Cyber security in 2027: resilience through strategic governance and autonomy

Key insights

• Leading organisations are moving beyond cyber security as a cost centre and finding strategic ways to leverage it as a competitive advantage
• Digital sovereignty is an ever-increasing focus, but autonomy is a more useful objective for global organisations
• A plethora of digital and security regulations in Europe and contrasts with a pull towards deregulation in the US, meaning a risk-based approach remains the answer to compliance fatigue
• Operational technology is being integrated more and more into corporate IT ecosystems, creating both risk and reward
• AI has created an arms race between attackers and defenders, necessitating fighting AI with AI and deploying right-sized governance
• Data governance is still the cornerstone of effective cyber security strategies but must be applied proportionally
• Cyber security teams must receive continual investment to balance stability with staying agile and advancing security postures

To move forward, organisations must embed cyber security into their innovation and implementation strategies while staying agile to adapt to evolving threats. Those that do will protect their assets and gain a competitive edge in the digital economy.

Global state of cyber security

Heading into 2027, cyber security is inseparable from digital transformation, and the pace of that transformation is increasing. The movement of AI from emerging technology to mainstream modality has proven to be a structural disruption, reshaping the threat landscape. Meanwhile, shifting operational strategies, an evolving regulatory landscape and an increased focus on digital sovereignty create a complicated web of requirements and risk that necessitate strategic decision-making.

Why cyber security is becoming a supply chain priority

Organisations with strong cyber security postures are increasingly winning contracts and partnerships over competitors, as RFPs and tenders now routinely screen out vendors who cannot demonstrate they meet prescribed cyber standards.

With the tech infrastructure and supply chain of each organisation growing more complex, organisations with strong cyber postures are increasingly benefiting from reputational advantages and supply chain preferences. This trend is particularly pronounced in B2B markets, where RFPs and tenders now routinely include substantial cyber security requirements, removing potential vendors from consideration whose cyber measures do not meet the prescribed standard.

The complexity of modern supply chains means that organisations often do not fully understand where their data resides or how it is being processed. This lack of visibility creates significant vulnerabilities, particularly as technologies like AI introduce new forms of data sharing and processing. Additionally, the growing interconnection between core enterprise systems, cloud platforms and third-party services is expanding attack surfaces and making resilience dependent on visibility across the full technology ecosystem.

Ultimately, each organisation is now expected to manage and monitor cyber security risks across its full ecosystem. This is reflected in the EU’s Digital Operational Resilience Act (DORA) and the NIS2 Directive, both of which strengthen the requirements for managing third-party and supply chain cyber risks.

This shift towards shared responsibility is driving the adoption of more sophisticated third-party risk management (TPRM) frameworks. The rise of third-party monitoring tools that score organisations on cyber security metrics has created a new form of market pressure. Companies are discovering that their cyber maturity can directly impact their ability to win contracts, secure partnerships and maintain customer trust.

Sovereignty versus autonomy: the new geopolitics of cyber security

Cyber security is increasingly a matter of national sovereignty. Governments now scrutinise where critical data is stored, who operates key digital services and which technologies organisations depend on, because cyber-attacks have become instruments of statecraft. Groups such as Volt Typhoon have embedded themselves in civilian infrastructure for future leverage, and disruptions like the 2024 CrowdStrike outage have exposed the fragility of over-dependence on external providers, especially those beholden to other jurisdictions.

The policy response has been swift, particularly in Europe: data residency requirements, sovereign cloud initiatives and a tightening web of regulation, with NIS2 and DORA emphasising operational resilience and supply chain security. The trend reaches well beyond Europe, however, and the bar for effective cyber security is shifting with it. From proving compliance to proving resilience, demonstrating that essential operations can continue and recover following a cyber incident is vital.

Yet sovereignty alone is not a resilience strategy. Pursued to its extreme, sovereignty can fragment supplier landscapes, duplicate infrastructure and limit access to effective technology, and can even concentrate risk, allowing a single government the power to hold continuity hostage.

What organisations should pursue is autonomy – the ability to understand, control and, where necessary, change their digital dependencies. Organisations should:

• Know where sensitive data is stored and processed: including backups and support functions, not just what the contract says.
• Understand suppliers’ geopolitical exposure: hidden dependencies deep in the supply chain can matter as much as headline contracts.
• Consider provider location and jurisdiction during procurement: the legal and geopolitical exposure of a critical provider is now a legitimate risk factor.
• Demonstrate resilience, not just compliance: folding sovereignty into a broader resilience programme as one input among many.

How are DORA and NIS2 changing cyber security regulation?

