Cyber leaders fear rise in state attacks amid costly breaches

New research has found that 88% of cybersecurity and information security leaders at organisations in the UK and US are concerned about state-sponsored cyber attacks. This concern reflects a broad awareness that geopolitical cyber threats have become a strategic risk for businesses, with pressure increasing on boards to address these dangers directly.

Escalating threats

The research shows a marked escalation in concern as state-linked attacks increasingly target both critical infrastructure and private sector operations. A third of organisations surveyed voiced dissatisfaction with the level of government support in protecting businesses from such threats, underlining expectations for greater collaboration between the public and private sectors to defend national and commercial interests.

Recent incidents highlight the evolving threat landscape. Examples include UK government reviews into the vulnerability of remotely controlled Chinese-manufactured buses and warnings from the UK National Cyber Security Centre about sophisticated state-level adversaries such as China, Russia, Iran, and North Korea.

"When it comes to threats facing CNI, there is a significant national effort going into protecting vital assets. However, at the same time, it also carries a stark warning. If an organisation is connected to the right systems, servicing critical infrastructure, or simply handling sensitive data, it could be targeted by nation-state adversaries.

Widespread business impact

The research highlights fears over the operational, reputational and financial consequences of state-sponsored attacks. The most pressing concern, noted by 41% of respondents, is the potential for large-scale data loss or inaccessibility caused by DNS attacks or major cloud outages. Other concerns include reputational damage resulting from indirect compromises (40%), operational disruption through supply chains (38%), and interruptions to critical national infrastructure such as power and transport systems (36%).

Security leaders are also paying attention to the risks associated with storing data in regions assessed as adversarial, cited by 35% of respondents. Added to these concerns are the pressures from increasing regulatory scrutiny and stakeholder expectations around demonstrating resilience.

Incident frequency

Nearly nine in ten organisations reported experiencing a cyber incident in the past year. The most common incidents included data breaches (31%), phishing attacks (30%), malware infections (29%), and cloud security breaches (27%). Employee and customer data were most at risk, amplifying the stakes for both reputation and compliance.

The ramifications of breaches have been significant. Seventy-one per cent of organisations were fined for security violations in the last year. Of those penalised, 30% paid fines in excess of GBP £250,000, and nearly half faced penalties ranging from GBP £100,001 to GBP £1 million. Leadership-level consequences were notable, with one third of security or board leaders losing jobs or facing formal disciplinary action. Furthermore, 18% of organisations experiencing major breaches involving employee data had to cease operations or fundamentally alter their strategies.

Board-level scrutiny

State-sponsored cyber threats are now a significant agenda item for boards. Organisations are reassessing risk registers, tightening supply chain controls, and refining incident response strategies. Despite these efforts, the continued high rate of breaches and penalties suggests a gap between perceived and actual resilience.

However, the research indicates a proactive stance among security leaders. Seventy-four per cent report new investments in resilience measures to counter nation-state threats. In organisations with high levels of concern, the vast majority are enhancing incident response plans, increasing threat intelligence spending, and boosting supply chain security and resilience.

"State-level cyber activity is now a real concern for businesses and resilience, not retaliation, will be the accurate measure of national and corporate defence in 2026. Organisations that understand their exposure, test their defences, and secure their supply chains will be best placed to withstand the next wave of attacks.

"With the right preparation, collaboration, and robust compliance measures, we can collectively ensure that the infrastructure - and the businesses supporting it - are equipped to withstand even the most sophisticated attacks," said Sam Peters, Chief Product Officer, IO.