Cyber security in 2027: resilience through strategic governance and autonomy

Every year, industry leaders at Forvis Mazars come together to collate insights on the global state of cyber security and offer advice to organisations navigating its complexity. This year’s report explores how organisations can leverage technology and navigate complex global issues – like regulation, geopolitical instability and questions of digital sovereignty – to improve organisational resilience and autonomy.

Download the report

Key insights 

To move forward, organisations must embed cyber security into their innovation and implementation strategies while staying agile to adapt to evolving threats. Those that do will protect their assets and gain a competitive edge in the digital economy. 

Global state of cyber security 

Heading into 2027, cyber security is inseparable from digital transformation, and the pace of that transformation is increasing. The movement of AI from emerging technology to mainstream modality has proven to be a structural disruption, reshaping the threat landscape. Meanwhile, shifting operational strategies, an evolving regulatory landscape and an increased focus on digital sovereignty create a complicated web of requirements and risk that necessitate strategic decision-making.

"Cyber threats are evolving faster than ever, driven by AI, interconnected ecosystems, geopolitical tensions and an increasingly complex regulatory environment. Yet the answer remains constant: a risk-based approach that protects what matters most and treats resilience, not simply compliance, as the true measure of cyber security." 

—— Wadi Mseddi, Group Head of Cyber Security Consulting, Forvis Mazars

Why cyber security is becoming a supply chain priority 

Organisations with strong cyber security postures are increasingly winning contracts and partnerships over competitors, as RFPs and tenders now routinely screen out vendors who cannot demonstrate they meet prescribed cyber standards.  

With the tech infrastructure and supply chain of each organisation growing more complex, organisations with strong cyber postures are increasingly benefiting from reputational advantages and supply chain preferences. This trend is particularly pronounced in B2B markets, where RFPs and tenders now routinely include substantial cyber security requirements, removing potential vendors from consideration whose cyber measures do not meet the prescribed standard. 

The complexity of modern supply chains means that organisations often do not fully understand where their data resides or how it is being processed. This lack of visibility creates significant vulnerabilities, particularly as technologies like AI introduce new forms of data sharing and processing. Additionally, the growing interconnection between core enterprise systems, cloud platforms and third-party services is expanding attack surfaces and making resilience dependent on visibility across the full technology ecosystem.  

Ultimately, each organisation is now expected to manage and monitor cyber security risks across its full ecosystem. This is reflected in the EU’s Digital Operational Resilience Act (DORA) and the NIS2 Directive, both of which strengthen the requirements for managing third-party and supply chain cyber risks.  

This shift towards shared responsibility is driving the adoption of more sophisticated third-party risk management (TPRM) frameworks. The rise of third-party monitoring tools that score organisations on cyber security metrics has created a new form of market pressure. Companies are discovering that their cyber maturity can directly impact their ability to win contracts, secure partnerships and maintain customer trust. 

Sovereignty versus autonomy: the new geopolitics of cyber security 

Cyber security is increasingly a matter of national sovereignty. Governments now scrutinise where critical data is stored, who operates key digital services and which technologies organisations depend on, because cyber-attacks have become instruments of statecraft. Groups such as Volt Typhoon have embedded themselves in civilian infrastructure for future leverage, and disruptions like the 2024 CrowdStrike outage have exposed the fragility of over-dependence on external providers, especially those beholden to other jurisdictions. 

“The boundaries between peace and conflict are blurring in cyberspace. State actors are positioning themselves inside civilian infrastructure – not for immediate gain, but for future leverage – and that changes the risk calculus for every organisation that depends on digital services.” 

—— George Lagarias, Chief Economist, Forvis Mazars

The policy response has been swift, particularly in Europe: data residency requirements, sovereign cloud initiatives and a tightening web of regulation, with NIS2 and DORA emphasising operational resilience and supply chain security. The trend reaches well beyond Europe, however, and the bar for effective cyber security is shifting with it. From proving compliance to proving resilience, demonstrating that essential operations can continue and recover following a cyber incident is vital. 

Yet sovereignty alone is not a resilience strategy. Pursued to its extreme, sovereignty can fragment supplier landscapes, duplicate infrastructure and limit access to effective technology, and can even concentrate risk, allowing a single government the power to hold continuity hostage. 

