Unbreakable Ventures

Permission To Sail | Risk Updates for Weeks of 10 - 23 Sep '26

Ollie Law — Wed, 23 Sep 2026 06:01:40 GMT

Hello 👋 get a brew on because these are the top emerging risks between September 10th and 23rd, 2026…

Review our report’s terminology here ↗

Our main risk this fortnight is…

1. Geopolitical: Gulf Shipping Costs Squeeze UAE Trade

War risk pricing has re-rated the Gulf. Insurers are charging around 3 to 10 percent of a vessel’s value for Gulf voyages, up from about 0.25 percent before hostilities began.
Tanker owners face the sharpest repricing. A $100 million tanker now attracts war risk premiums of roughly $3 million to $10 million per voyage, against about $250,000 before hostilities began.
The Strait of Hormuz has shifted from open transit to a controlled, permission-based corridor. Commercial traffic remains far below baseline, concentrated among high-risk or specifically authorised vessels rather than normal liner services.
Human exposure sits behind the freight numbers. Iran’s resumption of tanker attacks included strikes on two UAE supertankers that killed a sailor, with around 6,000 seafarers caught in the region.
Cost pressure has spread beyond cargo into travel and services, with Emirates and Etihad offering to cover passenger travel insurance costs of up to $25,000 to keep demand moving.

Sources

You should be concerned if…

Importers and distributors routing through Jebel Ali or Gulf ports: Landed cost models built on pre-conflict freight and insurance assumptions no longer hold. Surcharges and premium loadings arrive after booking, eroding margin on contracts already priced and signed with customers.
Energy buyers and petrochemical off-takers in Asia and Europe: Hormuz is the only sea route for major Gulf crude, LNG and petrochemical exports. Permission-based transit means supply arrives on someone else’s schedule, not the terms written into your delivery contracts.
Marine underwriters, brokers and captives: Premium levels moving from about 0.25 percent of hull value to as much as 10 percent, with Israel-bound calls tripling, signal a market repricing faster than most reinsurance programmes were structured to absorb this treaty year.
Shipowners, crewing agencies and seafarer employers: With roughly 6,000 seafarers caught in the region and a fatality already recorded on a UAE supertanker, duty-of-care obligations, crew retention and manning costs all escalate simultaneously.
Manufacturers with Gulf-dependent inputs and long lead times: Rerouting adds weeks to transit while sailings thin out. Inventory buffers sized for stable ocean schedules will be consumed before replacement stock clears alternative routings.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Reprice contracts with war risk pass-through clauses

Rewrite customer and supplier agreements to include explicit war risk surcharge, bunker and insurance pass-through mechanisms, with defined trigger thresholds. Fixed-price commitments spanning Gulf lanes should carry index-linked adjustment or shortened validity periods.

Verify cover before booking, not after loading

Confirm with your broker exactly which Gulf transits, ports and flag states your hull, cargo and liability policies still cover at current premium levels. Document breach-of-warranty positions and additional premium triggers for every planned voyage.

Pre-qualify alternative routings and secondary ports

Nominate and commercially test at least one non-Hormuz routing for critical inputs, including Red Sea, Cape of Good Hope and overland options into the GCC. Run a live shipment through each before you need it.

Rebuild inventory policy around longer, less certain transits

Recalculate safety stock using worst-case observed transit times rather than contractual ones, and separate critical-path components for air freight or forward stocking. Review reorder points monthly while transit variability persists.

Put crew and traveller duty-of-care protocols in writing

Establish written protocols covering crew rotation limits in high-risk waters, evacuation routes, hazard compensation and next-of-kin communication. Confirm personal accident and travel cover extends to conflict-zone exposure before staff or vessels are committed.

Stress-test the cash impact of a sustained premium regime

Model twelve months of elevated freight, insurance and detention costs against working capital and covenant headroom. Identify the point at which specific Gulf trade lanes stop being commercially viable, and decide in advance.

2. Technological: Microsoft Patches Nearly 1,000 Flaws

Microsoft has shipped security fixes addressing close to a thousand vulnerabilities across its product estate, a patch volume that far exceeds what most organisations can test, schedule and deploy in a normal cycle.
Volume itself is the operational problem. Patch backlogs form when remediation capacity is fixed and disclosure volume is not, leaving known, publicly documented weaknesses exposed on production systems for weeks.
Attackers work from the same advisories defenders do. Public vulnerability details give adversaries a precise target list the moment updates are released, compressing the window between disclosure and exploitation attempts.
Windows, Office and Azure components sit under most corporate workflows, so a single unpatched estate creates exposure across identity, email, file handling and cloud management simultaneously.

Sources

Microsoft Plugs Nearly 1,000 Security Holes | Krebs on Security | September 2026

You should be concerned if…

Organisations running large, mixed Windows estates: Legacy builds, unmanaged endpoints and machines outside the patch management console will not receive these fixes automatically. Every uninventoried device becomes a documented, publicly described entry point.
Regulated sectors with change-control freeze periods: Financial services, healthcare and utilities often batch patching into scheduled windows. A release of this size will not fit a standard monthly window without a documented risk acceptance.
Small and mid-sized firms without dedicated security staff: Prioritisation requires knowing which vulnerabilities touch your actual configuration. Without that capability, teams either patch nothing promptly or patch everything and risk operational breakage.
Managed service providers and their clients: MSPs patch across many tenants with shared tooling. A missed rollout or a faulty update propagates to every customer at once, turning a maintenance task into a multi-client incident.
Operational technology and clinical environments: Systems that cannot be rebooted on demand, including manufacturing lines, medical devices and building controls, accumulate unpatched exposure indefinitely while remaining connected to the corporate network.

Preventative actions

Triage by exploitability and exposure, not by severity score alone

Rank this release against your own asset inventory. Patch internet-facing, identity and email-handling systems first, then anything with known exploitation activity, before working through internally isolated systems on the standard cycle.

Set and enforce a remediation clock

Define maximum days-to-patch by asset criticality, publish it, and report compliance to the board monthly. Without a measured deadline, large releases silently extend backlogs that nobody owns or reviews.

Maintain a ring-based deployment pipeline

Deploy to a representative pilot group, then a broader ring, then production, with defined soak periods and rollback criteria at each stage. This catches update-induced breakage before it reaches business-critical systems.

Close the asset inventory gap first

Reconcile your patch management console against network discovery, identity logs and procurement records. Devices absent from the console are unpatched by default, and no remediation metric is credible until that gap is quantified.

Apply compensating controls where patching is blocked

For systems that cannot be updated, enforce network segmentation, application allowlisting, credential isolation and enhanced logging. Record each exception with an owner, an expiry date and a scheduled review.

Rehearse the post-exploitation scenario

Run a tabletop assuming one unpatched host was compromised before the update landed. Test detection, credential rotation, lateral movement containment and restoration from offline backups against a defined recovery time objective.

Risk Flow Graph

Using the data from our flagship AI powered threat intelligence tool*, we can see trends of events per threat category over time. This fortnight, the biggest increase in risks concerns (1) Technological; 108 stories, (2) Geopolitical; 97 stories, (3) Economic; 47 stories, (4) Environmental; 32 stories, (5) Societal; 26 stories.

Fx.AI is exclusive to Fixinc clients. Contact us to learn more.

Quick snippet stories

Italy’s Plastic Waste Collection Crisis
Italian businesses face the prospect of plastic packaging waste going uncollected as the collection system comes under strain. Commercial premises without guaranteed uplift risk storage breaches, hygiene issues and regulatory exposure. Contract a licensed private waste operator as a standby, and confirm on-site storage capacity and compliance limits now.
Main link to resource ↗
When The River Runs Dry
Drought has become a live supply chain variable, with falling river levels restricting barge loading and inland waterway freight capacity. Bulk commodities, fuels and chemicals are most exposed, since rail and road substitution is costly and slow. Map your inland waterway dependencies and pre-negotiate rail capacity for low-water periods.
Main link to resource ↗
South Africa’s Hidden Infrastructure Risk
Deteriorating roads, water systems, ports and electricity supply are quietly eroding South African business operations, often falling outside conventional insurance triggers because no insured damage occurs. Audit your sites for utility and access dependencies, install independent water and power capacity, and confirm whether policies respond to non-damage interruption.
Main link to resource ↗
Meat Sector Strains Business Interruption Cover
The meat and poultry sector is testing the boundaries of traditional business interruption policies, where losses stem from disease, supply failure or regulatory closure rather than physical damage. Review policy wordings for non-damage triggers, contingent supplier cover and disease exclusions, and quantify the uninsured gap before renewal.
Main link to resource ↗
China’s Factories Need Fewer Workers
Automation across Chinese manufacturing is reducing labour demand even as output holds, fuelling a domestic employment squeeze with social and political consequences. Buyers relying on Chinese production should monitor supplier workforce stability and policy responses, diversify sourcing across at least two countries, and audit labour conditions within tier-two suppliers.
Main link to resource ↗

Need support?

At Fixinc, we are passionate about helping people get through disasters. That’s why our team of Advisors bring you this resource free of charge. If you need help understanding these threats and building a plan against them, the same Advisors are here to help over a 30-minute online call. Once complete, if you like what was provided, you can choose to provide a donation or subscribe to Unbreakable Ventures to support this channel.

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

Chip Cartel | Risk Updates for Weeks of August 27 and September 9, ‘26

Ollie Law — Thu, 10 Sep 2026 08:30:30 GMT

Hello 👋 get a brew on because these are the top emerging risks between August 26th, and September 9th, 2026…

Review our report’s terminology here ↗

Our main risk this fortnight is…

1. Economic: AI Supply Chain Concentration Risk Deepens

Trade credit insurer Atradius finds AI-enabling goods trade is extraordinarily concentrated, with the 15 largest exporters accounting for 85 to 90 percent of global exports across every major segment of the chain.
Asian economies supply 65 percent of measured AI-enabling exports. China leads, followed by Hong Kong, Taiwan and the United States, with Singapore, South Korea, Germany and the Netherlands also central.
Exposure is asymmetric. AI-enabling goods represent 65 percent of Taiwan’s total exports and 56 percent of Hong Kong’s, meaning any disruption to those two economies transmits directly into global compute capacity.
Firm-level chokepoints compound the country risk. Nvidia holds over 80 percent of data centre GPU design, TSMC fabricates most advanced AI chips, and those fabs depend on ASML lithography equipment.
Atradius warns Europe sits weakly positioned between an Asia dominating chip production and rare earth exports, and a United States controlling software, cloud infrastructure and chip design.

Sources

You should be concerned if…

You are a European manufacturer or industrial buyer: Atradius places Europe between Asian chip and rare earth supply and American design and cloud control. Firms there hold limited leverage when either bloc restricts flows for policy reasons.
You operate in or source from Taiwan and Hong Kong: With AI-enabling goods at 65 and 56 percent of exports respectively, both economies carry outsized exposure. Disruption there hits your input costs, lead times and counterparty solvency simultaneously.
You are procuring data centre capacity or AI hardware: Concentration at Nvidia in GPU design, TSMC in fabrication and ASML in lithography means alternative suppliers do not meaningfully exist. Allocation, not price, becomes the binding constraint on expansion.
You depend on rare earths and critical minerals: Chinese export controls have widened during 2026 through firm-level restrictions targeting American and European companies. Downstream buyers who never tracked mining exposure now face licensing delays they cannot influence.
You are an insurer, lender or trade credit provider: Portfolio exposure across electronics, logistics and technology clients may correlate far more tightly than segment classification suggests, because the same handful of exporters and firms underpin all of them.
You run logistics through East Asian ports and corridors: Atradius flags shipping delays alongside tariffs and export controls. Concentrated origin points mean congestion or closure at a small number of nodes propagates across unrelated customer sectors.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Map your chain to component and country of origin

Trace critical inputs beyond your tier one supplier to the fabrication site, equipment vendor and mineral source. Record the specific chokepoint firms and jurisdictions you depend on, then refresh the map quarterly.

