Geopolitics and Cyber

Territory, industrial capacity, military strength and resources remain relevant; cyber capability changes how actors can use and complement them.

The following are illustrative assets and dependencies, informed by Nye’s cyber-power analysis and the technical sources linked below. They are not a ranked or exhaustive classification of national power.

• Data
• Artificial Intelligence
• Semiconductor capability: designing and manufacturing electronic chips from materials with controllable electrical conductivity
• Cloud computing: shared computing resources accessed on demand over networks
• Communications networks
• Cyber operations
• Quantum computing: computing that uses quantum-physical effects to process information
• Digital ecosystems

Access to technology can create strategic leverage, but possession alone does not determine outcomes. The United States (US) Government Accountability Office (GAO)’s review of advanced semiconductor controls documents how computing technologies link commercial applications with national-security policy (Highlights).

The recommendation to give these dependencies strategic attention follows NIST’s guidance on organisational context and supply-chain risk (GV.OC and GV.SC). The framework describes high-level outcomes rather than imposing general requirements or prescribing how every organisation must achieve them. No comparison of historical significance is advanced here.

Interconnected software, cloud services and supply chains can transmit consequences beyond an initial compromise. Microsoft’s Digital Defense Report 2026 describes this ecosystem risk from its own telemetry (remotely collected operational and security measurements) and research (Opening statement, p. 4); it should not be read as a census of all global attacks.

The World Economic Forum’s Global Cybersecurity Outlook 2026, developed with Accenture, examines resilience, geopolitical fragmentation and supply-chain interdependency through leaders’ perspectives and supporting analysis (Executive summary; sections 3.2, 3.4–3.6; Appendix: Methodology). Its findings are not a representative census of every organisation.

Business leaders should evaluate cybersecurity as part of business strategy and financial resilience, as well as an operating cost. The UK government’s Cyber Governance Code of Practice recommends aligning cyber strategy with organisational objectives, allocating appropriate resources and establishing board oversight (Strategy; Assurance and oversight). This is a governance recommendation, not evidence that every security investment produces a positive return.

Joseph S. Nye’s research provides a corrective to simplistic accounts of digital dominance. In Cyber Power, published by Harvard Kennedy School’s Belfer Center for Science and International Affairs in 2010, he explains how low entry costs, anonymity and uneven vulnerabilities can give smaller actors scope to exercise influence, while governments remain powerful. His observation that “diffusion of power does not mean equality of power” appears in the abstract. The recommendation to assess relevant capability and access rather than size alone is also grounded in NIST’s risk-assessment guidance, which considers threat sources, vulnerabilities, likelihood and impact. It is not a claim that Nye experimentally validated an executive assessment method.

Digital power also has organisational and service dependencies. NIST’s contingency-planning guidance recommends identifying resources, interdependencies, recovery priorities and alternative arrangements through business impact analysis (sections 3.2–3.4). WEF examines supplier concentration in section 3.5, while Microsoft’s Opening statement describes how compromise can travel through interconnected platforms. The recommendation derived here is to judge capability by continuity of essential outcomes, examining supplier alternatives and recovery dependencies rather than technology ownership alone. This applies the cited guidance; it does not establish a universal relationship between ownership and resilience.

NATO includes national resilience within its cyber defence policy. The author’s interpretation is that digital resilience should therefore be considered alongside other capabilities when assessing preparedness, without assigning it a universal ranking.

Cyber capabilities serve espionage, disruptive and other strategic purposes; their role cannot be reduced to a recent progression from intelligence collection to statecraft. Nye’s 2010 analysis already considered cyber power in international relations.

The Volt Typhoon advisory and UK attribution of the Viasat attack discussed below show different uses and assessed intentions. They do not establish that all states share a strategy or that every campaign follows the same trajectory.

The potential appeal depends on the objective and operating conditions.

Nye examines uneven cyber resources and vulnerabilities, while research by RAND examines operational challenges, warning and capability requirements. Drawing on these analyses, the checklist below proposes questions rather than claims universal advantages over conventional operations.

