2026年数字风险报告 【摘录】Digital Risk Report Protecting Digital Trust in the AI Era

q4outtake

2026

DigitalRiskReport

ProtectingDigitalTrustintheAIEra

Researchby

cybersecurity

NSIDERS

ExecutiveOverview

Digitalriskhascrossedathreshold.Asenterpriseshardenedendpoint,identity,cloud,network,andemail,

adversariesshiftedtotheopeninternetwherebusinesstrustisexposed.Whatonceappearedasisolated

impersonationsandone-offfraudhasbecomeacoordinated,industrial-scaleoperation.Theassetunderattackistrust:trustinexecutivesandemployees,trustinbrands,trustintheworkflowsthatmovemoney.Attackers

nowruncampaignsendtoend,whilemostdigitalriskprogramsstillrespondoneincidentatatime.Thatgapisvisibleacrossthissurveyofmorethan1,100securityandriskleaders.

Behindeveryvisibleartifact,fromaspoofeddomainorfakesocialaccounttoadeepfakevideoorsyntheticpersona,sitsanoperatordirectingthecampaign.Thesecampaignsmovethrougharecognizablekillchain:

reconnaissance,infrastructuresetup,trustexploitation,targetengagement,credentialcapture,account

takeover,impactandfraud,andmonetization.Yetmostprogramsstillinterceptvisibleartifactscasebycase,withoutfollowingthechainbacktotheoperatorbehindthem.

Keyfindings:

•Digitalriskisabusinessriskcategory,not

asecuritytoolproblem:84%oforganizations

experiencedmaterialdigitalriskincidentsinthe

pastyear,yetonly7%describetheirprogramas

leading.Costsspreadacrossstaffhours,customersupport,legalresponse,andexecutivetime,yet21%havenosingleownerfordigitalriskatall.

•Peoplearethemostexposedandleast

protectedattacksurface:Executiveoremployeeimpersonationhit53%oforganizationsthisyear.

Yetprotectionremainsnarrow:77%limitworkforcecoveragetoexecutives,afewhigh-riskroles,or

reactivecase-by-caseresponse,and43%runnoperson-of-interestthreatprofilingatall.

•Detection,investigation,response,and

measurementarebrokenacrossthekill

chain:Only7%haveend-to-endvisibilityfrom

reconnaissancethroughfraud.42%sayattacks

nowmovefasterthandetection,34%closecasesattakedownwithoutpursuingtheadversarybehindthem,and28%runnotakedownSLAtomeasure

responseperformance.Failuresatonestagecascadeintothenext.

•AIisopeningasecondfront:47%have

alreadyencounteredconfirmedorsuspectedsynthetic-mediaimpersonationofanexecutiveorbrandrepresentative,whileAI-generated

attacksthatlooklikerealactivitynowtopthe

survey’svisibilitygapsat44%.Ontheexposureside,only4%havefullvisibilitywithactive

controlsovertheiragents’externalinteractions,and96%havenoautomatedwaytostopanAIagentmanipulatedthroughitsexternalinputs

-theAITrustGapmostprogramshaven’tyetmeasured.

•Themarketisataninvestmentinflection

pointwithnocategoryleader:58%plan

toincreasedigitalriskinvestmentinthenextyear,yet82%stilllackapurpose-builtplatform.69%placethemselvesbelowanestablishedresponsemodel.Thenext12to24monthswilldecidewhetherdigitalriskconsolidatesinto

apurpose-builtplatformcategoryorstaysfragmentedacrosspointtoolsandmanualworkflows.

Eachfindingtracesbacktothesameproblem:acoordinated,AI-amplifiedthreatoperatingacrosschannels

andsurfacesisbeingmetbyafragmentedresponsethatnosingleteamownsandnosingleplatformdefends

against.Investmentisrisingintothatgap,butthearchitecturehasn’tyetconsolidatedtocloseit.Atthisscale,

andatmachinespeed,responsehastobeanagenticloop:AIagentsrunningpre-stageddetection,investigation,attribution,takedown,verification,andlearningatmachinespeed,withhumanssettingpolicyandjudgment.

