The cyber risk framework protecting your organization wasn't built for this adversary | Tech Radar

Overview

News, deals, reviews, guides and more on the newest computing gadgets

Start exploring exclusive deals, expert advice and more

Details

Unlock and manage exclusive Techradar member rewards.

Unlock instant access to exclusive member features.

Get full access to premium articles, exclusive features and a growing list of member rewards.

The cyber risk framework protecting your organization wasn't built for this adversary

When geopolitical actors attack, most cyber risk frameworks can't see it

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

(Image credit: sarayut Thaneerat/ via Getty Images)

The conflict in the Middle East has entered a new phase, but the cyber threats remain. Geopolitical threat actors have been targeting critical infrastructure across sectors.

With security agencies issuing warnings of attacks exploiting energy, water and government facilities in the U. S., it’s clear that organizations far from the battlefield remain in scope.

SVP of Risk and Threat Exposure Management at Dataminr.

Those aren’t the only industries impacted by the threats. Earlier in the conflict over 150 retaliatory hacktivist incidents slammed the financial sector almost immediately. Most of the organizations affected were responding with cyber risk frameworks built for a different adversary.

When confidence becomes a risk: The gap between cyber resilience readiness and reality

AI-driven cyber discovery signals a new era of systemic risk for banks

The war in Iran is reaching cyberspace - here’s how to prepare

While criminal actors optimize for profit: gain access, steal data, encrypt systems, collect payment. Geopolitical actors follow a different logic. Their goal is to undermine trust in critical systems, disrupt operations and create uncertainty.

The old 'detect and respond' approach isn't enough anymore. If you wait for an attack to happen, you’re already behind. Real resilience is about spotting the threat early and fixing the vulnerabilities that allow an attack to work in the first place.

This requires a new way of calculating risk. The industry has long used a static formula: Risk = Threat x Exposure x Impact. That formula is no longer sufficient because it ignores the variable of time.

We have to factor in how fast attackers move compared to how quickly we can stop them before they strike. Projections indicate that the time to exploit a new vulnerability will soon drop from days to minutes. A manual response process cannot compete with a ten-minute exploitation window.

Using the financial sector as a case study, we can quantify the potential harm these geopolitical cyber threats pose. Proprietary Dataminr cyberloss data shows that the mean loss for a serious cyber incident at a mid-size bank with

The mean loss per serious incident for financial institutions in 2024 reached $41.8M — the highest ever recorded. Organizations cannot outspend the threat, so they have to out-prioritize it.

Current risk frameworks were built to measure breach costs, recovery time, and data loss. Geopolitical campaigns are designed to produce outcomes those metrics do not capture: payment uncertainty, confidence erosion, and operations built to look like noise until the damage is visible.

From boardroom risk to deal flow: why cyber M&A is accelerating in 2026

The shocking reason 43% of UK businesses have been hit by cyber attacks last year

Why our national sovereignty depends on cyber resilience

Geopolitical-style intrusions are harder to detect because the attacker behaves like a patient operator. They rely on legitimate credentials, trusted vendor access, and low-volume actions that register as normal operational activity.

Standard playbooks work for simple attacks with a clear start and end. Geopolitical threats are different; they are patient and use distractions to wear you down while they hide their real objective.

This puts pressure on the seams between technical response and business continuity, particularly for small and medium-size organizations.

Making decisions about operations, customer communications, payment flows, and vendor coordination under sustained uncertainty is the real challenge.

Most organizations have workable controls and solid compliance programs. What they typically cannot answer is which specific exposures matter most against the adversaries active right now, and which business services get disrupted first if those exposures are exploited. Three adjustments matter most:

Adopt a threat-informed model Instead of just listing technical flaws, look at how an outsider could actually use them to get in. Your risk reports should focus on the three biggest threats to the business this quarter, not just a tally of how many patches you've installed.

Test for business disruption Practice for a shutdown, not just a data leak. You need to know ahead of time if you’re willing to pull the plug on a critical system before you’re even 100% sure it’s been hacked. That’s a business call, not a technical one.

Map supply chain exposure Across every industry, your biggest risk is often the partners you trust most. You need to know exactly which vendors have deep access to your payments or data. Don't wait for an annual check-up to see if that trust is being abused—you need to be watching for it in real time.

The era of treating cyber risk as a separate IT problem is over. As geopolitical tensions continue to spill into digital systems, the goal for business leaders is no longer just “security,” but operational persistence.

Moving to a threat-informed strategy helps organizations stay ahead of politically-motivated attackers instead of just reacting to them.

This article was produced as part of Tech Radar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of Tech Radar Pro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

SVP of Risk and Threat Exposure Management at Dataminr.

You must confirm your public display name before commenting

1 Newly drafted EU cloud rules could stop US hyperscaler access to critical tenders

2 Peak Design launches four travel bags for photographers — and I'm tempted

3 Nvidia claims RTX Spark laptops will offer all-day battery life

4 How to watch The Vardys online for free: stream reality TV series from anywhere

5 From code-first to intent-first: Microsoft Build 2026 could be the end of programming as we know it

Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.

© Future US, Inc. Full 7th Floor, 130 West 42nd Street, New York, NY 10036.

Key Takeaways

• News, deals, reviews, guides and more on the newest computing gadgets
• Start exploring exclusive deals, expert advice and more
• Unlock and manage exclusive Techradar member rewards
• Unlock instant access to exclusive member features
• Get full access to premium articles, exclusive features and a growing list of member rewards