The World Economic Forum Annual Meeting on Cybersecurity 2026, held this week as a part of Geneva Cyber Week, reinforced a shift that has been building for several years. Organizations can no longer treat cybersecurity as a supporting function. Instead, it must now sit directly in the path of how organizations operate, scale, and collaborate.

Across sessions and closed-door discussions, two themes continued to surface: Attackers are moving faster and operating with more structure than most environments are designed to handle, and AI is accelerating both the pace and effectiveness of that activity. At the same time, defenders are still grappling with fragmentation, governance gaps, and inconsistent visibility across systems.

Fortinet played two key roles in these discussions. Carl Windsor, EVP and CISO at Fortinet, addressed operational realities and governance challenges, while Derek Manky, Fortinet’s Chief Security Strategist and Global VP of Threat Intelligence, led discussions on the changing threat landscape, including a session on deepfake attacks targeting executive leadership.

Identity Is Now a Primary Attack Surface

A key theme was the increasing use of deepfakes in targeted attacks against executives, where identity itself becomes the point of compromise. In the “Defending Leaders in the Age of Deepfakes” session, the discussion emphasized how deepfakes now bypass verification systems, impersonate leaders, and carry out fraud with a level of credibility that was not achievable just a few years ago.

These attacks succeed by exploiting trust instead of technical flaws. Techniques using voice recognition, video verification, or knowledge of communication habits are becoming less reliable as those signals can be convincingly mimicked. In January, the forum’s Cybercrime Atlas, an initiative where Fortinet is a founding member, published a report, “Unmasking Cybercrime: Strengthening Digital Identity Verification against Deepfakes,” that showed how deepfakes are making identity artificial, scalable, and exploitable, creating real financial, operational, and systemic risks. Consequently, executive teams are no longer just indirect targets. They are now being actively and deliberately targeted as gateways into the organization.

The implication is not just that verification should be improved. Instead, organizations must assume that impersonation attempts will occur and implement controls to address them. This reflects the wider trend of viewing identity, API access, and service connectivity as key control points, since they are now primary routes for initial access and lateral movement.

Cybercrime Has Become Structured and Continuous

Another consistent theme across sessions was that cybercrime has become a structured and repeatable system. Instead of waiting for opportunities, attackers actively generate them through continuous reconnaissance of exposed infrastructure, such as services, APIs, identity endpoints, and misconfigurations.

This process creates a working dataset of accessible assets and viable access paths before exploitation begins. AI speeds up this process by enhancing the discovery’s speed and thoroughness, thereby decreasing the time required to move from initial access to compromise.

An insight offered as a part of this discussion was that by the time an alert is activated, the attacker often already has a thorough understanding of the environment and confirmed routes to exploit. While detection remains important, it is no longer enough by itself because much of the critical work has already been done.

AI Is Changing the Pace, not the Fundamentals

AI has been a constant topic, but in Geneva, the discussion shifted from questioning its importance to examining its applications. Attackers leverage AI to produce phishing materials, craft deepfakes, and automate reconnaissance efforts. Meanwhile, defenders utilize AI to analyze signals, filter out noise, and speed up investigation and response processes.

The critical difference lies in how each side operates. Attackers are not constrained by system stability, compliance, or operational dependencies, enabling rapid iteration and seamless adoption of new capabilities. Conversely, defenders need to integrate AI into existing systems while ensuring reliability and control.

Another key takeaway included the importance of treating governance, visibility, and control as fundamental design elements rather than afterthoughts. Incorporating AI into a fragmented environment doesn’t fix the core problems. Instead, it often worsens them by adding more data and complexity to manage.

Fragmentation Remains the Primary Constraint

Many of the operational challenges identified in Geneva stem from fragmentation. Organizations often use a variety of tools and data sources, each with its own logic and risk interpretations, which hampers the creation of a unified view of activities and delays responses when issues arise.

This fragmentation shows up in delayed correlation, manual investigation steps, and inconsistent response workflows. Even when visibility exists, the lack of coordination across systems introduces friction that slows decision-making and response times.

Fortinet’s distinctive platform strategy integrates telemetry, analytics, and response into a single operating layer. Fortinet’s SOC platform consolidation minimizes investigation time and streamlines the transition from detection to response, eliminating unnecessary handoffs. They key takeaway is not that visibility is lacking. It is that visibility without coordination does not translate into effective action.

Collaboration Is Becoming More Operational

The discussion around public-private collaboration has also evolved. While information sharing remains critical, the main focus now is on leveraging that information to promote coordinated action.

Discussions linked to initiatives such as the Cybercrime Atlas show a move towards tangible results, such as dismantling criminal networks and enhancing collaboration with law enforcement. The focus has shifted from raising awareness to taking action, which depends on shared frameworks and a better grasp of how intelligence can be converted into operational effects.

Fortinet’s participation reflects this trend, emphasizing contributions from both insights and practical approaches across different environments.

What This Means in Practice

These recent discussions in Geneva point to a set of practical changes organizations need to make. Identity and access controls must be prioritized as they are now the most common entry points. Security architectures should aim to minimize fragmentation, ensuring that data, analysis, and response are cohesive rather than isolated in separate systems. Additionally, security strategies should shift towards exposure management, concentrating on conditions that attackers can realistically exploit rather than striving to eliminate every possible risk.

These are not incremental adjustments. They reflect a critical change in how security must be structured to keep pace with evolving attack methods.

Closing Perspective

The gap between attack methods and defensive structures remains clear. Attackers today act quickly, with better coordination and greater AI integration, whereas many organizations continue to deal with siloed environments and slow response systems.

Closing that gap requires a change in approach rather than an expansion of tools. The path forward is becoming clearer through forums like this. The only question left is how fast organizations can adapt their architectures and operations to keep up.