Regulation Is Most Popular Where It Is Newest

74% per cent of respondents to the World Economic Forum’s Global Cybersecurity Outlook 2026 hold a positive view of the effectiveness of cyber-related regulation.

The regional breakdown runs against the direction regulatory maturity would suggest. Positive sentiment is highest in the Middle East and North Africa at 81 per cent, followed by East Asia and Pacific at 79 per cent, Latin America and the Caribbean and sub-Saharan Africa at 78 per cent, and South Asia at 76 per cent. The two regions with the longest-established and most detailed cyber regimes record the lowest figures: North America at 71 per cent and Europe and Central Asia at 70 per cent.

The Global Cybersecurity Outlook 2026 is the fifth annual edition of the report, produced by the World Economic Forum in collaboration with Accenture and published in January. It draws on a survey conducted between 25 August and 1 October 2025, which returned 873 responses from 99 countries, normalised to 804 qualified participants from 92 countries, including 316 chief information security officers, 105 chief executives and 123 other C-suite respondents.

What practitioners say regulation does for them

The benefits respondents to the Forum’s survey name are mostly internal and political rather than technical.

The most frequently cited is that regulation helps raise awareness of security with the board and across the organisation, at 58 per cent. Improving security posture and reducing cyber risk follows at 55 per cent, securing budget for cybersecurity at 36 per cent, and increasing customer trust and brand reputation at 30 per cent.

The objections are concentrated and specific. Difficulty ensuring that third-party vendors comply with relevant requirements is cited by 18 per cent, difficulty fully understanding the applicability of the volume of regulation across the business by 17 per cent, limited internal resources or expertise to track and implement changes by 16 per cent, and difficulty ensuring consistent implementation across business units by 11 per cent.

The report’s reading of the regional pattern is that organisations in markets where regulation is more mature face greater difficulty applying it consistently across borders, and that more advanced regulatory environments can introduce greater complexity and compliance burden alongside their benefits. It describes the global picture as an accelerating effort to codify trust and accountability in the digital domain, advancing at different speeds and with differing priorities, producing a patchwork of obligations that multinational organisations find difficult to reconcile.

The sentiment tracks resilience

Within the same survey, views on regulation are not evenly distributed by capability either. Among organisations rating themselves highly resilient, 79 per cent hold a positive view of regulatory effectiveness. Among those rating their resilience insufficient, 62 per cent do.

The sharpest divergence is on commercial benefit. Some 44 per cent of highly resilient organisations say regulation helps increase customer trust and brand reputation, against 20 per cent of insufficiently resilient ones. On budget, 44 per cent against 33 per cent. On improving posture, 56 per cent against 44 per cent.

The objections invert. Limited internal resources or expertise to track and implement regulatory change is cited by 34 per cent of insufficiently resilient organisations and 6 per cent of highly resilient ones — the widest gap on any item in the comparison. Difficulty ensuring consistent implementation across business units runs at 18 per cent against 7 per cent.

That pattern suggests compliance capacity behaves like any other security capability. Organisations that have it experience regulation as leverage. Organisations that do not experience it as load.

Regulation as a fixed point

The report situates the finding inside its wider argument about fragmentation. Geopolitics remains the top factor shaping cyber risk mitigation strategies, with 64 per cent of organisations accounting for geopolitically motivated cyberattacks, and 66 per cent reporting that their cybersecurity strategy has evolved because of geopolitical volatility.

Against that backdrop, the report characterises regulation as serving as both a stabilising force and a shared language for resilience, even as the contours of sovereignty and coordination continue to evolve.

The Global Cybersecurity Outlook 2026 also records that the sovereignty question is now operational rather than theoretical. Governments, public institutions and private enterprises are reassessing dependencies on foreign technology providers and global cloud infrastructure. The report cites European actors including the municipality of Copenhagen, in Denmark, and federal agencies in Germany shifting towards sovereign or regionally managed cloud solutions to ensure compliance with national data-protection mandates and to mitigate perceived risks associated with extraterritorial control of data.

The use to make of it

The report’s governance findings give the sentiment data a practical edge.

Among highly resilient organisations, 99 per cent report board involvement in cybersecurity, and 30 per cent say board members hold personal liability in the event of a cyber breach, against 9 per cent of insufficiently resilient ones. Board engagement is absent entirely at 13 per cent of insufficiently resilient organisations and 1 per cent of highly resilient ones.

Set beside the finding that 58 per cent of practitioners value regulation primarily for raising security awareness at board level, the picture is of a sector using compliance obligations to secure attention that is otherwise hard to obtain. On the survey’s numbers, that is the most commonly reported benefit of cyber regulation anywhere in the world.