In my experience working with executives on cyber risk, the issue is rarely a lack of concern

Risk is becoming far more dynamic. Where older models assumed impact would rise in proportion to threat volume, that relationship is now broken. Risk and impact are moving at different velocities, increasing through sudden step changes rather than gradual progression.

In a recent analysis, I quantified how AI is changing the attack sequence in business email compromise and enabling multiple financial transactions within a single event. When a control fails, whether through an AI-driven bypass or a zero-day exploit, the impact does not simply double. It can jump by an order of magnitude, turning a $50,000 fraud event into a $50 million business-wide disruption almost overnight.

Cyber risk is already on the agenda. But despite that attention, leaders often struggle to make clear, confident decisions. The challenge is not awareness. It is that they are being asked to decide in an environment of uncertainty, flooded with signals but without coherent analysis.

They receive dashboards, vulnerability reports, threat intelligence, and compliance updates, but those inputs rarely connect in a way that clarifies what matters most, what it means for the business, or what action should follow. Each may be useful on its own, but without analysis that ties them together and quantifies the impact, executives are left with noise instead of guidance. The result is often reactive decision-making shaped by the latest incident or the loudest internal voice.

Good risk-based decisions require the ability to compare risks, differentiate between them, and prioritize based on business impact, whether operational or financial. That is not simple, and many organizations do not have that internal capability.

It is easy to lean on compliance frameworks, especially when the work is already underway, but compliance alone does not eliminate cyber risk. I recently analyzed the latest NY DFS cybersecurity guidance against the most common financial-sector attack paths. While stronger controls do reduce exposure, they do not close the gap. Material residual risk remains, with an estimated 19% to 33% probability of attack across the next 30, 60, and 90 days.

Part of that gap is being driven by AI. In both email compromise and perimeter defense, AI-assisted attacks are reducing the effectiveness of current technical controls. At the same time, the external threat environment is changing in ways we have not seen before.

The cyber threats that concern me most are not incremental evolutions of familiar risks, but step changes—shifts that could fundamentally alter the scale of impact and the stability of entire sectors. Three, in particular, are either closer than you think or already here, and all are underappreciated.

First, AI-driven attacks represent a force multiplier that could expand the impact of cyber incidents by an order of magnitude. Automation in cyber operations is not new, but advances in AI have sharply lowered the barrier to entry while increasing precision, speed, and scale. Attackers can now generate campaigns that adapt in real time to defensive responses, allowing what once required skilled teams to be executed with far fewer resources.

The concern is not simply efficiency, but amplification. AI-enabled attacks can target thousands of organizations at once, tailor methods to individual victims, and evolve faster than defenders can respond. A single campaign could create systemic disruption, overwhelming incident response capabilities and disrupting critical services. As these capabilities mature, the gap between attacker speed and defender readiness will widen.

Second, the institutional loss of data integrity remains largely theoretical in widespread use, but far closer than many assume. The ability to subtly alter financial records, operational metrics, and decision-support systems already exists. What has not yet occurred is a deliberate large-scale attempt to exploit it for maximum disruption.

This threat is dangerous because it undermines trust itself. Organizations depend on the assumption that their data is accurate, even if systems go offline. If that assumption breaks, decision-making degrades, recovery becomes uncertain, and operations begin to fail. In shared data ecosystems, the consequences extend beyond individual organizations and can erode confidence across entire industries.

Third, geopolitical cyber attacks are likely to intensify as global tensions rise. Cyber has long been used for espionage and limited disruption, but the threshold for more destructive action appears to be lowering. Nation-states may increasingly use cyber not just for signaling, but for direct economic and societal impact.

Critical infrastructure, supply chains, and financial systems could become direct targets in sustained campaigns aligned with broader strategic objectives. Unlike criminal attacks, these operations can be coordinated over longer periods and designed for deeper disruption, while attribution challenges continue to weaken immediate deterrence.

Taken together, these threats point to a future where cyber risk becomes systemic rather than operational. AI expands the scale and speed of attacks, data integrity threats undermine trust, and geopolitical tensions increase the potential impact. Organizations relying only on traditional controls may find themselves unprepared for the next phase of cyber disruption.

AI is not a separate category of cyber threat; it is an accelerant. It allows attackers to move faster, operate at greater scale, and weaken controls that organizations once considered dependable.

Email compromise is one of the clearest examples. What may begin as broad, opportunistic targeting can become highly tailored the moment a target engages. At that point, tactics intensify, AI-assisted methods adapt quickly, and traditional controls may no longer hold. This is contributing to a shift from isolated attempts to multiple simultaneous attacks at a scale that was previously harder to execute.

The financial consequences are rising in non-linear ways. As attack speed and scale increase, the impact can expand faster than most organizations anticipate. These shifts can be modeled, and they should be, because they materially change how leaders need to think about exposure, response, and resilience.

At the same time, organizations face AI-related risk through their own adoption and use. Two of the most significant exposure points are overreliance on AI tools and deploying them without fully understanding their limitations, dependencies, or downstream risks.

Overreliance becomes dangerous when organizations begin treating AI output as authoritative without sufficient human review, validation, or contextual judgment. In practice, this can affect security operations, fraud detection, customer communications, legal interpretation, and internal decision support. When leaders assume these tools are more accurate or reliable than they are, they can introduce new operational and strategic risks.

Cyber resilience is the ability to withstand an attack and continue operating through disruption.

That capability depends on more than security tools. It reflects how technical defenses, operational processes, and leadership decisions work together under pressure. Increasingly, resilience will be defined less by what technology an organization owns and more by how effectively it performs when systems are degraded, information is incomplete, and decisions must be made quickly.

That is why resilience has to be tested before it is needed. Organizations that have not exercised their defenses under realistic conditions are far more likely to face prolonged disruption when an incident occurs. In those moments, unclear ownership, communication gaps, and delayed decisions tend to emerge at the point they are most costly. Tabletop exercises, simulations, and live testing are essential because they expose those weaknesses before an attacker does.

Preparation also requires understanding the business cost of different attack scenarios. Many organizations still lack a clear view of how cyber incidents translate into operational downtime, revenue loss, regulatory exposure, or reputational damage. Without that understanding, it becomes difficult to prioritize investments or make informed trade-offs during a crisis. Quantifying those risks in advance allows leaders to respond faster and align decisions with what matters most to the business.

Looking ahead, CEOs need to recognize that the threat environment is becoming broader and less contained. Attacks are more coordinated, more targeted, and increasingly shaped by geopolitical dynamics and interconnected supply chains. That means disruption may no longer remain isolated within the organization itself. The effects can extend across partners, vendors, and markets.

For CEOs, this makes cyber resilience a leadership responsibility. It requires integrating cyber risk into core business planning, defining accountability clearly, and ensuring the organization can make fast, disciplined decisions under stress. The companies best positioned for what comes next will be those whose leaders treat cyber resilience as a strategic discipline and build the capacity to operate through disruption, not simply defend against it.

Conversations with the executives, authors, and operators who run complex organizations.

Explore our current leadership spotlight.