Preparing governments for an era of interconnected cyber risk

Government agencies and services were the most impacted sector by cyber threats in 2026, accounting for 27% of observed activity, up from 17% in 2025. Governments are primary targets for nation-state activity due to the sensitive information they hold and their role in critical infrastructure networks. Dwell time, the period between access and detection, increased across multiple sectors. Phishing accounted for 23% of observed intrusions in 2026, up from 7% in 2025, indicating compromised identities are a significant entry point.
The findings suggest that security in the AI era requires shifting focus from preventing single intrusions to ensuring institutional resilience against interconnected risks where threats move faster and remain hidden longer. To achieve this, governments should prioritize five areas: preparing for a faster threat environment by establishing clear responsibilities, integrating security into the AI ecosystem through secure-by-design practices, planning for incident spread by understanding how compromises can evolve across entities, enabling timely public-private information sharing through bidirectional trust, and ensuring essential services can operate despite disruption. Success in this new landscape relies heavily on public-private partnerships to address systemic risks.

* Government agencies and services were the most impacted sector by cyber threats in 2026, accounting for 27% of observed activity, compared to 17% in 2025.
* Governments are frequently targeted by nation-state activity because they possess sensitive information and manage essential services.
* Dwell time increased across multiple sectors this year.
* Phishing accounted for 23% of observed intrusions in 2026, up from 7% in 2025.
* A compromised account resulted in additional credential theft in 52.2% of intrusions.
* Five priorities for governments are: prepare for a faster threat environment; build security into the AI ecosystem; plan for incidents to spread; enable timely, two-way public-private information sharing; and prepare essential services to operate through disruption.
* Adversaries move from vulnerability discovery to weaponization in under 24 hours, with publicly disclosed software vulnerabilities projected to reach 72,000 in 2026.

The narrative presents a fundamental tension between the accelerating speed of adversarial action and the slower, often siloed pace of institutional response. The core implication is that traditional perimeter-based security models are insufficient when threats exploit compromised identities and operate across interconnected systems—especially within the context of AI deployment. The emphasis on public-private partnership and bidirectional sharing highlights a realization that technical controls alone cannot solve systemic risk; governance and coordinated action must be integrated into the defensive posture.
The pattern suggests a systemic push to shift the locus of control from reactive defense to proactive, cross-organizational coordination. The focus on AI security as an ecosystem challenge rather than a narrow technical fix reflects a recognition that the most significant vulnerabilities lie in the trust relationships and infrastructural dependencies between entities. This implies that resilience is less about hardening individual systems and more about building trustworthy operational pathways across boundaries.
The mechanism appears to leverage the fear of systemic collapse, using statistics on increased dwell time and intrusion types (like phishing) to justify a broad policy shift toward mandated collaboration. The implication for human agency is whether governmental and private sector leaders can internalize the responsibility for shared risk management rather than viewing partnerships as optional add-ons. If agencies fail to establish truly trusted, two-way channels, then even the fastest technical preparations will fail during coordinated attacks because the necessary situational awareness cannot be established across boundaries.
Bridge Questions: What specific mechanisms are most effective at establishing "trusted" information sharing across adversarial and public entities when legal and privacy constraints exist? How can institutions practically redefine accountability when incidents cascade across organizational boundaries, particularly involving AI systems? What alternative models of governance, beyond current public-private partnerships, could facilitate truly real-time, coordinated response?