网络安全进入高复杂度时代：2025全球风险全景扫描

IncollaborationwithAccentureGlobalCybersecurity

Outlook2025I

N

S

I

G

HT

R

E

P

O

R

TJA

N

UA

RY

2

0

2

5Images:Getty

ImagesContentsForeword

3Executivesummary

41

Understandingcomplexity

incyberspace81.1

Majordisparitiesanddisruptions91.2Thechallengefortheyear

ahead

92

Decodingcomplexity

112.1Thecyberthreat

landscape122.2Security

inthe

IntelligentAge

192.3Growingecosystem

interdependenciesand

risks232.4Thestateof

cyber

resilience323

Navigatingcomplexity

incyberspace403.1

Introducingtheeconomicsofcybersecurity40Conclusion42Appendix:

Methodology43Contributors44Acknowledgements44Endnotes

47Global

Cybersecurity

Outlook20252is

resulting

insystemic

pointsoffailurewithsignificantconsequencesfortheoverall

resilience

oftheecosystem.Thetransformative

potentialofAItechnologiespresents

both

unprecedented

risksand

unmatched

opportunitiesforcybersecurity.AsorganizationsracetoadoptAI,cybercriminalsare

moving

atbreakneckspeedtoexploitvulnerabilitieswhileenhancingtheefficacyoftheir

methods.Cyber

defenders,too,are

leaving

nostone

unturned

in

harnessingthe

potentialofthesetechnologiesto

shiftthe

balance

inthisgrowingAIarms

race.Lookingtothefuture,the

levelofcomplexityshows

nosignsofabating.

Ina

borderless

cyberspace,greatercollaboration

betweenactors

inthe

public

and

privatesectors

iscrucialforsafeguardingthe

benefitsofdigitalizationforall.This

is

a

call

to

action,andthetimeto

act

is

now.Followingdecadesofrelative

stability,the

worldtoday

is

marked

by

increasedgeopoliticalconflicts.

Thefalloutofthisturbulence

inthedigital

realm

–

thegrowing

prowessofcybercriminals,

rapidadvances

inemergingtechnologiesandwidening

cybercapabilities–

have

ledtoacyberspace

that

is

morecomplexthanever

before.Againstthisbackdrop,theGlobalCybersecurityOutlookserves

asan

indispensabletoolto

help

leaders

navigate

suchcomplexityand

identifyessentialactions

to

build

resilientecosystems.Lastyear’s

report

broughttotheforethe

prevailing

inequity

betweenthecyber

havesand

have-nots.

Despite

increasedexecutiveawarenessof

cybersecurity

risks,thecomplexity

incyberspace

isfurtherexacerbatingcyber

inequityas

resilient

organizations

pullahead,whileothersstrugglewith

limited

resources.Amid

increasinglyinterdependentsupplychains,thiscyber

inequityGlobal

Cybersecurity

Outlook2025ForewordGlobal

Cybersecurity

Outlook20253January2025Cyber

skills

gapComplexity

in

cybersecurityExecutivesummaryInacomplexcyberspace

characterized

by

geopolitical

uncertainties,wideningcyber

inequityandsophisticatedcyberthreats,leaders

mustadoptasecurity-first

mindset.Whilethe2024editionoftheGlobal

Cybersecurity

Outlook

highlightedthegrowing

inequity

incyberspace,thisyear’s

reportshinesa

lightonthe

increasingcomplexityofthecyber

landscape,

which

has

profoundandfar-reaching

implications

fororganizationsand

nations.Thiscomplexity

isdriven

by

a

series

ofcompoundingfactors:–Escalatinggeopoliticaltensionsare

contributing

toa

more

uncertainenvironment.–Increased

integrationofand

dependence

onmorecomplexsupplychains

is

leadingto

amoreopaqueand

unpredictable

risklandscape.–The

rapidadoptionofemergingtechnologies

iscontributingto

newvulnerabilitiesascybercriminals

harnessthemeffectivelyto

achievegreatersophisticationand

scale.–Simultaneously,the

proliferationofregulatoryrequirementsaroundtheworld

isadding

asignificantcompliance

burdenfororganizations.Allofthesechallengesare

exacerbated

by

awideningskillsgap,

making

itextremelychallenging

to

managecyber

riskseffectively.Some35%

ofsmallorganizations

believetheircyber

resilience

is

inadequate,a

proportionthathas

increasedsevenfoldsince2022.