• Resources and preparation required for the intended effect
• Prospects for concealment and the risk of attribution
• Political consequences if the operation is exposed
• Time needed to acquire and maintain useful access
• Scope of impact and the risk of unintended consequences
• Potential physical effects and escalation risks

This is an analytical checklist, not evidence that cyber operations are inherently cheaper, faster, safer or less escalatory than other instruments.

The following advisory’s summary provides a documented example of persistent access and assessed disruptive intent.

A joint advisory from the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Federal Bureau of Investigation (FBI) and partners confirms Volt Typhoon compromises of IT environments in multiple US critical infrastructure organisations, including in US territories. The advisory identifies Volt Typhoon as a People’s Republic of China (PRC) state-sponsored actor. In this US context, CISA defines critical infrastructure as physical or virtual assets, systems and networks whose incapacitation or destruction would have a debilitating effect on security, national economic security, public health or safety. In the advisory’s summary, the US authoring agencies assess pre-positioning for disruptive or destructive attacks in a major crisis or conflict with the United States.

This campaign illustrates a reported purpose beyond conventional intelligence collection; it does not establish a universal change across all adversaries.

The advisory’s summary states that Volt Typhoon’s targeting and behaviour are inconsistent with traditional espionage and assesses with high confidence that access could enable movement to operational technology (OT) assets (systems that monitor or control physical devices and processes) to disrupt functions.

The Volt Typhoon advisory’s summary distinguishes observed compromise from assessed intent. Confirmed IT intrusions and a high-confidence judgement about disruptive pre-positioning are not evidence that every compromised organisation had already suffered an operational technology outage, nor do they establish a timetable for conflict. The recommendation here is to examine exposure, improve detection and test continuity arrangements rather than treat a future scenario as an accomplished event. Executive reporting should retain the source’s confidence language and explain what has, and has not, been observed.

Cyber capability should not be assumed to be cheap, reliably deniable or politically safe. Nye’s analysis considers uneven resources and vulnerabilities, while RAND’s research examines operational integration, planning and warning. The Volt Typhoon advisory recommends measures intended to detect and mitigate the activity; these recommendations do not establish successful eviction in every affected environment. The management recommendation is to assess the actor, access and plausible consequences, consistent with NIST’s Guide for Conducting Risk Assessments, rather than label every intrusion geopolitical.

The Microsoft Digital Defense Report 2026 discusses nation-state and geopolitical threats, critical infrastructure and national resilience (sections beginning pp. 38, 85 and 90). These observations reflect Microsoft’s visibility and research, rather than establishing an unqualified increase across every category of global state activity.

Author’s interpretation of Nye’s analysis: cyber capability is one component of state power, not a substitute for other strategic resources.

WEF’s 2026 outlook, section 3.2, treats geopolitics as a defining feature of cybersecurity, while documented incidentsshow how digital operations can intersect with wider conflict.

Nye’s analysis places cyber capability within wider relationships of power. The following instruments provide context for the author’s analysis; their presence in a dispute does not by itself demonstrate coordination with a cyber campaign.

• Economic sanctions
• Trade restrictions
• Diplomatic pressure
• Information campaigns
• Conventional military activities

The following sources document distinct technology-policy measures and attributed cyber incidents. They should not be treated as interchangeable evidence.

US–China technology competition includes controls on advanced semiconductors and manufacturing equipment. GAO documents the national-security rationale and the relevance of advanced computing to AI and military applications(Highlights); these export controls are distinct from cyber operations.

The United Kingdom (UK)’s attribution of the Viasat incident provides a specific example of assessed Russian cyber activity associated with the invasion of Ukraine.

North Korea’s revenue-generation activity should be distinguished from the evidence about Iran. A July 2026 multinational alert describes North Korean IT-worker schemes that use false identities to earn income for prohibited weapons programmes and identifies cyber-enabled theft and insider risks. This evidence specifically concerns revenue generation and sanctions evasion. By contrast, a joint advisory’s summary and Background information describe actors affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) compromising programmable logic controllers (PLCs)(industrial computers that control equipment and processes) across sectors, including US water and wastewater facilities. It supports a claim about Iranian-linked infrastructure targeting, not the same sanctions-related revenue mechanism.

