AXA XL and Thales, Resilience at Scale: 2026 cyber risk and leadership priorities

In two minutes

• The report says four developments define 2026 cyber risk: consolidated cybercrime, geopolitical escalation, regulatory fragmentation and sovereignty pressure, and technology acceleration (AI, IoT, quantum) (p. 4).
• It argues cyber resilience can no longer sit only in technical functions. It needs clear ownership, escalation paths and rehearsed leadership response (p. 14).
• Cybercrime is described as a commercial ecosystem: ransomware-as-a-service, phishing-as-a-service, access brokers, and AI-assisted phishing and deepfake impersonation (p. 8).
• Geopolitics adds exposure through geography, sector, supplier ties and critical infrastructure. OT is a growing target because disruption has physical effects (pp. 9-10).
• Regulation is expanding (NIS2, AI Act, DORA, Cyber Resilience Act) and sovereignty rules may limit which providers can be used in which markets (p. 11).
• Five board priorities for 2026: visibility of digital assets, third-party oversight, AI governance that matches adoption, board-level crisis readiness, and a post-quantum roadmap (p. 15).
• Quantum risk is framed as 'harvest now, decrypt later'. The report advises mapping where encryption is used across systems, vendors and products now (pp. 12-13).
• Pages 16-19 describe AXA XL's four-pillar service framework and Thales's offering. Both publishers sell services of the kind the report recommends.

Key numbers

• $4.44m: global average cost of a data breach (IBM, Cost of a Data Breach Report 2025) (p. 6).
• More than 12,000: confirmed data breaches recorded globally in 2025, described as the highest on record (citing Verizon) (p. 6).
• Roughly 130: new CVEs published every day (citing DeepStrike) (p. 6).
• About 29 minutes: average breakout time, with the fastest observed at 29 seconds (citing CrowdStrike) (p. 6).
• 50%: growth in access broker advertising through 2024 (citing CrowdStrike) (p. 8).
• 144 countries: countries with privacy and data protection laws in effect (citing a privacy law directory) (p. 11).
• 96%: executives who report strengthening security posture in response to regulatory pressure (citing PwC) (p. 11).
• Around 70%: share of EU cloud deployments controlled by US-headquartered providers (citing European cloud provider research) (p. 11).

What to do with it

• Take the three board questions on p. 14 (geopolitical retaliation, cryptographic inventory, adequacy of resilience practices) to your next board session.
• Build an inventory of where cryptography is used across systems, vendors and products, starting with long-life systems, as the report advises (pp. 13, 19).
• Extend governance to vendors, managed service providers and shared platforms. Put resilience expectations into procurement, contracting and continuous monitoring (p. 15).
• Run scenario exercises and escalation rehearsals so decision rights, regulatory duties and communication are clear under pressure (p. 15).
• Define acceptable AI use, accountability for model outputs, and auditability. Review identity verification against deepfake impersonation (pp. 15, 19).
• Shift CISO focus to visibility of access pathways, credential control, third-party privilege and fast detection to limit lateral movement (p. 9).

Read the full document if

• you need a board-level framing of 2026 cyber risk and want a short list of leadership priorities.
• you want role-by-role implications for CFO, Board, CISO and brokers (p. 9).
• you are weighing how sovereignty, NIS2, DORA and AI regulation affect cloud and vendor choices (pp. 11-12).

What it relies on

The report says it draws on public reports plus proprietary AXA XL and Thales analysis, but it gives no sample, period or method for that internal data. Its figures are cited to outside sources such as IBM, Verizon, CrowdStrike and PwC (pp. 6, 8, 11, 13). Thales CTO Ivan Fontarensky is quoted several times. The foreword authors are AXA XL risk consulting heads. AXA XL sells insurance and risk consulting, and Thales sells security products of the kind the report recommends (pp. 16-19).

Our read

Useful as a leadership-level summary of the 2026 threat and regulatory picture, with a ready list of board questions and priorities. The statistics come from third-party reports, so check them at source. The service sections on pp. 16-19 describe the publishers' own offerings.