Dive Brief:

• Ransomware is the top organizational cyber risk this year, the World Economic Forum said in its Global Cybersecurity Outlook for 2025. Nearly half of all respondents to the annual global survey said a ransomware attack concerns them the most.
• While ransomware ranked as the top cyber risk among CEOs and CISOs, the report found a significant gap in the level of concern between the executive roles. Nearly 1 in 3 CEOs said ransomware is their top cyber risk concern, but more than half of CISOs made the same determination.
• Executives in the study expect significant innovations in ransomware attacks, including the continued growth of ransomware-as-a-service models, which further the commoditization of cybercriminal activity. Nearly 3 in 4 chief risk officers said they anticipate severe organizational disruptions from cyber risks and criminal activity.

Dive Insight:

The report highlights a growing gap in cyber readiness between large enterprises with considerable resources and small organizations with fewer tools and talent at their disposal.

“Amid increasingly independent supply chains, this cyber inquiry is resulting in systemic points of failure with significant consequences for the overall resilience of the ecosystem,” the report said.

More than 1 in 3 small organizations said their cyber resilience is inadequate, a sentiment that’s grown sevenfold since 2022, the report found. Conversely, large organizations with more than $5.5 billion in annual revenue cited an improvement in cyber resilience with only 7% describing insufficiencies.

Nearly 3 in 4 cyber leaders told the WEF that small organizations can no longer adequately secure themselves against cyber risks.

Supply-chain challenges, compounded by a lack of visibility and oversight into the security practices of suppliers, are the largest barrier to cyber resiliency, according to more than half of respondents at large organizations.

Fraud from other forms of digital threats, including phishing and business email compromise, ranked as the second-highest cyber risk this year. Respondents ranked supply-chain disruption as the third-highest cyber risk.

WEF’s Global Cybersecurity Outlook survey is based on responses from more than 400 executives from 57 countries.