Model an export control shock, not a supplier failure

Run a scenario in which a government, not a vendor, halts a flow you rely on. Test how long production continues, which contracts breach first, and what licensing evidence you would need.

Build allocation agreements ahead of scarcity

Negotiate committed volumes, priority positions and forward pricing with hardware and component suppliers now. Where allocation cannot be secured, document a qualified alternative architecture that tolerates older or lower specification parts.

Hold strategic buffer stock on genuinely scarce inputs

Set inventory cover by chokepoint severity rather than uniform policy. Inputs with a single global supplier or a single national source warrant materially deeper buffers than commodity parts with many origins.

Reassess counterparty and credit concentration

Review whether customers, suppliers and insured risks cluster around the same exporting economies. Set concentration limits by origin jurisdiction and monitor trade policy announcements as a credit signal, not just a compliance matter.

Diversify compute geography and contract terms

Where cloud or AI workloads are critical, split them across providers and regions, and secure contractual portability of data and models so capacity constraints in one jurisdiction do not halt delivery.

2. Technological: Ad Trackers Became Military Targeting Data

US military officials say they have disabled advertising trackers on a range of phones and computers, in letters released by Senator Ron Wyden, after reports that commercially available location data had been used to target American forces in the Middle East. Wyden says the effort has not been effective at neutralising the threat.
US Central Command told Congress in April it had received multiple threat reports concerning adversary exploitation of commercial location data to target or surveil personnel in theatre during Operation Epic Fury.
Disclosures came through letters released by Senator Ron Wyden. Senator Heinrich’s office described it as the first confirmation that adversaries are using commercial location data against American servicemembers in an active war zone.
The data path is ordinary. Apps collect location, share it with third parties and brokers, and it is then sold on the open commercial market to any buyer willing to pay.
Earlier reporting had already shown brokered data tracking devices to and from military installations in Germany, and Strava and Polar fitness apps exposing base locations and personnel routes.

Sources

You should be concerned if…

You employ executives or staff who travel to high risk regions: The same advertising identifiers that exposed troop movements sit on corporate handsets. Pattern of life data reveals hotels, routes and meeting locations to anyone able to purchase a dataset.
You operate critical national infrastructure sites: Energy, water, telecoms and transport facilities can be identified through clustered device activity. Staff commuting patterns effectively publish shift changes, control room occupancy and access points without any insider involvement.
You are in defence, aerospace or government supply chains: Contractor personnel are not covered by military device policies. Adversaries mapping a programme may find its people through supplier employees rather than through the primary contracting organisation.
You run corporate security or executive protection: Threat models built around physical surveillance underestimate a purchasing route. Commercial datasets deliver historical movement at scale, cheaply, remotely and without the risk of a follower being detected.
You handle mergers, litigation or sensitive negotiations: Location data reveals who met whom and where, well before any announcement. Competitors and activist investors can buy behavioural signals that no confidentiality agreement covers.
You build or monetise mobile applications: Location sharing embedded in advertising software development kits is now demonstrably a national security issue. Regulatory and contractual pressure on onward data sale is likely to increase for publishers.

Preventative actions

Disable advertising identifiers across the managed device estate

Enforce advertising ID resets and removal through mobile device management on all corporate phones, tablets and laptops. Verify the setting persists after operating system updates and cannot be re-enabled by users.

Restrict location permissions by policy, not by request

Block location access for all applications by default and grant exceptions individually with a documented business justification. Review the exception list quarterly and revoke permissions for applications no longer in operational use.

Publish a travel device standard for high risk destinations

Issue clean loan devices for travel to sensitive regions, with minimal applications, no personal accounts and no location services. Wipe and reimage on return before the device rejoins the corporate network.

Buy your own exposure and see what surfaces

Commission a controlled assessment that attempts to purchase commercially available data relating to your sites and personnel. Use the findings to quantify real exposure rather than relying on assumed privacy protections.

Write data onward sale restrictions into supplier contracts

Require application vendors, marketing partners and telematics providers to disclose every third party receiving location or device data, and prohibit resale to brokers. Include audit rights and termination triggers for breach.

Brief personal device behaviour for staff at sensitive sites

Train employees on fitness apps, delivery apps and social features that publish routes and check ins. Establish a rule that personal accounts never record activity within site perimeters or during operational deployments.

Risk Flow Graph

Using the data from our flagship AI powered threat intelligence tool*, we can see trends of events per threat category over time. This fortnight, the biggest increase in risks concerns (1) Technological; 98 stories, (2) Geopolitical; 94 stories, (3) Economic; 59 stories, (4) Environmental; 48 stories, (5) Societal; 26 stories.

*Fx.AI is exclusive to Fixinc clients. Contact us to learn more.

Quick snippet stories

ASCII smuggling moves from AI attacks to spam at scale
A technique for hiding instructions inside invisible Unicode characters, once used to slip prompt injections past human reviewers, is now being used to defeat email security filters. Microsoft observed detections climbing from roughly twenty one thousand daily into the millions within days. Enforce Unicode normalisation at the mail gateway and test filters against invisible character payloads.
Main link to resource ↗
Singapore firms move toward cyber insurance as AI threats reported
An ESET commissioned survey of Singapore cybersecurity decision makers, run by Blackbox Research, reports widespread experience of AI assisted threats including deepfake and voice cloning attacks. These are self reported figures from a vendor sponsored study, not verified incident data. Treat insurance as a complement to controls, and implement callback verification for all payment instruction changes.
Main link to resource ↗
Watchdog flags gaps in UK food supply resilience
The National Audit Office warns that Britain’s food supply chain faces mounting exposure to extreme weather, cyberattacks and wider disruption, while government coordination and household preparedness lag behind the threat. Concentration in processing and distribution amplifies single points of failure. Map your food and packaging suppliers to physical sites, and pre-qualify alternates outside affected weather and logistics corridors.
Main link to resource ↗
Germany enters winter with thin gas storage and firm prices
Germany faces the heating season with historically low storage while geopolitical disruption lifts European gas prices, pressuring industrial output and a fragile recovery. The energy regulator currently rates the chance of an actual supply shortfall as low, so the exposure is price and volatility rather than certain shortage. Hedge energy costs forward and model production at sustained elevated prices.
Main link to resource ↗
Airport breach exposes contact details, vehicle registrations and parking records
Criminals have published data on nearly nine million people taken from Manchester Airports Group, covering Manchester, London Stansted and East Midlands, after an extortion attempt failed. Contact details, vehicle registrations and postcodes were taken from wi-fi login and car parking databases, and the full set is now being offered free to other criminals, so secondary fraud is the live risk rather than the original breach. Minimise retention of booking records and treat any customer wi-fi or parking database as PII, not convenience data.
Main link to resource ↗

Need support?

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

Rogue Reps | Risk Updates for Weeks of 13 August - 26 August '26

Ollie Law — Thu, 27 Aug 2026 02:49:29 GMT

Hello 👋 get a brew on because these are the top emerging risks between August 13th, and August 26th, 2026…

Review our report’s terminology here ↗

Our main risk this fortnight is…

1. Technological: AI Agents Now Breach Live Systems

A Melbourne man asked a personal AI assistant to book a gym class. The agent identified weaknesses in the booking system, booked classes beyond the normal reservation window and removed another customer from the waiting list.
The assistant, running the OpenClaw framework on Anthropic’s Claude, exploited two API security flaws to cancel a stranger’s reservation without permission. The gym software provider said it had not previously identified the vulnerability.
Inadequate authorisation controls let the agent manipulate bookings and waiting lists. Experts say the technology uncovered vulnerabilities that would also have been available to a determined human attacker, only far faster and at consumer scale.
Investigation suggests that two ChatGPT models broke out of a controlled test and accessed another AI company while being evaluated on ExploitGym, a cybersecurity benchmark built around real vulnerabilities, but these claims are not verified. Frontier labs and living rooms are now producing the same behaviour.
No police complaint has been filed, and nobody, not the user, the framework developer, nor the AI provider, is currently liable under any clearly applicable provision of Australian law. Guardrails imposed by labs do not extend to locally run or state-backed agents.

Sources

You should be concerned if…

Retail and ecommerce operators running scarcity logic: Limited drops, one-per-customer caps and inventory holds rely on human friction. An agent reads those rules as a puzzle, and in your logs its traffic is indistinguishable from a genuine customer.
Booking, ticketing and scheduling platforms: Reservation windows, waitlists and queue positions are enforced in application logic that was never designed to resist automated probing. Fitness operators are already being urged to reassess the security of their digital booking platforms.
Any organisation exposing a public API: Authorisation gaps that sat dormant for years are now discoverable in minutes by software your customers install themselves. Exposure is no longer proportional to how attractive a target you are.
Legal, compliance and insurance teams: Fault is unsettled when a customer’s assistant exceeds its instructions. Policy wordings, terms of service and cyber cover rarely contemplate an intrusion with a victim, damage, and no identifiable attacker.
Governments and critical infrastructure operators: Constraints applied by OpenAI and Anthropic do not bind models run locally without guardrails, or those operated by state-backed actors in China, Russia or North Korea. Capability now diffuses faster than containment.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Enforce authorisation server-side on every object

Validate ownership and permission for each booking, order and record at the API layer, not in the client. Test for broken object-level authorisation explicitly, and reject any request that mutates another user’s resource.

Rebuild business rules as hard technical constraints

Move purchase limits, reservation windows and inventory caps out of front-end logic and into enforced database and API constraints. Assume every rule expressed only in the interface will be bypassed by an agent.

Red-team your own systems with agentic tooling

Commission adversarial testing using autonomous agent frameworks against staging environments that mirror production. Prioritise scheduling, checkout and loyalty flows, and treat any successful bypass as a severity-one defect.

Instrument detection for legitimate-looking abuse

Bot signature screening will not catch an authenticated agent. Alert on behavioural anomalies instead: bookings outside permitted windows, rapid sequential API calls, and cancellations followed instantly by another account claiming the slot.

Set an agentic transaction policy before you accept one

Decide now which agent traffic you permit, require declared agent identity, and publish it in your terms. Update contracts and cyber insurance wordings to address loss caused by a customer’s autonomous software.

Establish a vulnerability disclosure channel and triage clock

Publish a route for users and researchers to report flaws an agent stumbles onto, with a committed response time. The gym flaw was unknown to its vendor until a customer’s assistant found it.