What organisations should pursue is autonomy – the ability to understand, control and, where necessary, change their digital dependencies. Organisations should: 

• Know where sensitive data is stored and processed: including backups and support functions, not just what the contract says. 
• Understand suppliers’ geopolitical exposure: hidden dependencies deep in the supply chain can matter as much as headline contracts. 
• Consider provider location and jurisdiction during procurement: the legal and geopolitical exposure of a critical provider is now a legitimate risk factor. 
• Demonstrate resilience, not just compliance: folding sovereignty into a broader resilience programme as one input among many. 

Framed this way, autonomy – not sovereignty – is the strategic objective, and a truer marker of the resilience regulators, customers and investors are really asking for. 

How are DORA and NIS2 changing cyber security regulation? 

DORA and NIS2 are reshaping cyber security compliance across Europe, shifting the standard from providing compliance on paper to demonstrating operational resilience. For multinational organisations, navigating both simultaneously has become one of the most complex regulatory challenges of 2027. 

In the EU, the challenge is largely one of volume: there are now well over a hundred digital-related acts and directives on the books, each adding to a dense, interconnected web of obligations. NIS2 is finally being enforced after several postponements, and the forthcoming Cyber Resilience Act will require products with digital elements to meet cyber security controls. Since NIS2 is a directive, member states write its principles into national law in subtly different ways, so organisations cannot simply lift and reuse compliance work from one jurisdiction to the next. The proposed digital omnibus aims to layer regulation more sensibly and tailor it to each organisation’s size and risk profile, though it has yet to fully land. 

Across the Atlantic, the problem inverts. The United States is moving towards significant deregulation, with nothing resembling a comprehensive federal framework for cyber security. What exists is principally industry- and government-focused, most notably the Cybersecurity Maturity Model Certification (CMMC) for those working with the Department of War. Though, even this has been pushed back, its application effectively paused and the effects rippling into adjacent areas such as IT in financial services. There is no federal privacy law; protection is handled state-by-state, and the current political climate points away from national legislation rather than towards it. Counterintuitively, this lighter-touch environment brings its own fatigue: where some frameworks are highly prescriptive and others leave organisations guessing. Meanwhile, global businesses face the strain of reconciling wildly disparate approaches at once. 

How a risk-based approach supports continuity without undue cost 

This regulatory complexity has created what many industry professionals describe as both a burden and an opportunity. While many new regulations do aim to help improve resilience and business continuity, the burden compliance creates can also be a huge weight for already constrained teams. 

As the web of compliance requirements becomes more complex, organisations who take a tick-box approach may struggle to juggle disparate requirements and convoluted areas of overlap. To remain cost effective in their compliance efforts, businesses should prioritise risk-based assessments. A risk-based cyber security approach can help cyber security teams focus on the risks that matter most, so compliance supports security instead of driving it. 

What is operational technology security, and why is it under attack? 

Operational technology (OT) underpins critical infrastructure and industrial operations worldwide. As these systems become more digitally connected, cyber threats are growing, exposing environments that have historically received less security attention than conventional IT systems.  

OT has long been treated as an engineering concern rather than a cyber security one, protected less by sophisticated defences than by sheer isolation. However, attacks on OT environments are rising sharply, especially in critical infrastructure, and these historically under-protected systems are proving an attractive target for well-resourced, geopolitically motivated adversaries; December 2025 alone saw attempted attacks on infrastructure in both Venezuela and Poland. Set alongside incidents such as those at M&S and Jaguar Land Rover, where business continuity was significantly disrupted by cyber attacks, the expectation of visibility is only increasing. 

Here lies a difficult paradox: most technology leaders report a serious lack of visibility into their OT network, and an organisation cannot govern what it cannot see. The natural response is to reach in and connect systems, data and other tools so that risk becomes legible and reportable. Yet, that reaching-in is precisely what creates the new exposure. OT environments are increasingly linked to corporate IT, cloud platforms and remote maintenance tools, and every new pathway erodes the isolation that may have been protecting these assets. The pursuit of transparency, handled without discipline, can manufacture the very vulnerability it was meant to expose – a risk compounded by OT’s long lifecycles, legacy-by-default estate and huge change windows. 

However, protecting these assets is becoming increasingly mandated by digital regulation, especially where critical infrastructure is concerned. 

How is AI changing cyber security? 