OUTTAKE|2026DigitalRiskReport©2026

CybersecurityInsiders

.AllRightsReserved.2

OUTTAKE|2026DigitalRiskReport©2026

CybersecurityInsiders

.AllRightsReserved.3

DigitalRiskHasOutgrownSecurityOperations

Industrial-scaledigitalriskhitseveryfunction.Theheaviestcostsfalloutsidesecurityoperations,andthedatashowsexactlywhere.

84%oforganizationsexperiencedmaterialdigitalriskincidentsinthepastyear,yetonly7%describetheir

programasleading.Behindthatgapiscoordinateddeceptioninmanyformsatonce:65%sawlookalikeor

homoglyphdomains,53%hadanexecutiveoremployeeimpersonated,and47%facedcoordinatedmulti-

channelcampaigns,oftenwithinthesametwelvemonthwindow.Thebusinessimpactrunsinparallel:credentialtheft(34%),brandharm(32%),directfraud(30%),customerconfusion(29%),andpaymentdiversionrisk(26%).

Thecostprofiletellsthesamestory.Sta仟hoursleadthecostcategoriesat53%,aheadofcustomersupport(41%),executivetime(31%),andlegalandregulatoryresponse(23%);another23%don’ttrackthecostatall.Thelargestsinglecostisthelaborofcleanup,spreadacrossfunctionsoutsidesecurityoperations.ThatiswhatturnsdigitalriskintoaP&Levent,evenwhenthecostneverlandsinasinglebudgetline.

Takeanexecutiveimpersonationcampaignthatrunsforsixweeksbeforediscovery.Bytakedown,thecleanup

haspulledinfivefunctions.Marketingrewritespublicstatements.Customersupportfieldsconfusedinquiries.

Legalcoordinatesremoval.Theexecutive’so仟icescansforfurtherfakes.RiskandInsurancefileanincidentreport.Noneofthefiveareinsecurityoperations.Digitalrisknowsitsatboardlevel.Thegovernancerequiredtomanageit(includingownership,accountability,andcross-functionalauthority)hasnotyetcaughtup.

WheretheCostofDigitalRiskLands

Whathasbeenthetruecostofdigitaltrustincidentsyourorganizationexperiencedinthepast12months?

41%34%

31%

23%

23%

20%

18%

15%

Operationallabor

Customerburden

Financialloss

Executivetime

Legal/regulatory

Communications

Revenue/churn

Insurance

Untracked

84%

experienced

materialdigitalriskincidents

Only7%

describetheirprogramas

leading

Staffhours

topthecost

ledgerat53%

—aheadofdirectfraudlossat34%

53%

Wherethisisworking,everyteamthattouchesdigitalriskoperatesfromthesameconnectedworkflow,withsharedevidence,asingleoperatorview,andoneaccountableowner.

OUTTAKE|2026DigitalRiskReport©2026

CybersecurityInsiders

.AllRightsReserved.4

PeopleAreNowtheAttackSurface

Digitalriskturnspersonal.Theindividualswhocarryauthority,access,andcredibilityareamongthemostexposedattacksurfaces,andoftentheleastprotected.

Morethanhalfoforganizations(53%)hadanexecutiveoremployeeimpersonatedinthepastyear,with27%

seeingbothandanother17%notmonitoringatall.Executiveimpersonationoperatesthroughauthorityand

urgency,whileemployeeimpersonationopensdoorsthroughaccessandfamiliarity.Theactivityspansspoofed

emailormessaging(41%),socialmedia(36%),andprofessionalnetworks(32%),thesurfacesindividualsactually

liveandwork.Securityhaslongbeenorganizedaroundtechnicalattacksurfacessuchasnetworks,endpoints,

credentials,applications.The2026dataexpandsthatprioritylist.Theassetunderattackisnowaperson’sidentity,andindividualsliveonopenchannelsmostbrand-protectionprogramsdonotreach.