The attack on Viasat’s KA-SAT network on 24 February 2022 illustrates the intersection of digital operations and conflict. The UK and its allies attributed the incident to Russia; the NCSC assessed Russian responsibility as almost certain. The UK government reported that the attack began approximately one hour before the invasion. Viasat’s opening incident overview reported disruption affecting several thousand customers in Ukraine and tens of thousands of other fixed broadband customers across Europe. Government reporting provides attribution and context; the operator account describes service impact and network scope. These are attributed accounts, not independent replication of the underlying intelligence or forensic investigation.

Viasat’s incident overview states there was no evidence that the KA-SAT satellite itself was directly involved, impaired or compromised. It also reports that directly managed mobility and government users on KA-SAT, and users of other Viasat networks, were unaffected. Absence of evidence is not categorical proof of non-compromise. The recommendation to examine shared management systems, upstream providers and the independence of recovery options follows NIST’s supply-chain risk guidance and contingency-planning guidance. It is a business application of those publications, not an additional forensic finding about Viasat.

The NCSC’s assessment and Microsoft’s 2026 report describe changes to attacker and defender workflows. This article does not attempt to rank AI’s historical significance against the internet. Required expertise and resources vary by task: assistance with reconnaissance (gathering information about a target) or message composition should not be equated with reliable end-to-end autonomous operations. The NCSC’s Context and Key judgements provide the basis for that distinction.

The NCSC’s Key judgements assess that wider availability of AI-enabled tools will highly likely expand access to intrusion capability; this does not mean equal gains for every actor.

The Microsoft Digital Defense Report 2026 describes compressed attack timelines and increased speed, scale and autonomy (Top 10 takeaways, p. 8; AI, pp. 9–30). These are Microsoft’s findings and assessments, not a guarantee of autonomous capability in every campaign.

Microsoft reports AI use across reconnaissance (gathering information about a target) phishing, meaning deceptive messages used to trick recipients into opening harmful links, downloading malware or disclosing sensitive information, vulnerability discovery, malicious software (malware) and exploit development, and data analysis (AI, pp. 9–30). A vulnerability is a weakness in a system, security procedures, controls or implementation that a threat source could exploit or trigger; an exploit is the technique or code used to take advantage of it. The following examples encompass AI-assisted tasks and potential applications also discussed in WEF’s outlook, section 3.1; they should not be read as proof of fully autonomous execution or consistent effectiveness.

• Assist phishing-message production, as discussed in Microsoft’s AI threat analysis
• Automate parts of reconnaissance, rather than assume autonomous completion of an entire operation (NCSC assessment)
• Analyse stolen datasets
• Identify vulnerabilities
• Support malware development
• Create synthetic media: artificially generated or altered images, audio or video
• Support social engineering at scale: deception intended to gain trust, information or unauthorised access (WEF, section 3.1)

Microsoft’s AI section, pp. 9–30, and WEF’s section 3.1 also discuss defensive AI applications, including the following areas. Adoption should be distinguished from demonstrated effectiveness in a particular organisation.

• Threat hunting: proactively searching for signs of cyber threats and intrusions beyond those identified by existing detection rules, using hypotheses and available data
• Vulnerability prioritisation
• Security analytics: analysing security data to identify suspicious activity
• Threat information analysis: adding context to information about threats to support decisions; the term “enrichment” here describes this contextual analysis, rather than a separate standardised definition
• Automated response

The World Economic Forum’s Global Cybersecurity Outlook 2026 discusses AI’s effects on offensive and defensive capability in section 3.1. This is the more direct source for those claims than its broader Global Risks Report.