Bycontrast,theshareoflarge

organizations

reporting

insufficient

cyber

resilience

has

nearly

halved.Thegrowingcomplexityof

cyberspace

isexacerbatingcyber

inequity,wideningthegapbetween

largeandsmallorganizations,deepening

thedivide

betweendevelopedand

emergingeconomies,andexpandingsectoraldisparities.1FactorscompoundingthecomplexnatureofcybersecurityGlobal

Cybersecurity

Outlook20254interdependencieSupply

chainFIGURE

AAIandCybsophisticatGeopoliticaltemergingtechRegulatensiercrimirequirementoryooennsssHowconfidentareyouthatthecountry

inwhichyourorganization

is

based

is

well

preparedto

respondto

majorcyber

incidentstargetingcritical

infrastructure?LatinAmericaAfricaAsiaMiddle

EastEuropeNorthAmericaOceania-70%-60%-50%-40%-30%-20%-10%0%10%20%30%40%50%60%70%80%

Notconfident

Neutral●ConfidentVeryconfidentSmallerorganizationsarestrugglingto

ensure

cyberresilience,while

largerorganizationsshowsteady

progress35%30%20%71%ofcyber

leaders

at13%thatsmallorganizations

have7%5%tippingpointwherethey

canno

longeradequatelysecurethemselvesagainstthegrowing

complexityofcyber

risksThisdisparity

incyber

resilience

isfurtherhighlighted

by

regionaldifferences

in

preparedness:

whileonly15%

ofrespondents

in

Europe

and

North

America

lackconfidence

intheircountry’sabilityto

respondto

majorcyber

incidentstargetingcriticalinfrastructure,this

proportion

risesto36%

inAfrica

and42%

in

LatinAmerica.The

publicsector

isdisproportionatelyaffected,with

38%

ofrespondents

reporting

insufficient

resilience,comparedtojust10%

ofmedium-to-largeprivate-sectororganizations.This

inequityextendstothecyberworkforce,with49%

ofpublic-sector

organizations

indicatingthey

lackthe

necessary

talentto

meettheircybersecuritygoals–

anincreaseof33%

from

2024.TheGlobalCybersecurityOutlook

2025reportincludes

adeeperanalysisofthe

most

important

drivers

ofcomplexityand

providesvaluable

insights

intothe

most

pressingcyberchallenges

intheyearahead

andtheir

potential

implicationsforexecutives.FIGURE

BFIGUREC71%OrganizationsreportinginsufficientcyberresilienceRegionaldifferencesincyberresiliencetheAnnual

MeetingonCybersecurity2024

believeMyorganization'scyberresi

lienceisinsufficientGlobal

Cybersecurity

Outlook20255already

reachedacritical●Small

●Large2022202540%10%40%42%40%48%36%31%36%36%37%35%50%27%27%20%21%25%25%14%13%15%15%15%17%0%4%9%9%7%8%

