As the EU marks Cybersecurity Month, a new analysis warns that European businesses are facing a broader and more complex security landscape than ever before. While phishing emails and malware attacks remain a daily nuisance, the real danger now extends far beyond the digital realm, encompassing physical threats to executives, insider sabotage and the unpredictable fallout of political polarisation.
A European Commission survey released for Cybersecurity Month found that three in four employees encounter suspicious emails, messages or links at work, with 39% reporting phishing attempts or fake websites designed to steal credentials. A further 18% said they had faced attempts to steal personal data, 17% experienced malware attacks, and 16% reported attempts to obtain passwords. Yet these figures, alarming as they are, only scratch the surface.
From cyber to physical: the expanding threat matrix
Marcelo Rodriguez, President of the International Security Management Association (ISMA), argues that companies, their senior executives and employees are now vulnerable on a wider number of fronts than at any point in recent memory. Threats come not just from organised crime syndicates or rogue states, but increasingly from lone individuals or small groups that are far harder to identify. The risks range from cyberattacks to the kidnapping or abduction of staff on business trips.
Insider threats are a particular concern. A Ponemon Institute report last year found that the average total cost of insider threat incidents rose by roughly 135% between 2018 and 2025. While North American companies still bear the highest financial burden, with an average annual cost of $24 million, Europe ranks second globally at $18.6 million per year.
Physical violence against business leaders is also on the rise. The 2024 shooting of UnitedHealthcare CEO Brian Thompson in the US was a stark reminder, but Europe has its own examples, such as the attempted kidnapping of the daughter of French cryptocurrency executive Pierre Noizat. An ISMA survey of chief security officers found that more than half reported their executives or their families receiving up to nine direct threats of harm each year, whether online, by phone, in writing or in person.
The digital age has made these threats harder to predict. Even if a CEO maintains a minimal online presence, a family member's social media activity can unwittingly expose a trail that malicious actors can exploit. Public records and AI-enabled research tools have made it easier to obtain personal information; one study of executive vulnerability assessments found publicly discoverable home addresses in 94% of cases.
Rodriguez, a former police officer, notes that the path to violence used to be more predictable. “Today, risks are increasingly hard to map,” he says. “Who would have predicted the threat to the UnitedHealthcare CEO would come from an Ivy League graduate who was top of his class?”
Economic pain and political polarisation fuel instability
One theory is that economic hardship and political grievances are converging, with businesses becoming the most visible and accessible symbols of discontent. An Allied Universal report surveying over 2,300 security chiefs in 31 countries found that 44% expected economic instability to be the top security hazard in the coming year.
Political polarisation is also heightening risks. A 2024 report for Littler, an employment law practice, found that 86% of European employers face at least some difficulty managing divisive political beliefs in the workplace, up from 75% a year earlier. The upcoming Spanish general election, for instance, is unfolding against a backdrop of deep polarisation and social tension. Highly charged political rhetoric can lead people to transfer their emotions onto businesses or their leaders, whom they may see as complicit.
To address these challenges, companies need to map potential “trigger points” – events or announcements that could spark a threat or attack. A profit announcement, a decision not to fund research into a new drug, or a CEO's public stance on a political issue can all ignite strong reactions. AI can play a major role in this effort, from CCTV object recognition and facial recognition to social media monitoring and predictive analysis that detects emerging patterns.
As Europe marks Cybersecurity Month, the message is clear: cyber risks are increasing, but so too are the broader threats. European businesses, their executives and their employees face a security environment that is more complex and more dangerous than ever before. For more on how the continent is grappling with hybrid threats, see our analysis of a proposed European Security Council and the Brussels push for a new security body. Recent incidents, such as the cyberattack on French supermarkets, underscore the real-world impact of these vulnerabilities.
