Executive Summary
The years from 1991 to 2016, with open trade routes and the U.S. as the only superpower, were a historical exception. Strategies still built on that world now carry serious operating risk.
Core conclusions
- Most infrastructure and vendor strategy was designed for one integrated global market. That market has given way to rivalry between great powers, deal-by-deal geopolitics, and rules that differ from one jurisdiction to the next.
- AI cuts both ways. It shortens the time it takes to find and respond to a breach. It also widens the attack surface through AI agents acting as non-human identities, shadow AI, and attacks that use AI.
- The fix is redundancy, not prediction: remove single points of failure across vendors, cloud regions, and jurisdictions, and review them every quarter.
The resilience case, in ten slides
Save it, share it, or send it to whoever still thinks 2016-era assumptions are a safe default.
Between 1991 and 2016, businesses ran on assumptions that were rare in history. Open trade routes, lasting multilateral institutions, and supply chains cut to the lowest cost all reflected one unusual moment in geopolitics. Cloud infrastructure and vendor deals were designed for efficiency.
That world has changed. A U.S. with no rival was itself an exception. Relations between states have gone back to their usual pattern of great powers competing. The evidence is now built into the system. It shows up in export controls on chips, patchwork rules for data and AI, attacks on undersea cables, and rising cybersecurity costs.
If you run infrastructure, data platforms, or digital ecosystems, especially across Asia and the Middle East, a strategy built on 1990s assumptions is now a serious operating risk.
The Return of Great Power Politics
Competition between major powers is a lasting feature of how states deal with each other. Rivalry between two or more powers shaped most of the twentieth century. U.S. dominance after 1991 was a short break, possible only because no rival of equal weight existed. That is no longer true.
Technology is now the main field of that contest. You can see it in export limits on advanced chips and in efforts to build national or allied technology stacks. Businesses that built their buying and infrastructure plans around one integrated global market now work from out-of-date premises.
Transactional Geopolitics
The United States now defines its interests more and more in narrow, deal-by-deal terms. It uses tariffs, export limits, and renegotiated bilateral trade deals as routine policy tools. China and the European Union have answered with their own rules and industrial measures.
For your business, this means you should treat compliance on cross-border data transfer, AI deployment, and critical infrastructure buying as provisional and specific to each jurisdiction. Several jurisdictions are rewriting the rules in all three areas at the same time, on a rolling basis. What complies today may not comply in twelve months.
The Cybersecurity Cycle
Attackers keep moving faster than defenders. The global average cost of a data breach in 2025 was $4.44 million, as the carousel above shows. In the United States the average was over $10 million per incident. Healthcare breaches averaged $7.42 million, for the fourteenth year running.
Just over half of breaches involved malicious activity. Human error and IT failure together made up roughly half of all incidents. So weak processes and poor training are still as big a weakness as outside attack.
A different kind of risk appeared in July 2024. One flawed software update from a major endpoint-security vendor caused about 8.5 million Windows systems to fail at once. It disrupted airlines, hospitals, banks, and government services worldwide, with direct losses estimated in the billions.
The lesson goes beyond cyber defence to the risk of leaning on too few vendors. Nobody can predict when or where attacks and failures will come from. So build on the assumption that breaches and outages will happen. Judge yourself mainly on how fast you detect them and how well you recover, with prevention only part of the picture.
The Limits of Absolute Sovereignty
Full sovereignty over technology and data cannot be achieved, yet the rules across Asia and the Middle East are moving firmly toward it. The UAE’s Personal Data Protection Law, Saudi Arabia’s Cloud Cybersecurity Controls and AI governance frameworks, India’s Digital Personal Data Protection Act, and growing ASEAN data-localisation regimes all set local rules on where data sits and who can reach it.
Over sixty countries now enforce some form of data-localisation rule. At the same time, the physical links that carry global traffic still pass through a few exposed chokepoints. In September 2025, several undersea cables were cut in the Bab el-Mandeb Strait, which disrupted internet access across the Middle East and South Asia. Similar incidents in the Baltic Sea and around Taiwan have been put down, with varying confidence, to deliberate state-linked activity.
Sovereignty over data and infrastructure should be treated as a matter of degree and jurisdiction, not an absolute condition. The more useful goal is to remove single points of failure one by one, whether that is a single vendor, cloud region, jurisdiction, or cable route.
Sovereignty over data and infrastructure should be treated as a matter of degree and jurisdiction, not an absolute condition.
AI Is Both an Accelerant and an Attack Surface
AI is at once the biggest lever you have for managing this volatility and a serious new source of risk. On defence, organisations that used AI and automation heavily in security operations cut breach lifecycles by an average of 80 days in 2025 and saved close to $1.9 million per incident. Agentic AI systems now handle more and more Tier-1 detection, triage, and remediation, at a scale and speed human analysts cannot match.
On offence, the same capability widens the threat surface. Roughly one in six breaches in 2025 already involved attackers using AI, mainly for phishing and deepfake impersonation.
A faster-growing risk comes from agentic AI deployed inside the enterprise. Autonomous agents with standing access to company systems, APIs, and operational technology are non-human identities, and legacy identity and access management frameworks were not built to govern them. Specific ways this goes wrong include prompt injection, tool misuse, privilege escalation, and failures that cascade across several agents.
