Cybersecurity: The Public Sector Is Pulling Apart

Public-sector and international organisations report the highest share of any group whose cyber resilience exceeds requirements, at 24 per cent. They also report more than double the private sector’s share describing their resilience as insufficient, at 23 per cent against 11 per cent.

Those two figures, from the World Economic Forum’s Global Cybersecurity Outlook 2026, published in January with Accenture, describe a sector that is not uniformly behind. It is polarised.

The private sector clusters in the middle. Some 67 per cent of private-sector respondents say their resilience meets minimum requirements, with 22 per cent exceeding and 11 per cent insufficient. The public-sector distribution is flatter: 54 per cent meeting, 24 per cent exceeding, 23 per cent insufficient. Non-governmental organisations trail both, with 8 per cent exceeding and 37 per cent insufficient.

For a sector carrying primary responsibility for critical national infrastructure, the dispersion matters more than the average.

The Global Cybersecurity Outlook 2026 is the fifth annual edition of the report, produced by the World Economic Forum in collaboration with Accenture and published in January. It draws on a survey conducted between 25 August and 1 October 2025, which returned 873 responses from 99 countries, normalised to 804 qualified participants from 92 countries, including 316 chief information security officers, 105 chief executives and 123 other C-suite respondents.

Lower confidence from the custodians

The Global Cybersecurity Outlook 2026 pairs that finding with a second. Despite its central role in safeguarding critical infrastructure, the public sector reports markedly lower confidence in national preparedness than the private sector.

That sits inside a broader decline recorded by the survey. Across all respondents, confidence in a country’s ability to respond to a major cyber incident targeting critical infrastructure fell to 37 per cent in 2026 from 42 per cent a year earlier, while those not confident rose from 26 per cent to 31 per cent. Among private-sector chief executives specifically, fewer than 45 per cent expressed confidence, with 43 per cent confident, 26 per cent neutral and 31 per cent not confident.

The report attributes the heightened attention to recent incidents affecting key infrastructure, including airports and hydroelectric facilities. It cites the September 2025 compromise of check-in and boarding systems used by several major European airport hubs, where a relatively minor breach at a single supplier cascaded into flight delays and cancellations, and an April 2025 incident in which a Norwegian hydropower dam was hacked and a floodgate opened, releasing 500 litres of water per second for four hours in what officials described as deliberate sabotage.

Different constraints from the private sector

Asked by the Forum to name their greatest challenges to cyber resilience, public-sector organisations produce a different ranking from private companies.

The rapidly evolving threat landscape leads for both, cited by 67 per cent in the public sector and 59 per cent in the private sector. After that the lists diverge. Public-sector respondents name cybersecurity skills and expertise shortages second, at 57 per cent, with third-party and supply chain vulnerabilities third at 35 per cent and lack of funds fourth at 29 per cent. Private-sector respondents name supply chain second at 53 per cent, skills third at 38 per cent and funds fourth at 26 per cent.

The ordering reflects the report’s wider pattern. Organisations with capability in place move their attention outward to the ecosystem. Organisations without it remain occupied with staffing.

Skills shortages are identified in the report as the single factor with the most pervasive impact on cyber inequity, ahead of governance frameworks, financial resources and access to digital infrastructure. The roles in shortest supply globally are threat intelligence analysts, DevSecOps engineers, and identity and access management specialists.

Adoption of AI defences lags the large private sector

The gap also shows in tooling. On the Forum’s figures, 70 per cent of public-sector organisations have implemented AI-enabled tools for cybersecurity. Among large companies by revenue the figure is 93 per cent, among medium-sized companies 83 per cent and among small companies 78 per cent. NGOs sit at 45 per cent.

Across all respondents, 77 per cent have deployed AI-enabled security tools, most commonly for phishing and email threat detection at 52 per cent, intrusion and anomaly response at 46 per cent and automating security operations at 43 per cent. The leading barrier to going further is insufficient knowledge or skills, cited by 54 per cent, ahead of insufficient funds at 36 per cent.

A coordinated model

The report profiles one national approach at the resilient end of the distribution. Saudi Arabia’s National Cybersecurity Authority sets strategic direction under a whole-of-nation model, supported by the Saudi Information Technology Company, which translates those priorities into programmes. The arrangement includes cyber drills that stress-test containment, crisis management and cross-sector coordination during major events such as Hajj, alongside nationwide awareness campaigns addressing risks including phishing and AI-driven misinformation.

Respondents in the Middle East and North Africa record 84 per cent confidence in national preparedness for a major attack on critical infrastructure, the highest of any region, and the strongest organisational resilience scores in the survey, with 40 per cent exceeding requirements and 13 per cent reporting insufficient resilience.

The number that frames the rest

The Global Cybersecurity Outlook‘s comparison between highly resilient and insufficiently resilient organisations applies across sectors, and most of the distinguishing practices are governance rather than procurement.

Among highly resilient organisations, 99 per cent report board involvement in cybersecurity, 78 per cent have the skills they need, 83 per cent assess the security of AI tools before deploying them and 44 per cent simulate incidents with ecosystem partners. Among insufficiently resilient ones, the equivalents are 15 per cent on skills, 39 per cent on AI assessment and 16 per cent on simulation, with 13 per cent reporting a board not engaged in cybersecurity at all.

On the Forum’s own figures, roughly a quarter of public-sector organisations already sit at the top of that distribution. Roughly another quarter sit at the bottom.