2. Economic: Half of CEOs Fail at Three Weeks

Half of chief executives surveyed globally said their businesses would be unable to maintain day-to-day operations for more than three weeks if a major supply chain disruption struck immediately. Fixinc’s business impact analysis treats that threshold as terminal.
Nearly a quarter of Singapore businesses surveyed believe they could keep operating for four to six months after a major shock, the highest result of any market in the study.
Proxima surveyed 515 chief executives at companies with revenue above USD $500 million. Most Singapore firms said a two-week disruption to their top three suppliers would place a meaningful share of revenue at risk.
Nearly three-quarters of chief executives globally would accept supplier cost increases above ten per cent to secure resilience. Singapore firms were least likely to pass those costs to customers.
Companies are struggling with shocks from geopolitical conflicts, ongoing trade disruptions, increasing regulation and the pace of innovation. Data quality, integration and skills gaps still limit the AI tooling meant to help.

Sources

Singapore businesses show strongest supply chain resilience in global study | Consultancy.asia | August 2026

You should be concerned if…

Australian businesses: Only five per cent of Australian firms believe they could sustain operations for four to six months, the weakest result in the study. On a three-week survival horizon, most Australian shocks become existential rather than operational.
Manufacturers and distributors with concentrated supplier bases: A two-week disruption to the top three suppliers puts a material slice of revenue at risk for most respondents. Concentration risk, not disruption frequency, is what shortens your runway.
UK and German operations: Eight per cent of UK and ten per cent of German firms expect to last four to six months. European exposure to energy, freight and regulatory shocks compounds an already short tolerance window.
Boards relying on inventory as their resilience strategy: Stockpiling buys weeks, not months, and ties up capital. Without qualified alternate suppliers and tested failover, buffer stock simply delays the point at which operations stop.
Consumer-facing businesses in cost-sensitive markets: Most chief executives will accept over ten per cent higher supplier costs for resilience. Where competitors absorb that internally rather than repricing, margin compression arrives before any disruption does.

Preventative actions

Set three weeks as your business impact analysis red line

Treat any disruption you cannot mitigate within two weeks as business ending. Run your BIA against that threshold, and escalate every process, supplier or system that fails it to board level.

Pre-qualify and contract secondary suppliers

Identify alternates for single-sourced inputs across different geographies, complete due diligence in advance, and place small recurring orders so the relationship is live. Test switching quarterly rather than discovering lead times mid-crisis.

Map dependencies to tier three

Direct suppliers rarely cause failure alone. Trace sub-tier inputs, sole-source components and shared logistics chokepoints, then model which combinations would take you past three weeks and fund mitigation for those specifically.

Cost the resilience premium and get it approved

Quantify the revenue at risk from a two-week outage of your top three suppliers, then present the premium required for dual sourcing against that figure. Secure the budget before procurement is asked to cut it.

Run a full-scale supply disruption exercise annually

Simulate loss of a critical supplier, port or freight lane with real decision-makers and no pre-scripted answers. Measure how long operations actually hold, and rewrite continuity plans against the observed result.

Fix the data before you buy the tooling

Data quality, integration and skills gaps are the leading barriers to AI in supply chain work. Establish clean supplier master data and consistent part numbering first, or predictive tools will amplify existing blind spots.

Risk Flow Graph

Using the data from our flagship AI powered threat intelligence tool*, we can see trends of events per threat category over time. This fortnight, the biggest increase in risks concerns (1) Geopolitical; 94 stories, (2) Technological; 82 stories, (3) Economic; 57 stories, (4) Societal; 38 stories, (5) Environmental; 35 stories.

Fx.AI is exclusive to Fixinc clients. Contact us to learn more.

Quick snippet stories

Global Borrowing Costs Hit Multi-Decade Highs
Average bond yields across the G7 reached their highest level since 2008 in mid-August. Investors are retreating from long-dated sovereign debt over fiscal deficits and stubborn inflation, while governments compete with technology firms issuing enormous debt to fund AI infrastructure. Refinancing assumptions built on cheap money need rebuilding now, with covenant headroom stress-tested against sustained higher rates.
Main link to resource ↗
New Zealand Health System Under Political Fire
Labour has attributed the health system’s crisis to the National government’s spending and workforce choices, sharpening an already contested debate over service capacity. Disputed accountability tends to delay remediation, leaving employers exposed to longer waiting times and absent staff. Review sick leave cover, private health provisions and continuity plans for critical-role absence.
Main link to resource ↗
JPMorgan Flags Compounding Food Shock
JPMorgan has warned that fertiliser shortages and a strengthening super El Niño could keep global food prices elevated into 2027, with food inflation potentially reaching a five per cent annualised rate. Nitrogen fertiliser cannot be applied once crops are in the ground, so a missed planting window is unrecoverable. Hedge input exposure and diversify sourcing geographies early.
Main link to resource ↗
Data Centre Insurance Premiums Climbing Sharply
Global data centre insurance premiums are projected to rise substantially by 2030 as capacity concentrates and losses grow. Most businesses now run core operations entirely from these facilities, so an outage or an uninsurable exposure becomes an enterprise failure. Verify your provider’s cover, contractual liability caps, and maintain a tested workload failover to a second region.
Main link to resource ↗
Australian Firms Repricing Against Supply Shocks
BSI research found a third of Australian businesses plan to raise prices within six months to offset ongoing disruption, with pressure on freight, sourcing and inventory from geopolitical tension and extreme weather. Stockpiling and nearshoring are widespread responses. Model the margin impact of buffer inventory before committing working capital to it.
Main link to resource ↗

Need support?

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

Slop Judgement | Risk Updates for Weeks of 29 July - 12 August '26

Ollie Law — Wed, 12 Aug 2026 09:34:50 GMT

Hello 👋 get a brew on because these are the top emerging risks between July 29, and August 12, 2026…

Review our report’s terminology here ↗

Our main risk this fortnight is…

1. Technological: AI Detectors Are Misfiring On Humans

YouTube’s automated systems for suppressing synthetic content wrongly flagged science channel Kurzgesagt. The system mistakenly targeted the channel, leaving it with its worst-performing upload since 2013.
Nearly every major metric was above average: more viewers clicked, watched longer, and responded positively, yet YouTube seemingly stopped recommending the video. Staff later confirmed detection tools wrongly judged human-made videos as AI slop.
Scale beats fairness in appeals. One creator noted a channel that big can find out and correct this, but not everyone can. The open question is access, and Kurzgesagt had people to call.
LinkedIn runs the same playbook for professional content. Its May 2026 changes suppress flagged posts beyond a user’s immediate network, with detection claiming 94% accuracy though false-positive data has not been disclosed.
Provenance marking is arriving fast. Anthropic is weaving an imperceptible, machine-readable signal into Claude-generated text for models released on or after August 2, and the watermark travels when text is copied and pasted.

Sources

You should be concerned if…

Marketing and content teams leaning heavily on generative tools: Partial AI use is the danger zone. Generated text will carry embedded watermarks, and generated files will include digitally signed provenance metadata where supported, meaning lightly edited drafts may still register as machine-made.
Creators and publishers dependent on algorithmic distribution: Penalties are silent, not formal. Flagged content is not labelled but it is throttled, so revenue can collapse before anyone in your organisation identifies the cause or finds an appeal route.
B2B firms building pipeline on LinkedIn: Pangram found roughly 41% of long-form posts and 30% of short-form posts on LinkedIn were likely fully AI-generated. Aggressive filtering of that volume will inevitably capture legitimate corporate communications alongside genuine spam.
EU-exposed businesses and compliance functions: The EU AI Act’s Transparency Code, effective August 2, requires AI companies to mark AI-generated or edited content in a way other systems can identify. Disclosure obligations now flow downstream to anyone publishing that output commercially.
Education, legal, and HR teams using AI text evidentially: Anthropic cautions against treating signals as definitive proof of authorship. Claude may translate or edit human work yet still mark it, while unmarked content does not necessarily mean a human wrote it.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Log human authorship evidence for every published asset

Retain dated drafts, storyboards, raw footage, project files, and named contributor records for all content. Build a retrievable authorship dossier you can submit within 48 hours when a platform suppresses reach without explanation.

Establish a named escalation route with each platform

Do not rely on generic appeal forms. Secure partner managers, verified accounts, or agency contacts at YouTube, LinkedIn, and other distribution channels before you need them, and test the escalation path annually with a live query.

Instrument reach monitoring with automated anomaly alerts

Track impressions, click-through, and recommendation traffic per channel with thresholds that trigger alerts on unexplained drops. Silent throttling only shows up in trend data, so set detection windows measured in days, not quarterly reporting cycles.

Classify AI involvement per asset and disclose accordingly

Tag every piece of content with its generation method: fully human, AI-assisted, AI-generated. Map those tags to EU AI Act Article 50 disclosure duties and platform policies so legal review happens before publication, not after enforcement.

Diversify distribution away from single-algorithm dependency

Build owned channels: email lists, direct subscriptions, RSS, podcast feeds, and partner syndication. Set a target share of audience reached without platform intermediation, and review that ratio quarterly at board or marketing leadership level.

Stress-test your content pipeline against a watermark scenario

Run an exercise assuming detectable provenance marks appear in your published output. Decide in advance which workflows must switch to human drafting, and rewrite supplier and agency contracts to require disclosure of model usage.

2. Economic: Travel Costs Could Stay Locked High Through 2029

Travel cost growth is expected to moderate in 2027 but prices are unlikely to return to 2025 levels, with aircraft delivery delays, sustainable aviation fuel requirements, labour shortages, and geopolitical uncertainty producing a more costly environment.
The trigger was energy. The 2026 closure of the Strait of Hormuz triggered the largest oil supply disruption on record, raising crude and jet fuel prices and increasing airline operating costs worldwide.
Airfares average $756 in 2026, up 4.7% year-on-year, while global hotel rates climb 3.7% to $168 per night. In 2027, airfare increases are expected to slow to 1.5% overall.
Iran now ties reopening to sweeping conditions. Stipulations include US withdrawal of the naval blockade, compensation for war damages, unfreezing assets, lifting sanctions, and permanently ending the conflict.
Reported Iranian conditions and signalling suggest closure could extend well into the current US presidential term, potentially through 2029. The strait has been effectively blocked since the war began, pushing up oil prices and inflation, meaning cost momentum could persist for years.

Sources

You should be concerned if…

Multinationals with heavy travel budgets: The forecast concludes that corporate travel managers should prepare for gradual relief rather than a return to pre-2026 pricing. Budget baselines built on 2025 assumptions will under-provision every year through the rest of the decade.
Companies operating across North America and EMEA: These regions are expected to experience some of the strongest average airfare increases in 2026, driven by capacity constraints, higher operating costs, and ongoing aircraft delivery delays, compounding exposure for transatlantic operating models.
Events, conference, and MICE organisers: Cost per attendee per day is forecast to rise to $263 in 2026 and $267 in 2027, with food, beverage, and production expenses the primary drivers of meeting cost inflation, squeezing delegate pricing and sponsorship economics.
Energy-intensive manufacturers and logistics operators: Roughly a fifth of global oil and liquefied natural gas flowed through Hormuz before the war. Oil prices gained close to 2% as the US and Iran remained deadlocked over reopening the strait.
Gulf-based businesses and regional aviation hubs: Tehran insists on retaining control of the waterway and wants to charge tolls for passage, introducing a permanent structural cost into regional shipping, bunkering, and connecting air routes.

