Cyber Risk Is Now Business Risk - And the Gaps Are Growing

Updated June 1, 2026

Cyber risk isn't a background concern anymore. It's a live business threat, and most organizations are still playing catch-up. The 2025 Global Cybersecurity Outlook from the World Economic Forum makes one thing very clear: thinking about it isn't enough.

Cyber risk is the probability that a threat, a system weakness, or a human action will compromise the confidentiality, integrity, or availability of your information systems, resulting in financial, operational, or reputational damage. It isn't just an IT concern; it belongs in every enterprise risk model.

This year's report, based on input from over 140 global leaders across business and cybersecurity companies, confirms a widening gap between awareness and action, especially when it comes to identity-based attacks, governance, and workforce readiness.

Key takeaways

• Identity-based threats: Credential phishing, deepfakes, and synthetic IDs are now the fastest-growing attack vectors.
• The readiness gap: While 91% of leaders prioritize cyber resilience, only 30% have integrated cyber metrics into enterprise risk models.
• AI dual-usage: AI is simultaneously scaling sophisticated attacks and providing essential tools for real-time fraud detection.
• Boardroom priority: Cybersecurity has shifted from an IT concern to a core business risk affecting reputation and financial stability.

For U.S. companies in high-trust industries (finance, insurance, real estate, lending, and others), the report is a wake-up call: identity threats are rising, defensive measures are unevenly and inconsistently applied, and it's expensive when fraudulent transactions are missed.

Identity is at the center of today's threat landscape

The report names identity-focused attacks like credential phishing, deepfakes, and synthetic IDs as the fastest-growing threat vectors worldwide. These aren't abstract risks. They're showing up inside real workflows:

Common tactics

• Account takeover attempts during loan originations
• Fraudulent notary seals used in real estate transactions
• Synthetic identities used to bypass KYC

What you can do

• Replace document scan/upload with biometric identity verification
• Add liveness detection to flag deepfake or spoofed credentials
• Use cryptographic records to create an auditable chain of identity assurance

The common thread is a breakdown in verifying who's on the other side of a transaction. Many organizations are still relying on outdated methods: passwords, document scan/uploads, and static data checks that are easily spoofed by attackers using data brokers and AI at scale. And the risk doesn't only come from outside. Internal gaps like inconsistent security practices, unpatched systems, and manual workflows create the openings attackers exploit.

The cost of inaction is high

WEF's report found that nearly half (41%) of cybersecurity leaders believe a major cyber incident is more likely than not to occur at their organization within the next two years. And most business leaders surveyed believe that reputational harm, regulatory scrutiny, and financial losses are inevitable without stronger controls.

Here's the gap: only about a third (30%) of respondents say their organization has implemented cybersecurity metrics into enterprise risk models. Identity, often the root cause of breaches, remains a blind spot.

Why? Because the riskiest moments are the ones organizations measure the least: authorizations, transactions, and data handoffs. These are the exact points where identity breaks down and fraud slips through.

AI is amplifying both attacks and defenses

AI is front and center in the report, and for good reason.

On one hand, threat actors are using AI to create more convincing deepfakes, generate phishing content at scale, and automate credential stuffing attacks. On the other hand, AI gives risk and fraud teams the ability to detect anomalies faster, flag suspicious activity in real time, and stop threats before they complete.

The same AI that generates a deepfake can also detect one in real time. What separates resilient organizations from vulnerable ones isn't whether they use AI. It's whether they've built the governance, identity controls, and fraud detection workflows to stay on the right side of that equation.

Cybersecurity is now a boardroom issue

The WEF found that 91% of business leaders now see cyber resilience as a key business priority, up significantly year-over-year.

Alignment between CISOs and boards is still inconsistent, particularly when it comes to identity infrastructure, authorization, and the hidden risk in manual workflows. When identity fraud slows down closings, disrupts onboarding, or results in legal exposure, it becomes a business issue, not just an IT one.

The WEF's report is comprehensive, but the message is simple: security strategies need to evolve beyond firewalls and encryption. Whether a breach starts with a human mistake, a system flaw, or a deliberate attack, identity is almost always in the blast radius. Identity needs to be verified, embedded, and enforced at every step, not treated as a one-time checkpoint.

That's where Proof comes in. We help organizations verify customer identities using biometric checks, liveness detection, and cryptographic records, evaluating risk before a single transaction is authorized. From notarizing and eSigning documents to onboarding employees and resetting account passwords, our platform lets you know who's on the other end and digitally certifies what they're doing.

The gap between cybersecurity intent and execution is where fraud thrives. Proof helps close it, with identity verification, fraud detection, and cryptographic records built into every authorization moment. Reach out to see how it works.

Join the trust conversation

Want to hear directly from the experts? Watch our on-demand, in-depth discussion with Proof and Liminal:

The 2025 Trust Ledger: Transaction & Identity Fraud Webinar

Insights from Proof's Trust Ledger and Liminal's latest research, plus live Q&A with our fraud experts. Whether you're in compliance, cybersecurity, operations, or product, this session will arm you with the context and clarity to make better decisions.

Access the Webinar