WEF: CEOs now rank cyber fraud above ransomware as top concern
According to an interview published by Help Net Security, Akshay Joshi, Head of the Centre for Cybersecurity at the World Economic Forum (WEF), says CEOs now rank cyber-enabled fraud and phishing as their top cyber concern, ahead of ransomware. The finding comes from the WEF’s Global Cybersecurity Outlook 2026. There is no vulnerability or CVE involved; this is a survey-based view of risk, not an active incident.
What we know
Joshi describes three forces reshaping cyber risk: AI speeding up the threat landscape, geopolitical fragmentation increasing systemic exposure, and cyber-fraud that has become industrialized. In his words, this changes the speed and scale at which cyber risk unfolds.
The figures he cites from the Outlook are:
- 73% of respondents said they or someone in their network was personally affected by cyber-enabled fraud in 2025.
- 77% reported an increase in fraud and phishing.
- 87% identified AI-related vulnerabilities as the fastest-growing cyber risk.
Joshi also points to the possibility of AI agents operating as independent threat actors, showing goal-directed behaviour and coordinating complex operations in ways that challenge current approaches to governance and defence. He describes this as an emerging possibility, not a confirmed trend.
Who is affected
Joshi argues that fraud hurts customers, employees and organizations and erodes trust in the digital economy. He says addressing it means looking beyond a company’s own network and working across technology companies, financial institutions, telecommunications providers, governments and law enforcement.
The interview also covers a widening resilience gap between large and small organizations and between regions, and the role of skills shortages. The excerpt available to us does not include the detailed figures for these points, so they are not quantified here.
Why this matters
Analysis, not new reporting. Many security programmes are built around ransomware and vulnerability management. If leadership now sees fraud and phishing as the bigger risk, security teams may find budget and board attention shifting toward email security, identity protection and fraud response. Small organizations, which the interview describes as lagging in resilience, may be the least prepared for that shift.
What has not been confirmed
- The interview does not, in the material we reviewed, give a breakdown of how the survey respondents were chosen.
- The possibility of autonomous AI agents acting as threat actors is described as emerging; no specific incident is cited.
- Details of the advice Joshi gives to CEOs and boards were not available to us.
What to do
- Check that your risk register covers cyber-enabled fraud and phishing alongside ransomware, with named owners.
- Review phishing defences: mail filtering, user reporting, and verification steps for payment or account-change requests.
- Add AI-related vulnerabilities to your assessments, as 87% of survey respondents rank them as the fastest-growing risk.
- Agree contacts and escalation paths with your bank, telecom provider and law enforcement before a fraud incident, not during one.
- Smaller organizations should look at shared services or sector groups to close skills gaps.
Read the full interview at Help Net Security for Joshi’s complete comments, including his advice for CEOs and boards, and compare the survey’s framing with your own incident history before changing priorities.