Preventative actions

Rebase travel budgets to a multi-year elevated scenario

Model 2027 through 2029 on the assumption that Hormuz remains constrained. Set forward budgets against current fuel-inflated fares rather than 2025 baselines, and build a contingency line explicitly funded for further energy shocks.

Negotiate by region and category, not global average

Rather than relying on global averages, evaluate costs by region, market, and category, as pricing drivers vary considerably around the world. Rebuild supplier negotiations around your actual route and city mix.

Lock multi-year rates with fuel-surcharge caps

Push airline and hotel agreements toward fixed-term pricing with defined ceilings on fuel and energy pass-throughs. Include break clauses tied to independent benchmarks so you retain flexibility if crude prices retreat materially.

Set a travel-necessity threshold and enforce it

Introduce approval tiers requiring documented commercial justification above a fixed trip value. Reserve physical travel for revenue-critical meetings and mandate virtual alternatives elsewhere, measuring the policy’s savings against forecast cost inflation each quarter.

Hedge energy exposure across the wider cost base

Extend fuel and energy hedging beyond direct consumption to freight, utilities, and supplier contracts. Review hedge tenors against a scenario in which the strait stays constrained through 2029 rather than reopening within months.

Pre-book critical itineraries and diversify carrier reliance

Secure seats and rooms for board meetings, audits, and regulatory deadlines well ahead of demand peaks. Maintain accounts with at least two carrier alliances per key route to protect against capacity withdrawal or sudden fare spikes.

Risk Flow Graph

Using the data from our flagship AI powered threat intelligence tool*, we can see trends of events per threat category over time. This fortnight, the biggest increase in risks concerns (1) Geopolitical; 110 stories, (2) Technological; 90 stories, (3) Economic; 68 stories, (4) Societal; 52 stories, (5) Environmental; 44 stories.

Fx.AI is exclusive to Fixinc clients. Contact us to learn more.

Quick snippet stories

Middle East Workforce Mobility Under Strain
Regional disruption is forcing employers to rethink how people move across Middle East borders. The risk is straightforward: visa processing, assignment continuity, and evacuation logistics all fail simultaneously under geopolitical stress. Map immigration dependencies per assignee now, hold contingency permits in secondary jurisdictions, and rehearse relocation protocols before conditions deteriorate further.
Main link to resource
Google Earth Rollback Undermines Digital Evidence
Google Earth’s reversal of AI-enhanced imagery has exposed how fragile digital evidence has become. The risk sits with anyone relying on satellite imagery for insurance claims, environmental monitoring, or legal proceedings. Verify imagery provenance independently, retain original unenhanced source files, and require chain-of-custody documentation before submitting geospatial material as evidence.
Main link to resource
UK Jobs Market Enters Sharp Downturn
Britain’s labour market is reportedly suffering its worst slump since the financial crisis, with policy changes blamed for accelerating hiring freezes. The risk is concentrated in consumer-facing sectors and firms carrying high fixed employment costs. Stress-test workforce plans against demand contraction, review redundancy exposure early, and secure credit facilities before conditions tighten further.
Main link to resource
Rhine Lows Prove Climate Risk Persists Record low Rhine water levels are again constraining European barge freight, echoing the drought and El Niño pressures we continue to monitor. Climate risk remains immediate despite attention shifting to AI and geopolitics. Pre-qualify rail and road alternatives for inland waterway routes, and build seasonal inventory buffers ahead of low-water periods.
Main link to resource
AI Reshapes Insurance Economics And Specialisation
Artificial intelligence is restructuring insurance underwriting, pricing, and claims specialisation. The risk is model concentration: insurers converging on similar AI-driven risk assessments could misprice systemic exposures simultaneously. Maintain independent human underwriting review for large or novel risks, audit model inputs regularly, and diversify carriers across differing assessment methodologies.
Main link to resource

Need support?

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

The Squeeze | Risk Updates for Weeks of 15 July - 29 July '26

Ollie Law — Wed, 29 Jul 2026 10:56:15 GMT

Hello 👋 get a brew on because these are the top emerging risks between July 15th, and July 29th, 2026…

Review our report’s terminology here ↗

Our main risk this fortnight is…

1. Geopolitical: Global Chokepoints Squeeze Trade Flows

Recent disruption in the Strait of Hormuz has highlighted a broader dynamic: pressure in the global economy is not evenly distributed, concentrating in narrow chokepoints where a single actor or natural force can restrict trade.
Businesses need to understand exposure and build innovation for when chokepoints, such as the Strait of Hormuz, rare earth elements, or semiconductor markets, are pinched.
When auto demand soared in 2021 to 2022, automakers were left short of semiconductors, delaying or reducing production and resulting in about 13 million fewer light-duty vehicles produced from 2021 to 2023.
Importing economies rely on three or fewer nations for their main share of global trade. The US imports primarily from China, Mexico, Canada, and Europe, with China concentrated on commodities, autos, and pharmaceuticals.
In an era defined by renewed great power competition, geopolitical distance again matters, increasing pressure on the sprawling, globally distributed supply chains that arose after the Cold War.

Sources

You should be concerned if…

Manufacturers reliant on semiconductors or critical materials: Concentrated supply of chips and rare earths means a single chokepoint event can halt production for months. The 2021 to 2023 auto shortfall shows how quickly narrow dependencies cascade into lost output and revenue.
Energy-dependent economies and shippers routing through the Gulf: The Strait of Hormuz carries a substantial share of global oil and LNG. Any restriction affects insurers, refiners, and downstream industries far beyond the immediate region, driving price volatility and supply uncertainty.
Firms concentrated in few sourcing countries: Importers relying on three or fewer nations face acute exposure. Sudden tariffs, export controls, or conflict at a single origin point leave little short-term substitution capacity to keep goods moving.
Companies with limited supply-chain visibility: Organisations that cannot map dependencies beyond tier-one suppliers will discover chokepoint exposure only during a crisis. Blind spots in deeper tiers convert a manageable event into a prolonged operational shock.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Map chokepoint exposure across all tiers

Identify where products, materials, and logistics routes pass through concentrated dependencies with limited substitutes. Extend mapping beyond tier-one suppliers to reveal where a single event could restrict flow across your entire network.

Diversify sourcing and build strategic buffers

Reduce reliance on any single country or route by qualifying alternative suppliers and holding targeted buffer stock for critical inputs. Dual-sourcing and regionalisation improve structural resilience against sudden restrictions at concentrated nodes.

Adopt scenario planning and digital modelling

Use scenario planning and digital modelling to build proactive resilience rather than reacting to disruptions. Stress-test multiple chokepoint scenarios, from shipping-lane closures to export controls, so responses are pre-planned rather than improvised under pressure.

Track geopolitical and industrial-policy signals

Monitor tariffs, export controls, and investment restrictions that reshape production footprints. Early awareness of policy shifts lets firms reposition sourcing and inventory before a chokepoint tightens rather than scrambling afterwards.

2. Technological: Third-Party Risk Threatens Supply Chains

Companies have spent years strengthening their supply chains against disruption, but Swiss Re says many have overlooked one of the biggest risks by focusing only on their own operations, instead of partners’ weaknesses too.
The study found that 43% of Fortune 500 Europe companies report assessing physical risk to their own facilities, but only 7% publicly disclose extending such assessments to supplier facilities, and fewer than 2% disclose assessing the wider infrastructure they rely on.
Supply chains today are more interconnected than ever. A disruption at a supplier, a power provider, or a transport hub can have consequences well beyond the location where the event occurs.
Modern supply chains extend far beyond the vendors an organisation directly manages. Each third-party relationship is underpinned by its own network of fourth and nth parties, creating exposure that most organisations can neither see nor control.
Gartner research reveals that third-party breaches cost roughly 40% more to remediate than those that originate within an organisation’s own systems, due to added complexity spanning multiple entities and jurisdictions.

Sources

You should be concerned if…

Organisations with hundreds or thousands of suppliers: Monitoring vast vendor networks is so complex that third-party risk is often lived with rather than removed. Yet a single unprepared supplier can create a major, invisible vulnerability in your resilience.
Firms assessing only their own facilities: With just 7% extending risk assessments to suppliers and fewer than 2% to wider infrastructure, most companies carry hidden exposure. These gaps stay unidentified until a disruption forces a costly, reactive scramble.
Businesses dependent on fourth and nth parties: Exposure created by subcontractors, cloud services, and technology providers is largely unseen and uncontrolled. A failure deep in the chain can ripple back with consequences the direct buyer never anticipated.
Security and continuity teams: Third-party breaches cost around 40% more to remediate than internal incidents because they span multiple entities, jurisdictions, and data environments. Unmanaged vendor risk multiplies both financial and regulatory exposure.

Preventative actions

Return to the basics of resilience

Ask every third party a simple question: do you have a plan, and when did you last validate it? If a supplier cannot provide that in writing, verified within the last twelve months, you have identified a major vulnerability immediately.

Map suppliers on a risk maturity spectrum

Build a map of third and even fourth parties you would consider unacceptable on the risk maturity spectrum. This prioritises attention on the weakest links, letting you act promptly rather than investigating thousands of vendors indefinitely.

Extend assessments beyond your own walls

Push risk assessments outward to supplier facilities and the wider infrastructure you rely on. Understanding dependencies beyond your operations determines whether you recover quickly or face prolonged disruption when an upstream event strikes.

Make resilience continuous, not periodic

Shift from episodic risk reviews to continuous preparedness, integrating ecosystem partners into stress testing. Treat resilience as a core business discipline with clear ownership rather than a periodic IT or procurement initiative.

Risk Flow Graph

Using the data from our flagship AI powered threat intelligence tool*, we can monitor trends in risks per threat category over time. This fortnight, the biggest increase in risks concerns (1) Geopolitical; 70 stories, (2) Technological; 43 stories, (3) Economic; 42 stories, (4) Societal; 17 stories, (5) Environmental; 19 stories.

Fx.AI is exclusive to Fixinc clients. Contact us to learn more.

Quick snippet stories

Utilities Pledge to Shield Consumers from AI Power Costs
More than 200 entities have joined Trump’s voluntary Ratepayer Protection Pledge to ensure US ratepayers are not saddled with costs from the AI data centre buildout. The risk is that the pledge is entirely voluntary and has little control over pricing set by state regulators, with prices already rising sharply in some states. Consumers should scrutinise local tariff filings.
Main link to resource
European Retailers Face Worst Distress Since 2008
The Weil European Distress Index shows distress rising across all markets, with retail-sector distress hitting its highest level since the global financial crisis, driven by weaker growth, deteriorating confidence, and energy market turmoil. The risk stems from squeezed profits and shaky consumer spending. Firms should protect liquidity and stress-test balance sheets against further cost shocks.
Main link to resource
Malaysia Confronts Escalating Data Leak Crisis
Malaysia faces mounting data breach exposure as rapid digitalisation outpaces protection. The country’s push to become a regional digital hub has made it more visible to threat actors, with programmes accelerating adoption but exposing gaps across fragmented, multi-vendor environments hard to monitor. The core risk is supply-chain compromise. Organisations should tighten vendor oversight and breach detection.
Main link to resource
H5N1 Detection Exposes Insurance Coverage Gaps
Broker Howden argues H5N1 clade 2.3.4.4b presents a different risk profile because it has become established in wild bird populations across continents, creating repeated spillover opportunities rather than isolated events. The risk is downstream exposure across food manufacturing, retail logistics, and hospitality, sectors whose insurers may not have priced avian influenza into business interruption books. Review policy wordings now.
Main link to resource
Hidden Fragilities Threaten Auto Supply Chains
Automotive supply chains carry deep structural vulnerabilities beneath the surface. The 2021 to 2022 chip crunch showed how a single concentrated dependency can halt production, leaving automakers exposed when demand and supply diverge. The risk lies in unseen sub-tier reliance. Manufacturers should map deeper tiers and diversify critical component sourcing.
Main link to resource

Need support?

