Supply chain risk has moved centre stage
Perhaps the most striking evolution since 2025 is the growing prominence of supply chain risk.
Last year, organisations recognised supplier security as an important concern. In 2026, it has become one of the defining themes of the entire report. Supply chain attacks have jumped from the eleventh to the third position in the cyber risk ranking. More than half of respondents reported that a supplier or service provider had experienced a cyber incident or was suspected of having experienced one.
The message is clear: organisations increasingly understand that they are no longer defending only their own perimeter. Their resilience depends on the resilience of every partner, supplier and technology provider in their ecosystem
This is the essence of “Every Link Matters”.
AI has moved from hype to reality
Artificial intelligence is another area where the conversation has matured significantly.
In 2025, organisations were optimistic about AI and expected major cybersecurity benefits, but many admitted that practical improvements had not yet materialised.
The debate is therefore becoming more mature. Organisations are moving beyond the question of whether to use AI and are instead focusing on how to govern it responsibly.
Digital sovereignty has entered the boardroom
A new and highly visible theme in the 2026 edition is digital sovereignty.
While the 2025 report already raised concerns about geopolitical dependencies and trust in technology providers, the 2026 study demonstrates that many organisations now view digital sovereignty as a strategic issue rather than a political discussion.
Belgian organisations acknowledge their dependence on foreign technologies, cybersecurity products, cloud services and AI solutions. They increasingly see this dependence as a resilience challenge, particularly in a world shaped by geopolitical tensions and growing uncertainty.
Questions that were rarely asked a few years ago have become board-level concerns:
- How dependent are we on foreign technology?
- How long could we operate if critical services became unavailable?
- How can Europe strengthen its digital autonomy?
These questions are now firmly part of the cybersecurity conversation.
From compliance projects to operational resilience
Another important shift concerns regulation.
In 2025, organisations were preparing for NIS2, DORA, the AI Act and the Cyber Resilience Act. The focus was on understanding the requirements and getting implementation projects underway.
In 2026, the conversation has evolved. Most organisations now recognise that compliance alone is not enough. The challenge is no longer writing policies but demonstrating that controls work in practice. Incident reporting, supplier assurance, governance, crisis exercises and operational resilience have become the real test of cybersecurity maturity.
The survey highlights an important distinction: compliance may create structures, but resilience requires continuous testing, adaptation and collaboration.
Trust has become the new security perimeter
Perhaps the biggest difference between the two reports is that cybersecurity is no longer primarily discussed in technical terms.
The 2025 report focused strongly on protecting systems. The 2026 report focuses increasingly on protecting trust. Trust in suppliers. Trust in AI. Trust in information. Trust in digital infrastructure. Trust in institutions.
That is why the concept of “Every Link Matters” is so powerful.
Cyber resilience can no longer be achieved by a single organisation acting alone. As digital ecosystems become more interconnected, resilience becomes a collective responsibility. The strength of the chain is determined by its weakest link.
The second edition of the Cybersecurity in Belgium study demonstrates that Belgian organisations have begun to understand this reality. The challenge for the years ahead is to turn that awareness into sustainable capability.
Because resilience is no longer built in isolation. It is built together.
