Cybersecurity, emerging technology and systemic risk

Managing cyber risk within organizations is already a major leadership challenge. The costs for enterprises are increasing – building and maintaining cybersecurity capability is expensive, and the return on investment is uncertain. The risks associated with cyberthreats are often opaque, and it is difficult to calibrate the right nature and scale of investment in cybersecurity. Regulatory requirements are increasing and are often different among jurisdictions, and there is a risk that divergent approaches to tackling cybersecurity will act as a strategic barrier to cross-border data flow and e-commerce. Current approaches to supply-chain cybersecurity assurance are broken: Friction is being introduced by the need to provide security attestation, which does not necessarily give the level of assurance required, thus diverting resources away from more effective cybersecurity capacity investments. The analysis considered four representative transformative technologies that will contribute to the changing dynamics of cyberspace: ubiquitous connectivity; artificial intelligence (AI); quantum computing; and next-generation approaches to identity and access management. We do not claim that this is the complete set of technology innovations that will define the future, nor that they illustrate all of the risks faced. However, the technologies chosen are sufficiently representative to illuminate the range of risk that the community is likely to face in the next 5–10 years. Below are the key interventions recommended to address the systemic issues and to enable the management of cyber risks in the near future. If these collective actions cannot be taken forward, the global community risks creating an ecosystem that is not resilient to the emerging threat landscape, where cybersecurity could become a barrier to unlocking the full potential of technology and cyberspace.