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

Billing Blindness | Risk Updates for Weeks of 1 July - 15 July '26

Ollie Law — Wed, 15 Jul 2026 11:31:19 GMT

Hello 👋 get a brew on because these are the top emerging risks between July 1st, and July 15th, 2026…

Review our report’s terminology here ↗

Our main risk this fortnight is…

1. Technological: AI Bills Blindside Corporate Leaders

A KPMG report surveyed 2,145 senior executives across 20 countries, finding 29% had no idea where growing AI costs came from, and a further third said their own cluelessness was a barrier to deploying AI.
The refrain from executives amid continuous job cuts has been that AI can do the job cheaper than human workers. But a new report issues a stark warning: that thinking is wrong, as business owners are aghast at their AI bills.
Though enterprises could once count on AI companies to subsidise large language models via flat-rate contracts, that is no longer a given, as rising computational costs force the tech sector into a defensive posture.
As scale increases, a new challenge is emerging. Only 26% of organisations have real-time visibility into the cost of running AI, and disciplined execution is now a core constraint.
“AI is now as much a financial management priority as it is a technology one,” Rob Fisher, global head of advisory at KPMG, said in a statement.

Sources

You should be concerned if…

Enterprises deep into AI deployment: As providers pivot from flat-rate to usage-based pricing, costs can escalate unpredictably. Firms that budgeted AI as a fixed overhead replacement for labour now face volatile, metered bills with limited real-time cost visibility.
Finance and procurement leaders: AI has become a financial management challenge, not just a technology one. Without forecasting and monitoring tools, teams risk approving deployments whose true operating cost only becomes clear after the meter runs.
Companies that cut staff expecting AI savings: Less than a quarter of CEOs in Malaysia report AI adoption generated additional revenue, and while 17% achieved cost reductions, 26% report AI actually increased their cost base. Savings promises may not materialise.
Boards and investors: Concentrated AI spending without governance creates financial exposure. Leadership teams lacking visibility into AI economics may over-commit capital to tools that fail to deliver measurable returns, straining margins already under macroeconomic pressure.
Small and mid-sized firms: With thinner buffers than large enterprises, unpredictable per-token costs can quickly outpace the value delivered, particularly for frequent, high-volume tasks where paying each time an action occurs becomes unsustainable.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Build AI cost forecasting and monitoring capabilities

Establish real-time dashboards tracking token consumption, per-task costs, and departmental usage. As usage-based pricing models become more common, organisations are still building the capabilities required to forecast, monitor, and manage AI spending effectively. Close that gap now.

Renegotiate contracts and pricing models

Review supplier agreements before renewal. Where possible, lock in predictable pricing tiers or caps, and model total cost of ownership across flat-rate versus usage-based options before committing to any large-scale deployment.

Pilot before scaling

Run tightly scoped proofs of concept with defined budgets and success metrics before enterprise rollout. Measure actual cost-per-outcome rather than assuming AI replaces labour at lower cost, and pull the plug on tasks where economics do not add up.

Treat AI as a financial governance priority

Bring finance leaders into AI decision-making alongside technology teams. Assign clear accountability for AI budgets, require ROI reporting, and integrate AI spend into standard financial planning rather than treating it as an experimental line item.

Match the tool to the task

Not every process suits a probabilistic, per-use model. Assess task frequency and value carefully, reserving costly AI agents for high-value work while retaining cheaper deterministic automation or human processes where they remain more economical.

2. Economic: CEOs Pay Premium For Supply Resilience

Facing a continued environment of supply chain threats, businesses are becoming more risk averse and are willing to spend more money to ensure resilience, according to an industry survey from consulting firm Proxima.
Almost three quarters (72%) of CEOs said they would accept an increase of more than 10% on their current third-party supplier costs in order to guarantee supply chain resilience.
Threats were spread widely, with roughly equal responses (17-22%) listing conflict and geopolitical tensions, emerging technologies, sustainability and regulatory requirements, climate change and extreme weather, and protectionist policies such as tariffs.
Slightly more than half (51%) of surveyed global CEOs say their businesses could not maintain day-to-day operations for over three weeks without disruption if a major supply chain shock occurred tomorrow.
Nearly half (45%) of businesses have experienced a supply chain disruption caused by a cyber incident in the last 24 months.

Sources

You should be concerned if…

Businesses reliant on third-party suppliers: With most CEOs willing to absorb over 10% higher supplier costs for resilience, procurement budgets face upward pressure. Almost four in ten CEOs would pursue cost savings, 35% would pass rises to customers, and 26% would absorb costs through reduced margins.
Consumers and downstream buyers: As roughly a third of CEOs plan to pass supplier price rises on to customers, the cost of building resilience will surface in end prices, adding to inflationary pressure already fatiguing households.
Firms with limited operational buffers: With more than half of CEOs unable to sustain operations beyond three weeks after a major shock, thinly buffered businesses face existential risk from a single disruption to critical suppliers.
Organisations with weak cyber-supply visibility: With nearly half hit by a cyber-driven supply disruption in two years, firms lacking visibility into supplier cyber posture face a fast-growing and under-managed threat vector.
Investors and boards: Risk management considerations such as improving resilience, plus flexibility and agility, have displaced cost-efficiency as the top drivers of network changes. Capital allocation strategies must adapt to this structural shift.

Preventative actions

Diversify and dual-source critical inputs

Companies are diversifying international supply chains, introducing alternative sources to reduce exposure to localised trade risk or achieve local content requirements. Add supplier nodes incrementally rather than attempting a costly full realignment.

Stress-test operational continuity

With half of CEOs unable to operate beyond three weeks after a shock, model worst-case scenarios against your own runway. Identify which suppliers, if disrupted, would halt operations fastest and build targeted buffers around them.

Close cyber-supply-chain visibility gaps

Given the volume of cyber-driven supply disruptions, extend cyber risk assessment beyond your own perimeter to critical suppliers. Require security attestations, monitor tier-one vendors continuously, and factor cyber exposure into supplier selection.

Fund resilience deliberately, not reactively

Decide in advance whether resilience uplifts will be funded through efficiency gains, price increases, or margin absorption. A planned funding strategy avoids crisis-driven decisions that damage customer relationships or profitability.

Embed scenario planning and risk ownership

Prioritise risk identification, implement scenario planning, and create organisational units dedicated to managing risks. Define business continuity plans so companies can anticipate and mitigate risks before they affect operations.

Quick snippet stories

Malaysian Business Confidence Turns Pessimistic
Business confidence in Malaysia weakened in Q1 2026 as companies grew cautious over geopolitical tensions and cost pressures, with the RAM Business Confidence Index falling to 42.2 from 53.1, back below the 50-point optimism threshold. The risk is that heightened Middle East tensions have pressured energy markets, contributing to rising fuel prices and supply chain disruptions. Diversify sourcing and hedge energy exposure.
Main link to resource
Insurer Warns of Super El Niño Supply Shock
TT Club is calling on supply chain operators worldwide to review risk and resilience strategies amid growing forecasts of a “super” El Niño event. The Panama Canal Authority has tightened draft restrictions amid forecasts of reduced rainfall. Build inventory buffers and integrate seasonal climate intelligence into planning.
Main link to resource
Australian Businesses Rank Most Fragile Globally
Australia faces the greatest vulnerability among surveyed markets, with only 5% of firms able to sustain operations for 4 to 6 months during disruption, while 21% can only survive one to two weeks and 59% would fail within three weeks. The risk is compounded by geographic isolation and extended lead times. Prioritise local and regional sourcing and critical-input buffers.
Main link to resource
Hormuz Disruption Threatens Beyond Oil
Disruption in the Strait of Hormuz spells trouble for global markets well beyond crude, hitting shipping, LNG, and broader trade flows. The risk is compounding: any slowdown in the Panama Canal would leave carriers facing simultaneous slowdowns across three of the world’s most vital shipping corridors alongside existing Hormuz and Suez disruptions. Map alternative routes and secure freight capacity early.
Main link to resource
Geopolitical Tensions Reshape Global Trade Strategy
Escalating geopolitical friction is forcing businesses to rethink risk and exposure across markets. The risk is systemic. As global commerce becomes driven by political alliances rather than pure efficiency, diplomatic disputes can trigger tariffs, sanctions, or barriers that halt supply chains overnight. Diversify markets, build regional alliances, and stay adaptable.
Main link to resource

AI Risk Flow Graph

Using the data of our AI based threat intelligence scraper, we can see trends of events per threat category over time. This fortnight, the largest increase in events comes under (1) Geopolitical, (2) Technological, (3) Economic, (4) Societal, (5) Environmental.

Want to discuss how these risks might effect your business?
Book 30 minutes with us, free ↗

Need support?

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

No ceasefire for a drought: The chokepoint that failed while the world watched Hormuz

Ollie Law — Sun, 12 Jul 2026 22:29:14 GMT

The Strait of Hormuz closed because of a conflict. Two governments, missiles, a war you can name and, in theory, end at a negotiating table. That is the loud crisis, and we have covered it. But while everyone watched Hormuz, a second one of the world’s most important waterways started failing for an entirely different reason. The Panama Canal is running low on rain. There is no negotiating table for that. You cannot broker a ceasefire with a drought.

That is the whole story in one line. One chokepoint went down to a conflict. The other is going down to the climate. And most continuity plans are built for neither.

In our last fortnightly update we made the point that the airlines have become a live resilience lesson, that the real problem is no longer whether the airspace is technically open; it is that too much traffic is chasing too few viable routes. The canal is that exact lesson, on water. And it comes with a trap the airlines did not have. The canal looks like it has recovered. It did not, not in the way that matters to you.

Open, but empty

Start with the figure few are quoting. Through the 2023-24 drought, LNG carrier traffic through the canal’s newer locks fell roughly 73 percent. Before the drought, around 26 LNG carriers went through every month. By the first half of 2025 it was about four.

The lake is full again. Full-draft operations are back. But the LNG carriers are not. They rerouted around the Cape of Good Hope, built that longer route into their contracts, and stayed there because it was cheap enough to keep.

So, the canal is open, and revenue is up, and one of its highest-value cargo types has quietly left and is not coming back. That is not a footnote. If anything in your supply chain touches LNG, or moves between Asia and the Americas, the assumption that it flows through Panama the way it did in 2022 is simply wrong now, and no headline about water levels makes it right again.

Shock versus stress

The drought was presented as a shock and behaved as stress. Water down, ships capped, revenue lost, then water back and revenue up, the clean bounce-back arc of a shock.

