Global Cyber
Policy Radar

A: Geopolitical disruption needs to be planned for as part of everyday governance, not reserved for exceptional crises. For critical infrastructure, organisational and geopolitical risks increasingly overlap, with state-linked cyber activity capable of causing disruption far beyond its initial target. Organisations should identify which core functions must continue, which systems can tolerate temporary degradation and how recovery would be coordinated across suppliers, sectors and government. 

For more on how geopolitical instability is reshaping cyber preparedness, see page 24 of Edition 6 as we ask “Is Critical Infrastructure prepared for persistent geopolitical turbulence?”.  

A: Organisations should prepare for AI-enabled cyber defence to develop with a focus on sovereign capability across national markets. Governments are exploring how AI can provide defensive advantage at a national level, but approaches to its development, oversight and availability are still taking shape. 

For multinational organisations, the challenge is to assess what these differences could mean for their operations and the secure adoption of AI. Building the capability to assess the secure and assured adoption of AI now could make it easier to navigate that developing landscape. Edition 6 of the Global Cyber Policy Radar explores in detail the emerging policy landscape and the questions it raises for cyber readiness. 

A: Effective resilience is not simply about building stronger defences. It means recognising that some disruption may be inevitable and being able to sustain essential services, contain incidents and restore operations quickly when it occurs.  

That requires robust and tested recovery plans, but also an understanding of interdependencies. Critical infrastructure rarely operates in isolation, so resilience also depends on preventing failures in one organisation, supplier or sector from cascading into others.  

See “Is Critical Infrastructure prepared for persistent geopolitical turbulence?” on page 24 of Edition 6 for the Global Cyber Policy Radar's wider analysis.  

A: Governments are considering who owns or controls important suppliers, which jurisdictions they operate within, where sensitive data can be accessed and whether viable alternatives exist. EU proposals including Cybersecurity Act 2 and the Cloud and AI Development Act demonstrate how these considerations are moving into cyber policy.  

For organisations, that makes supplier visibility increasingly important. Knowing that a supplier is technically secure may no longer be enough; organisations also need to understand what they depend on, how that dependency could be disrupted and whether they could continue operating if it were. 

Read more on page 10 of Edition 6. 

A: Post-quantum cryptography is starting to move beyond long-term guidance into present-day procurement, regulationand implementation expectations. Edition 6 of the Global Cyber Policy Radar points to developments including US federal PQC transition projects, migration plans for Singapore's Critical Information Infrastructure and France's decision to stop certifying security products without quantum-resistant encryption from 2027.  

We dive into this in detail on page 18 of the latest Global Cyber Policy Radar.