87% of Firms Hit by Threat Incidents, but Major Preparedness Gaps Persist: McKinsey
A McKinsey report reveals 87% of organisations faced threat-related incidents, highlighting critical gaps in espionage and coercion preparedness.
A startling new report by McKinsey & Company has revealed that 87 per cent of organisations experienced at least one threat-related incident in the 24 months leading up to a recent survey. While businesses are increasingly targeted, the study warns of a dangerous disconnect between the evolving complexity of these threats and the actual ability of organisations to respond to them.
Where are the attacks hitting hardest?
The research indicates that the digital backbone of modern business is the primary target. Technology infrastructure and software were the most vulnerable areas, with 75 per cent of respondents reporting incidents involving these systems. However, the threats are not limited to the virtual world.
The report detailed a broader spectrum of vulnerabilities:
- Physical and Industrial Infrastructure: Affected 31 per cent of organisations.
- Economic and Financial Systems: Impacted 29 per cent of respondents.
- Supply Chain Ecosystems: Also reported incidents in 29 per cent of cases.
The Danger of Interconnectivity
Based on a survey conducted across various sectors and geographies in the first quarter of 2026, McKinsey highlighted a worrying trend: the blurring line between digital and physical worlds. Traditional infrastructure—including healthcare, telecommunications, transportation, water systems, and power grids—now relies heavily on AI computing capacity, cloud platforms, and data centres.
"As these systems become more interconnected, a disruption to one technology provider or platform can cascade across physical infrastructure, supply chains, and essential services," the report stated.
The Preparedness Paradox
The report reveals a significant disparity in how companies prepare for different types of risks. While most organisations have mastered the basics of cybersecurity, they are largely blind to more sophisticated, non-conventional threats.
The Strong Suits:
- Cyber and IT Risks: 98 per cent of organisations have established capabilities to manage these.
- Physical and Hardware Infrastructure: 77 per cent have arrangements in place.
The Critical Gaps:
Preparedness drops sharply when it comes to psychological and political warfare. Only 59 per cent of organisations can manage information and psychological operations risks, and a mere 47 per cent are equipped to handle economic and political coercion.
The most alarming gap exists in the realm of espionage and covert operations. Only 32 per cent of organisations have the capabilities to address these threats, despite 64 per cent of businesses considering espionage a highly relevant risk. McKinsey noted that because covert operations are designed to stay hidden, organisations without dedicated tools are often unable to even identify that they are under attack.
Siloed Defense: The Internal Struggle
Beyond external threats, McKinsey flagged a systemic internal problem: a lack of coordination. Risk management is frequently fragmented across different departments, creating "blind spots" in security.
Currently, cybersecurity teams typically handle digital systems, while separate teams manage compliance, physical security, and enterprise risk. The report points out that budgets and accountability usually follow these rigid departmental boundaries, even though modern threats easily cut across all these divisions.
The Call to Action
McKinsey is urging business leaders to stop viewing security through a narrow lens. The report calls for an integrated approach to managing risks across both technology and physical infrastructure. Leaders are encouraged to identify where their current preparedness falls short of the threats they perceive as relevant and realign their investments and collaborations to close those gaps.