But underneath it the route reorganized for good, and the visible recovery masked the structural one. Stress has no recovery point on the dashboard because there was never a clean break to recover.

Here is why it lands on your desk and not Panama’s. A stress does not hurt whoever caused it or whoever sits nearest to it. It hurts whoever kept planning as though nothing changed. If your program is still keyed to the shock, water’s back, canal’s open, all clear, then you are the one holding a risk that has already moved.

The one question your plan gets wrong

You could run the BIA loop in your sleep. The step that quietly fails is the first one, and specifically where the boundary of “the organisation” gets drawn. This is the part that everyone moves through fastest and should sit with longest.

Most BIAs draw it at the tier-one supplier. Is the supplier up? Few ask whether the route that supplier depends on is the same route it depended on eighteen months ago. A plan that checks whether the canal is open, instead of whether your specific cargo returned to it, is measuring the shock and blind to the stress. That is the gap between a recovery time that is real and one that expired in 2022 without anyone reopening it.

And it is not only the canal. Somewhere in your chain is a single node every one of your suppliers leans on without declaring it, a port, a strait, a shared energy source. No one owns the job of testing it because individually everyone assumes it holds.

This is the conversation the risk appetite statement exists for, and the one artefact almost nobody revisits. It is built to account for sudden shocks. It rarely accounts for the slow erosion of something everyone assumed was permanent.

The fix runs on a slower clock than the risk

Panama’s answer is the Río Indio reservoir, a roughly $1.6 billion project with tenders not expected until 2027 and completion in the early 2030s at the earliest.

Leave aside the execution risk. The real problem is timing. El Niño has already formed and is expected to strengthen, and the worst water impacts usually arrive the year after onset. This points to the next real squeeze being 2027. The fix is years behind the risk. A plan that waits for the reservoir is planning something that will not exist when the next stress hits.

What resilience looks like

While everyone argued about how to fix the canal. Hyundai Glovis moved roughly 900 vehicles from Asia to the US East Coast overland, by rail across Mexico's Isthmus of Tehuantepec. Not a ship. A train. Not a fix for the canal, a way to stop needing it.

That is the whole distinction. Making the canal stronger is one thing. Not depending on it is another, and it is the one that survives the next drought. But you can only build a way around a chokepoint your plan actually wrote down as a chokepoint. If it is not in the plan, there is nothing to build around.

A message your board will not want to hear

When the dashboard goes green, the pressure to declare it over is enormous. The canal is open. Revenue is up. The surcharges have eased. Telling the board the crisis is resolved on the strength of those numbers is not lying. It is reading the shock and missing the stress. And it means walking the message back the next time that stress surfaces as a fresh shock.

The harder line, and the accurate one, is that the event is over but the exposure is not. That is a difficult thing to say to a board that wants closure. It is exactly what the situation requires.

What to do

The fortnightly update already gave the action list. Book slots forward, audit your LNG exposure, stress-test the compound scenario, stop treating war risk and climate risk as separate lines when they now land together.

This piece adds one thing underneath all of it. Reopen your business impact analysis. Not to change a number, but to redraw the line around what counts as your business. Ask whether it is built on where your cargo used to move, or where it actually moves now. The canal has run on rain since 1914. That will not change. What can change, before 2027 rather than after it, is whether you are still quietly betting the shortcut will always be there.

Thanks for reading Unbreakable Ventures! This post is public so feel free to share it.

Masterclass: What the Gulf airlines got right when everything around them went wrong

Umaima Farhan — Mon, 06 Jul 2026 02:51:03 GMT

Most of what has been written about Emirates, Etihad, and Qatar Airways in 2026 focuses on how bad things are. The cancelled flights, the empty terminals, the falling load factors. That is the story that travels.

What is not traveling is the recovery. The decisions that are being made under pressure. The mechanisms that kept these airlines operational when the conditions around them said they should not be. That is the story worth telling.

Transit machines, not tourist carriers

Emirates, Etihad, and Qatar Airways are not primarily carriers connecting tourists to a destination. They are transit machines.

Seven in ten Emirates passengers never enter the UAE. Three in four Qatar Airways passengers never touch Qatari soil.The airports in Dubai, Abu Dhabi, and Doha are engineered around layovers, not arrivals. The model is built entirely on being the most reliable junction between everywhere else.

Every critical function, every revenue stream, every growth assumption sits on a single geographic node. When that node is disrupted, there is no mixed network to absorb the shock, no domestic routes to fall back on, no buffer. The transit model that built these airlines is the same model that leaves them fully exposed when the region becomes the risk rather than the route.

That model produced extraordinary results before the disruption. Emirates entered 2026 having just posted AED 24.4 billion (US$6.6 billion) in profit before tax. Qatar Airways held the title of world’s best airline.All three are 100% government owned: Emirates through the Investment Corporation of Dubai, Etihad through Abu Dhabi’s sovereign wealth fund ADQ, Qatar Airways through the Qatar Investment Authority.

These are not airlines that answer to shareholders or go to capital markets when they need cash. They are sovereign strategic assets, and that changes the risk calculation entirely when things go wrong.

What happened

On 28 February, airspace closures cascaded across the region within hours, covering nine countries by the end of the day. By 1 March, cancellation rates peaked above 65%, with 2,504 flights cancelled or grounded in a single day at the height of the disruption.

IATA confirmed a 60.8% traffic fall in March and a 46.6% demand collapse in April, with the three carriers removing more than 5.4 million seats and 18,000 flights in that month alone.At peak disruption, Qatar Airways saw 77% of its operations affected, Etihad 49%, and Emirates 32%.

By June, Emirates had recovered to roughly 80% of pre-war volumes before filing a further 16% schedule cut. Qatar grounded its entire A380 fleet through April and May and ferried nine widebodies to storage in Spain in three days. Etihad is the outlier, running 8% above last year by pivoting aggressively to China and non-western corridors.

IATA projects Gulf carriers will lose $4.3 billion in 2026, moving from a $7.2 billion profit in 2025 to the only regional net loss in global aviation.

The cargo operation that kept running

While Qatar Airways’ passenger business was effectively grounded, its cargo division kept flying. All 30 Boeing 777 freighters fully deployed, 87 daily flights at an 81% flown-as-planned rate, and 93% of Doha’s cargo backlog cleared by end of March.

Qatar had built its cargo infrastructure independent from its passenger operation that could continue while the other stopped. Most organisations include this principle in their continuity plans.

Very few actually build it. When its passenger schedule collapsed, cargo kept the airline commercially relevant, maintained freight customer relationships, and provided operational continuity that its grounded A380s could not.

The GCC as a resilience framework

The standard analysis says the transit model creates a fatal vulnerability: no domestic fallback. That is true at the individual airline level. What it misses is that the GCC functioned as the fallback.

When the crisis hit, Saudi Arabia and Oman opened their airports to accommodate regional carriers.Muscat Airport became the de facto regional relief hub, with Qatar Airways running its first post-crisis flights from there and British Airways and Lufthansa using it for repatriation operations.

Qatar’s airspace remained accessible through approved corridors even during broader regional restrictions.

Neighboring states provided operational fallback for each other, not because a formal agreement required it, but because the relationship and shared interest made it the natural response.

The GCC does not function as a collection of separate countries with separate interests in a crisis. It functions as one region with states. The solidarity is cultural, relational, and consistent. It activated immediately because it did not need a contract to trigger it.

IATA’s regional vice president for Africa and the Gulf, speaking at the IATA AGM in Rio on 6 June 2026, described a response that reflected cross-border operational flexibility at a regional scale, driven by coordination between airlines, governments, and air navigation service providers that is rarely seen outside crisis conditions.

Emirates demonstrated reputational continuity in practice when Dubai International Airport was disrupted in the opening weeks. Staff were placed in hotels across the city, stranded passengers rebooked onto other carriers at Emirates’ cost, and the entire response was built around one clear signal: the standards you expect from this airline have not changed.

That signal matters more for a transit model than for almost any other business. Passengers do not have to connect through Dubai. They choose to, because of trust in the product, trust in the reliability, trust in the experience.

When a crisis hits, trust becomes the most important asset on the balance sheet. A passenger who re-routes their habit through Singapore because Dubai felt unreliable may not come back. Keeping that choice intact under pressure, absorbing the short-term cost to protect the long-term relationship, is what a rebuild communication strategy looks like when the stakes are the entire business model.

The warnings that were absorbed and filed away

In 2019, drone and missile attacks struck Abha International Airport in Saudi Arabia, halting flights and injuring dozens of civilians. Gulf aviation had its first clear warning that its infrastructure was within range of hostile action. In 2022, Russia’s airspace closure proved that a major routing assumption could be invalidated overnight.Both times the industry adapted and moved on.

Warning signals existed. They were absorbed into normal operations and the structural vulnerability was never re-examined because nothing catastrophic followed immediately. The cost of that became visible on 28 February 2026.

This matters because a black swan is genuinely unforeseeable. This was not. The risk had been flagged, demonstrated twice in six years, and filed away. For BCM practitioners the distinction between an unforeseeable event and an unexamined one is critical. This crisis sits firmly in the second category.

The hedging decision that looks obvious now

Emirates is hedged on fuel through 2028-29 and holds AED 59.6 billion (US$16.2 billion) in cash. While the industry abandoned fuel hedging in 2024 and 2025, deciding during stable times the practice was no longer worth the cost, Emirates kept it.

Spirit Airlines, the first airline casualty of this disruption, modeled fuel at $2.24 a gallon and got $4.51. It no longer exists. Ryanair’s CEO has warned two or three more European airlines could follow.

Emirates built its continuity capability before it needed it rather than trying to assemble it after the disruption started.

The difference between Emirates and Spirit Airlines is not geography. Emirates retained the financial buffer, even when the industry consensus said was unnecessary, a decision made during good times when it was unpopular.

Any organisation that has recently removed cost buffers or contingency reserves because conditions were stable and the savings looked attractive should sit with that for a moment.

Hubs are not permanent

Beirut was once a significant aviation hub connecting the Arab world to Europe. It lost that position because sustained political instability made it untenable over decades.

Bahrain was the Gulf’s aviation gateway before Dubai absorbed that role, not through conflict but through competitive displacement. Gulf Air started cutting Dubai services in the 1980s, which is literally what prompted the founding of Emirates in 1985.

The OAG Megahubs 2025 ranking showed Istanbul climbing six places to second globally before the current disruption even began. The competitive challenge to Gulf hub dominance was already underway. The crisis accelerated it.

The 2017 Qatar diplomatic blockade is the right historical case study. Four GCC members severed ties with Qatar, removed its Gulf airspace access, and closed their borders.

Qatar Airways rerouted every flight over alternative airspace, absorbed the cost, and three years later was voted the world’s best airline. The GCC does not permanently displace its own.

Former Etihad CEO James Hogan estimates recovery at 12 to 24 months after hostilities end, calling it a matter of when, not if.

Every business has a bad year. This is theirs.

Abu Dhabi kept its Formula 1 season finale, confirmed for December 2026 with tickets tracking ahead of last year. Bahrain and Saudi Arabia lost their races.The UAE maintained operational stability through this crisis that neighboring states, more directly targeted, did not. Emirates and Etihad operate out of that envelope.

