CEOs see cyber-enabled fraud and phishing as top threat over ransomware

CEOs place cyber-enabled fraud (fraud using cyber means) and phishing ahead of ransomware as their top cyber worry. Over 90 percent of large organizations say they factor geopolitical risks into their cybersecurity strategies. Meanwhile, 64 percent of organizations include geopolitically motivated attacks in their risk mitigation plans.

73 percent of respondents say they or someone they know experienced cyber-enabled fraud in 2025. In the same year, 77 percent observed a rise in fraud and phishing attempts.

Threat actors use frontier AI models (advanced artificial intelligence systems) to automate credential-stuffing (credential stealing), deep-fake phishing (phishing using deep-fake videos/audio) and autonomous reconnaissance (self‑guided scouting for vulnerabilities). AI could democratize access to cybersecurity tools for underserved organizations.

85 percent of organizations with low cyber resilience say they lack the staff needed to meet security goals, compared with 22 percent of highly resilient firms. 65 percent of organizations point to supply chain weaknesses (vulnerabilities in suppliers’ security) as a hurdle to cyber resilience.

31 percent of respondents lack confidence in their country’s ability to handle a major cyber incident (attack or breach involving digital systems). In contrast, 84 percent in the Middle East and North Africa trust their nation to safeguard critical infrastructure, while only 13 percent in Latin America and the Caribbean share that trust. Smaller firms report insufficient cyber resilience at twice the rate of larger firms, and the strongest cyber resilience appears in the Middle East and North Africa with the weakest in Latin America, the Caribbean and sub-Saharan Africa.

48 percent of CEOs at highly resilient companies say they are boosting cooperation with government agencies and information-sharing networks (platforms for sharing threat data). CEOs ought to view cybersecurity as a driver of business resilience, map their operational dependencies, calculate disruption costs, and invest to counter real threats instead of merely checking compliance boxes.