How geopolitics is rewriting digital risk

How can organisations prepare as global conflicts expand beyond kinetic conflict and into cyber disruption?

Nation-state cyber attacks used to require deep pockets, cutting-edge expertise and highly targeted spying tactics. Innovative digital assets were used sparingly; as if discovered, the investment was lost and developers had to start over from scratch.

Today, the changing state of global geopolitics has dismantled this traditional nation-state cyber playbook. Hostile nation-states are shifting away from centralised, cautious spying towards a much more volatile, blatant and unpredictable model of tactical attacks and system infiltration, which can result in company networks finding themselves on the front line of international encroachment and revenge¹.

“The recent telecom breaches² show where state-backed actors are focusing: the infrastructure that connects us all. Organisations need to look beyond their own perimeter and understand the security of the ecosystem they depend on.” 
Francisco Donoso, Chief Product & Technology Officer, Beazley Security

Furthermore, the accessibility and automation capabilities of AI tools and open-source code generators mean that access and attacks are no longer constrained by human coding capabilities. Instead, attackers are constrained by the strength and scale of their compute power³.

A shift from subterfuge to chaos

Stealthy espionage is likely to continue within organisations that involve valuable intellectual property and political intelligence such as IT providers, research and academia entities, government agencies, and think tanks/NGOs, to intercept intellectual property and political intelligence⁴. However, state-sponsored cyber risk will likely gravitate towards loud, destructive disruption over covert subterfuge.

Case in point – driven by political payback, an Iranian-linked group called Handala used destructive software to wipe out thousands of devices within a single US-based company as a form of retaliation during a conflict⁵.

These types of disruptive attacks are now also increasingly exploiting decades of under-investment in utility infrastructure⁶. For example, municipal water plants and regional electricity grids – built when local utilities went overlooked as targets of global dispute – have become vulnerable marks for geopolitical retaliation by adversarial nations.

The fractured reality of adversary operations

When protecting a company, traditional risk planning assumes that adversarial nations operate like single, highly coordinated armies following a logical chain of command. The reality of modern geopolitical conflict is entirely different:

• Hostile states do not operate as single units: Their cyber operations are often fractured into competing military factions, local university labs and state-sanctioned freelance criminals who often fight for control⁷ and resources⁸.
• Any business can be a functional target: Because these decentralised groups chase their own local goals and quotas, their behaviour can be unpredictable⁹. Businesses cannot assume safety just because they lack obvious military or political value.
• Uncoordinated attacks create unpredictable damage: A freelance group or state-sponsored cell trying to make a quick political point may not care about long-term stealth. They can use automated AI tools to cause immediate operational friction, turning corporate networks into collateral damage in wider global disputes¹⁰.
• Defence must shift from prevention to resiliency: Because organisations cannot predict the logical next step of a fractured adversary, they cannot rely on blocking them at the perimeter. Their strategy must focus on containing the impact radius when an unpredictable attack happens.

Rethinking cyber resilience

Since AI can automate network probing 24/7, simply being safer than the organisation next door is no longer enough. If effective cyber defences and risk management are not embedded organisation-wide, even a single phishing incident could materially destabilise operations, which can expose system-wide unpreparedness, rather than just individual employee carelessness.  

While geopolitical cyber threats, spurred by conflict and power play, may be unavoidable, organisations can strengthen their resilience by hardening their monitoring, configuration and infrastructure, and building multi-layered controls to help ensure a mid-level attacker cannot wipe out digital operations.

"Insurance can help boards to ask themselves the right questions about their risk profiles. So that instead of looking at geopolitical risk as a power competition that their businesses courting, these boards are understanding that they are strategic actors with agency. Trying to reframe these abstract political concepts as operational issues is probably the most actionable thing that organisations can do."

Dr Ahana Datta Fasel, Geopolitical, technology and systemic risk adviser and Beazley Geopolitical Council Member

Modern geopolitical tensions are increasingly being played out in cyberspace, turning ordinary networks into potential targets and battlegrounds for state-backed actors, hacktivists, and other politically motivated attackers. To withstand the disastrous, long-term impacts of disruption – ruined reputation, operations halted, snowballing costs, societal impact – businesses must meet these unpredictable threats with strong defences, and long-prepared and adaptive response plans, backed up with quality, service-led cyber insurance to be battle ready if the worst should happen.