TL;DR: Cybercrime and cyber insecurity entered the WEF Global Risks Report 2023 top 10, underscoring that digital disruption is now treated as a persistent business risk rather than a passing threat, according to INTIGRITI's analysis of the report. For practitioners, the signal is that resilience, identity control, and operational recovery must be governed as core risk-management capabilities, not separate security workstreams.
At a glance
What this is: WEF's 2023 risk outlook places cybercrime and cyber insecurity among the most serious global threats, reinforcing that cyber risk is now a standing business issue.
Why it matters: For IAM, NHI, and broader security programmes, the message is that control, recovery, and resilience have to be governed together because digital dependency now amplifies business impact.
Context
Cyber risk is no longer a narrow technical concern when global risk surveys place it alongside the issues that shape business continuity and national resilience. The governance problem is not whether organisations recognise the threat, but whether their operating model treats digital disruption as a core enterprise risk with accountable control ownership.
In identity-heavy environments, the same problem shows up when access, service credentials, and infrastructure dependencies are managed in separate silos. When business processes depend on always-on digital services, the question becomes whether privilege, recovery, and resilience are governed as one control plane or left fragmented across teams.
Key questions
A: They should treat cyber risk as an enterprise continuity issue, not just a technical security one. That means mapping critical services, assigning owners for resilience, setting recovery objectives, and reviewing whether access, monitoring, and restoration processes still work under disruption. If the business cannot operate when digital systems fail, the governance model is incomplete.
Q: Why does digital dependency make identity and access controls a resilience issue?
A: Because authentication, privilege, and service credentials are often the control points that keep critical systems available. If those identities are mismanaged or cannot be recovered quickly, the organisation may restore infrastructure but still be unable to run safely. Identity governance therefore becomes part of continuity planning, not just access administration.
Q: What fails when critical infrastructure security is treated as a separate IT problem?
A: The organisation misses the system-level dependencies that allow disruption to cascade across services. A siloed approach can protect individual assets while leaving the control plane, administrative access, and recovery paths exposed. The result is often partial recovery, where systems come back but essential business functions remain interrupted.
Q: Should organisations prioritise preparation or response in cyber resilience programmes?
A: Organisations should prioritise preparation because it reduces the number of incidents that become expensive in the first place. Response still matters, but it cannot undo uncontrolled spread, delayed containment, or exposed identity pathways. Preparation creates the highest return when threat intelligence is tied to access and vulnerability decisions.
Technical breakdown
Why cyber risk becomes a governance problem at enterprise scale
Cyber risk crosses from security operations into enterprise governance when digital services support revenue, customer access, supply chains, and critical infrastructure. At that point, the issue is not only prevention but continuity: how quickly a business can tolerate disruption, detect it, and recover service. That makes cyber risk management a board-level discipline, not a purely technical one. In practice, this means control ownership, recovery objectives, and business dependency mapping must be aligned, or the organisation will overestimate its ability to withstand a real outage.
Practical implication: treat cyber resilience as a governed business capability with named owners, not as an IT afterthought.
How digital dependency changes identity and access assumptions
As more processes move onto connected platforms, identity becomes part of the attack surface and the continuity model. Human accounts, service accounts, API keys, and cloud entitlements can all become failure points when disruption hits, especially if access is overextended or poorly recovered after an incident. The security issue is not only whether attackers can get in, but whether the business can still operate safely when authentication, authorization, or infrastructure controls are degraded. That is why identity lifecycle control and recovery planning belong in the same conversation as resilience.
Practical implication: map critical business services to the identities and credentials that keep them operating.
Why critical infrastructure security now depends on control over connected systems
The report's concern about critical information infrastructure reflects a broader pattern: as physical services become software-controlled, the trust boundary shifts toward the digital systems that orchestrate them. That creates systemic risk because a failure in one environment can cascade into transport, energy, water, financial services, or communications. Security teams therefore need to understand which digital dependencies are truly critical, which accounts administer them, and which recovery paths are realistic under stress. This is not just about defending systems individually; it is about preserving service continuity across a networked environment.
Practical implication: identify the digital control points whose compromise would interrupt essential services and govern them as high-value assets.
Threat narrative
Attacker objective: The objective is to force business or infrastructure disruption by targeting the digital systems that underpin continuity and trust.
- Entry begins where organisational dependence on digital services creates a broad attack surface across cloud, infrastructure, identity, and connected operational systems.
- Escalation occurs when attackers or disruptive events can affect the services that deliver authentication, control, or availability, turning one compromise into enterprise-wide interruption.
- Impact is realised when critical business or infrastructure processes lose continuity, creating financial, reputational, and operational harm.
- The objective is to disrupt trusted digital services at scale so that the organisation loses resilience before it can recover.