Personalexposurefeedstheattack.Adversariesassembletargetprofiles,includinghomeaddresses,family

details,andcontactdata,frombrokersites,credentialdumps,andpublicsignalslongbeforeimpersonation

campaignsbegin.Theprotectiongaponthisreconnaissancesurfaceissevere:43%oforganizationshave

noPerson-of-Interestthreatprofilingcapabilityforactivelytargetedindividuals,35%runnoactivePIIremoval

programacrossbrokerandpeople-searchsites,and52%lackvisibilityintoencryptedordecentralizedchannelssuchasWhatsApp.Thereconnaissancewindowstaysopenwhileprotectionfocusesonwhatcomesafter.

WhoHasBeenImpersonated

Inthepast12months,hasanyexecutiveoremployeeatyourorganizationbeenimpersonatedonline?

Both executivesandemployees

Executives

Employees

Noimpersonated

Wedonotmonitor

Notsure

53%

hadexecutivesoremployees

impersonatedinthepastyear

25%

visibilitygap

havenoPOIthreatprofilingcapability

runnoactivePIIremovalprogram

havenoorlimitedvisibilityencrypted/decentralized

channels

27%

16%

10%

22%

17%

8%

43%

35%

52%

Theprotectionlayersthatshouldcatchthisearlieraremissinginalmosthalfofprograms

41%

Spoofedemail/messaging

32%

Professionalnetworks

36%

Socialmedia

Programsthathaveextendedbrandprotectiontopeoplemonitorexecutiveandemployee

impersonationcontinuously,attributeittotheoperator,andremediateonameasurableSLA.Aprogramthatcan’tnamewhichexecutivesandhigh-riskemployeeswereimpersonatedthisyear,onwhich

channels,andhowquicklyeachcaseclosedisstillprotectingbrandswhileitspeoplestayexposed.

OUTTAKE|2026DigitalRiskReport©2026

CybersecurityInsiders

.AllRightsReserved.5

WorkforceProtectionIsStillTooNarrow

Bythetimeanattackerpicksatarget,theyhavealreadymappedwhichrolesholdtheaccessworthtaking.Yetworkforceprotectionrarelyreachespasttheexecutivesuite.

77%keepprotectionlimitedtoexecutives,reactcasebycase,orcoveronlyafewhigh-riskroles.Withinthatgroup,29%runnoformalprogramatallandrespondonlyafteranincidentlands.Another12%covermostemployees,andjust4%runcomprehensivecoverageacrossthefullworkforce.

Attackersmovethroughtheroleswiththerightaccess,regardlessoftitle.Financeapproversreleasepayments.ITadminsholdtheaccesskeys.Customer-facingstaffcarrythebrandtrust.Heavyexecutivemonitoringjust

routesthethreataroundtheprotectedlayer,towardtheunmonitoredseatoneleveldownthatstillmovesmoneyorgrantsaccess.Whenoneofthoseseatsishit,19%havenodefinedownerfortheresponse,sodelayand

duplicationlandexactlywherespeedmattersmost.Protectionbuiltaroundsenioritywatchesthewronglist.

AnattackerignoresthemonitoredCFOandgoesaftertheaccounts-payablemanagerwhoactuallyreleasesfunds.Noprogramcoversthatseat.Thefraudulentpaymentclears.

HowFarWorkforceProtectionReaches

Doesyourorganizationhaveaformaldigitalprotectionprogramforthebroaderemployeebase,beyondexecutives?

Only4%havea comprehensiveprogramcoveringthefullworkforce

77%withexecutive-only,reactive,orpartialcoverage

29%24%24%12%7%4%

Noformalprogram;respondtoemployeeincidentsreactively

No,protectionislimitedto

executivesonly

Partialcoverageforhigh-risk

rolesonly

Yes,formalprogram

covering

most

employees

Thisisnotsomethingwehave

considered

77%keepprotectiontoexecutives,reactcasebycase,orcoveronlyafew

high-riskroles.4%coverthefullworkforce.Attackersgothroughwhichever

seatholdstheaccess—andmostofthoseseatssitbeyondtheexecutivesuite.