Shadow AI, meaning tools staff adopt without security or governance oversight, was already a factor in one in five breaches in 2025. It added an average of $670,000 to the cost of a breach, and the large majority of organisations affected lacked proper access controls at the time.
Breach costs in 2025 by region, sector and AI use
Average cost per breach
How AI moves the bill, per incident
Source: IBM Security / Ponemon Institute, Cost of a Data Breach Report 2025. All bars share one dollar scale. The United States figure is reported as over $10 million and is drawn at $10 million.
Take organisations that deploy AI in digital twins, IoT-connected operational technology, and intelligent operations platforms. For them, this two-sided nature is a primary design constraint. The same agentic capability that lets them tune critical infrastructure in real time also adds autonomous decision points. An attacker, or a poorly governed internal deployment, could exploit them.
Action Items for Leadership
To build organisations that can withstand modern risk, leaders should put these first:
Integrate risk into decision-making. Do not treat geopolitical and operational risk as a compliance checkbox you deal with after the strategy is set. Build it into core decisions (where capital goes, which vendors you pick, how data is laid out, where sites go), even when the risk cannot be measured precisely. Investment cases for cross-border infrastructure and digital platforms should rest on stress tests across several scenarios, rather than on a single forecast.
Cultivate organizational agility. Agile thinking should run through the whole hierarchy. Plans give you a needed operating baseline. But leaders should assume those plans will fail under stress, and set decision rights, escalation paths, and incident-response protocols to match. That lets teams at every level adapt without waiting for direction from the centre. Regular cross-functional war-games of plausible disruptions (vendor failure, regulatory shift, infrastructure outage, geopolitical shock) build this capability more reliably than static contingency documents.
Diversify dependencies. Do not lean too heavily on one vendor, cloud provider, or region for critical systems. This applies to cybersecurity tools and endpoint protection as much as to cloud infrastructure and data hosting, since markets run by a few providers have already shown the risk of concentration. For smaller organisations especially, deliberate diversification is still the main lever against systemic risk. That means multi-vendor architectures, data held in several regions in line with local rules, and backup connectivity routes. Smaller firms usually lack the scale to negotiate custom resilience guarantees from any one provider.
Adopt deep scepticism. This is scepticism, not cynicism: the habit of testing assumptions rather than rejecting the data you have by default. Do not wait for the world to settle before you decide. The underlying forces show that volatility is now the normal state and will not pass. Operating models and planning horizons should instead assume constant shifts in the balance of regulation, commerce, and security. Review them every quarter rather than every year, to keep pace with the world around you.
Govern AI as critical infrastructure, not as a productivity tool. Treat every AI agent with access to enterprise systems, APIs, or operational technology as a non-human identity. It needs the same access governance, audit trail, and ability to revoke access as a privileged human user. That means closing the shadow AI gap with formal approval processes and continuous monitoring, instead of relying on policy documents alone. It also means extending AI governance explicitly to digital twin and IoT-connected environments, where an agent’s actions have direct physical consequences. Regulation is already moving. The EU AI Act’s high-risk provisions were originally due in August 2026 but have been pushed back to December 2027 for stand-alone systems under the EU’s Digital Omnibus on AI, and parallel AI governance frameworks are emerging across Saudi Arabia, the UAE, and other jurisdictions. So build your AI governance for each jurisdiction’s rules from the day you deploy, rather than retrofitting it later.
Conclusion
The organisations that prove most resilient by 2030 will be those that, in 2026, chose to leave no assumption unquestioned, and rebuilt operating models around redundancy, jurisdictional awareness, and decision-making speed.
Organizations should plan to be caught off guard and build operating models that adapt to change as standard practice.
Evidence & Methodology
Two of the numbers below come from named studies I have linked. One I have not tied to a source anywhere in this piece, and you should treat it as reported rather than verified. The geopolitical read underneath all of it is mine, not a forecast from any institution.
| Claim | Source | Grade |
|---|---|---|
| $4.44 million average cost of a data breach in 2025, and AI-driven security cut breach lifecycles by 80 days | IBM Security / Ponemon Institute, Cost of a Data Breach Report 2025, cited below | Measured |
| 8.5 million Windows systems failed from one vendor’s software update in July 2024 | Microsoft’s own incident report, cited below | Documented |
| Over sixty countries now enforce data localisation, and undersea cable incidents are rising | My own reading of open reporting, not tied to a specific study in this piece | Uncited |
| Great-power competition and transactional geopolitics have permanently replaced the 1991-2016 order | My own geopolitical judgment, not a forecast from a named institution | My view |
Sources
- IBM Security / Ponemon Institute. (2025). Cost of a data breach report 2025.
- Microsoft. (2024). Incident update on the CrowdStrike-related outage.
Free tool
AI Trust, Risk & Governance Dashboard
Puts AI threat monitoring, bias signals, data lineage, and privacy compliance into practice, across the regulatory frameworks this article treats as non-negotiable.
Free tool
TRACE Agent Evaluation
Before you give an AI agent standing access, check that escalation and override paths exist and have been tested.
The Four-Question Governance Baseline provides the organisational governance structure for treating AI as the critical infrastructure it has become.