3.5 Securing supply chains amid opacity and concentration risks The digital supply chain is highly interconnected, with dependencies within and across industries that are often not clearly mapped. A breach or disruption of one supplier can cascade through the entire ecosystem, affecting production, operations and even other suppliers or customers. This complexity makes it difficult to assess and manage cyber risk effectively. Attacks on widely used software or service providers can have global and systemic impacts. Such critical interdependencies were highlighted by the cyberattack affecting airports across Europe in September 2025, where a relatively minor breach targeting the check-in and boarding systems used by several major airport hubs caused a cascading disruption to airport operations, with flight delays and cancellations.41 Though the immediate damage was contained, the incident exposed the fragility of interconnected digital supply chains, leaving participants in focus groups for this report to reflect on how devastating a similar attack could be if directed at hospitals or other critical infrastructure. Concerns about the resilience of supply chains against cyberattacks are continuing to worry business and cyber executives. This year’s survey data shows that 65% of large companies by revenue indicate third-party and supply chain vulnerabilities are their greatest challenge, which has risen from 54% in 2025.42 40% 20% 80% 60% 2026 2025What is your organization's greatest challenge to becoming cyber resilient? (select up to three) Insufﬁcient incident response and recovery planning10%Lack of funds 15%Lack of visibility across IT, OT and loT environments26%Cybersecurity skills and expertise shortage29%Regulatory compliance and governance complexities31%Legacy systems (data available for 2026 only) 49%Rapidly evolving threat landscape and emerging technologies63%Third-party and supply chain vulnerabilities 65% 54% 52% 39% 25% 48% 24% 8% 0%Large companies’ greatest barriers to cyber resilience, 2025–2026 FIGURE 37 Global Cybersecurity Outlook 2026 45