1%

5%

2%

3%

2%

2%

1%7%DisruptionofoperationsCyberespionageand

loss

of

sensitive

informationor

IPFinancial

lossesduetocyberattacksDamagetobrand

reputation

andloss

ofcustomertrustIncreasedcostsforcybersecuritymeasuresandincident

responseDisinformationcampaignsNotconcernedOtherThesearethe

keyfindingsfromthisyear’s

reportandthe

main

trendsthatexecutiveswill

needto

navigate

in2025:Supplychainvulnerabilitiesareemerging

asthetopecosystemcyberriskOflargeorganizations,54%

identified

supply

chain

challengesasthe

biggest

barriertoachievingcyber

resilience.The

increasingcomplexityofsupplychains,coupledwitha

lackofvisibilityand

oversight

intothesecurity

levelsofsuppliers,

has

emergedasNearly60%

oforganizationsstatethatgeopolitical

tensions

haveaffectedtheircybersecuritystrategy.Geopoliticalturmoil

hasalsoaffectedthe

perceptionofrisks,withone

in

three

CEOs

citingcyberespionageand

lossofsensitive

information/

intellectual

property(IP)theftastheirtop

concern,

while45%

ofcyber

leadersareconcerned

about

disruptionofoperationsand

business

processes.Whichofthefollowingcyberrisksareyou

most

concerned

aboutinthecontextof

geopolitical

tensions?the

leadingcybersecurity

riskfororganizations.

Keyconcerns

includesoftwarevulnerabilities

introduced

bythird

partiesand

propagationof

cyberattacksthroughouttheecosystem.GeopoliticaltensionsshapecybersecuritystrategyTheeffectsofgeopoliticaltensionsonorganizations’cybersecuritystrategies45%0

10%20%

30%

40%

50%11%11%●CEO●CISOGlobal

Cybersecurity

Outlook2025612%FIGURE33%27%31%D11%13%4%3%

2%

2%AI/machine

learningtechnologies(generativeAI,malicious

useofAI,AI-drivendetectionand

response)Convergenceof

ITandOT

securityCloudtechnologies(greateradoption

ofcloudsolutions)Quantumtechnologies(computing,encryption)Decentralizedtechnologies

(secure

multi-partycomputation,

blockchain)Satellitetechnologies(communication,GPS,

internet)OtherRegulationsare

increasinglyseenas

an

important

factorfor

improving

baselinecybersecurity

posture

and

buildingtrust.

However,their

proliferationand

disharmonyarecreatingsignificant

challengesfororganizations,with

morethan76%

ofchiefRegulationsbolstercyberresilience,yettheirfragmentation

introducessignificantcompliancechallengesinformationsecurityofficers

(CISOs)at

theWorld

Economic

Forum’sAnnual

MeetingonCybersecurity

in2024

reportingthatfragmentation

ofregulationsacrossjurisdictionsgreatlyaffectstheirorganizations’abilityto

maintaincompliance.Some72%

ofrespondents

reportan

increaseinorganizationalcyber

risks,with

ransomwareremainingatopconcern.

Nearly47%

oforganizationsciteadversarialadvances

powered

bygenerativeAI

(GenAI)astheir

primaryconcern,GenerativeAIisaugmentingcybercriminalcapabilities,

contributingtoanuptickinsocialengineeringattacksWhile66%

oforganizationsexpectAIto

havethemostsignificant

impactoncybersecurity

intheyear

tocome,only37%

reporthaving

processes

in

place

toassessthesecurityofAItoolsbefore

deployment.This

revealsthe

paradoxofthegap

betweenthe

recognitionofAI-drivencybersecurity

risksandthe

rapid

implementationofAIwithoutthe

necessary

securitysafeguardstoensurecyber

resilience.Since2024,thecyberskills

gap

has

increasedby8%

,withtwoout

ofthree

organizationsreporting

moderate-to-criticalskillsgaps,

including

a

lackofessentialtalentand

skillsto

meet

theirenabling

moresophisticatedandscalableattacks.

In2024therewasa

sharp

increase

in

phishingandsocialengineeringattacks,with

42%

of

organizations

reportingsuch

incidents.security

requirements.

