01

Last year, we spoke about the catch-22 situation many organisations are finding themselves in. On the one hand, the push for digital transformation is vital to carve out competitive advantage, improve customer experiences and streamline business processes. But at the same time, these efforts expand the cyber-attack surface, providing more opportunities for threat actors to strike.

If anything, these trends are even more pronounced in 2025, as organisations double down on digital amid persistent economic and business uncertainty, and adversaries take advantage. It’s why many respondents cite things like securing emerging technologies (39%), cloud services/apps (37%) and IoT/BYOD (28%), as well as managing third-party risk (41%), among their top challenges. Tech sprawl (35%) resulting from too many siloed point solutions also signifies anxiety over the size of the attack surface. As does the fear of “as-a-service” cyber threats like ransomware- as-a-service (39%), which are democratising the means to compromise corporate networks via under-protected endpoints.

But the attack surface isn’t just comprised of technology solutions. As we’ll discuss later in the report, it’s also distinctly human in parts. A lack of employee awareness, cited as a challenge by 38%, can lead directly to successful social engineering attacks (35%) and compromise. Even more acute is the persistent skills gap in cybersecurity teams, cited by 42%. According to ISC2 figures, the global workforce gap in cybersecurity now stands at nearly 4.8 million professionals, including over 392,000 in Europe and almost 543,000 in North America. AI will be able to absorb some of this shortfall. But even it needs skilled professionals to deploy, manage, train and interpret output.

According to ISC2 figures, the global workforce gap in cybersecurity now stands at nearly 4.8 million professionals, including over 392,000 in Europe and almost 543,000 in North America. AI will be able to absorb some of this shortfall. But even it needs skilled professionals to deploy, manage, train and interpret output.

Against this backdrop, many (37%) organisations are struggling to comply with industry regulations and standards. The former is concerning, given the potentially significant financial penalties that can now be levied by regulators. The latter is disappointing, as best practice standards like ISO 27001 can actually help to reduce the regulatory compliance burden, given many new pieces of legislation – especially in Europe – require similar foundational steps be put in place.

A final challenge worth mentioning is digital resilience, cited by 41% of respondents. As ransomware and data extortion attacks cause chaos on both sides of the Atlantic, it has become increasingly important to company boards and stakeholders that organisations can continue to operate, even following a breach. The concept lies at the heart of regulatory efforts like DORA and NIS2. However, IBM claims that 86% of data breach victims over the past year experienced operational disruption affecting customer-facing services, sales processing and production.

The good news is that, despite the relatively large share of our respondents citing challenges achieving digital resilience, many are moving in the right direction. As we’ll see, the threat landscape is undeniably weighted in the favour of our adversaries. But by assuming breach and preparing for the worst – through incident response, recovery planning, threat intelligence and more – organisations can and are improving resilience.