Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Asdr�bal Pichardo, CEO of Squalify
As 2026 approaches, multinational enterprises face a hard truth: fragmented approaches to cyber resilience no longer work. The complexity of global operations, overlapping regulatory mandates, and increasingly sophisticated threat actors are forcing organizations to rethink how they govern risk. The old models-either managing risk independently for each subsidiary or applying one-size-fits-all governance-have reached their breaking points. In their place, a new paradigm is emerging: Unified Risk Steering, where cyber risk is managed with shared standards based on financial risk metrics across all subsidiaries, while retaining local flexibility.
Risk and Complexity
Managing cyber risk across a multi-entity enterprise is not simply a matter of “more risk.” It is about more complexity. A corporation with dozens or even hundreds of subsidiaries faces a kaleidoscope of challenges:
? Different maturity levels: Some subsidiaries may have advanced security programs, while others are still building basic capabilities.
? Varying exposures and threat landscapes: A manufacturing plant in Asia faces different risks than a financial services unit in Europe.
? Conflicting regional regulations: Compliance requirements differ not only by country but often by sector, creating overlapping obligations.
? Multiple business models under one roof: A single corporation may operate retail, logistics, and digital services simultaneously, each with unique risk profiles.
CISOs are left with an impossible choice: oversimplified dashboards that obscure critical detail, or overwhelming data that paralyzes decision-making.
Some organizations allowed subsidiaries to manage their own cyber risk according to local priorities. This approach was often justified by differences in regional regulations, business models, or maturity levels. But the cracks in this system are impossible to ignore. Overlapping mandates from regulators, complex supply chains that span continents, and the sheer scale of digital interdependence have made localized approaches untenable. Fragmentation no longer just creates inefficiency-it actively undermines resilience.
In the light of these drawbacks, many organizations have resorted to the other extreme: one-size-fits-all strategies. While centralization promises consistency and control, it often sacrifices agility and contextual awareness. Global mandates can clash with local realities, creating friction that slows execution and erodes trust. The result is a governance model that looks robust on paper but struggles to adapt in practice-leaving enterprises exposed to emerging risks and unable to fully leverage regional strengths.
The New Baseline: Global Visibility And Common Metrics
A more sustainable approach has to start with unified visibility and common KPIs. Financial exposure is the new unified baseline for governing digital resilience. Organizations are investing in platforms and governance structures that allow them to see how risk manifests across their global operations. This shift is not just technological-it is cultural. Subsidiaries are held to common standards that are based on the best interest of the overall group, while retaining the autonomy required to take meaningful action.
This unification enables several critical outcomes:
? Quantification of risk: Enterprises can measure financial exposure across the group, aligning investment with actual risk rather than anecdotal reports or subjective risk ratings.
? Consistent standards: Instead of fragmented playbooks, organizations can steer investments in security and risk transfer according to common standards within the group, leading to more effective protection
? Regulatory alignment: Unified governance ensures that compliance is managed consistently, reducing the risk of fines that scale with group revenue.
? Strategic accountability: Boards and executives gain a clear, quantified view of resilience, enabling informed decisions about investment and risk appetite.
The Challenge for Group CISOs
For CISOs at the group level, the challenge in 2026 is not simply to defend against threats but to orchestrate resilience across the organization. Their mandate is to manage risk landscapes with common KPIs, balancing detail with clarity, and ensuring that accountability flows both upward to the board and downward to subsidiaries. The ability to deliver a quantified, unified view of risk is now the defining measure of success.
This requires new skills and new tools. CISOs must become adept at navigating regulatory diversity, integrating data from multiple business models, and fostering collaboration across organizational boundaries. They must also champion investment in resilience not as a cost center but as a strategic enabler of continuity and trust.
Looking Ahead
The picture for 2026 is clear: resilience will be measured not by localized response plans but by an organization’s ability to quantify, unify and govern risk across its global footprint. Multinational corporations that embrace unified risk steering will not only survive but thrive.
In this new era, cyber resilience is not about building stronger walls around individual subsidiaries. It is about building a stronger, smarter nervous system for the enterprise: one that can sense, respond, and adapt across the entire global organism. Those who master this shift will set the benchmark for resilience-and gain a decisive edge in trust, continuity, and growth.
##
ABOUT THE AUTHOR
Asdr�bal is a senior technology executive with a broad and unique combination of experience in growing solutions, business units, markets, and revenues. He’s currently the CEO of Squalify, a Munich-based Start-Up, providing a Cyber Risk Quantification solution aimed at the C-Suite to make cyber risk measurable and manageable at the strategic level. Before joining Squalify, he was the CEO of Vernaio, a SaaS AI company helping production companies to become more efficient and sustainable. Prior to Vernaio, he was the CEO of FactoryPal, a corporate Start-Up offering a SaaS solution to increase manufacturing efficiency by leveraging AI and IoT technology. Before joining FactoryPal, he was the EVP & GM Europe at Corporater, a global SaaS company providing Risk & Compliance Management (GRC) solutions. He also spent 12 years at SAP, Europe’s largest Software company, where he held several leadership positions.
In addition to management and executive education at MIT and INSEAD, Asdr�bal holds a Computer Science and an M.Sc. degree in Advanced Computing from King’s College London.
