Polish infrastructure in the crosshairs. Companies are preparing for a lack of energy and internet

Although the most frequently mentioned scenario in the risk analysis is the loss of a key cloud service provider (37 percent), 26 percent companies pay attention to hybrid warfare and sabotage – according to the KPMG study “Cybersecurity Barometer 2026”. 36 percent companies take into account the long-term lack of energy.

As stated, the range of threat scenarios included in risk analyzes as part of business continuity management shows how well organizations prepare for systemic and long-term events.

“The threat scenarios most frequently indicated in risk analysis are: loss of a key cloud service provider (37%) and long-term lack of electricity (36%). 29 percent surveyed companies include a long-term lack of Internet access among the threat scenarios. At the same time, every fourth respondent (26%) draws attention to hybrid warfare and sabotage,” it was written in the release dedicated to the report “Cybersecurity Barometer 2026. Cyber ​​Resilience in an Era of Changes”.

“Further threats taken into account in company risk analyzes are: technological supply chain failurese.g. infected updates (23%), extensive ransomware attack (21%), and 16%. respondents also take into account the risk of a full-scale armed conflict,” it was further written.

As KPMG emphasized, the scale of preparations still does not keep pace with the pace of changes in the security environment, in which digital infrastructure is becoming one of the first targets of destabilization.

“A full-scale war scenario appears in risk analyses. Every fourth organization is preparing for risks related to hybrid warfare and sabotage. The simultaneous loss of all data processing centers as a result of sabotage activities becomes a real threat. That is why we are observing, among others, accelerated adoption of the public cloud, also for security purposes,” said Michał Kurek, Partner, Advisory, Head of the Cybersecurity Team at KPMG in Poland and Central and Eastern Europe, quoted in the release.

The report also indicates a two-fold increase in the number of organizations with a dedicated CISO (Chief Information Security Officer), while the lack of involvement of top management was the most important barrier to building effective cybersecurity.

KPMG also indicated that the cyber resilience mechanisms declared by the respondents focus primarily on organizational and process solutions. 46 percent respondents declare the implementation of a supply chain security management program in the form of a supplier audit, 35 percent companies prepare comprehensive business continuity plans (BCP), and 30 percent conducts regular risk analyzes in the area of ​​cybersecurity and business continuity.

“Hackers acting alone remain the greatest threat to companies – 46 percent indicated them. respondents. Cyberterrorists came second (35%), and hacktivists third (24%). In this year's edition of the study, phishing was again recognized as the cyberthreat generating the most serious operational risk – ahead of, among others, attacks exploiting errors in applications and data theft by employees,” the statement said.

As reported, in 2026 companies plan to focus their budgets primarily on protection against malware, employee awareness programs and internal network security. The importance of investing in managing the security of business partners has also increased significantly, reflecting growing regulatory pressure.

The report “Cybersecurity Barometer 2026. Cyber ​​Resilience in an Era of Change” was developed by KPMG in Poland on the basis of a survey conducted using the CATI method in December 2025 among 100 people responsible for IT security in organizations operating in Poland. The sample included small (30%), medium (50%) and large (20%) enterprises representing 16 industries. (PAP Biznes)

tom/ana/