WEF Council report: governing cybersecurity as economic risk, with a five-move 2027 agenda

In two minutes

• The report argues that cybersecurity is a condition of economic resilience, but boards, governments and investors still govern it as a technical cost (executive summary, p. 4).
• Its April 2026 survey found 42% of respondents saw measurable economic effects from cyber, but only 9% said their institutions treat it as an economic stabilizer (p. 4).
• Language is a named problem: 62% said communication challenges delayed or weakened incident response, and the most used terms were resilience, continuity and trust (pp. 8-9).
• Four value mechanisms come from self-reported organizational cases: economic discipline, ecosystem trust, enabling digital transformation, and governance and culture (pp. 11-12).
• It proposes six cross-institution measures: service continuity, recovery credibility, dependency concentration, tail-loss exposure, value preserved and cost-of-capital effect (Table 2, p. 15).
• It also proposes a country and sector benchmark that weights demonstrated recovery above declared resilience, to be piloted across two sectors and five countries (p. 16).
• It recommends a Sustainable Cybersecurity Finance Mechanism and reclassifying cyber as civil resilience, not defence, in funding categories (p. 18).
• The close lists five moves for 2027, from a common executive vocabulary to making cyber a standing item in financial stability forums (p. 20).

Key numbers

• 42% vs 9%: Respondents who recognized cyber's measurable economic effects vs those who said their institutions view it as an economic stabilizer (executive summary, p. 4).
• More than half vs 8%: Respondents saying cyber investment is driven mainly by crisis events vs those citing demonstrated returns as a trigger (executive summary, p. 4).
• 62%: Respondents reporting communication challenges delayed or weakened incident response (p. 8).
• 77%, 61%, 55%: Share using the terms resilience, continuity and trust for cyber at senior level (p. 8).
• 67%, 58%, 50%, 48%: Metrics boards and CFOs want: revenue and productivity, financial loss avoided, downtime reduction, risk-adjusted return (p. 11).
• 0.2% to 2% of GDP: Modelled effect of severe cyber incidents on national output in the year of the event (p. 14).
• $100-200 million a year: Estimated private and corporate philanthropy to cybersecurity-specific causes, from a review of 28 funds (p. 18).
• 110 responses: Size of the self-selected survey; 60% of respondents were in Latin America and the Caribbean (p. 22).

What to do with it

• Test your board and incident papers against the report's check: what is at risk, which services are affected, recovery time, economic value exposed and who is accountable (p. 20).
• Review the six measures in Table 2 as a candidate set for board reporting, since the report says leaders can require them without waiting for a standard (pp. 15, 20).
• Set cyber and technology risk as a business risk with a small set of executive-level KRIs, and give the CISO independence and direct access to governance, as Table 1 advises for financial services (p. 12).
• Bring security into transformation projects at the start, and define safe adoption conditions early for cloud, AI and third parties (Table 1, p. 12).
• Monitor critical and non-technology suppliers and plan credible substitution, since 61% of respondents named third-party disruption as a main spread route (p. 14).
• Define criticality at function and service level using substitutability, concentration and restore time, rather than by whole entity (p. 9).

Read the full document if

• you must make the case to a board or CFO for treating cyber as productive capital, and want the report's case examples (pp. 11-12).
• you work with regulators, insurers or investors and want the proposed six measures and benchmark (pp. 15-16).
• you are interested in funding for under-resourced economies and the proposed finance mechanism (p. 18).

What it relies on

The report rests on a Global Future Council on Cybersecurity survey run 9 to 30 April 2026. It had 110 anonymous, self-selected responses, and 60% came from Latin America and the Caribbean. The authors call the results directional, not statistically representative (p. 22). It also uses mini-cases validated mostly through organizations' own audits, 13 expert interviews and a desk review of 28 funds (p. 22). External sources include UK government research, IMF, UNCTAD, and academic work, listed in the endnotes (p. 25). The Forum publishes it as Council work, and several Council members work for security firms, banks and agencies (p. 23). The report recommends no product.

Our read

Useful as a board-level framing document. It gives CISOs vocabulary, six candidate metrics and case examples for the cost-versus-value discussion with finance leaders. The survey is small and skewed by region, and the cases are self-reported, so treat the figures as directional. The recommendations are mostly aimed at governments, supervisors and funders, not security teams.