Cybersecurity: The 99 Per Cent Nobody Plans For

Ninety-nine per cent of international data traffic travels through cables lying on the seabed. Eighteen per cent of organisations account for that dependence in their cyber risk mitigation strategy.

Those two figures, both drawn from the World Economic Forum’s Global Cybersecurity Outlook 2026, published in January with Accenture, describe the widest gap between exposure and attention anywhere in the report.

Space-based assets fare worse in the same survey. Satellites, GPS and satellite communications are factored into risk planning by 15 per cent of organisations, placing them last among the considerations the Forum tested, below geopolitically motivated attacks at 64 per cent, disinformation at 49 per cent, IT and operational technology convergence at 42 per cent, and natural disasters at 41 per cent.

“Our digital world runs through cables lying deep beneath the ocean’s surface,” said Doreen Bogdan-Martin, secretary-general of the International Telecommunication Union, in the report. “With 99 per cent of international data traffic flowing through them, these undersea systems are the unseen lifelines of our global economy — and they are also uniquely vulnerable. A single break can disrupt essential services and daily life for billions.”

The Global Cybersecurity Outlook 2026 is the fifth annual edition of the report, produced by the World Economic Forum in collaboration with Accenture and published in January. It draws on a survey conducted between 25 August and 1 October 2025, which returned 873 responses from 99 countries, normalised to 804 qualified participants from 92 countries, including 316 chief information security officers, 105 chief executives and 123 other C-suite respondents.

The failure mode is already documented

The Global Cybersecurity Outlook 2026 classifies subsea and seabed infrastructure as comparatively overlooked in cyber risk planning, despite enabling core critical infrastructure functions. We don’t need to model the evidence for what happens when it fails.

On 14 March 2024, four cables — ACE, SAT-3, WACS and MainOne — went offline following a suspected underwater rock slide off the coast of Côte d’Ivoire. Thirteen countries recorded degraded or near-total loss of international connectivity: Benin, Burkina Faso, Cameroon, Côte d’Ivoire, Gambia, Ghana, Guinea, Liberia, Namibia, Niger, Nigeria, South Africa and Togo. Côte d’Ivoire, nearest the fault, suffered a near-total outage.

The Internet Society’s analysis of the incident noted that all four cables converge at the point of failure, making it a single point of failure for a continent’s worth of westward capacity. Repair estimates ran from early April for SAT-3 to mid-May for MainOne.

Two months later, on 12 May 2024, cuts affecting the SEACOM and EASSy systems disrupted traffic in Kenya, Tanzania, Rwanda and Uganda, with effects also recorded in Malawi, Mozambique and Madagascar. Tanzanian traffic fell to about 30 per cent of expected levels.

Neither event was a cyberattack. That is the point the Forum’s report makes repeatedly about concentrated infrastructure: the distinction between a deliberate attack and an accident matters to attribution, and not at all to the organisations whose operations stop.

Why the number stays low

The Forum’s report offers an explanation for the gap rather than a judgement on it. Dependence on cables and satellites is indirect. An organisation contracts with a carrier, a cloud provider or an internet service provider, and the physical path beneath that contract is neither visible nor negotiable. It does not appear on a risk register that is built from systems the organisation controls.

That is the same reasoning the report applies to supply chain exposure, where inheritance risk — the inability to assure the integrity of third-party software, hardware and services — ranks as the top supply chain concern, and visibility into the extended supply chain ranks second.

The Global Cybersecurity Outlook‘s wider finding on concentration reinforces it. Cloud technologies rank second only to AI among technologies expected to affect cybersecurity over the next twelve months, cited by 61 per cent. The Forum points to the October 2025 disruption caused by a DNS misconfiguration at Amazon Web Services, a Microsoft Azure outage in the same month and a Cloudflare disruption in November 2025 — none of them security incidents — as illustrations of how provider-level events cascade through dependent ecosystems.

What rises as dependence deepens

The report’s forward-looking section, drawn from a focus group with members of the Forum’s Global Future Councils, argues the exposure grows rather than stabilises.

Satellite-based positioning, navigation and timing is identified as increasingly essential to aviation, maritime activity, power-grid coordination and financial transactions by 2030. Satellite communications and undersea cables are described as forming the backbone for emergency services, cloud infrastructure and international data exchange.

Alongside that, the report identifies climate volatility as a compounding factor. Extreme weather, prolonged droughts and heatwaves are expected to disrupt power, data and logistics networks routinely by 2030, with cross-border effects including satellite degradation from solar storms and undersea cable damage from seabed shifts. It describes climate as a persistent amplifier of cyber risk that extends recovery times rather than a background stressor.

The planning question

Nothing in the Global Cybersecurity Outlook 2026 tells an organisation to buy a cable. What the data exposes is a category of dependency that sits outside most risk registers because no one in the organisation owns it.

The measures the Forum’s survey associates with resilience elsewhere apply here without modification. Among highly resilient organisations, 44 per cent map their ecosystem in detail to understand where they and their partners are exposed, against 23 per cent of insufficiently resilient ones, and 44 per cent simulate incidents or run recovery exercises with ecosystem partners, against 16 per cent.

Route diversity, carrier redundancy and a tested answer to the question of what happens when international capacity drops by two-thirds are planning exercises, not procurement ones. On the Forum’s figures, 82 per cent of organisations have not done them.