.
Confidence in the national ability to protect critical infrastructure against cyberattack stands at 31%, a modest improvement from 26% in 2025 but still low overall. Large enterprises – those with more than 100,000 employees – are most likely to be affected by geopolitics, with 91% reporting strategic changes.
The report links rising cyber risk to what it describes as a shift toward a “paradigm of more global confrontation,” driven in part by trade policies such as tariffs and export restrictions. These dynamics are reshaping alliances and technology dependencies, while accelerating the fragmentation of global technology ecosystems as countries and companies diversify partnerships and supply chains.
Mounting political and economic tensions are pushing governments and enterprises to reconfigure supply chains, reshore manufacturing and prioritize “trusted” regional partners. But the scramble to stand up alternative suppliers, logistics routes or data-hosting arrangements is moving faster than cyber due diligence, widening the attack surface across weaker networks and third-party relationships.
As policy shifts and tariffs ripple through industries, the report warns that cybersecurity risk management must adapt accordingly – treating trade disruptions as signals for renewed threat modeling and vendor risk reassessments.
Looking Ahead to 2030
The report identifies several longer-term vectors likely to shape the threat environment by the end of the decade. Quantum technologies top the list at 37% expected impact in the near term, followed by autonomous systems and robotics at 26%, decentralized technologies at 20% and space-based infrastructure at 9%.
The impending threat to current encryption standards from quantum computing has already prompted recommendations to begin migration to post-quantum cryptographic algorithms aligned with NIST guidelines.