Furthermore,only14%

oforganizationsareconfidentthatthey

havethe

peopleandskillsthey

needtoday.OrganizationsaregrapplingwithashortageofcriticalcybertalentDoesyourorganization

havea

process

in

placetoassessthe

securityofAItools

beforedeployingthem?Inyourview,whichofthefollowingwill

mostsignificantly

affectcybersecurity

inthe

next

12

months?RapidadoptionofAIintroducesnewvulnerabilities37%63%Cybersecurity

vulnerabilities

anticipated

in202566%Global

Cybersecurity

Outlook20257010%20%

30%

40%

50%

60%

70%●

Yes

●NoFIGUREEUnderstandingcomplexityincyberspaceAscyberspace

becomes

increasinglycomplex,

it

hasthe

potentialtoexacerbate

cyber

inequityfororganizationsthatareunableto

meetgrowingchallenges.Global

Cybersecurity

Outlook202581The2025

reportfindsthataseries

ofcompounding

factorsaredrivingan

escalating

complexity

inthe

cyber

landscape:–Geopoliticaltensionsarecontributingto

a

more

uncertainenvironment.–Increased

integrationanddependence

on

more

complexsupplychainsare

leadingto

a

moreopaqueand

unpredictable

risklandscape.–The

rapidadoptionofemergingtechnologies

iscontributingto

newvulnerabilitiesandnewthreats.Meanwhile,the

proliferationofinternationalregulatory

requirementsaddsanadditionalcompliance

burdenfororganizations.Allofthese

challengesarecompounded

byawidening

skills

gap,furthercomplicatingtheabilityto

manage

cyber

riskseffectively.Together,thesefactorsdrive

increasingcomplexity

and

unpredictability

inthecyber

landscape,whichaffectsorganizations

in

manyways.

First,itdrives

inequitythroughoutthecyberecosystem,

undermining

resilience

bycreatingadivide

between

thoseorganizationsthat

havethe

resourcestoadaptandthosethatdo

notand

subsequentlyfall

behind.Thisaffectsthe

resilienceoftheecosystem,

because

many

largerand

morematureorganizationstypicallydependon

extensive

networksofsmaller,often

less-maturesuppliers,andany

incidentaffectingthemcould

also

impact

theentiresupplychain.Second,

it

drives

greaterdemandfor

morespecialistskills

incybersecurity,

furtherexacerbatingtheskillsgap.

Keeping

upwithtechnologicaladvances

requires

morespecific

skillsthatare

ingreater

demand

inthe

cyberskills

market.Atthesametime,complexity

puts

increasing

pressureonoftenalready

stretched

cybersecurityteams.Thesechallengesdemanda

comprehensive

re-evaluationofcyberstrategiesatthe

organizational

andecosystem

leveltoaddressthecomplexitythat

has

become

inherent

inthecyber

landscape.7

Abroader

understandingofcyber

riskis

necessary

thatgoes

beyond

mere“IT”andconsiderscyber

fromanoverall

business

risk

perspective.TheGlobalCybersecurityOutlook2024

revealedsignificantcyber

inequity,exposingstarkdisparities

in

resilience

betweensmalland

largeorganizations.2

TheWorld

Economic

Forum’sGlobalRisksReport

2024foundthatcyber

insecurity

isaglobal

riskover

multipletime

horizons,withcyber

riskssuchas

malware,deepfakesand

misinformationthreateningsupplychains,financialstability

anddemocraticsystems.3

Additionally,theChief

RiskOfficersOutlookfromOctober2024

rankedcyber

riskamongthetopthreethreatsseverely

affecting

organizations.4

Astriking71%ofchief

risk

officers

anticipatedsevereorganizationaldisruptionsdue

to

cyber

risksandcriminal

activity.5In2024theworldwitnessedthe

largest

IToutagein

history,disruptingairlines,

banks,

broadcasters,

healthcare

providers,

retail

paymentsystemsandATMsgloballyandcausingan

estimated

$5

billion

in

losses.6

This

incident

underscoredthevulnerabilities

stemmingfromdependenceona

limited

numberofcritical

providers.Cyberthreatscontinuedtoescalate,with72%ofrespondents

to

the

GlobalCybersecurityOutlook(GCO)survey(seeAppendix:Methodology)

