Cyber survey

An Executive Preview

Cyber Survey 2026: Every Link Matters

Explore key insights from the KPMG Cybersecurity in Belgium report on digitalization, AI, and digital sovereignty in modern corporate governance.Contents

Questions?
Find out more on:
kpmg.com/be/cyber

The illusion of calm

A trend that has emerged in recent months and will presumably continue into the future is the change in how cyberattacks are carried out and the signals with which they appear. Whereas in the past an attack was relatively loud (e.g. ransomware that very quickly brought the organization to a standstill), cyberattacks are now becoming increasingly quiet. But quiet is not a sign of relaxation; rather, it is a clear indication that cyberattacks are becoming increasingly professionalized, sophisticated, intense, and complex.

Quiet attacks underline once more that we are no longer dealing exclusively with classic organized crime. We are experiencing phenomena that occur in combination, such as state or state-sponsored actors working with intelligence or secret services. Perpetrators today act strategically through

espionage and information gathering against research, public, and industrial institutions, but also with disinformation campaigns designed to undermine our trust in institutions and information.

They all have one thing in common: they work more quietly, more patiently, and with a longer horizon. Their success is measured not primarily by quick ransom payment, but by lasting, persistent access. Especially when we think of export-oriented countries like Belgium, with a strong industrial base, high innovation density, and tightly interwoven supply chains, this is no longer an abstract threat. It is a threat that affects competitiveness, challenges the attractiveness of the business location, and at its core raises the question: what remains reliable when systems, data, and decisions come under the pressure of cyberattacks?

More efficient, better, faster?

The past 12 months have shown us that no stone has been left unturned when it comes to cybersecurity and technological development. AI has driven rapid change which, on the one hand, has brought significant benefits by enabling us to automate tasks and perform them more efficiently and interactively given us much pleasure because we can automate tasks and handle them more interactively. On the other hand, it has also shown us how quickly we are at the mercy of attackers. In the long term, AI tools may make the world safer, but in the short term the currently available models create a "Wild West" scenario. The Zero-Day Clock vividly shows the time it takes from the discovery of a vulnerability to its exploitation. In 2025 it was still 23.2 days; in May 2026 we were at 10 hours.

This factor (one fifty-sixth) means we have arrived in a new reality. A reality we have consciously created for ourselves because it makes us faster, more efficient, and more capable. Yet it is precisely this reality that exposes us.

Handing over the helm

Beyond that, we have also decided to surrender our decision-making competence further and further. We let the machine decide for us, including all the consequences that come with it. We are seeing that hallucinations remain the order of the day and that autonomous systems cause ever more headaches when they delete our data and information. But at least they remain polite about it and apologize afterwards for having done so.

This is exactly the world we have created. A world in which we have shown attackers how

quickly we are vulnerable today. In the race against cybercriminals, we have fallen back many places and the momentum clearly lies with the attackers.

Defeating automation with automation

Autonomous systems can already carry out attacks independently and completely. While this is currently confined to laboratory environments, and such environments do not fully reflect the realities of a company with all its dependencies and complexities, the recent Hugging Face incident has shown that autonomous hacking is already a reality today.

What does that mean for us? We must counter automation with automation and automate tasks that are still performed manually or require significant coordination. Is that always easy? No. But this shift in

thinking is necessary for organizations. Seemingly unremarkable measures, such as maintaining good cyber hygiene across the infrastructure, become a lifeline. Organizations must be able to respond more quickly to potential cyberattacks, not only to meet regulatory reporting obligations. Automated responses to cyber incidents should also become standard practice.

Too late, too slow, too comfortable?

Automation and AI are not the answers to all problems; they are solutions but can also create problems at the same time. This rethinking must take place not only among companies but also among manufacturers. At present, security is very often tied to manufacturers' specifications to meet guarantee and warranty requirements, which permit only certain software versions levels. Given the current dynamics, this is no longer viable in the long run.

In other words, cooperation is therefore needed on all sides to find a solution. Speed is the top priority for everyone.

Attacks succeed where defense is too late, too slow, or too comfortable. That is no reason for alarmism, but a good reason for cybersecurity to mature. In the end it is as it so often is: those who play for time in the face of such developments, will eventually be overtaken by the pace. The threat is not new. What is new is the speed at which we now have to explain why it has once again been was underestimated.

Trust becomes a decision criterion

Finally, greater trust in AI is needed, especially when it comes to the integrity and immutability of information. We will have to conduct this integrity debate more intensively than ever over the next twelve months because, despite the advantages AI

offers for making autonomous decisions, it can on the flip side also alter existing information.

