87% of organisations face threat-related incidents, preparedness gaps persist: McKinsey

The report found that technology infrastructure and software were the most affected areas, with 75 per cent of respondents reporting threat-related incidents involving these systems.

Physical and industrial infrastructure accounted for 31 per cent of reported incidents, while economic and financial systems and supply chain ecosystems accounted for 29 per cent each.

The findings highlight how businesses are increasingly exposed to threats that can affect multiple systems, extending beyond conventional cyberattacks.

Based on a survey conducted across organisations, sectors and geographies in the first quarter of 2026, the report pointed to a widening gap between the growing complexity of threats and organisations' ability to respond to them.

McKinsey noted that traditional infrastructure, including power grids, water systems, transportation, healthcare and telecommunications, is becoming increasingly dependent on digital technologies such as data centres, cloud platforms and AI computing capacity.

"As these systems become more interconnected, a disruption to one technology provider or platform can cascade across physical infrastructure, supply chains, and essential services," the report stated.

However, organisations have developed stronger capabilities to address cybersecurity and physical security risks than other emerging threats.

Around 98 per cent of surveyed organisations have established capabilities to manage cyber and information technology risks, while 77 per cent have arrangements to deal with risks involving physical and hardware infrastructure.

Preparedness is considerably lower in other areas. Only 59 per cent of organisations have capabilities to manage information and psychological operations risks, while 47 per cent have arrangements to address economic and political coercion. The figure falls to 32 per cent for espionage and covert operations.

This gap is significant as 64 per cent of organisations consider espionage a highly relevant threat to their businesses, the report said.

McKinsey highlighted that espionage and covert operations are often designed to remain undetected, making it difficult for organisations without dedicated capabilities to identify and respond to such threats.

The report also flagged a lack of coordination within organisations, with responsibility for risk management often divided across departments.

While cybersecurity teams typically oversee digital systems, physical security, compliance and enterprise risk management are frequently handled by separate teams.

It noted that budgets, capabilities and accountability often follow organisational boundaries, even as threats increasingly cut across these divisions.

The report called on business leaders to identify areas where their preparedness falls short of the threats they consider relevant and align investments and collaboration accordingly.

It also emphasised the need for an integrated approach to managing risks across technology and physical infrastructure, as growing interdependence between these systems increases the potential impact of disruptions. (ANI)