The NCSC’s May 2025 assessment, Impact of AI on cyber threat from now to 2027, uses explicit probabilistic language. Its key judgements assess that AI will almost certainly make elements of intrusion more effective and efficient, and that proliferation of AI-enabled tools will highly likely expand access to intrusion capability. It also assesses an almost certain divide between systems keeping pace with threats and a large proportion that are more vulnerable. These are intelligence judgements, not guarantees of equal capability gains or inevitable defensive failure. The recommendation here is sustained adaptation, not a one-off purchase of an AI-labelled security product.

Defensive AI adoption should be evaluated against defined outcomes and risks. NIST’s Artificial Intelligence Risk Management Framework (AI RMF 1.0) addresses validity, reliability, safety, accountability, explainability, measurement and human–AI interaction (sections 3 and 5; Appendix C). Its measurement playbook, MEASURE 1.1, recommends fit-for-purpose testing, acceptable performance limits and documented metrics. Applying that guidance here means asking whether a tool improves investigation or prioritisation, which actions it may authorise, and how errors can be detected and reversed. Isolation of a production service is a hypothetical adverse outcome to test, not a documented incident asserted here. Controls should reflect the use case and consequences; NIST’s explanation of trustworthiness characteristics does not guarantee trustworthy operation in every setting.

AI systems also require protection. The NCSC’s Key judgements assess that their incorporation into the technology base increases the attack surface (the points through which an attacker could enter, affect or extract data from a system) while Microsoft describes risks to AI systems and data (AI as the new attack surface, p. 27 onwards). WEF reports that 94% of surveyed respondents expected AI to be the most significant driver of cybersecurity change in the year ahead (Key insights and Appendix: Methodology). This measures expectations, not attacks caused by AI. The reporting recommendation here is to distinguish incident observations, survey perceptions, experimental results and intelligence forecasts, and to examine dependencies on models, infrastructure and update channels.

WEF characterises these developments as a cyber arms race in section 3.1. That is an analytical framing, not a single measurable condition shared equally by all organisations.

A planning question for 2027–2031: where could AI improve security outcomes, and where could it create additional exposure?

The recommendation is to evaluate AI alongside secure foundations, recovery capacity and accountable human oversight. This combines NIST’s AI risk guidance, GOVERN and MEASURE, with the CSF Core’s governance and recovery outcomes; it is not proof that one investment mix is optimal for every organisation.

The UK Cyber Governance Code warns that incidents can disrupt continuity, competitiveness and customer trust (Why should boards and directors use the Code?). A compliance-only view would not fully address those outcomes. This is the article’s interpretation of the guidance, not a survey finding about executive attitudes.

The recommendation is to connect security and compliance with business objectives, continuity and commercial dependencies, consistent with the Cyber Governance Code’s Risk management and Strategy principles and NIST’s contingency-planning guidance, section 3.2.

CNBC’s contemporary reporting and CyberScoop’s account document substantial commercial disruption at Maerskfollowing NotPetya. These sources do not establish the attackers’ precise intent towards Maersk; the financial consequences should not be treated as proof of whether it was a principal or collateral target.

For risk assessment, relevant exposure includes intellectual property theft, compromised suppliers, espionage and operational interruption, as discussed in Microsoft’s threat landscape section, p. 31 onwards, and WEF’s section 3.5. These are different mechanisms of harm and should not all be labelled warfare.

The World Economic Forum examines supply-chain opacity and concentration risk in its outlook, section 3.5. The analysis supports attention to systemic dependencies, not a prediction that every sector will suffer the same consequences.

The following sectors are examples for applying the NCSC toolkit’s approach to identifying critical assets and collaborating with suppliers, not evidence that these sectors are a ranked or exhaustive target set. Organisations should select their own scope through business impact analysis, section 3.2.

• Artificial Intelligence
• Semiconductors
• Biotechnology
• Energy
• Telecommunications
• Advanced manufacturing
• Aerospace

The distinction is between policy instruments, such as technology export controls, and cybersecurity capabilities that help protect an organisation against compromise or disruption. Both matter to economic security, but they are not interchangeable.