Breaches seen in the wild
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Cyber risk has crossed from a security issue into an enterprise governance issue. The WEF framing matters because it reflects a world in which digital disruption affects revenue, operations, and public trust, not just technical environments. That means security leaders must translate cyber risk into business continuity language, with clear ownership for resilience, recovery, and control assurance.
Identity control is part of resilience, not a separate IAM concern. When business processes depend on always-on digital services, access governance, service credential management, and recovery design become one problem. If identity and privilege are not built into continuity planning, the organisation may recover infrastructure while still being unable to operate safely.
Critical infrastructure risk is really control-plane risk. The report's concern about technology-enabled resources shows that the highest-value target is often the system that orchestrates other systems. Practitioners should treat administrative access, automation credentials, and recovery paths as strategic assets because they define whether disruption stays local or becomes systemic.
Governance maturity now depends on whether resilience is testable under failure. A policy that assumes services stay up is not a control; it is optimism. Mature programmes will know which identities, services, and dependencies matter most, and will test what fails first when the environment is degraded.
Bug bounty, recovery, and monitoring are no longer optional extras in a digitally dependent business. The article's broader signal is that detection and resilience capabilities have to be integrated into risk governance, especially where a failure can cascade across services. The practitioner conclusion is simple: if a business cannot tolerate loss of digital trust, it must govern that trust as a core control objective.
What this signals
The strategic shift in this article is that cyber risk can no longer sit in a single security workstream. When the services that run the business are digital by default, governance has to connect exposure, identity control, recovery, and business continuity in one model.
Control-plane resilience: the real question is whether an organisation can still authenticate, authorise, and operate when core digital services degrade. That is the point at which IAM, NHI governance, and operational resilience stop being adjacent disciplines and become one governance problem.
For practitioners
- Map critical business services to identity dependencies Identify the human, service, and machine identities that support the most important business processes, then document what breaks if each one is unavailable.
- Embed recovery objectives into access governance Align authentication recovery, privileged access recovery, and service restoration targets so continuity planning covers the identities that keep systems running.
- Test resilience against control-plane failure Run exercises that assume identity services, orchestration layers, or administrative access are unavailable, and confirm the business can still operate safely.
- Classify digital infrastructure as a board risk asset Elevate the systems that control transport, energy, customer access, or other essential services into formal risk reporting with clear ownership and review cadence.
Key takeaways
- Cyber risk now behaves as an enterprise continuity issue because core business services depend on connected digital systems.
- The WEF framing reinforces that resilience, identity governance, and operational recovery need shared ownership rather than siloed teams.
- Practitioners should identify which identities and control planes would cause the greatest business disruption if they failed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The article is fundamentally about elevating cyber risk into enterprise governance. |
| RC.RP-01 — Recovery Plan Execution | The piece stresses resilience and recovery as core responses to digital disruption. | |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity control is part of the continuity and resilience model discussed in the article. | |
| Recommendation — Align cyber risk decisions to a formal enterprise risk strategy and review them with business leadership. Test recovery plans against service loss scenarios that include identity and control-plane failure. Review who and what can access critical systems and remove unnecessary privileges from recovery paths. | ||
| NIST SP 800-53 Rev 5 | CP-2 — Contingency Plan | The article emphasises continuity planning for digitally dependent services. |
| Recommendation — Build and exercise contingency plans for the systems that underpin essential business operations. | ||
| MITRE ATT&CK | TA0040 — Impact | The article highlights disruption to critical services as the key threat outcome. |
| Recommendation — Map disruptive scenarios to impact techniques and prioritise the systems whose failure would halt operations. | ||
Key terms
- Cyber Resilience: Cyber resilience is the ability to continue operating, recover, and make safe decisions during and after a cyber incident. It goes beyond backup availability by combining visibility, prioritisation, and restoration discipline so the organisation can restore what matters without amplifying harm.
- Control Plane: The control plane is the set of actions that create, configure, or manage a service. For AI workloads, it covers deployment and administration of the model platform, while data-plane permissions govern what the service and its identities can read or process.
- Identity Dependency Mapping: Identity dependency mapping is the process of tracing which accounts, groups, sync flows, and applications rely on one another to function. It is essential in hybrid estates because a seemingly inactive identity may still support production access. Without it, lifecycle actions can break services or leave hidden privilege in place.
- Critical Information Infrastructure: Critical information infrastructure is the digital and communications layer that supports essential national services such as power, water, transport, and finance. In the energy sector, it includes the systems that keep metering, monitoring, and control reliable. Security failures here can have broad operational and public impact.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It helps security and identity practitioners connect access governance to the broader controls their programmes depend on.
Published by the NHIMG editorial team on August 21, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org