Bad actors have moved from targeting individual companies to targeting supply chains, ecosystems, and critical infrastructure (see Arthur D. Little [ADL] Viewpoint “Developing Resilience for Global Supply Chains in Crisis”). The lines between the digital and the physical are blurring, and attackers are increasingly more patient and strategic. And, of course, AI is putting advanced tools into their hands, allowing them to move at ever higher levels of complexity.

If state actors are involved, the severity of the potential threats increases substantially, as state-sponsored groups are less driven by immediate financial gain. Instead, they are willing to invest months — or even years — in infiltrating systems and positioning themselves to inflict maximum damage at the most critical moment. And they’re not just targeting government agencies. “There are state actors working against a lot of companies, especially those in critical infrastructure,” says Maximilian Scherr, Partner in ADL’s Performance practice and co-leader of its cybersecurity function. And as global turmoil increases, so do these risks, he says.

“Cyberattacks are being used as part of warfare,” says Tom Teixeira, Partner in ADL’s Performance practice and Audit Committee Chair. Enemy actors want to create as much disruption and damage as possible, he explains.

“The real concern is serious cyberattacks on infrastructure that could lead to operational disruption and physical damage that affects citizens,” he says. “It would ultimately cost the state that’s being attacked an enormous amount in terms of finance and drain on resources.” These impacts wouldn’t necessarily be geographically limited. “The world has become more complex,” Teixeira notes. As the Jaguar Land Rover incident illustrates, an attack on one company can affect thousands of others.

There’s also increasing interconnectivity between the physical and digital worlds. Cyberattacks are no longer just about extracting data for financial gain. They can stop physical systems from operating because of the increased interdependence between IT and operational technology.

“In the transport industry, we’re having to close down airport operations,” Teixeira says. “We’ve seen that in Europe, following a cyberattack. There’s great dependency between physical hardware and the digital environment. You can’t look at a system in isolation — if one system gets taken out, multiple systems could be taken out, due to the level of interdependency and interconnectivity.”

Yet according to WEF, enterprises still aren’t taking operational technology (OT) security seriously. Only 16% of organizations with industrial environments report OT security issues to their boards, only 32% monitor OT security, and only 36% have a CISO (chief information security officer) who is responsible for both IT and OT.

That’s a mistake, says Teixeira. The CISO should oversee regular scanning for security issues in both IT and OT and be a key line of communication to the business units that own the physical systems. “The CISO also needs to be higher up in the food chain — to be able to influence senior management and the board,” he says.

Last, but by no means least, is the rise of generative AI (see ADL Viewpoint “AI in Cybersecurity”). According to WEF, 94% of leaders say AI will significantly affect cybersecurity in the next 12 months. “AI gives people who don’t have much of a clue a weapon in their hand to do harm — maybe even more harm than they think they want to do,” says Scherr. “And if you put that in the hands of people who are really smart and who do want to do harm, my God.”

The core problem is that enterprises measure inputs, such as controls, policies, and certifications, instead of outputs — the ability to absorb and recover from shocks (see ADL Viewpoint “Total Cost of Risk”). It all comes down to how companies think about cybersecurity, says Robert N. Charette, an international authority on IT and risk management and a contributing editor to IEEE Spectrum. “Cybersecurity has always been viewed as an added cost,” he says. “The aftermath of an attack becomes the cost of doing business, rather than building the infrastructure they need.”

WEF examined the views of CEOs at companies with various levels of organizational resilience. Only 19% of respondents said their organization’s cyber resilience exceeds requirements; 64% said it only met minimum requirements, and 17% said it was insufficient.

According to the WEF report, the most resilient companies were also the most proactive in their approaches to cybersecurity. For example, 52% of CEOs at resilient companies prioritize threat intelligence of nation-state actors, compared to just 13% of insufficiently resilient companies.

Resilient CEOs are also eight times more likely to have increased engagement with government agencies and information-sharing groups and more than twice as likely to have increased their cybersecurity budgets. Resilient CEOs are also more focused on third-party and supply chain vulnerabilities, rapidly evolving threat landscapes, and emerging technologies.

The CEOs of non-resilient companies said their biggest challenges are a lack of skills and money. Proactive cybersecurity can be a hard sell in organizations, explains Charette. “You want me to pay you to look for things that may not happen,” he says. “Sometimes, it seems they don’t really want to know because then they would need to do something about it.”

Putting mitigation/recovery strategies in place in case an incident does occur is also a hard sell, Charette says. If the company spends the money up front, and there’s an attack, then recovery will be quicker and more efficient, so it might be less expensive over the long term — but a lot of companies prefer to pay later, he says.

Things change when a company gets attacked, says Teixeira. But only for a while. “After a cyber breach, investment takes place, and people put additional controls in place,” he says. “Then there’s this comfort that everything is under control.” But this is a false sense of security. “Cyberattacks get more sophisticated,” Teixeira notes. “Your operating model changes, and in many cases, vulnerabilities start to reappear.”