What’s keeping CEOs up at night? WEF poll points to insider threats, payment fraud, other cybersecurity issues

[SINGAPORE] Cyberenabled fraud has displaced ransomware as the primary concern for chief executives globally, the Global Cybersecurity Outlook 2026 by the World Economic Forum (WEF) showed.

“As cyber risks become more interconnected and consequential, cyberenabled fraud has emerged as one of the most disruptive forces in the digital economy,” said Jeremy Jurgens, managing director at WEF.

The report, released on Monday (Jan 12), surveyed 804 global leaders, including 105 CEOs.

About 73 per cent of respondents reported that they or someone in their network had been personally affected by cyberenabled fraud in the past year.

Cyberenabled fraud can include phishing, payment fraud and identity theft, WEF said. Ransomware, on the other hand, is malicious software that extorts victims’ money by locking their devices or encrypting software.

While ransomware remains the top operational concern for chief information security officers due to its ability to paralyse infrastructure, CEOs are prioritising the financial and reputational risks associated with fraud and phishing.

AI, the primary disruptor

Artificial intelligence was identified as the most significant driver of change in cybersecurity for 2026, with 94 per cent of leaders expecting it to shape the industry.

However, the technology presents immediate risks. AI-related vulnerabilities formed the fastest-growing risk category in 2025, with 87 per cent of organisations reporting an increase.

Data leaks were cited as the top generative AI concern by 30 per cent of CEOs, followed closely by the advancement of adversarial capabilities, at 28 per cent.

SEE ALSO

Information at speed: Why AI-enabled search technology is the new competitive differentiator

Cybersecurity hiring in Singapore surges with AI adoption, but talent gaps remain

The proportion of organisations implementing processes to assess AI security before deployment nearly doubled year on year, rising from 37 per cent in 2025 to 64 per cent in 2026.

Minister for Digital Development and Information Josephine Teo said that while AI can strengthen defences, it introduces serious risks if poorly governed. 

“Governments therefore need a forward-looking and collaborative approach to ensure AI enhances cyber resilience while minimising risks that increasingly transcend borders,” she said.

Regional confidence and skills gaps

Geopolitical volatility continues to influence cyber strategy, with 64 per cent of organisations factoring geopolitically motivated attacks into their risk planning.

The report highlights significant regional disparities in confidence regarding national cyber resilience.

In the East Asia and Pacific region, 47 per cent of respondents expressed confidence in their territory’s preparedness to respond to critical infrastructure attacks.

This contrasts with 84 per cent in the Middle East and North Africa, and just 13 per cent in Latin America and the Caribbean.

Supply-chain fragility

Systemic risk via third parties remains a major hurdle for large enterprises. Among companies with revenues exceeding US$5.5 billion, 65 per cent cited third-party and supply-chain vulnerabilities as their greatest barrier to cyber resilience, up from 54 per cent the previous year.

WEF noted that concentration risk is intensifying, citing incidents at major cloud and internet service providers where infrastructure-level failures triggered widespread downstream impact.

Inequity widens

A “cyber equity gap” persists between large and small entities. Smaller organisations (by revenue) are twice as likely to report insufficient cyber resilience compared to large firms, WEF said.

The disparity also extends across regions. Regionally, the shortage of cybersecurity talent is most pronounced in Latin America and the Caribbean, with 65 per cent of organisations reporting insufficient skills to achieve their security objectives; 63 per cent of organisations in sub-Saharan Africa face similar constraints.