Emerging Cyber Threats Require Shift to Operational Resilience

Organisations are facing a fundamental shift in the threat landscape, requiring a move from traditional, reactive security models toward continuous operational resilience. The convergence of artificial intelligence (AI), supply chain vulnerabilities, quantum computing, and geopolitical instability is testing the limits of current security programmes.

AI-Driven Automation and Deepfakes

Artificial intelligence is being utilised to automate critical stages of the cyber attack kill chain, particularly in reconnaissance and vulnerability scanning. These advancements allow attackers to compress the time required to exploit vulnerabilities from several days to mere hours.

The rise of generative AI has also increased the sophistication of social engineering. Contextual phishing emails, voice and video deepfakes, and synthetic identities built on stolen data are becoming increasingly difficult to detect. In May 2026, a business professional in Singapore was defrauded of SGD 4.9 million following a Zoom meeting involving an AI-generated deepfake impersonating the nation’s prime minister.

Supply Chain and Third-Party Risk

Modern organisations rely on extensive networks of vendors, cloud providers, and partners, creating significant supply chain exposure. Attackers are increasingly targeting backdoors in vendor software and exploiting unmanaged application programming interfaces (APIs) to bypass traditional perimeters.

Because these tools and APIs often already have permission to access internal systems, intrusions can occur under a cloak of trust. These breaches often have a domino effect across entire networks; for example, a cyberattack on Australian manufacturer Mackay Sugar resulted in the shutdown of two mills and forced 1,300 farms to pause harvesting operations.

The Quantum Threat and Data Longevity

While functional quantum computers capable of breaking current public-key encryption—such as RSA and ECC—are still years away, the risk of “Harvest Now, Decrypt Later” (HNDL) is immediate. Threat actors may be collecting long-lived sensitive data, such as health records, financial information, and intellectual property, with the intention of decrypting it once quantum technology matures.

Migrating to post-quantum cryptography (PQC) is a complex, multi-year process. The Information Security Forum (ISF) estimates that while small enterprises may take five to seven years, large organisations could require 12 to 15 years or more to identify and replace vulnerable cryptography across all applications, hardware, and third-party dependencies.

Geopolitical Instability and Critical Infrastructure

Escalating global political tensions have turned critical infrastructure—including energy, transport, and finance—into primary targets for nation-state actors and their proxies. These attacks often target industrial control and operational technology (OT) systems rather than standard IT networks.

In 2026, Iran-affiliated hackers targeted U.S. energy, water, and government infrastructure, causing direct operational damage. Beyond direct strikes, the viral spread of disinformation and hybrid campaigns linked to geopolitical conflicts presents a persistent challenge to maintaining digital trust and business continuity.

The transition to post-quantum cryptography is expected to take over a decade for large-scale organisations, making the immediate mapping of encryption usage across all business units a critical priority.