Europe’s businesses face more security threats than ever before

As Euronews reported this week, the extent of cyber threats impacting Europe’s businesses are manifold.

ADVERTISEMENT

ADVERTISEMENT

According to a survey carried out for the European Commission to mark the EU’s Cybersecurity Month, three in four employees are encountering suspicious emails, messages or links whilst at work, with 39% saying they have received phishing messages or been directed to fake websites designed to steal data or gain unauthorised access.

A further 18% report attempts to steal personal data, 17% said they had experienced malware attacks, while 16% reported attempts to obtain passwords.

Threats from organised groups or rogue states

But while the risk of cybercrime continues to attract most of the attention in terms of what companies should be concerned about in the way of threats, it is just the tip of the iceberg when it comes to the range of corporate security issues that Europe’s businesses – and their leaders – face today.

Companies, their senior executives and employees are potentially more vulnerable on a wider number of fronts than ever before.

This includes threats from organised groups or rogue states, with the risks including not just cyberattacks but, for example, the danger of staff being kidnapped or abducted while on business. Bad state actors and large organisations are not the only sources of risk either: companies now potentially face an increasing number of threats from lone individuals or smaller groups, which can be much harder to identify.

Insider threats from disgruntled current or former employees

This includes the likes of insider threats from disgruntled current or former employees. According to a report last year by Ponemon Institute, the average total cost of insider threat incidents increased by around 135% between 2018 and 2025. And while companies in North America continue to suffer the highest financial impact from insider incidents, with the average annual cost of insider-related activities in this region costing $24.0 million in 2025, globally Europe ranks second with average annual costs of $18.6 million.

Another concern is an increase in violent threats to CEOs and senior executives and even their families. While the tragic shooting of UnitedHealthcare CEO Brian Thompson in the US in 2024 is perhaps the case most people remember. Europe is not immune to such threats with last year’s attempted kidnap of the daughter of Pierre Noizat, the French cryptocurrency chief, as a recent example.

Executives and their families face threats of physical violence

The growing risk on this front is also borne out by a survey from the International Security Management Association (ISMA), a global body representing the senior security executives of major corporations. More than half of the chief security officers surveyed reported that their organisation’s senior executives, or their families, received up to nine online, telephone, written or other direct threats of harm each year.

In today’s increasingly digital world, the risks have become greater because even if a CEO does not leave a digital footprint, a family member posting on social media can unwittingly leave a trail that can be exploited by someone posing a threat. Public records and AI-enabled research have also made it easier to obtain information about employees, executives and their families, with one study of executive vulnerability assessments finding publicly discoverable home addresses in 94% of cases.

Today, risks are increasingly hard to map

Such threats to business leaders are getting more difficult to foresee. When I was a police officer, the escalation to violence was usually a path you could track as it came from fairly predictable sources.

Today, risks are increasingly hard to map. Who would have predicted the threat to the UnitedHealthcare CEO would come from an Ivy League graduate who was top of his class?

Why are the threats from hard-to-predict sources increasing?

One theory is that economic pain and politics are fusing for many people, and business can represent the nearest visible and accessible symbol. Indeed, a report earlier this year by Allied Universal surveying more than 2,300 security chiefs in 31 countries found 44% were expecting economic instability to be the top security hazard in the year ahead.

Political polarisation fuels instability, increasing business risks

The increasingly polarised nature of politics today also creates a febrile environment, heightening the risks to business.

A 2024 report for Littler, an employment and labour law practice, found 86% of European employers face at least some difficulty managing divisive political beliefs at work, up from 75% a year earlier. The upcoming Spanish general election, for instance, is taking place against a backdrop of deep political polarisation, intense civic unrest and heightened social tensions.

Highly-charged political rhetoric may mean people transfer emotions onto businesses, or their leaders, that they feel are complicit.

How should businesses address such challenges? Good practice is detailed mapping of potential “trigger points”. Company announcements or external events can stir up emotions that could potentially be a catalyst for a threat or attack on a company. This could include, for instance, a company’s profit announcement or a decision not to fund research into a new drug. In a similar way, a CEO seen to be engaging in a political issue may ignite strong emotions in a potential attacker.

AI can play a major role in identifying risks and enhancing security

Because of the difficulty and time commitment required in terms of mapping the breath of risks today, AI can also play a huge role. It can be widely used in areas such as CCTV object recognition, facial recognition, social media monitoring, weapon detection and predictive analysis in terms of detecting patterns and emerging threats.

So, as Europe marks cybersecurity month, we should not forget that while cyber risks are increasing, so too are the broader threats. Europe’s businesses, their executives and their employees face the most significantly elevated risk environment ever. Security concerns need to be at the top of the corporate agenda.

ISMA is a global membership organisation comprising top senior chief security officers (CSOs) who represent multinational organisations across a range of industries. Founded in 1983, its members – around 375 in total – comprise 25 companies in the FTSE 100, DAX and CAC 40, together with a majority of the Fortune 100 and 25% of the Fortune 500. It includes representatives from global brands such as MetLife, S&P Global, Sky, Four Seasons, Unilever and Novo Nordisk.