Customer-facingstaff

APManager

ITAdmin

CFO

HR

ProgramsaheadofthisextendPOIprofiling,broker-sitemonitoring,andimpersonationdetection

beyondtheexecutivesuitetotheseatsthatactuallyholdtheaccess:financeapprovers,ITadmins,andcustomer-facingstaff.Protectionthatstopsatseniorityleavestheattacker’srealtargetsuncovered.

OUTTAKE|2026DigitalRiskReport©2026

CybersecurityInsiders

.AllRightsReserved.6

AI-GeneratedAttacksNowLookReal

Attackerscannowmakeimpersonationsthatlookandsoundliketherealthing.AImadethatpossibleatindustrialscale.

44%nameAI-generatedattacksthatlooklikerealactivityastheirbiggestvisibilitygap,thetopgapinthesurvey.Thethreatisalreadylive:47%haveconfirmedorsuspectedsynthetic-mediaimpersonation,includingvoice

clonesordeepfakevideo,ofanexecutiveorbrandrepresentative(18%confirmed,29%suspected).

Defenderspointatthesamethreatthroughthreerelatedvisibilitygaps:speed,hiddenplatforms,andcross-

channelmovement.42%flagattacksmovingfasterthandetection.39%flagplatformstheycan’tseeinto.32%flagactivitytheycan’tconnectacrosschannels.35%nameAI-generateddeceptiondetectionasatopbuyingpriority.CISOsseethesamethreatfrombothsides:thelargestdefensegapisalsooneoftheclearestinvestmentpriorities.

Theoldtellsusedtocatchfakeswerebadgrammar,distortedimages,andoff-tonephrasing.AIhasmadethosetellsunreliable,andcontent-provenancestandardslikeC2PAarenotyetwidespreadenoughtoreplacethem.

Defenderswhostillrelyonsomething“lookingoff”arelosingground.Detectionhastomoveearlierinthekillchain,towherethecampaignisbeingbuilt.

TheAIThreatFromThreeAngles

b

Whatarethebiggestgapsbetween

yourcurrentthreatvisibilityandwhatadversariescanactuallydotoyour

organization?

>

44%

NameAI-generated

attacksastheir#1

visibilitygap

b

Inthepast12months,hasyour

organizationidentifiedsynthetic

mediaordeepfakeimpersonation?

47%

Haveconfirmedorsuspected

synthetic-mediaimpersonation

inthepast12months

(18%confirmed+29%suspected)

b

>

Whichcapabilitiesareyourtopinvestmentprioritiesforthe

next12months?

35%

NameAI-generated

deceptiondetection

asatopbuyingpriority

CISOsseethesamethreatfromthreeangles:thebiggestvisibilitygap,a

confirmedliveproblem,andatopbuyingpriority.Theoldtellsthatusedtocatchfakes—badgrammar,distortedimages,off-tonephrasing—aregone.

ThedefendersstayingaheadofAIdon’twaitfortheattacktoland.Theyrunpre-stageddetection:fakeaccountsseeded,lookalikedomainsregistered,contentlibrariesbuilt-caughtbeforeacampaigngoeslive.Thentheyintercepttheadversarybehindthem.Ifdetectionstillstartsafterthefakecontentshowsup,thedefensewindowhasalreadyclosed.

OUTTAKE|2026DigitalRiskReport©2026

CybersecurityInsiders

.AllRightsReserved.7

AIAgentsCreateaNewTrustBoundary

That’stheattackside.Ontheexposureside,organizationsaredeployingAIagentsintothesameopenenvironmentattackersarefloodingwithsyntheticcontent.Asagentsbegintoparticipateincommunication,research,transactions,anddecisions,theyreadexternalinputsandactonthem,mostlywithoutactiveoversight.

