Insight

CEOs now rank cyber as the top risk to growth. What should they buy first?

KPMG's 2026 Global CEO Outlook finds 31 per cent of 1,400 CEOs name cyber and data security as the greatest risk to growth, and 45 per cent have increased investment. The harder question is where that money should go.

What KPMG found

On 15 October 2026, KPMG published its 12th annual Global CEO Outlook, based on a survey of 1,400 chief executives conducted between 11 August and 21 September 2026. Every respondent leads a company with annual revenue above US$500 million, and a third lead companies with more than US$10 billion.

The headline is clear. 31 per cent of CEOs name cyber and data security as the greatest risk to growth over the next three years, ahead of global economic uncertainty (28 per cent) and geopolitical instability and regulatory pressures (26 per cent).

CEOs are acting on it. 45 per cent say they have increased investment in cybersecurity and digital risk resilience. 59 per cent are placing greater focus on internal data governance and controls as part of their AI and data sovereignty strategies. And 52 per cent name cybersecurity as a leading challenge in implementing AI, second only to ethical concerns (57 per cent).

Why this matters

This is a notable shift. Cyber risk has moved from a technology line item to the risk chief executives believe is most likely to hold back growth. Unlike the economy or geopolitics, it is also one of the risks a board can directly influence.

But a bigger budget is not the same as a better outcome. Much of the money spent on cyber security goes on more of the same: more software, more monitoring, more layers placed around systems that remain permanently connected. Those controls matter. They also share a common assumption, that the organisation can keep defending a path which is always open.

The question boards should ask

The useful question is not "how much more should we spend?" It is "what must still be trustworthy on the day our connected estate is not?"

For most organisations, the answer is a short list: the records, recovery copies and critical data without which the business cannot operate, prove its position or meet its obligations. KPMG's finding that 59 per cent of CEOs are tightening internal data governance points the same way. Governance starts with knowing what that data is, where it lives and who, or what, can reach it.

Resilience the CEO can point to

KPMG also reports that CEOs see faster decision making under pressure (47 per cent) and the ability to identify, prioritise and manage risk (39 per cent) as increasingly essential leadership skills. Both depend on evidence. A CEO deciding how to respond to an incident needs to know which data has remained beyond the attacker's reach, not simply that controls were in place.

That is the thinking behind Offline Secure Storage® from Firevault. Dedicated storage stays physically disconnected by default and is reached only through an authorised, identity-verified session. When nobody needs the data, there is no standing network path to it. It is not a replacement for good security practice, and no single technology removes every risk. It gives the board something it can verify: a clean copy held outside the environment under attack.

For connected operations that cannot simply be switched off, Control by Firevault applies the same principle to network paths, third-party access and isolation decisions.

The takeaway

KPMG's survey confirms that chief executives now see cyber risk as the principal threat to growth. The organisations that turn that concern into resilience will be the ones that spend first on protecting what they cannot afford to lose, and on being able to prove it.

Physics, not promises.

Source: KPMG International, "CEOs make cybersecurity top investment priority after naming it greatest risk to growth", 15 October 2026. Figures quoted are KPMG's survey results.

Sources and reporting notes

1. kpmg.comPrimary reporting referenced in this analysis.

Incident facts are attributed to the named sources; the recommendations and product discussion are Firevault analysis by Mark Fermor.