NotPetya provides a documented example of commercial disruption. In August 2017, CNBC, the business-news publication and broadcaster, reported the company statement estimating a negative impact on results of US$200–300 million at A.P. Moller–Maersk (Maersk), expressed in United States dollars. CyberScoop’s report connected the estimate to the quarterly disclosure and reported research identifying a compromised M.E.Doc accounting-software update mechanism. It also quoted Maersk’s statement that six of its nine businesses maintained normal operations. The estimate was not a final audited loss total, and not every Maersk business was affected. The business implication drawn here is to include interruption of shipping, terminal and associated processes in risk analysis, rather than focus only on stolen data.

CyberScoop’s reporting describes compromised software distribution and operational consequences. It does not establish every pathway by which a local incident could affect an enterprise. To examine geographic presence, locally used software, shared providers and connected networks, apply NIST’s supply-chain guidance and business impact analysis and recovery planning. These sources support evaluating dependencies and recovery strategies; they do not prove that isolating or substituting a particular dependency will always be feasible or cost-effective. Select controls through the organisation’s own risk assessment.

The Binance theft of 29 October 2026 illustrates commercial loss with geopolitical significance. Its initial updateestimated approximately US$6.3 billion affected and around US$3 billion frozen on-chain (on blockchain networks with shared transaction records designed to reveal tampering). Its second update identified additional points of compromise beyond the initially suspected laptop. TRM Labs estimated US$6.36 billion in outflows across ten blockchains and attributed the attack with high confidence to North Korea’s TraderTraitor. The position subsequently changed: Reutersreported on 31 October that the FBI attributed the theft to North Korea. This is an official attribution reported by Reuters, not independent reproduction of the underlying intelligence. The recommendations below concerning access privileges(granted rights or authorisations) and recovery remain risk-management applications, not proof of the incident’s root cause.

In its 31 October recovery update, Binance said it had replenished backing for approximately 90% of the affected assets using company resources, including its treasury and funds described in that announcement. Reuters’ same-day reportingexplains that Binance was buying replacement tokens with company money. Replenishment is not recovery of stolen proceeds from the attacker: estimated theft, frozen assets, recovered proceeds and replacement backing are distinct measures. The remaining 10% comprised less liquid tokens that Binance said would take longer to source. At that update, reopening withdrawals on 1 November remained a plan, not a completed recovery milestone. These figures describe the position reported on 31 October, not a final audited loss or recovery total.

The control recommendations associated with the Binance example should be assessed against independent guidance, not inferred solely from a developing incident account. NIST CSF 2.0, PR.AA, addresses identity management, authentication and access control, while NIST’s Incident Response Recommendations and Considerations for Cybersecurity Risk Management supports coordinated preparation, response and recovery. These publications support reviewing privileged permissions and response arrangements; neither establishes Binance’s root cause or proves that a specified control would have prevented the theft.

The documented examples should not be collapsed into a single category of warfare. The North Korean alert concerns revenue generation, the Volt Typhoon advisory assesses disruptive intent, and the Maersk reporting describes commercial interruption. The recommendation is to assess consequences and choose proportionate controls rather than infer motive or legal status from a dramatic label. NIST’s CSF, GV.OC and GV.RM, supports placing cyber risk within organisational context and risk-management strategy. Any legal classification requires a separate assessment; this article does not supply one.

The consequence for business leaders is significant.

The Cyber Governance Code’s Introduction connects resilience with financial viability and business performance. Protecting continuity and competitive assets is therefore a supported governance objective, not a guarantee of commercial advantage.

The European Commission discusses digital sovereignty in terms of technological autonomy and capability. This article uses the term to mean the ability to make and implement decisions about consequential digital technologies, data and infrastructure. That is a working interpretation, not a claim that the source establishes a universal definition or a measured increase in geopolitical importance.

WEF reports sovereignty concerns and geopolitical fragmentation alongside technological dependencies in section 3.2. These findings support scrutiny of control and trust, without proving all foreign suppliers create the same vulnerabilities.