Only4%havefullvisibilitywithactivecontrolsovertheiragents’externalinteractions,roughly1in20.Another12%monitoragentactivitywithsomecontrolsinplace.Everyoneelserunningtheseagentsismoreexposed:22%

havenovisibilityintowhattheyaccessexternally,20%havepartialvisibilitybutnocontrols,and17%logactivitytheyneveractivelymonitor.Theremaining15%don’trunexternalagentsatall.

Theriskisconcrete:adversariescanplantinstructionsinexternalcontent(suchasemails,webpages,or

documents)thatanagentreadsaspartofitsnormalwork.Thistechnique,knownasindirectpromptinjection,isthetopentryonOWASP’sTop10forLLMApplications.Theagenttreatstheplantedinputaslegitimateandactsonit.Mostprogramshavenovisibilityintowhenthathappens.

Anaccounts-receivableagentreadsanemailaskingaboutapayment.Hiddeninstructionsinthemessagedirecttheagenttoforwardcustomerpaymentdetailstoanexternaladdress.Theagentacts.Nooneseesitforthreedays.

Theagentnowstandsonanewtrustboundary:onefootintheuntrustedoutsideworld,oneinthetrustedinternalsystem.Aplantedinstructioncrossestheboundarybetweenthem.

VisibilityIntoAIAgentInteractions

WhichofthefollowingbestdescribesyourvisibilityintowhatAIagentsandautomatedworkflowsinyourorganizationaccessorretrievefromexternalsources?

Only4%havefullvisibilitywithactivecontrolsovertheirAIagents'externalinteractions.Theresthavebuiltanewtrustboundarytheycan'tseeacross.

22%

20%

17%

12%

4%

Novisibilityinto

Partialvisibility,

Logexternal

Monitor

Full

externalaccess

nocontrols

interactionsbutdon'tactively

monitor

withsomecontrols

visibility

andactivecontrols

DonotuseAIagentswithexternalaccess15%|Thisisnotsomethingwehaveconsidered6%|Notsure4%

Programstreatingagentsasgovernedidentitiesmonitorexternalinputsforplantedinstructions,log

agentactions,andinspectoutputsbeforetheypropagate.Withoutthatloop,agentdecisionsbecomeapathnoonecansee,interrupt,orreconstruct.

OUTTAKE|2026DigitalRiskReport©2026

CybersecurityInsiders

.AllRightsReserved.8

FewCanStopaHijackedAgent

Seeingthemanipulationisonlyhalftheproblem.Containmentisthebottleneck.Onceanagentactsonaplantedinstruction,mostprogramshavenoautomatedwaytostoporrollitback.

14%candetectmanipulationbutcan’tcontainitautomatically.25%relyonmanualreviewofhigh-riskoutputs.34%knowtheriskandhavebuiltneitherdetectionnorcontainment.14%aren’tawareoftheriskatall.Betweenthem,morethan9in10havenoautomatedwaytostophijackedagentsbeforetheyact.

Itcomesdowntospeed.AnAIagentactsinseconds.Manualreviewandhumanescalationtakeminutesorhours.The14%thatcandetectwithoutautomatedcontainmentmayfindoutonlyaftertheagenthasmovedthemoney,sentthedata,ormadethecall.Andtheagentactswithprivilegedaccess:anunstoppedoneisatrustedinsider

carryingoutanattacker’sinstructionsatmachinespeed.

ThatistheAITrustGap:96%havenoautomaticwaytostopamanipulatedagentbeforeitacts.Forthem,the

brakeisapersoncatchingitintime.Thefewwithrealcontainmentbuildanautomaticstopintotheagent:outputinspection,egresslimits,andahaltthattriggerswithoutwaitingforahuman.Anagentthatcanactuntilapersonnoticescarriestwogapsatonce,avisibilitygapandacontainmentgap.

TheAITrustGap

Doesyourorganizationhaveanymechanismtodetect,isolate,orrollbackanAIagentthathasbeenmanipulatedthroughadversariallycontrolledexternalcontent?

4%

candetectandcontainahijackedAIagent

96%

cannotautomaticallydetectandcontainahijackedAIagent

BetweenanAIagentactinginsecondsandahumannoticinginminutes,

thebrakeissomebodycatchingitintime.

