A leading insurer has warned businesses that cyber risk is now a strategic challenge not simply a technical issue.

AXA XL, and defence, aerospace, cyber and digital technology business Thales has released a new study on organisational resilience in the era of cyber threats, as part of their partnership.

Based on an in-depth analysis of public sources, sectoral studies, and proprietary data from AXA XL and Thales, the report highlighted that in 2026, cyber risk is no longer solely a technical issue but has become a strategic challenge at the highest level of the organisation. This evolution is notably driven by the industrialisation of cybercrime, increasing geopolitical tensions, the growing complexity of the regulatory framework, and the acceleration of technological innovations.

It found 144 countries now implement regulations regarding privacy or cybersecurity, while new legislation such as NIS2, DORA, and the AI Act in Europe significantly strengthens requirements related to governance, risk management, and reporting.

However, the financial impact of cyber incidents continues to grow with the average cost of a data breach for an organisation reached $4.44 million in 2025.

The report identified five strategic priorities for senior leaders:

• Achieving full visibility of digital assets and critical dependencies
• Extending risk oversight across third-party ecosystems
• Ensuring AI governance keeps pace with deployment
• Building crisis-ready leadership and response capabilities
• Developing a structured roadmap for post-quantum cryptography

“This report reinforces a fundamental reality we are seeing across industries and regions: cyber resilience now extends well beyond technical controls. It requires disciplined governance, strategic foresight, and proactive risk management,” said Rebiah Girard-Bardot, head of cyber risk consulting services at AXA XL.

She added: “Spending on cybersecurity has never been higher. Confidence in cyber resilience has never been lower.

“In 2026, digital disruption is no longer a contained technical issue, but a defining feature of the current economic and geopolitical environment. Consolidated cybercrime, geopolitical tension, regulatory expansion, and rapid technological acceleration are all converging to reshape how organisations operate and compete.”

Girard-Bardot : “Cybercriminal activity is more than ever a combination of coordination, sophistication, speed and scale.

“Geopolitical tension increasingly plays out in the digital domain, where economic pressure, espionage and disruption intersect. Regulatory frameworks continue to extend expectations of governance, resilience and transparency. And at the same time, advances in AI, automation and quantum computing are altering both defensive capabilities and adversarial tactics, as well as lowering barriers to entry for attackers.

“The significance of cyber risk continues to grow. It influences supply chains, service delivery, investor confidence and cross-border trust.

“As our digital and physical worlds collide, the impact of a cyber breach now extends into physical consequences too. Interconnected ecosystems mean disruption rarely remains isolated anymore. For boards and executive teams, the implications are clear: cyber resilience is now a core business priority. It influences risk, continuity and trust, and increasingly acts as a source of competitive advantage when volatile conditions arise.”

She concluded: “To be effective, it cannot sit solely within technical functions. It must be embedded across the organisation through clear accountability, strong governance, robust risk management and executive buy-in, with rehearsed response plans and greater visibility across the business.”