9 in 10 organisations report threat incidents, but risk preparedness remains weak: McKinsey

Nearly nine out of 10 organisations experienced at least one threat-related incident over two years, but significant gaps remain in their ability to manage risks beyond conventional cybersecurity, according to a report by McKinsey & Company.

The report found that 87 per cent of organisations surveyed had encountered at least one threat-related incident in the 24 months preceding the survey. Technology infrastructure and software emerged as the most frequently affected areas, with 75 per cent of respondents reporting incidents involving these systems.

Physical and industrial infrastructure accounted for 31 per cent of reported incidents, while economic and financial systems and supply chain ecosystems each accounted for 29 per cent.

The findings point to an increasingly complex threat landscape in which businesses face risks extending beyond conventional cyberattacks, with disruptions potentially affecting interconnected systems and critical services.

Drawing on a survey conducted across organisations, industries and geographies during the first quarter of 2026, McKinsey highlighted a growing mismatch between the evolving nature of threats and the preparedness of businesses to tackle them.

The report observed that traditional infrastructure, including electricity grids, water supply networks, transportation, healthcare and telecommunications, is becoming increasingly reliant on digital systems such as data centres, cloud platforms and artificial intelligence computing infrastructure.

"As these systems become more interconnected, a disruption to one technology provider or platform can cascade across physical infrastructure, supply chains, and essential services," the report stated.

Despite the growing range of risks, organisations appear better equipped to handle conventional cybersecurity and physical security threats than emerging forms of disruption.

According to the survey, 98 per cent of organisations have established capabilities to manage cybersecurity and information technology risks. Around 77 per cent reported having arrangements to address threats involving physical and hardware infrastructure.

However, preparedness levels drop significantly when it comes to other categories of threats. Only 59 per cent of organisations have capabilities to deal with information and psychological operations, while 47 per cent are equipped to address economic and political coercion.

The preparedness gap is even wider in the case of espionage and covert operations, with only 32 per cent of organisations reporting capabilities to manage such threats.

This is a concern given that 64 per cent of respondents consider espionage a highly relevant threat to their organisations, the report noted.

McKinsey pointed out that espionage and covert operations are often intended to go undetected, making it challenging for organisations without specialised capabilities to identify suspicious activities and respond effectively.

The report also identified fragmented risk management structures as a major weakness within businesses. Responsibilities for identifying and addressing threats are often distributed across different departments, limiting coordination and the ability to respond to risks that affect multiple areas.

Cybersecurity teams generally oversee digital infrastructure, while physical security, regulatory compliance and enterprise risk management are handled by separate departments.

As a result, budgets, resources and accountability tend to remain divided along organisational lines, even as threats increasingly cross departmental boundaries.

McKinsey urged business leaders to assess whether their existing preparedness matches the threats considered most relevant to their operations. It also called for investments and cooperation to be aligned with the risks organisations face.

The report emphasised the importance of adopting an integrated risk management strategy covering both technological and physical infrastructure, warning that growing interdependence between these systems could amplify the consequences of disruptions.