reportinga

rise

incyber

risks.Thesurveyfurther

revealedthatcybercrimegrew

inbothfrequencyandsophistication,marked

byransomwareattacks,AI-enhancedtactics–such

as

phishing,vishinganddeepfakes–and

a

notable

increase

insupplychain

attacks.72%1.1ofGCO

surveyrespondents

reported

a

rise

incyber

risks.1.2Cybersecurity

isenteringaneraof

unprecedented

complexity.Geopoliticaltensionsare

intensifying,

newtechnologiesareemergingat

breakneckspeedandthreatsareevolving

into

ever

more

sophisticatedattackvectors.Atthesametime,expanding

regulatorydemands,vulnerabilitiesin

interwovensupplychainsand

awideningcyberskillsgaparecompounding

the

challenges

organizationsface

instayingsecure.Thestakes

have

never

been

higher.The

challenge

for

the

year

aheadMajordisparitiesanddisruptionsGlobal

Cybersecurity

Outlook20259FIGURE1FactorscompoundingthecomplexnatureofcybersecurityAgainstabackdropofgrowingcyberthreatsandexpandingattacksurfaces,networkdefendersaredrowningintheoperationalcomplexityofalegacysecuritymindset.Theystruggletostitchtogetherdozensofdisparatesecurity

solutionsandenforcesecuritypoliciesacrossanenterprise’snetwork,cloudandendpointenvironments.Asaresult,people–ourmostpreciouscyberresource–areleftmanuallytriagingalertsfromincreasinglyautomatedattacks.

Tostayaheadofadversaries,weneedtoreimaginecybersecurityoperations,

leveragethepowerofAIanddepriveattackersofanytechnologicaladvantage.NikeshArora,ChairmanandChiefExecutiveOfficer,

PaloAlto

NetworksFIGURE2CybersecurityisbecomingincreasinglycomplexSupplychaininterdependencies72%of

respondents

say

cyber

risks

haverisen

in

the

past

year,with

cyber-enabledfraud

on

the

rise,an

increase

in

phishingandsocialengineeringattacks

and

identifytheftbecomingthetoppersonal

cyber

risks.AI

andemergingtech78%ofleadersfromprivateorganizationsfeelthatcyberandprivacyregulations

effectivelyreduceriskintheirorganization’secosystems.However,two-thirds

of

respondents

cited

thecomplexityandproliferationofregulatoryrequirementsasachallenge.Cyber

skills

gapComplexity

in

cybersecurityThecyberskillsgap

haswidened

since2024,with

two

in

three

organizationsreportingmoderate-to-criticalskillsgaps.Only

14%of

organizations

are

confident

thatthey

have

the

people

and

skills

required.Geopolitical

tensions

are

an

influence

oncyber

strategy

in

nearly

60%

oforganizations,with

one

in

three

CEOscitingcyberespionageand

loss

ofsensitiveinformation/IPastop

concerns.With54%of

large

organizations

citingthird-partyriskmanagement

as

a

majorchallenge,supply

chain

challenges

remain

atopconcernforachievingcyber

resilience.66%of

respondents

believe

that

AI

willaffect

cybersecurity

in

the

next

12

months,but

only37%have

processes

in

place

forsafe

AI

deployment.CybercrimesophisticationRegulatoryrequirementsGeopolitical

tensionsCyberskills

gapGlobal

Cybersecurity

Outlook202510interdependencieSupply

chainAIandCybsophisticatGeopoliticaltemergingtechRegulatensiercrimirequirementoryooennsssDecodingcomplexityAscybercriminalsembraceadvancedtools,

theevolvingthreat

landscapedemandsinnovativestrategiestocombat

increasingly

sophisticatedandfar-reachingattacks.Global

Cybersecurity

Outlook20251127%6%6%10%20%30%40%50%Ransomware

remainsthetoporganizationalcyber

riskyearonyear,with

45%

of

respondents

ranking

itasatop

concern

in

this

year’s

survey.Accordingto

leadersattheAnnual

Meeting

onCybersecurity2024,significant

innovations

inransomwareattacksshould

beexpected.