GAO documents US investment in domestic semiconductor capability alongside export controls (What GAO Found). More broadly, the following are policy options to assess on their merits, not an assertion that every government has adopted them or that they share a single cause:

• National semiconductor programmes
• Sovereign cloud initiatives: a working label here for arrangements addressing specified jurisdictional and operational-control objectives. Evaluate their security claims against the NCSC’s cloud security principles; those principles are security guidance, not a definition or certification of sovereignty.
• Domestic technology investment
• Data localisation requirements: measures requiring specified data to be stored and/or processed domestically. The cited research distinguishes local-storage requirements from additional restrictions on transfers or overseas processing; the obligations depend on the particular measure.
• Strategic technology partnerships

WEF’s discussion of sovereignty in section 3.2 supports examining control and dependency. It does not establish a ranking against energy security; no such comparison is advanced here.

For this article’s business analysis, meaningful sovereignty is understood as control over consequential decisions, not ownership of every component. Where is information processed? Who can administer the service? Which jurisdictions and subcontractors are involved? Could essential workloads be restored without normal supplier control systems? These questions operationalise a dependency review; they are not a legal conclusion that location alone determines sovereignty. NIST includes organisational context (GV.OC) and cybersecurity supply-chain risk management (GV.SC) within governance; these are framework category identifiers, not separate technologies. The recommendation is to test local-storage and sovereignty claims against administration, identity, support and exit arrangements rather than rely solely on a service label.

The recommendation is selective independence, not complete technological self-sufficiency. NIST’s supply-chain guidance supports identifying and mitigating dependencies, and its contingency-planning guide addresses recovery priorities and alternative strategies. Apply these to test whether multiple suppliers genuinely provide independent recovery options; shared authentication or upstream services are hypothetical dependencies to investigate, not assumptions about every arrangement. WEF’s sections 3.2 and 3.6 provide context on sovereignty and collaboration. Alternatives and partnerships should be evaluated for cost, feasibility and residual risk rather than assumed to improve resilience automatically.

Cyber resilience (the ability to anticipate, withstand, recover from and adapt to adverse cyber conditions) complements other sources of organisational and national resilience. The World Economic Forum treats it as important to safeguarding economic value in its outlook, section 3.4. This does not imply that earlier societies measured resilience only through military and economic strength.

The following dimensions are the author’s planning lens. They draw on NIST’s recovery and supply-chain outcomes, GV.SC and RECOVER, and the AI risk framework’s Secure and resilient characteristic, but are not presented as an independently validated taxonomy.

• Cyber resilience
• Operational resilience
• Supply-chain resilience
• Information resilience
• Data resilience
• AI resilience

NIST’s CSF Core includes detection, response and recovery alongside governance, identification and protection. The UK Cyber Governance Code also discusses continuity and customer trust. The following are objectives to assess, not guaranteed outcomes or a universally validated set of measures:

• Detect rapidly.
• Respond effectively.
• Recover quickly.
• Maintain critical operations.
• Preserve stakeholder trust.

NIST’s CSF recovery category RC.RP addresses execution, restoration-asset integrity and the return of operational capability. For priorities and dependencies, use the Contingency Planning Guide’s business impact analysis and recovery-strategy guidance; for testing, use its named testing, training and exercises component, rather than treat a completed backup job as evidence that a business service can resume. An illustrative exercise should examine the relevant identity services, cryptographic keys, staff, supplier access and restored-data integrity. This checklist applies the cited planning guidance and is not an exhaustive or independently validated test. Agree service priorities and tolerable disruption through business impact analysis, then test the dependencies needed to meet them.

WEF’s sections 3.4–3.6 examine dependencies and unequal access to expertise. Mapping service dependencies follows NIST’s business impact analysis guidance; exercises and agreed escalation arrangements follow the UK Code’s incident-planning principle and NIST’s incident-response guidance. Consider support for a critical supplier only where supply-chain assessment identifies a material exposure and a feasible response. No cited research establishes that such expenditure always outperforms internal investment. Compare costs, limitations and residual risk in the organisation’s circumstances.

NATO’s policy provides a specific institutional example of cyberspace’s place in defence; it should not be read as evidence that every military follows identical doctrine.