DORA and NIS2 are reshaping cyber security compliance across Europe, shifting the standard from providing compliance on paper to demonstrating operational resilience. For multinational organisations, navigating both simultaneously has become one of the most complex regulatory challenges of 2027.

In the EU, the challenge is largely one of volume: there are now well over a hundred digital-related acts and directives on the books, each adding to a dense, interconnected web of obligations. NIS2 is finally being enforced after several postponements, and the forthcoming Cyber Resilience Act will require products with digital elements to meet cyber security controls. Since NIS2 is a directive, member states write its principles into national law in subtly different ways, so organisations cannot simply lift and reuse compliance work from one jurisdiction to the next. The proposed digital omnibus aims to layer regulation more sensibly and tailor it to each organisation’s size and risk profile, though it has yet to fully land.

Across the Atlantic, the problem inverts. The United States is moving towards significant deregulation, with nothing resembling a comprehensive federal framework for cyber security. What exists is principally industry- and government-focused, most notably the Cybersecurity Maturity Model Certification (CMMC) for those working with the Department of War. Though, even this has been pushed back, its application effectively paused and the effects rippling into adjacent areas such as IT in financial services. There is no federal privacy law; protection is handled state-by-state, and the current political climate points away from national legislation rather than towards it. Counterintuitively, this lighter-touch environment brings its own fatigue: where some frameworks are highly prescriptive and others leave organisations guessing. Meanwhile, global businesses face the strain of reconciling wildly disparate approaches at once.

How a risk-based approach supports continuity without undue cost

This regulatory complexity has created what many industry professionals describe as both a burden and an opportunity. While many new regulations do aim to help improve resilience and business continuity, the burden compliance creates can also be a huge weight for already constrained teams.

À medida que a teia de requisitos de conformidade se torna mais complexa, as organizações que adotam uma abordagem de cumprir tabela podem ter dificuldade em lidar com requisitos díspares e áreas complicadas de sobreposição. Para manter a relação custo-benefício em seus esforços de conformidade, as empresas devem priorizar avaliações baseadas em risco. Uma abordagem de segurança cibernética baseada em risco pode ajudar as equipes de segurança cibernética a se concentrarem nos riscos que mais importam, para que a conformidade ofereça suporte à segurança em vez de impulsioná-la.

As the web of compliance requirements becomes more complex, organisations who take a tick-box approach may struggle to juggle disparate requirements and convoluted areas of overlap. To remain cost effective in their compliance efforts, businesses should prioritise risk-based assessments. A risk-based cyber security approach can help cyber security teams focus on the risks that matter most, so compliance supports security instead of driving it.

What is operational technology security, and why is it under attack?

Operational technology (OT) underpins critical infrastructure and industrial operations worldwide. As these systems become more digitally connected, cyber threats are growing, exposing environments that have historically received less security attention than conventional IT systems.

OT has long been treated as an engineering concern rather than a cyber security one, protected less by sophisticated defences than by sheer isolation. However, attacks on OT environments are rising sharply, especially in critical infrastructure, and these historically under-protected systems are proving an attractive target for well-resourced, geopolitically motivated adversaries; December 2025 alone saw attempted attacks on infrastructure in both Venezuela and Poland. Set alongside incidents such as those at M&S and Jaguar Land Rover, where business continuity was significantly disrupted by cyber attacks, the expectation of visibility is only increasing

Here lies a difficult paradox: most technology leaders report a serious lack of visibility into their OT network, and an organisation cannot govern what it cannot see. The natural response is to reach in and connect systems, data and other tools so that risk becomes legible and reportable. Yet, that reaching-in is precisely what creates the new exposure. OT environments are increasingly linked to corporate IT, cloud platforms and remote maintenance tools, and every new pathway erodes the isolation that may have been protecting these assets. The pursuit of transparency, handled without discipline, can manufacture the very vulnerability it was meant to expose – a risk compounded by OT’s long lifecycles, legacy-by-default estate and huge change windows.

However, protecting these assets is becoming increasingly mandated by digital regulation, especially where critical infrastructure is concerned.

How is AI changing cyber security?

AI is changing the nature of cyber security on both sides of the battle. Attackers are using it to launch more sophisticated and targeted threats at scale, while defenders are leveraging it to strengthen detection, automate responses and improve resilience.

So far, AI has often been framed as opportunity versus risk, but that framing no longer holds. AI is a structural disruption transforming the entire landscape, and on both sides of the cyber fence, AI-driven ecosystems are emerging: from autonomous vulnerability discovery to fully automated attack chains. The result is an arms race in which the gap between attackers and defenders is widening.

To know more, download the complete report: