NGOs Report Weakest Cyber Resilience In WEF Survey

Non-governmental organisations (NGOs) report the weakest cyber resilience among the organisational groups compared in the World Economic Forum’s Global Cybersecurity Outlook 2026. Funding constraints and shortages of cybersecurity expertise are among their leading challenges, while fewer NGOs have adopted AI-enabled tools for cyber defence.

The report, published in January in collaboration with Accenture, found that 37% of NGOs rated their cyber resilience as insufficient. The comparable figure was 23% for public-sector organisations and international organisations, and 11% for private-sector organisations. Only 8% of NGOs said their resilience exceeded requirements, compared with 22% in the private sector and 24% in the public sector.

The gap is also evident in the adoption of AI-enabled cybersecurity tools. Some 45% of NGOs said they had implemented such tools, compared with 93% of large companies by revenue, 83% of medium-sized companies, 78% of small companies and 70% of public-sector organisations.

The Global Cybersecurity Outlook 2026 is the fifth annual edition of the report. Its findings draw on a survey conducted between 25 August and 1 October 2025, which received 873 responses from 99 countries. After normalisation, the analysis included 804 qualified participants from 92 countries, including 316 chief information security officers, 105 chief executives and 123 other C-suite respondents.

Funding and skills are major barriers

When asked about the challenges to becoming cyber resilient, NGOs were more likely than public- and private-sector organisations to identify a lack of funding as a barrier.

Some 62% of NGOs cited insufficient funds, compared with 29% of public-sector organisations and 26% of private-sector organisations. Shortages of cybersecurity skills and expertise were another major challenge, cited by 51% of NGOs, 57% of public-sector organisations and 38% of private-sector organisations.

Third-party and supply-chain vulnerabilities were cited by 26% of NGOs, the lowest proportion among the three groups compared in the article. This finding should be read alongside the other reported challenges rather than as evidence that supply-chain risks are less significant for NGOs. The figures measure the challenges respondents identify, not their actual exposure to every category of cyber risk.

The WEF identifies shortages of cybersecurity skills as a significant driver of cyber inequity. Its analysis points to gaps in access to expertise, financial resources, digital infrastructure and governance frameworks. It also identifies threat intelligence analysts, DevSecOps engineers, and identity and access management specialists among the roles in shortest supply.

Why cyber inequity affects more than one organisation

The WEF warns that uneven cybersecurity capabilities create risks beyond the organisations directly affected. Businesses, public institutions and other organisations increasingly depend on interconnected supply chains and digital services. A less-protected partner can therefore become a route through which attackers reach a more valuable target.

NGOs are part of these networks. They handle beneficiary information, distribute funds, operate in crisis settings and work with governments, donors and corporate partners. A cyber incident affecting one organisation can consequently disrupt services or expose information involving others.

In its discussion of cyber inequity, Illena Armstrong, president of the Cloud Security Alliance, argues that the problem extends beyond differences in budgets and geography. As she puts it, “The actual capability gap lies not just in technologies, but in people. Organisations with limited resources need access to training, mentorship and practical cybersecurity support.”

Armstrong’s wider argument is that organisations with limited resources need access to training, mentorship and practical cybersecurity support. She calls for vendor-neutral education and broader collaboration to help organisations keep pace with evolving threats.

The report also highlights the role of AI in widening existing inequalities. While AI can strengthen threat detection and automate parts of security operations, organisations without the necessary skills, resources or oversight may struggle to adopt these tools safely.

Initiatives seek to close the gap

The report examines efforts to extend cybersecurity expertise to organisations that cannot easily access it themselves.

One example is CyberPeace Builders, which mobilises skilled volunteers to provide tailored cybersecurity assistance to NGOs. The report also highlights Common Good Cyber, an initiative focused on coordinating public-interest cybersecurity organisations, identifying shared needs and supporting more sustainable funding for services.

These initiatives reflect the report’s broader argument that addressing cyber inequity requires sustained cooperation. No single programme can meet the needs of every under-resourced organisation, and support must extend beyond the provision of technology to include expertise, training and incident-response capabilities.

The survey also examined how organisations support smaller or less-resourced partners. Some 34% of respondents said their organisations provided formal, structured cybersecurity guidance or support, while 31% offered informal or ad hoc assistance. The remaining 35% said they provided no such support. These figures concern support for less-resourced organisations generally, not NGOs alone.

Collaboration as a measure of resilience

The report’s findings suggest that cybersecurity collaboration is one area where organisations can learn from one another, even when they have unequal resources.

Among organisations that rated their cyber resilience highly, 44% conducted cyber incident simulations or recovery exercises with ecosystem partners. Among organisations that rated their resilience as insufficient, the proportion was 16%.

Threat-information sharing showed a similar gap: 53% of highly resilient organisations shared threat information with partners, compared with 31% of insufficiently resilient organisations.

These figures compare organisations by their self-assessed resilience, rather than by sector. They do not establish that collaboration alone accounts for the difference, but they highlight practices associated with stronger resilience.

For NGOs, access to external expertise, shared threat information and opportunities to practise incident response with partners could help address some of the constraints identified in the survey. The wider challenge is ensuring that such support is available consistently, rather than relying on short-term projects or voluntary assistance.

The proportion of organisations providing formal cybersecurity support to less-resourced partners offers one measure of how widespread that assistance is. Whether that support becomes more accessible, alongside improvements in funding and skills, will be important to efforts to narrow the cyber-resilience gap.