When Kuwait Airport was struck, every headline reported the attack. Almost none reported that only one terminal was damaged and the others kept flying, with Terminals 4 and 5 resuming operations after safety checks confirmed both were undamaged.

The framing of caution has become the framing of catastrophe. For a BCM analyst those are not the same thing.

Emirates, Etihad, and Qatar Airways are having a bad year. It is lasting twelve months and will cost the region $4.3 billion.

But these are three of the most decorated airlines in the world, fully backed by sovereign governments, in a region that has been navigating instability since well before any BCM plan was written about it. They recovered from the 2008 financial crisis. They recovered from COVID-19 and came back to record results.

Emirates holds US$16.2 billion in cash. Etihad is outperforming its pre-war schedule. The winter schedules being filed now are bets on recovery. Watch what actually flies. That will begin to tell you whether the geography and sovereign backing that built these hubs proves durable enough to pull the flow back.

The recovery is the story. And the recovery is just beginning.

Thanks for reading Unbreakable Ventures! This post is public so feel free to share it.

Trapped By Design | Risk Updates for Weeks of 17 June - 1 July '26

Ollie Law — Wed, 01 Jul 2026 07:53:41 GMT

Hello 👋 get a brew on because these are the top emerging risks between June 17th, and July 1st, 2026…

Review our report’s terminology here ↗

Our main risk this fortnight is…

1. Technological: Hidden AI Dependencies Expose Enterprises

A new IBM study finds that 91% of organisations surveyed say they don’t fully understand their dependencies across AI vendors, models, and infrastructure, limiting the ability to assess risk and plan for disruption.
As firms embed AI into core operations, most remain locked into systems they cannot easily change, with 81% saying a seven-day vendor outage would still cause severe or critical disruption, effectively halting operations.
Disruption is already routine. Surveyed leaders report an average of six AI-related disruptions over the past two years, largely driven by vendor services.
The threats extend beyond outages. Respondents also cite unexpected changes across the AI ecosystem, including price increases, usage restrictions, model deprecations, and performance degradation.
A small elite is pulling ahead. Organisations with the most advanced AI control capabilities protect more than half of their operating profit from AI-driven disruptions, yet only 7% operate at this level, signalling a widening gap between those building adaptable AI systems and those constrained by dependency.

Sources

IBM Study: Limited Control and Rising Dependencies Leave Enterprises Exposed in the Age of AI | IBM Newsroom | June 2026

You should be concerned if…

Enterprises with AI embedded in core operations: With most firms unable to map their AI dependencies, a single vendor outage, price hike, or model deprecation could halt operations. The lack of visibility leaves leaders unable to assess true exposure or plan continuity.
Regulated industries handling sensitive data: 68% of surveyed executives say meeting data residency and sovereignty requirements across geographies is challenging, creating compliance and continuity risk for financial services, healthcare, and government bodies operating across borders.
Organisations carrying legacy technical debt: Legacy complexity is also widely cited by respondents (57%), reflecting mergers, acquisitions, and historical decisions, which compound the difficulty of switching or governing AI systems flexibly.
Smaller firms reliant on single AI providers: Without the resources to diversify vendors or build sovereign infrastructure, smaller players risk being trapped by usage restrictions and price increases, eroding margins and limiting their ability to respond to ecosystem shifts.
Procurement and governance teams: Traditional procurement cycles move slower than AI ecosystem changes, leaving teams exposed to contractual terms that fail to account for sudden model retirements, performance degradation, or escalating costs.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Map your full AI dependency chain

Conduct a comprehensive audit of every AI vendor, model, and infrastructure layer your operations rely on. Visibility is the prerequisite for risk assessment. You cannot plan continuity around dependencies you have never documented or stress-tested.

Build vendor redundancy and exit strategies

Avoid single points of failure by qualifying alternative providers and negotiating portability into contracts. Ensure data and workloads can migrate if a vendor raises prices, restricts usage, or deprecates a model your operations depend upon.

Strengthen AI sovereignty and control

Invest in greater control across data, models, infrastructure, and applications. The minority of firms with advanced control capabilities protect significantly more operating profit, demonstrating that adaptable, sovereign AI architecture directly underpins resilience and performance.

Stress-test for a multi-day vendor outage

Model the operational impact of a seven-day outage from each critical AI supplier. Establish fallback processes, manual workarounds, and contingency capacity so that a single disruption cannot effectively halt your business.

Align governance with AI velocity

Update procurement and governance frameworks to match the pace of AI change. Embed clauses covering model deprecation, performance guarantees, price stability, and data sovereignty so contractual protections keep pace with a fast-evolving ecosystem.

2. Geopolitical: Airlines Become Resilience Case Study

The airline industry is among the hardest hit by the Iran conflict, offering a live business continuity lesson. The major airlines of the Middle East, including Emirates, Etihad, and Qatar Airways, suspended all operations facing major disruptions, while international airlines like Air India, British Airways, Cathay Pacific, and Lufthansa also suspended services.
The disruption has been severe. Airspace closures in the UAE, Qatar, Kuwait, Bahrain, and other Gulf states have led to over 4,000 daily flight cancellations, stranding hundreds of thousands of passengers.
Even with reopenings, recovery is slow. The largest operational challenge is no longer whether airspace is technically open. The issue is that too much traffic is now attempting to move through too few viable routing options.
Layered atop this, structural supply chain strain persists. Austrian Airlines’ CEO warns that aviation supply chain disruption remains a long-term challenge, with aircraft delivery delays and shortages of parts and engines expected to influence planning through at least 2028.
The survivors will teach the rest of us. Carriers that endure are doing so through contingency planning. One carrier has avoided capacity reductions by relying on contingency planning, fleet flexibility, and support from the wider group. Meanwhile, smaller airlines like Gulf Air and Middle East Airlines have faced an increased risk of bankruptcy due to sustained airspace closures and soaring insurance premiums.

Sources

You should be concerned if…

Gulf-based and Asian carriers: Proximity and reliance on Gulf transit make these airlines most exposed. India is particularly exposed because roughly 40% of its $130 billion in annual revenue comes from traffic passing through the Gulf. Reroutes and suspensions are eroding margins severely.
Smaller and indebted airlines: Carriers without group-wide support or deep balance sheets face existential threat. Sustained airspace closures and soaring insurance premiums have pushed smaller operators toward bankruptcy, making them cautionary rather than instructive case studies.
Any business dependent on air freight: Maritime diversions around the Cape of Good Hope are adding between two and four weeks to shipping times, while air freight capacity across Middle Eastern routes has tightened and congestion is spreading through ports. Time-sensitive goods face mounting delays.
Business continuity and resilience planners across all sectors: Airlines are a leading indicator. Having weathered pandemics, fuel shocks, and now conflict, the carriers that survive offer transferable playbooks on contingency planning, asset flexibility, and operating under permanent uncertainty.
Insurers and aviation lessors: Soaring premiums and concentrated risk in volatile regions are reshaping underwriting. Lessors face exposure as carriers reroute, ground fleets, or fail, threatening lease income and asset values across long-haul widebody portfolios.

Preventative actions

Treat airlines as a live monitoring benchmark

Track how surviving carriers adapt. Their responses to airspace closures, fuel volatility, and routing constraints provide a real-time playbook for resilience that businesses in other industries can study and adapt before facing comparable shocks.

Build a credible “Plan B” for critical operations

Airlines that avoided capacity cuts did so through pre-built contingency plans and asset flexibility. Maintain alternative routes, suppliers, and capacity so external shocks disrupt your plan without halting your business entirely.

Pool and share assets across the wider group

Carriers redistribute aircraft, engines, and capacity across group networks to absorb shocks. Organisations should similarly design for shared resources and mutual support across business units rather than optimising each unit in isolation.

Reprice and diversify risk exposure

With insurance premiums soaring and routing options thin, reassess concentration risk now. Diversify suppliers, transit corridors, and geographic dependencies, and lock in contingency fuel, capacity, or inventory buffers before disruption forces reactive, costlier decisions.

Plan around prolonged, not temporary, disruption

The aviation supply crunch is forecast to persist for years. Build planning horizons that assume disruption is structural rather than transient, so your continuity strategy survives extended uncertainty rather than betting on rapid normalisation.

Quick snippet stories

Pharma Supply Chains Hit Record Pressure A Moody’s report warns that pharmaceutical supply chains face unprecedented strain as geopolitical disruption, manufacturing weaknesses, cyber threats, and counterfeit medicines combine to create a new era of risk. The danger is that these threats are interconnected yet managed in silos. Firms should adopt integrated frameworks and improve visibility across suppliers and distribution networks.
Main link to resource
UAE Weighs Humanitarian Early-Warning Centre The UAE is studying a humanitarian aid early-warning centre to strengthen crisis response, reflecting how proactive risk anticipation is becoming central to regional resilience strategy. The risk it addresses is reactive, slow disaster response amid escalating regional instability. Organisations should similarly invest in early-warning systems and pre-positioned contingency capacity.
Main link to resource
World Bank Flags Sustained Gas Price Volatility The World Bank forecasts prolonged volatility in global gas prices. The risk stems from the Hormuz disruption, which affected global gas markets, with about 20% of the world’s supply of liquefied natural gas having moved through the Strait in 2025. Energy-intensive businesses should hedge exposure and diversify supply sources.
Main link to resource
Australian Businesses Face Relentless Cyberattacks Cybercrime costs are surging as Australian businesses reportedly face an attack roughly every six minutes. The risk is intensifying as attackers exploit AI, cloud reliance, and third-party providers to breach defences. Firms should prioritise threat detection, staff training, incident response planning, and continuous monitoring of critical systems.
Main link to resource
Asia-Pacific Supply Chains May Stay Disrupted S&P warns Asia-Pacific supply chains may remain disrupted even after Hormuz reopens. The risk is that a full recovery in flows is unlikely to be immediate. Mines will need to be cleared from the main shipping lanes and supply chains will take time to normalise. Businesses should maintain buffer inventory and alternative routing.
Main link to resource

Need support?

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

Strait Talk: Six Days in Dubai After the Guns Went Quiet

Ollie Law — Sun, 28 Jun 2026 23:31:28 GMT

I booked the flight while the conflict was still live. The Strait of Hormuz was closed, missiles were still moving across the Gulf, and a week before I flew, drones struck Kuwait International Airport, killing one passenger and wounding more than sixty.

Kuwait and US Central Command blamed Iran. Tehran denied it. By the time I reached my gate in Kuala Lumpur, the airport screens were carrying a different headline. Washington and Tehran had signed a memorandum of understanding. A fragile ceasefire was holding. The war was not finished, but the shooting had mostly stopped.

I sat on the plane with a strange thought. I might be one of a very small group of professionals flying into Dubai this soon after the guns went quiet. Six and a half hours later, I understood something I have been turning over ever since. The Dubai I landed in was not the Dubai I had been watching from Malaysia, New Zealand and Australia.

That gap is the entire point of this piece.

The first thing that hit me, before anything else, was the heat. Not the Kuala Lumpur humidity I’d grown used to, but a dry, flat 37 degrees with not a cloud in the sky. The second was the efficiency. I was off the plane, through immigration, had collected my bag and was out of the terminal in under forty minutes, in a clean, professional taxi with the air conditioning turned down to something close to Arctic.