34%

Anadditional9%havenotconsideredthis

risk(excludedfrombreakdown)

A4%

AwareoftheriskbutnodetectionorcontainmentinplaceManualreviewprocessesforhigh-riskagentoutputsDetectioncapabilitybutnoautomatedcontainment

Noawarenessofthisriskutomateddetectionandcontainmentforcompromisedagents

25%

14%

14%

Programstreatingagentsecurityasinfrastructureputgovernanceonthesameoperationalfootingasidentityandaccessmanagement:continuousmonitoring,manipulationdetectionatinput-time,andautomatedcontainmentthatfiresbeforetheactionlands.

OUTTAKE|2026DigitalRiskReport©2026

CybersecurityInsiders

.AllRightsReserved.9

DetectionDependsonthePeopleBeingHarmed

Formostorganizations,thefirstsignalofanattackarrivesfromoutsidethecompany-fromcustomers,partners,orthepeoplealreadybeingharmed.

Digitalriskattacksunfoldacrossakillchain:reconnaissance,infrastructuresetup,trustexploitation,target

engagement,credentialcapture,accounttakeover,impactandfraud,andmonetization.Defendershavetocoverthesamepath.Mostprogramscoveronlypartofit,andateverystagemorethanhalfcomeupshort.

21%oforganizationslearnaboutbrandimpersonationfromcustomers,partners,orthepublic.18%relyonad

hocinternalreports.11%havenoformaldetectionprocess.Only29%runcontinuousmonitoring,andjust12%

runthefullpipelineofmonitoring,automatedalerting,andtriage.Halfthefieldfindsoutfromoutsideordoesn’tlooksystematically.

Detectionhererunsonsomeoneelse’spain,amanualhunt,oranaccidentaldiscovery.Formostorganizations,thefirstsignalisacustomerorpartnerreportingharm,nottheSOCorthreatintelligence.Detectionbeginsatthepointofharm,longafterthestaginghasrun.Takesocialmediaimpersonation.Afakeaccountfollowscustomers,buildsanaudience,andsendsaphishingmessage.Thebrandfindsoutwhenacustomerasksiftheofferisreal.Most

teamsstopattheartifact.34%closecasesattakedownwithoutpursuingtheoperator.Only16%mapthebroadercampaignorattemptattribution.Just5%conductfullcampaignattribution.9%continuouslycorrelateactivitytospotcoordinatedtargeting.Whentheadversarybecomesvisible,mostteamshavealreadystoppedlooking.

WhereDetectionStarts

Howdoesyourorganizationtypicallydiscoverbrandimpersonationactivity?

Learnaboutitfromcustomers,partners,orthepublicAdhocinternalreportsormanualchecks

NoformaldetectionprocessPeriodicmonitoringbyanexternalprovider

ContinuousautomatedmonitoringContinuousmonitoring+automatedalerting+triage

21%

50%

REACTIVE

18%

11%

PARTIAL

29%

12%PROACTIVE

16%

17%

Notsure5%

50%oforganizationslearnaboutbrandimpersonationfromcustomers,

adhocinternalchecks,ornoformalprocessatall.Detectionrunsonsomeone

else'spain—longafterthestagingisdone.

Programsthathaveclosedthisgaprunpre-stageddetection:monitoring,alerting,andtriageatthereconnaissanceandinfrastructurestages,beforecampaignslaunch.Whenmostincidentssurfacethroughcustomers,detectionisadownstreamtriggerratherthananearly-warningsystem.

OUTTAKE|2026DigitalRiskReport©2026

CybersecurityInsiders

.AllRightsReserved.10

CoverageandRemediationBreakattheEdges

Evenprogramsthatinvestigatewellstillleavechannelsuncovered.Thechannelstheymissareoftenthehardesttoseeandtheslowesttoremediate.

