Manufacturing and automotive: The most targeted sector, with a growing attack surface

Manufacturing has been the number one target for cyber attackers globally for five consecutive years. 27.7% of all IBM-observed incidents occurred here. The just-in-time nature of automotive supply chains makes them attractive targets for extortion: stop a production line and the cost of downtime is immediate and measurable. But here's the problem that is less discussed: the attack surface has expanded significantly. Software-defined vehicles and factory floor operational technology are now entry points that did not exist in previous threat models. New 2026 cyber-physical resilience mandates specifically address the risk of a server-level compromise causing a safety failure in a vehicle or on an assembly line. C-suite executives in this sector are now managing a security perimeter that extends from the server room to the vehicle on the road.

Banking and financial services: Personal liability, regulatory pressure, and credential theft

Financial institutions face what IBM describes as the triple penalty: regulatory fines, the high black-market value of financial data, and significant operational downtime when systems are compromised. The 27% surge in attacks in 2025 and 2026 was largely driven by credential harvesting, which means the entry point was usually a person, not a technical vulnerability. On the compliance side, DORA and NIS2 have introduced a specific provision that C-suite executives in financial services need to understand clearly: personal liability for failing to implement human-centric security controls. And 9% of banks are now fully live with tokenized assets, which moves value into more secure encrypted environments. But the institutions not yet taking that step are managing exposure that regulators are increasingly looking at directly.

Energy and utilities: Extortion without encryption, and IoT as the new entry point

The energy sector is seeing a shift in attacker behavior. Extortion-only attacks have increased, where hackers do not encrypt data at all. They threaten to leak it or disrupt service, which is often enough to extract payment without the technical complexity of ransomware. IBM also identifies a specific compounding risk: extreme weather events create physical disruption that attackers use for reconnaissance, looking for systems that are already stressed and less monitored. And 47% of energy leaders cite cooling and power constraints as their biggest reliability risk. Those same constraints, managed through IoT sensors, are now being targeted. C-suite executives in energy need to treat grid-edge AI and IoT infrastructure as part of their security perimeter, not as separate operational technology outside the security team's scope.

Telecommunications and media: High-value targets for data theft and backbone disruption

Telecoms and media companies are attractive targets because they sit at the center of the AI infrastructure being built globally. A compromise here does not just affect one organization. It can affect the organizations and individuals that depend on the network. Media and entertainment bucked the global trend in 2025 by seeing an increase in breach costs while other sectors saw a slight decline. On the compliance side, 95% of executives believe that clear disclosure of how AI processes user data will be the license to operate in 2026. Telcos are responding to the threat by using AI-driven network slicing to automatically isolate compromised segments of the network. But the organizations that have not built that capability yet are managing risk manually, which at network scale is not a sustainable approach.

Retail: Long-tail breach costs and the credential problem that does not go away

Retail breaches are different from breaches in other sectors in one specific way: the cost does not stop at the initial incident. Customer trust takes months to recover, and the commercial impact of that trust loss often exceeds the direct cost of the breach itself. Public-facing app exploits are up 44%, and attackers are using AI to scan for misconfigured systems faster than security teams can catch them. But the highest percentage of retail breaches still trace back to stolen credentials and phishing, which connects directly to the operational reality of retail: high seasonal staff turnover, inconsistent onboarding, and access controls that do not scale well with headcount fluctuations. C-suite executives in retail need a security posture that accounts for the people who will be touching customer data for three months, not just the permanent team.