Global Cybersecurity Outlook for 2024

In 2023 the geopolitical landscape remained polarized with multiple armed conflicts occurring globally amid economic uncertainty and diverging views on emerging technologies and their implications. Against this complex backdrop, the cybersecurity economy grew exponentially faster than overall global economic expansion and outpaced growth in the technology sector. However, organizations and countries experienced this growth in markedly different ways.

A stark divide has emerged between cyber resilient organizations and those struggling. This divergence in cyber preparedness has been exacerbated by threat dynamics, macroeconomic trends, varying regulation, and some organizations' early adoption of disruptive technologies. Additionally, rising costs to access innovative cyber services, tools, skills, and expertise continue influencing the global ecosystem's ability to collaboratively strengthen security amid substantial change.

These factors have also accelerated the disappearance of a moderate-capability grouping of organizations, i.e. those maintaining only minimum cyber resilience standards. Despite this divide, many organizations indicate clear progress in certain cyber capabilities. This outlook also finds cause for optimism when considering the relationship between cyber and business executives.

The following represent major findings from this year’s WEF Global Cybersecurity Outlook and the key trends executives must navigate in 2024:

• A growing inequity exists between cyber resilient and underprepared organizations. Concurrently, the population of organizations maintaining minimum cyber resilience standards is declining. Small and medium enterprises (SMEs), though comprising most national ecosystems, have been disproportionately impacted. While large organizations demonstrated significant gains, SME resilience declined notably. Over twice as many SMEs as larger organizations now lack resilience to meet critical operational needs. Executives surveyed overwhelmingly agreed urgent action is required to address growing inequity.
• Emerging technologies risk exacerbating longstanding cyber resilience challenges and further accelerating divides between most and least capable organizations. As organizations rapidly adopt technologies like generative artificial intelligence, a basic understanding is needed regarding immediate, medium-term, and long-term implications for cyber posture. Few expect generative AI to provide defenders over attackers an advantage in the next two years. Approximately half are most concerned about generative AI enabling more sophisticated deception tactics.

• The alarming cyber skills and talent shortage continues widening. Half of smallest organizations either lack required skills or are unsure. Only 15% are optimistic about skills and education will significantly improve in two years. Public sector organizations cited lack of resources and skills as their top barrier to designing resilience.

• Cyber and business alignment is becoming streamlined. However, all organizations must continue prioritizing and maintaining security fundamentals as new risks emerge. 29% reported material incidents in the past year. Legacy challenges represented the top barrier to resilience for largest organizations. A clear correlation exists between resilience, CEO engagement, and willingness to discuss cyber risk externally.

• Escalating ecosystem risk also challenges resilience. 41% of materially impacted organizations cited third parties as the root cause. Over half have an inadequate supply chain understanding, including 64% believing their own resilience suffices. 60% agreed regulation has reduced ecosystem risk in the past two years.

So what next from here?

The struggle to maintain high-quality – or even adequate – cyber-resilience capability is fast becoming a zero-sum game.

As maintaining adequate cyber resilience becomes increasingly competitive, those lacking capabilities can least address it, endangering broader ecosystem security given interdependencies. Urgent cross-sector collaboration is needed to close divides threatening the digital future's security, resilience, and trustworthiness.

While current challenges exist, there are reasons for optimism regarding cyber resilience in the near future. Prudent cyber practices that cybersecurity professionals and forward-thinking business leaders have identified as wise are gradually taking effect. However, changes are still needed to alter the present course. If not, as seen throughout 2023, early technology adoption by pioneering organizations, challenges for those lagging in foundational trust and security capabilities, and fragmented incentives within digital ecosystems will accelerate digital disparity in coming years.

Moreover, the interconnection of the digital economy makes the negative effects inevitable to compound and affect all participants. Therefore, everyone must collaborate to foster sustainable capabilities for the future - including developing proper priorities and culture while enabling equitable access to talent, technology, and security tools. Raising systemic resilience - with all organizations reducing inequities dividing them and improving resilience of interconnections - is not only the most pressing requirement, but also the greatest responsibility.

New here? Don't forget to subscribe to the postcards