Thisiscompounded

bythecontinued

adoption

ofRansomware-as-a-Service

(RaaS),entrenchingthecommoditizationofthe

ransomware

model.82.1The

cyberthreat

landscapeTheevolutionofcybercrimeCyber-enabledfraud

ranksasthesecond-highestorganizationalcyber

riskfor2025,

viewed

byCEOsasasignificant

threat

alongside

ransomwareandsupplychain

disruptions.Atthe

same

time,identitytheftclimbstothe

top

ofthe

agenda,

emergingasthe

primary

personalcyber

risk

for

bothCISOs

and

CEOs.Malicious

insiderDisinformationDenialof

service

(DoS)anddistributed

denial

ofservice(DDoS)

attacks045%20%RansomwareattackCyber-enabledfraud(including

phishing,otherbusinessemail

compromise,

vishing,

etc.)Whichorganizationalcyberriskconcernsyouthe

most?FIGURE3Organizational

cyber

risks

ranked–2025Supplychaindisruption

17%Global

Cybersecurity

Outlook202512Whichorganizationalcyberriskconcernsyouthe

most?30%57%20%22%26%7%8%7%11%2%3%3%2%2%0

10%

20%

30%

40%●CEO●CISO35%9%46%11%24%20%20%37%Organizational

cyber

risk–CEO

and

CISO

viewsChanges

in

view

of

personal

cyber

risk,

2024–2025FIGUREFIGURERansomwareattackSupplychaindisruptionCyber-enabledfraud(including

phishing,other

businessemailcompromise,vishing,etc.)Malicious

insider

Lossofaccessto

utilitiesCompromised

personaldataCyberextortionIdentitytheftWhatpersonalcyberrisk

concernsyou

the

most?Denialof

service

(DoS)

anddistributed

denial

of

service(DDoS)

attacks45Global

Cybersecurity

Outlook20251350%60%Disinformation20242025OtherCybercrimehaspersistentlyevolvedalongsidethethreatlandscape,anditsreachextendsbeyondfinancialloss,becomingadisruptiveforce

thatthreatensoursocieties.Wemustremainvigilantandcollaborateacrosssectorstosafeguardthefutureofourdigitalworld.Cybercrime’s

impactisfar-reaching–itcanhaltoperations,undermineconfidenceandpermeatetoouroperationaltechnologyandcriticalinfrastructure.

Intheyearahead,wemustprioritizenotonlydefencebutproactiveand

systemicdisruptionofthesecriminalnetworksaspartofourcollective

efforttoensurecyberresilienceandprotectourdigitalfuture.KenXie,

Founder,Chairmanofthe

BoardandChiefExecutiveOfficer,

FortinetTherapidadvancementsandincreasingadoptionofdigitalplatformsgloballyismatchedbyanequallyevolvingcyberthreatlandscape.Cybercrimetodayisincreasingnotjustinscalebutalsoin

sophistication.Asourdigitalfootprintswiden,sodoesthepotentialattacksurfacefornefariousactors.Itisessentialthatweworktogether

toaddressthisgrowingmenace.Theborderlessnatureoftheinternet

necessitatescollaborationacrossvarious

jurisdictionallimitationstoensurethatthreatactorshavenosafehavenfortheirevilactivities.IvanJohn

E.Uy,SecretaryofInformationand

Communications

Technologyofthe

PhilippinesThesurge

inthevolumeandvalueof

cyber-enabled

fraud

hasattracted“traditionally”violentorganized

crimegroups

intothecybercrime

market.Theinteractionoforganizedcybercrimewithorganizedviolentcrimegroups

ischangingthe

nature

ofcybercrimeandgreatlyincreasingtheirsocial

impact.This

is

perhaps

moststarklyshown

bythetrafficking

ofmorethan220,000peopletoforciblyworkinonlinescam-farms

inSouth-EastAsia.10

Withsuchfarms

engagingintheharvestingofdata,disinformationand

socialengineeringtonameafewcapabilities,theyare

essentially

becoming“criminalservice

providers”

.11

AccordingtotheGlobalAnti-Scam

Alliance,scammersCybercrime-as-a-Service(CaaS)

platformscontinueto

beadominantand

rapidly

growingbusiness

model

inthecriminal

landscape,allowing

individualsorgroupswithouttechnicalexperti