By Marc Minar, Partner, Technology Consulting | EY Switzerland
As chief information security officers and cybersecurity experts, you stand at the forefront of a digital battleground where the stakes have never been higher. Cybercrime is projected to drain $10.5 trillion from the global economy by 2025, with attacks striking every 39 seconds — over 2’200 times daily. The rapid pace of digital transformation, fueled by artificial intelligence (AI) and cloud computing, offers immense opportunities but also opens new vulnerabilities.
As a proud sponsor of the Global Cyber Conference 2025 in Zurich, EY Switzerland is committed to advancing the conversation on future cyber resilience. This editorial dives into the state of cybersecurity today, the challenges we face, and the practical steps we must take to build a secure, adaptable digital future.
The cybersecurity landscape in 2025
We are navigating a world of unprecedented connectivity. By 2030, an estimated 200 billion devices will be linked globally, creating an ever-expanding attack surface. Supply chain attacks have skyrocketed, surging by 431% between 2021 and 2023, with projected losses reaching $130 billion by 2031. The average data breach now costs $4.88 million, up 10% from last year, reflecting the growing sophistication of threats. From AI-driven phishing schemes that mimic trusted voices to cloud misconfigurations exposing sensitive data, the risks are evolving faster than many organizations can keep up with.
Here in Switzerland, we’re faring better than most, but the challenge remains steep. The EY Cybersecurity Leadership Insights Study shows 57% of Swiss CISOs feel confident in their ability to tackle future threats, compared to 46% globally. Swiss organizations detect incidents in under five months — faster than the global norm of over six months. Yet, cloud security worries 39% of our CISOs, and AI-related risks concern 36% primarily, with 54% citing it as a secondary issue. These numbers tell a clear story: preparedness is a start, but resilience demands more.
The challenges ahead
The road to resilience is filled with challenges. AI, for all its promise, is a double-edged sword. It powers smarter defenses but also enables attackers to craft hyper-realistic phishing emails or exploit vulnerabilities at scale. Cloud adoption, now a cornerstone of business agility, introduces risks like misconfigured servers and weak access controls, which account for a significant share of breaches. Supply chain vulnerabilities are another headache — 61% of Swiss CISOs, according to the EY study, see third-party risks as a top concern. Add to that the human factor: social engineering continues to exploit trust, and the cybersecurity talent shortage makes it harder to build robust defenses.
Regulatory demands are also reshaping the landscape. The Digital Operational Resilience Act (DORA), now in effect and mandatory since January 2025, pushes organizations to strengthen ICT risk management and third-party oversight. Compliance alone is not enough; it must be paired with a mindset that prioritizes long-term security over short-term fixes. These challenges — technological, human, and regulatory — require us to rethink how we protect our digital ecosystems.
Building a resilient future
So, how do we rise to the occasion? First, we need to embrace zero-trust principles. This means verifying every user, device and transaction, no matter how trusted they seem. It is about building security into every layer of an organization, from code to culture. Strong data governance is just as critical. Our work on AI risks underscores the need for tight access controls, encryption and regular assessments to protect sensitive information, especially in AI-driven systems where a single flaw can cascade into major disruptions.
We can also turn AI into an ally. Half of the organizations participating in the study plan to use AI for third-party risk assessments, and 65% aim to ramp up co-sourcing in the next few years, according to the EY DORA insights. AI can spot threats faster than any human, analyzing patterns to catch anomalies in real time. But we must implement it carefully — immature AI tools can create new vulnerabilities if not properly vetted. Beyond technology, resilience means preparing for the inevitable. Regular assessments, proven and robust incident response plans and cross-team collaboration ensure we can bounce back quickly when breaches occur.
Finally, we must think globally. Cyber threats do not respect borders, so sharing intelligence and best practices is essential. Events like this conference foster the information exchange and collaboration needed to stay ahead. Investing in people is equally vital — training teams, nurturing talent and fostering a security-first mindset will empower organizations to tackle tomorrow’s challenges.
A call to lead
The path to future cyber resilience is not easy, but it is within our grasp. As leaders in this field, you have the opportunity — and the responsibility — to shape a world where digital systems are secure, adaptable and trusted. The Global Cyber Conference 2025 is your chance to connect, learn and drive meaningful change. Let us come together to build a future where resilience is not just a goal, but a reality.
