Most businesses face security incidents, but lag in preparing for non-IT threats, McKinsey report shows

Eighty-seven per cent of organisations faced at least one threat-related incident over a two-year period, according to a report by McKinsey & Company. The survey, conducted in early 2026, reveals that companies struggle to handle risks that go beyond standard cyberattacks.

Incident Breakdown

Technology infrastructure and software suffered the most, with 75 per cent of respondents reporting incidents in these areas. Physical and industrial infrastructure recorded 31 per cent of incidents, while economic systems and supply chains each accounted for 29 per cent. Traditional sectors like power grids, healthcare, and transport now rely heavily on digital tools like cloud platforms and AI, making disruptions more likely to spread.

Preparedness Gaps

While 98 per cent of organisations handle IT risks and 77 per cent manage physical security, readiness drops sharply for other threats. Only 59 per cent manage information and psychological operations, 47 per cent handle economic and political coercion, and just 32 per cent address espionage and covert operations. At the same time, 64 per cent of firms view espionage as a major threat, though such hidden operations are hard to detect.

Department Dives

Internal coordination remains weak because risk management duties are split across different departments like IT, physical security, and compliance. Budgets and accountability stay divided even as modern threats cross these departmental lines. The report urges leaders to match investments with actual threat levels and adopt an integrated approach to security.

Context

Modern businesses increasingly connect digital platforms with physical infrastructure, creating complex dependencies where a single failure can cascade across entire supply chains. Managing these diverse modern risks requires breaking down internal silos so that IT, physical security, and compliance teams work together.