Cybersecurity is not just a line in IT budgets. In a hyperconnected, VUCA world, where classic forecasting is insufficient. This article sketches how strategic foresight, supported by EU megatrends and ENISA’s threat outlook, can reshape future‑proof cybersecurity strategies.
Cybersecurity is still regarded as being mostly IT related, i.e. intended to keep IT systems secure, based on forecasts developed from known data sets, such as CVE databases. Today’s society is a VUCA environment where forecasting hits its limits. Foresight helps organizations exploit VUCA as an opportunity and in creating their desired futures. Opposed to the push future, which happens regardless what we do, foresight allows us to create a future and pull our organization towards it. Foresights uses horizon scanning to identify emerging trends and how they interact. Many organizations already adopted foresight as an essential tool. The EU commission created a list of megatrends, defined as driving forces that are observable now and will most likely have significant influence on the future.
Using the Megatrends hub we can inform cybersecurity strategies to be future-proof. Additionally, a more cyber-focused trends list is available from ENISA. Here I provide a short example.
One megatrend in the EU list is ‘Accelerating technological change and hyperconnectivity’. We could connect this trend to some of the 21 identified by ENISA for example ‘rise of digital surveillance authoritarianism/loss of privacy’, ‘Artificial Intelligence Abuse’ and ‘exploitation of e-health and genetic data’. Putting all these trends together we may observe that confidentiality of data in the future is far from being a pure cybersecurity matter but it has deep social and political implications. As Shoshana Zuboff observed, data are an invaluable raw material generating huge profits and power. Data are eventually an instrument of power shaping the relationship among states. If on one side, knowledge is power, on the other hybrid warfare and disinformation can be used to exert economic, political and eventually military influence, steering the sentiment, the opinion and even the actions of entire groups of individuals and communities, by affecting the cognitive domain with fake or manipulated data. The use of AI in this context is a double-edged sword: on one side, AI allows the processing of huge quantities of data at an unprecedented speed, on the other side, AI can be weaponized to conduct attacks or manipulated by humans or adversarial AI with prompt engineering attacks to override its security constraints.
Hyperconnectivity further amplifies these dynamics. The concept of global village was coined In 1962 but what we see today is significantly different than what predicted. The global village of the future is a conglomerate of different clusters interacting and often colliding and competing with each other’s. In a future of ‘growing inequalities’ (another trend from the EU hub) we may therefore expect an increasing of hacktivism. We could push the limit of hyperconnectivity further by adding the layer of machine to machine (the so-called Internet of Things) and eventually the human-machine teaming triggered by neuro- and biotech robotics. Hyperconnectivity creates a ‘butterfly effect’ where small scale local actions may have unpredictable, large-scale implications.
The right question for a cybersecurity strategy may then switch from something like ‘are we ready for post-quantum cryptography?’ to ‘what is our mission in the society of the future with regard to protecting data?’. Data protection is not a pure IT matter and becomes an ethical, social and economic responsibility.
Strategic foresight, can complement traditional cyber-risk based approach empowering organizations to create strategies not merely intended to protect IT assets but to shape their socio-economic future through an holistic view of cybersecurity. The benefits of this approach are already tangible in many European organizations, and its wider adoption will contribute to create a more sustainable future, in the cyberspace and in the physical world.