At this point, the appeal is that: we should not always regard AI as the miracle tool par excellence. Notwithstanding its many strengths, at the end of the day these are simple algorithms and processes that we already know from the past and that are now, dressed up with a new ribbon, presented as promising cure-alls. Even the most conventional medicines have side effects, for which one must consult the package leaflet, doctor or pharmacist. Exactly the same is necessary in the field of AI. Agent-based systems can completely undermine a well-intentioned network segmentation at a stroke, throwing us back into flat structures and thereby disabling our existing cybersecurity and risk management measures.

Digital sovereignty put to the test

We have arrived in an age in which establishing who is on the other side is becoming increasingly difficult. AI, in the form of deepfakes, is making a significant contribution to this trend. At the same time, new vulnerabilities are being identified in systems that were previously unknown. In other words, the exclusive targeting of humans as the entry point is shifting; instead, technological vulnerabilities in both hardware and software are coming into the crosshairs.

Technology is also moving to center stage at another level, as technological progress requires innovation, competencies and sovereignty in the digital domain. It is precisely this sovereignty, or the lack of it, that challenges us.

The power-projection capabilities of technology companies and platform operators, whether from East or West, hold up a mirror to Europe’s digital position: Belgium and Europe, remain significantly dependent on technologies and ecosystems that are increasingly influenced by geopolitical developments.

In a tight spot

In cybersecurity we recognize three fundamental protection objectives: confidentiality, which concerns keeping information inaccessible to third parties; integrity, which refers to the accuracy, immutability, and trustworthiness of data and is coming under increasing pressure, particularly from AI; and availability of information, which is gaining renewed importance in the context of digital sovereignty.

At first glance, digital sovereignty may appear to be primarily a technology-policy topic. On closer inspection, however, it becomes clear that it has a direct impact on cybersecurity, in particular on the protection objective of availability. If services, platforms and cloud solutions become unavailable from one day to the next, companies face significant operational and existential challenges.

"Cybersecurity is the conscious decision to put reliability above convenience, traceability above mere speed and responsibility above technological novelty."

Such unavailability may result from technical failures, but it can also be used as an instrument of geopolitical influence or power projection.

Recent examples in Europe have demonstrated how quickly personal displeasure can lead to individuals or entire institutions being completely denied access to technologies. The same effect may also occur through economic means, for instance when license or subscription costs for individual regions or countries are significantly increased, often in connection with political pressure. And switching to an alternative provider is not something companies can accomplish overnight. Digital sovereignty is therefore more than a pure technology topic. It is a topic of resilience, of security and of the long-term viability of domestic companies.

Stormy seas

Trust, reliability and sovereignty

As a society, we are learning that the operating environment is becoming increasingly challenging as a result of technological innovation and the constantly evolving nature of cyberattacks. To strengthen resilience and limit the impact on society, value chains, and supply chains, legislators and regulators are responding with a growing body of regulation. This is reflected in the Cybersecurity Act (and its future evolution as CSA2), DORA for the financial sector, NIS2 for essential and important entities, the Cyber Resilience Act (CRA) for product manufacturers, the Critical Entities Resilience Directive (CER), and the AI Act. Together, these initiatives aim to enhance resilience, improve security, and foster trust in digital technologies among organizations and the public. For some organizations, meeting these requirements is a substantial undertaking.

It is nonetheless the logical consequence of a digital economy in which local instability can propagate rapidly and a single dependency can disrupt an entire chain. Regulation exists to contain that propagation. It becomes effective only when organizations understand what is expected of them and when regulators apply the rules in a proportionate and pragmatic manner. With these requirements, cybersecurity moves from a technical discipline governed by standards to a legal obligation governed by supervisory authorities.

One thing is clear: the requirements imposed by regulation are demanding. However, they are requirements that companies can and must fulfil and they remain far removed from any excessive demands (the often overused "gold-plating") . Rather, the aim is to enable the proper, secure and stable operation of

digital network and information systems and of critical (digital) infrastructures. The fact that shortcomings from the past, often referred to as "digital debt", cannot be resolved overnight and may at times conflict with the digitalization initiatives that organizations pursue with agility and an innovative mindset, is beyond dispute.

Perhaps that is the real lesson of this era: not every crisis announces itself loudly. Some emerge quietly, in small shifts, in dwindling reliability, in decisions that still appear plausible even though their foundation has long since become fragile. A digital society rarely fails because of what it cannot do, but because of what it has relied on too carelessly for too long. That is precisely why cybersecurity today is more than protection against attacks. It is the conscious decision to put reliability above convenience, traceability above mere speed and responsibility above technological novelty.

Discover what the data reveals and uncover opportunities you won't want to miss.

Get access to exclusive research, expert analysis, and actionable insights. Explore the study to understand what's driving change and growth in the market.

Click here to download the study