The North Atlantic Treaty Organization (NATO) recognised cyberspace as a domain of operations at the Warsaw Summit in July 2016. Cyberspace is the interconnected digital environment. Its policy overview describes protecting Alliance networks, operating in cyberspace, supporting national resilience and providing political consultation.

NATO’s opening policy overview states that cyber defence is part of its core task of deterrence and defence and that malicious cyber events occur daily. These are the Alliance’s policy position and threat characterisation.

Collective defence does not create an automatic military response to every serious intrusion. Sarah Wiedemar’s 2023 analysis discusses case-by-case political decisions, while NATO’s explanation of Article 5 states that assistance may or may not involve armed force. These sources concern allied obligations, not commercial compensation. This article establishes no entitlement for a company to restoration, reimbursement or operational support. Its recommendation to maintain organisational preparedness is grounded in the UK Code’s incident-planning and recovery guidance.

NATO’s policy emphasises resilience, information-sharing and collective responses; Nye’s analysis discusses actors with uneven resources. The recommendation for companies is narrower: agree incident responsibilities, external contacts and exercised communications, following the UK Code and NIST’s incident-response guidance. These practices can support coordination; they are not a promise that government assistance will be available in every incident or that a formal partnership ensures operational readiness.

Quantum computing, which processes information using quantum-physical effects, adds a longer-term security consideration, without establishing a date for cryptographic collapse. In August 2024, NIST finalised its first three post-quantum cryptography (PQC) standards – methods designed to resist both conventional and quantum-computer attacks. They cover a key-encapsulation mechanism, used to establish a shared secret, and two digital signature schemes, used to verify origin and detect modification. Its release announcement encouraged transition to begin. This supports preparation before a cryptographically relevant quantum computer exists, not a prediction of when one will arrive. NIST’s migration project workstreams address discovery, prioritisation and interoperability—the ability of different systems to work together. The leadership interpretation here is to plan around confidentiality lifetimes and upgrade complexity, rather than assume that uncertainty justifies either panic or indefinite delay.

NIST’s migration project describes identifying quantum-vulnerable public-key cryptography, supporting risk-based prioritisation and testing interoperability. Its discovery and interoperability workstreams support beginning with dependencies and supplier plans. NIST’s dedicated crypto-agility white paper defines agility as replacing and adapting cryptographic algorithms while preserving security and ongoing operations, and examines implementation challenges and trade-offs. Apply those considerations to information confidentiality lifetimes, upgrade complexity and service testing; these are organisational prioritisation decisions, not a prediction of quantum-computer availability. Directors should connect the roadmap with ownership and resources using the UK Code’s strategy and oversight guidance.

The following are the author’s planning scenarios, not source forecasts or assigned probabilities. The documented cases and assessments provide context, but do not establish that any scenario must occur in 2027–2031. Each proposition is conditional and includes indicators to monitor. Leaders should test proportionate responses, record assumptions and revise them if the evidence changes. WEF’s Preface similarly distinguishes its potential futures from predictions, although its report uses different time horizons.

1. Could our organisation continue operating through a prolonged cyber disruption?
2. How dependent are we on a limited number of technology providers?
3. Are we prepared for AI-generated misinformation targeting our executives, brand or stakeholders?
4. Could geopolitical tensions directly affect our technology supply chain?
5. Have we tested cyber resilience at board level within the last twelve months?

These questions adapt themes from the NCSC’s board question set, the Cyber Governance Code’s Incident planning, response and recovery principle and NIST’s AI risk framework, GOVERN and MAP. Use them to complement metrics, not as a validated score or a substitute for technical assurance. The twelve-month question is an author-proposed review prompt, not a universal legal deadline.

