Emerging Threats and Future Risks

Beyond the immediate impact of artificial intelligence on the threat landscape, several other emerging developments will shape the cybersecurity environment over the coming years. A manager with a strategic perspective understands not only the threats of today but the forces that will make the landscape of 2027, 2030 and beyond significantly different from the one that exists now. This understanding informs better decisions today: about the investments worth making, the skills worth developing and the risks worth accepting.

Quantum Computing and the Post-Quantum Transition

Quantum computing represents one of the most significant long-term challenges to cybersecurity. Current encryption systems, which protect everything from online banking and government communications to personal data and commercial secrets, rely on mathematical problems that classical computers cannot solve in a practical timeframe. Quantum computers, which use the principles of quantum mechanics to perform calculations in fundamentally different ways, have the potential to break the most widely used encryption algorithms in a fraction of the time a classical computer would take.

The question of when quantum computers will be capable of breaking current encryption at scale is genuinely uncertain, but the direction of travel is not. The US Department of Defence has published a plan to identify vulnerabilities in existing cryptographic systems and aims to fully implement NIST-approved post-quantum cryptography (PQC) algorithms by 2030. The European Union’s guidance calls for critical infrastructure to be quantum-safe by 2030. The UK’s NCSC and counterparts around the world are actively urging organisations to begin the transition to post-quantum cryptography as soon as possible.

The most immediate risk is the harvest now, decrypt later strategy already being employed by advanced adversaries. State-sponsored actors are intercepting and storing encrypted data today, expecting to decrypt it when quantum computing capability is available. For organisations holding data that will remain sensitive for a decade or more (medical records, intellectual property, long-term contracts, classified information), the harvest now threat means the quantum risk is not future: it is present. The NCSC’s guidance is explicit: move to post-quantum cryptography well before 2035.

For managers, the practical implication is to be aware of this transition, to understand that it is coming and that it requires planning rather than a last-minute response, and to ensure that when their organisation’s IT or security function raises the post-quantum transition, it receives the leadership engagement and resource allocation that the scale of the change requires.

Geopolitics and Cyber Security

The relationship between geopolitical instability and cybersecurity has never been clearer than in the mid-2020s. The WEF Global Cybersecurity Outlook 2026 found that geopolitics remains the top factor influencing overall cyber risk mitigation strategies, with 64% of organisations accounting for geopolitically motivated cyberattacks. PwC’s 2026 cyber risk report found that 60% of executives cite geopolitical instability as one of their top three strategic cyber priorities.

Geopolitical instability affects cybersecurity in several ways that managers need to understand:

• State-sponsored attacks: nation-state actors conduct cyber operations for strategic purposes including espionage, infrastructure disruption, intellectual property theft and political influence. These actors are typically highly sophisticated, well-resourced and patient, capable of conducting long-duration campaigns that remain undetected for extended periods. The NCSC Annual Review 2025 documented a 130% year-on-year increase in nationally significant cyber incidents responded to between September 2024 and August 2025.
• Regulatory fragmentation: geopolitical tensions are driving regulatory divergence, with different jurisdictions imposing different and sometimes conflicting requirements on data handling, technology use and security standards. Organisations operating across multiple jurisdictions face an increasingly complex compliance landscape in which meeting requirements in one country may conflict with requirements in another.
• Supply chain geopolitics: the security of technology supply chains has become a geopolitical issue. Concerns about the security of technology products from particular countries have driven regulatory responses in multiple jurisdictions, and organisations may find that the geopolitical relationships of their technology suppliers affect their own security and compliance position.
• Critical infrastructure targeting: cyberattacks on critical infrastructure (energy, water, healthcare, financial services, and telecommunications) by state and state-sponsored actors are increasing in frequency and sophistication. Organisations in or adjacent to critical sectors face a heightened threat environment that reflects geopolitical tensions rather than purely criminal motivation.

The Expanding Attack Surface

The combination of continued digital transformation, the growth of the Internet of Things, the proliferation of connected operational technology, the expansion of remote and hybrid working and the increasing complexity of technology supply chains means that the attack surface available to threat actors continues to expand. The WEF AI and Cyber report describes enterprise attack surfaces as now including hundreds of thousands of internet-facing assets, a scale of complexity that creates significant governance challenges.

Several specific dimensions of this expansion are particularly relevant for managers:

• Operational technology convergence: the increasing integration of industrial control systems, manufacturing equipment, and operational technology with IT networks and the internet creates attack surfaces in environments that were previously air-gapped from cyber threats. Sectors including energy, utilities, manufacturing and transport are particularly affected. A cyberattack on operational technology can have physical consequences that extend beyond data compromise.
• Internet of Things proliferation: connected devices in workplaces, including everything from smart printers and CCTV systems to building management systems and environmental sensors, create entry points that are often poorly secured and infrequently monitored. NETGEAR’s 2024 threat research found that IoT devices on home networks were targeted an average of ten times per day.
• The cyber security skills shortage: the global shortage of cyber security professionals is itself a structural risk factor. The WEF reports that the cyber security talent gap is one of the main obstacles to organisational resilience against cybercrime. Organisations that cannot attract and retain security expertise face compounding vulnerability as threats become more sophisticated. This shortage also affects the mid-level management layer: organisations benefit significantly from managers who understand enough about cyber security to make informed decisions and ask the right questions, even without being specialists.