Only7%haveend-to-endvisibilityfromreconnaissancethroughfraudexecution.Another19%covermoststagesbutstillhavegapsattheedges.Theotherthree-quartersrunpartialcoverage,missearly-stagesignals,orrespondonlyafterharm.

Somechannelsarehardertoclearthanothers.22%reportencryptedmessagingsuchasTelegramastheslowestchanneltoremediate,followedbyappstoresandmobileecosystemsat16%andsocialmediaat14%.Another

19%don’ttracktime-to-takedownbychanneltypeatall.Theslowchannelsareslowforareason.Encrypted

messagingandapp-storeecosystemscarryaccess,jurisdictional,policy,andapprovalbarriersthatslowremoval.Campaignsstaylivelongestinexactlythosechannels,wheredefendershavetheleastleveragetoshutthem

down.Defendersconcentrateontheeasychannels.Operatorsconcentrateonthehardones.

Defendersfallshortontwomorefronts.Only5%correlateexternalthreatsignalswithinternalfrauddatainrealtime.28%havenodefinedtakedownSLA,andanother24%carryinformaltargetstheydon’ttrack.Withoutreal-timecorrelationoratrackedSLA,ateamcan’ttellwhethertakedownisgettingfasterorslower,whichchannelslag,orwhythesamecampaignkeepscomingback.

CoverageAcrosstheAttackLifecycle

b

Howwouldyoudescribeyourthreatintelligencecoverageacrossthefullattacklifecycle—fromreconnaissancethroughtofraudexecution?

18%

24%

32%

19%

7%

Reactiveonly,

respondafterharmoccurs

Coverlaterstages

(fraud,credentialtheft)butmissearlysignals

Partial,

decentcoveragein

2-3stages,blindspotsinothers

Good,

covermoststagesbutgapsattheedgesComprehensive,end-to-endvisibility

WhereRemediationSlowsDown

Whichchanneltypetakesthelongesttoremediate?

HARDCHANNELSWHEREATTACKERSCONCENTRATE

Encryptedmessagingplatforms

Appstoresandmobileecosystems

Socialmediaplatforms

Onlinemarketplacesandcommerceplatforms

Domainregistrarsandhostingproviders

Digitaladvertisingandsearchplatforms

Don'ttracktime-to-takedownbychanneltype

22%16%

14%

12%

10%

7%

19%

Only7%haveend-to-endlifecyclecoverage.Theslowestchannelstoclear—

encryptedmessaging,appstores,social—areexactlywhereattackersconcentrate

whiledefenderscovertheeasychannels.

Programswithrealcoverageruncross-channelmonitoringandcoordinatedtakedownacrossthe

surfacesattackersactuallyuse,includingencryptedmessaging,mobileecosystems,andappstores.

Aprogramthatcoversemailandsocialandstopstherehassecuredtheeasyhalfofthesurfaceandleftthehardhalfopentolonger-runningcampaigns.

OUTTAKE|2026DigitalRiskReport©2026

CybersecurityInsiders

.AllRightsReserved.11

NoOneOwnstheWholeResponse

Evenwhereprogramscoverpartsofthekillchain,responsibilitystillbreaksatthehandoffs.Nooneownsthewholeresponse.

Themostcommonanswertowhoownsdigitalriskisnoone:21%havenosingleowner.Whenorganizations

donameone,responsibilityfragmentsacrosseightfunctions,nonewithmorethan18%share.Accountabilityisspreadthinbeforetheincidentevenstarts.

Whenanincidenthits,fragmentationbecomesoperationaldrag.61%describeresponseacrossteamsas

inconsistent,siloed,orfragmented.45%haveexperiencedacrisiswherethesocialmedianarrativeoutpacedthecompanyresponse.Teamsconfirmthegapthemselves:only7%describetheirdigitalriskprogramasleading,

while69%remainbelowanestablishedresponsemodel.

Withoutoneaccountableowner,eachfunctionholdsadifferentpieceoftheevidence.Afakeaccountlandswith

oneteam,animpersonationreportwithanother,aleakedcredentialwithathird.Eachteamseesits