AI is changing the nature of cyber security on both sides of the battle. Attackers are using it to launch more sophisticated and targeted threats at scale, while defenders are leveraging it to strengthen detection, automate responses and improve resilience. 

So far, AI has often been framed as opportunity versus risk, but that framing no longer holds. AI is a structural disruption transforming the entire landscape, and on both sides of the cyber fence, AI-driven ecosystems are emerging: from autonomous vulnerability discovery to fully automated attack chains. The result is an arms race in which the gap between attackers and defenders is widening.  

An asymmetric contest 

It’s a possibility gap as much as a capability one; attackers and defenders may command similar technology, but agile attackers, by nature, often have the edge over process-bound defenders. Attackers have nothing to maintain: no business continuity burden, no change management, no regulatory obligations and no board to answer to. Defenders are bound by layers of policy, process and ethics – rightly so, because they have an organisation to protect – but every layer adds friction, and friction is precisely what AI-enabled attackers exploit. The evidence of acceleration is everywhere: 

• Rising volume and realism: The overall volume of attacks is climbing, with AI-leveraged fraud a particular growth area. Deepfakes have moved from novelty to boardroom threat – in one high-profile case, engineering firm Arup lost around $25 million after an employee was deceived by a deepfake video call impersonating senior executives. 
• Self-rewriting malware: Metamorphic malware – malicious code that rewrites itself to evade detection – is rendering traditional signature-based controls obsolete, forcing defenders towards behavioural indicators of compromise rather than known fingerprints. 
• Fully automated attack chains: With agentic AI now capable of automating entire attack sequences, no human team can match the pace, no matter how strong its defences. Organisations need to patch proactively, monitor continuously and focus first on the systems and data that would cause the most damage if compromised. 

If attackers are using AI, defenders must, too – and the good news is that it works. 

According to the IBM “Cost of a Data Breach” report 2026, organisations using AI-assisted detection and response have seen the average cost of a breach fall by nearly 40%, with roughly $1.93 million saved per incident, and the same techniques attackers use can be turned inward to stress-test an organisation’s own defences.  

The ambition, increasingly, is agentic: AI that not only detects a threat but isolates and addresses it, with a human in the loop for critical decisions. Agentic AI can help address a key paradox of this arms race: deploying AI safely requires clear guardrails, but cyber security exists precisely because attackers exploit the unknown; defenders cannot pre-establish guardrails for every response a defensive agent might face. Attackers, on the other hand, face no such constraint. Agentic AI, appropriately harnessed, can respond to attacks semi-autonomously without the need for a crystal ball.  

That said, the efficiency gains are real, but so is the risk; an attacker’s agent needs no permission structure, while a defender’s must work within justifiable guardrails. 

AI also expands the battlefield: every AI tool creates another attack surface, with prompt injection now mainstream – as DPD discovered when customers manipulated its chatbot into swearing at them, and McDonald’s when a recruitment chatbot exposed millions of applicants’ data. This is why AI governance and data privacy, long treated as separate if tangential disciplines, now urgently need consolidating into a unified policy, controls library and vendor oversight strategy. 

AI challenges & practical implementation strategies 

The key challenges with agentic AI lie in confirming proper input validation and preserving meaningful human oversight, without letting it become a brake on every action. 

As with all cyber security, AI governance should remain risk-based and proportional; it has never been possible to defend completely, and automated attacks only make that clearer. Security by design, the gold standard of risk mitigation, involves trade-offs with usability and time to market, and demanding perfection is self-defeating. 

The goal is not to eliminate risk but to identify the “crown jewels” and protect them proportionately. Cyber teams should act as business partners, enabling the organisation to adopt AI safely and at pace. In practice, that means: 

• Govern proportionately: apply the same risk assessment methodology used for other technologies, matching controls to the risk each AI use case carries. Not every deployment warrants the same scrutiny, and treating them as though it does makes failure more likely. 
• Keep humans in the loop: define what an agent may do on its own – identify, isolate, even shut down certain systems – and where a decision must escalate to a person, with robust input validation. 
• Consolidate governance and privacy: manage AI governance and data privacy together – shared policy, controls library and vendor oversight strategies – rather than as separate disciplines with separate metrics. 
• Invest in the team: upskilling cyber teams to keep pace with new attack techniques and defensive tooling is crucial; the capability gap is as much about people as technology.