Board assurance should connect management claims with evidence. NIST’s Contingency Planning Guide treats testing, training and exercises, and plan maintenance, as distinct named components. Use the former to assess procedures and preparedness, and the latter to keep plans current; a maintenance citation alone does not substantiate testing. The UK Code’s assurance and oversight principle and NIST’s AI framework, MEASURE, support requesting relevant evidence. Directors should seek exercise results, unresolved constraints, supplier-dependency findings and AI evaluation criteria. Document triggers for changing procurement and recovery priorities as organisational decisions, not a fixed agenda established by research for every enterprise.

Measures should reflect the business service and decision they support. NIST’s business impact analysis, section 3.2,addresses recovery priorities and tolerable disruption, while the NCSC’s board questions on embedding cyber securityencourage cross-functional accountability and management information. Suggested indicators here include restoration time, suppliers covered by exercises and unresolved dependencies. They are illustrative, not a validated set proven superior to alert volumes in every setting. Security, technology, operations, finance and legal leaders should agree ownership and explain uncertainty and trade-offs, consistent with the Code’s Risk management and Assurance and oversight principles.

Evidence should retain its scope and provenance. The Volt Typhoon advisory’s Summary distinguishes confirmed compromise from assessed intent; WEF identifies its survey methodology in the Appendix; and the Viasat account is the operator’s description of the incident. The recommendation is to record source, date, observed facts and assessment confidence in executive reporting. This applies the distinction visible in those sources; it does not imply independent verification of undisclosed intelligence, every survey response or an operator’s forensic conclusions. Recommendations should likewise state their supporting guidance and limits, rather than acquire unwarranted certainty through a citation.

Cybersecurity combines operational execution with strategic governance, as reflected in NIST’s CSF 2.0, Audience and CSF Core. Treating one as a replacement for the other would misrepresent both the technical work and leadership responsibilities.

The Cyber Governance Code’s Introduction assigns explicit responsibilities to boards and directors; strategic oversight is not an alternative to operational security work.

The Cyber Governance Code, WEF’s outlook, sections 3.2–3.5, and NATO’s policy connect cybersecurity with business resilience, technological dependence and national defence. This is a synthesis of their different perspectives, not evidence that every incident is geopolitical.

The World Economic Forum describes accelerating AI adoption, geopolitical fragmentation and supply-chain interdependencies in its 2026 outlook. These are the report’s findings and framing, informed by leaders’ perspectives and its stated methodology (Executive summary and Appendix).

Microsoft discusses nation-state and geopolitical threats; CISA and partners document Volt Typhoon access and assess disruptive intent; NATO sets out a collective cyber defence policy. These sources support concern and preparation, but do not establish one uniform trend across all countries or campaigns.

The sources cited in this article do not reliably predict which organisations or nations will succeed over the next decade. NIST’s business impact analysis, recovery strategies, testing and plan-maintenance guidance instead supports assessing priorities and preparedness in current decisions; it is not a forecast of commercial or geopolitical success.

The practical objective is to strengthen continuity, governance and tested recovery, without promising immunity from attack or commercial success. These priorities are supported by the Cyber Governance Code and NIST’s contingency-planning guidance.

Nye’s research and NATO’s policy provide clear grounds for including cyber capability and resilience in geopolitical analysis.

The management task is to translate that context into proportionate governance, supplier oversight and tested plans, as recommended by the Code and NCSC toolkit.

Call to Action

Ask your executive leadership team one simple question:

If geopolitical tensions escalated tomorrow and cyber operations directly affected our suppliers, customers, technology providers or critical infrastructure, how long could we continue operating?

An uncertain answer is a reason to undertake business impact analysis, test recovery assumptions and document limitations; not proof by itself that the strategy has failed. NIST’s Contingency Planning Guide supports these through its distinct business impact analysis, testing/training/exercises and plan-maintenance components. Assess priorities, exercise the proposed response and update the plan in light of findings; these are separate activities.

The documented incidents justify preparation now; they do not establish what geopolitical competition will look like in 2031. Scenario planning should remain conditional and evidence-led, consistent with the distinction in WEF’s Preface.

Use the Code’s governance actions and NIST’s recovery planning to make today’s decisions more explicit, testable and accountable. These are supported practices for preparedness, not a guarantee of tomorrow’s outcomes.