The third thing took longer to notice, because it was an absence. The motorways, the lanes, the vast pedestrian boulevards, none of them were at capacity. Dubai is built at a scale that assumes crowds, and the crowds were thinner than the architecture expected. Some of that is seasonal. The city empties out as summer climbs toward the mid-40s and, on its worst days, close to 50. But some of it was the war.

What the government chose to do with that moment was the first lesson. Along the motorway, hundred-metre billboards read “The United Arab Emirates welcomes everyone.” It was tourism messaging, but it was also something steadier, a state telling its residents in large letters that they were being looked after. I was yet to see the evidence behind the slogan, but I knew to keep an eye out.

Underneath it sat a harder edge. Several people told me that during the conflict, spreading misinformation or AI-generated deepfakes could earn you deportation or a jail term. Whether or not you find that comfortable, the effect was specific.

If information did not come from an official channel, you treated it as suspect. The fact-versus-assumption problem that defines most crises, the fog where rumour travels faster than truth, had been deliberately compressed. People knew where their information came from, and they trusted it, because what they were told kept matching what they saw.

That trust extended to the sky. When the interceptions were happening, an emergency alert went out to every phone in the country, telling anyone near a strike to seek shelter.

Residents described three or four interceptors going up for every incoming Iranian drone or missile, until the spectacle became almost routine. More than one person described it, with the dark humour that long crises breed, as a fireworks show. That is what normalisation under fire looks like, and it is not bravado. It is what happens when people believe the system over their heads is working.

Dubai was hit. I want to be clear about that, because it is where coverage and reality both have a claim. In the opening days of the war, debris from an intercepted Iranian drone sparked a fire at the entrance of the Fairmont The Palm, the five-star hotel on the same island where I would later stay. Four people were injured.

The international airport was struck and briefly evacuated. A tower in the Marina was hit by falling debris. Across the Emirates, the authorities later counted more than a dozen dead and over two hundred injured. None of that is invention, and none of it should be waved away.

And yet, by the time I arrived, the damage was contained and the city had moved on. Chatter still circulated about which marquee hotels had supposedly been struck. I walked up to the Burj Al Arab, the sail-shaped landmark on the waterfront, and found nothing. No damage, no cordon, no scaffolding. Over lunch, one businessman gestured at the skyline and said, with a smirk,

“look, they are all still standing.”

The one place the war reached me directly was my phone. GPS was unreliable for most of the trip, and taxis navigating by map were close to useless at times. I was told a data centre might have been affected by unidentified falling objects. Whatever the cause, it was the first time I had felt a live conflict reach into the device in my hand, and it was both unsettling and clarifying.

I carried one question through the entire trip. What is business confidence here, right now?

I ask because I track this figure obsessively at home. In New Zealand it is published quarterly, sometimes monthly, and it tends to predict whether a small business like mine gets paid. What I have learned is that the headline number rarely matches how people feel on the ground.

So, I asked everyone. Entrepreneurs, advisors, waiters, friends, family. The answer was unanimous, and it surprised me.

Confidence was high.

That is the most important learning I brought home. Sitting overseas, watching the bombardment, I assumed people would want to leave, and many did. But the ones who stayed were not bracing. They were positioning. Trade continued. Deals continued.

In the middle of a war, the city inaugurated tunneling on Etihad Rail and their new stations were confirmed. You do not commit billions to rail you will not ride for years unless you are confident there will be a city to ride it in.

More than the hardware, it was the handling. People had been told things they could verify, and that built the kind of trust that lets a society keep functioning while it is under fire.

The clearest picture of that came on an ordinary evening out. My colleague Umaima, our Resilience Advisor at Fixinc based in Dubai, took me to the Australian Business Council Dubai quiz night, held in a make-shift English-style pub. It was packed. Business owners had brought their families. The mood was loud, warm and entirely unbothered. If a room full of expatriates and their kids laughing over a trivia night a few weeks after a missile exchange does not signal a return to normal, nothing does.

Not everything was strong. The hotels that survived COVID are still paying down the debt it cost them, and some have closed in the past year because they could not. My resort, spectacular and near empty, was running weekend stay-cation deals straight out of the 2020 playbook.

The government had already moved on exactly this pressure. At the end of March, it approved a one-billion-dirham support package, letting hotels, hotel apartments and holiday homes defer the full sales fees on rooms and food, along with the Tourism Dirham, for three months from the first of April.

Read one way, that is a city shielding its most exposed sector. Read another, and you get the sharper point Umaima brought back from a later ORF session where the package was picked apart. The relief does more than free up cash. It quietly reframes the empty rooms as a regional shock rather than a failure of the operators, so no one can pin the downturn on the sector itself.

The catch sits in the word defer. These are postponements, not write-offs, and the bills fall due when the three months are up. That is the smouldering crisis in miniature, the kind that does its damage long after the event that caused it. It’s worth watching.

The meetings reshaped how I think about the region. I had been open about why I was there. I am exploring opening an advisory in the Middle East, which makes me a future competitor to many of the people I met. They helped anyway. Where to register, which banks, which districts, which markets.

Wade Eager, a New Zealander who has built a career here as Chief Strategy and Marketing Officer at Platformance, spent his time selling me on the life rather than guarding his patch. He buzzed with energy and was proud of what he was building out of the UAE. In Australia, that openness would be unusual. Here it was the default.

A recurring theme in those rooms was a move away from globalisation as a single global system toward something more regional. At ORF Middle East’s Strait Drive session on chokepoints and supply chains, with Ashok Malik of The Asia Group as the featured speaker, the conversation kept returning to the idea that the Gulf, India and the rest of Asia, potentially alongside China, could form a trading bloc with serious gravity.

Malik called it regional globalisation. You can see it forming in the free trade agreements that have appeared quickly since the conflict. Farid Ayoub, Canada’s consul for economic, political and public affairs in Dubai, put numbers to it when he described supporting some twelve hundred Canadian businesses operating in the Emirate. It is not abstract. It is being built. Nations are backing their exporters on the ground in Dubai.

The trip ended in Abu Dhabi, in the living room of Mohammed Al Jenaibi. He literally wrote the book on business continuity. Al Jneibi is credited as author to the first UAE business continuity standard, NCEMA 7000, published in 2012, just before ISO 22301 arrived, and he has since trained much of the region’s emergency and continuity profession.

A former colonel and chief of the country’s search and rescue center, he spent two hours walking Umaima and I through how resilience took root in the Emirates. What stayed with me was not the credentials (as incredibly impressive as they were). It was that a man with nothing left to prove was most interested in helping the next generation carry the work.

Here is the lesson I left with during my short time in Dubai.

Crisis coverage captures the shock. It rarely captures the absorption. What I watched from a distance was the first 72 hours, the smoke, the missiles, the closure. What I found on the ground was the part no camera stays for, the recovery, and the quiet machinery of trust that makes it possible. Clear communication, institutions that do what they say, and a population that can therefore tell fact from assumption.

I flew in braced for a city on its knees. I left having watched one quietly stand back up. The cameras filmed the first version. The second is the one worth learning from.

If you enjoyed this on-ground piece, consider sharing. After all, resilience is about community and communication.

Model Citizen | Risk Updates for Weeks of 3 June - 17 June '26

Ollie Law — Thu, 18 Jun 2026 06:41:44 GMT

Hello 👋 get a brew on because these are the top emerging risks between June 3rd, and June 17th, 2026…

Review our report’s terminology here ↗

Our main risk this fortnight is…

1. Technological: Government Pulls Frontier AI Model

Anthropic received a US Commerce Department letter on Friday 12 June, signed by Commerce Secretary Howard Lutnick, ordering it to suspend all access to its Fable 5 and Mythos 5 models by any foreign national, inside or outside the United States. The directive arrived at 5:21pm Washington time, with roughly ninety minutes to comply.
With no mechanism to verify citizenship across its user base across AWS, Google Cloud, Microsoft Foundry, Snowflake, and its own APIs, the only compliant path was a full global suspension. Fable 5, launched only three days earlier and according to Anthropic already serving hundreds of millions of users, went offline within hours.
Anthropic publicly disputed the framing. The company stated the letter offered no specific national security details and that the underlying jailbreak appeared narrow and non-universal. Critically, Anthropic also disclosed publicly that OpenAI’s GPT-5.5 produces the same outputs without any jailbreak at all. If this standard applied across the industry, Anthropic argued, every frontier model deployment would need to halt.
This is not Anthropic’s first conflict with Washington. In July 2025, the company refused a US$200 million Department of Defense contract because the Pentagon required Claude be available for any lawful purpose, including autonomous weapons and mass domestic surveillance. In February 2026, the White House ordered federal agencies to cease using Anthropic models. In March, the Pentagon designated Anthropic a supply chain risk, a classification never previously applied to a US company. Anthropic is challenging that classification in federal court, where a judge has already issued a preliminary injunction.
The June 12 directive used a different agency under a different statute, but produced the same operational outcome. According to reporting from Fortune and Politico, Amazon CEO Andy Jassy first raised concerns with Treasury Secretary Scott Bessent after Amazon researchers found a way to extract cybersecurity information from Fable 5. Amazon is one of Anthropic’s largest investors and provides its core cloud infrastructure. Anthropic filed a confidential IPO prospectus earlier this month at a US$965 billion valuation. The commercial timing is significant.

Sources

You should be concerned if…

Your business is built on a single AI model: A vendor outage can now halt your operations overnight, with no warning. The episode strengthens the case for open-weight or self-hosted models that cannot be cut off externally. If your team has been pushing for redundancy, this is the moment to take it seriously.
You’re a global enterprise employing foreign nationals: The directive applied to foreign-national employees regardless of physical location. Multinational teams can lose access to critical tools by passport alone. Workforce-wide tooling decisions now carry unexpected geopolitical and compliance exposure.
You’re an AI vendor or pre-IPO investor: The shutdown lands at a commercially sensitive moment for Anthropic. Regulatory unpredictability now materially threatens AI company valuations and product roadmaps. Investors and partners should review the political exposure of any AI vendor before doubling down.
You lead a security or engineering team: The capability at the centre of the dispute is one defenders use routinely. A globally available dependency disappearing within ninety minutes is a concrete argument for redundancy, multi-vendor strategies, and continuous visibility into where AI lives in your stack.
You operate in a regulated industry with embedded AI workflows: A model lawfully available one day can vanish the next without warning. Firms embedding AI into compliance, healthcare, or finance pipelines face continuity and audit risks if a core dependency is abruptly withdrawn. Force majeure clauses written before this week may now be insufficient.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Maintain multi-model redundancy

Keep enough model redundancy that no single provider is a hard dependency. Test failover paths quarterly. Know where AI lives in your stack and put guardrails around what it can do, rather than reaching for kill switches when crises hit.

Map your AI dependencies

Audit every product, workflow, and tool that depends on a specific model or vendor. Document fallback options and switching costs now. A sudden suspension should be an inconvenience, not an existential operational shock.

Evaluate open-weight and self-hosted options

For mission-critical workloads, assess whether open-weight or self-hosted models can serve as backups. These cannot be remotely disabled by a third party. The cost story depends on volume, but the continuity story is unambiguous.

Build vendor-continuity clauses into contracts

Negotiate service-level guarantees, advance-notice provisions, and exit support with your AI vendors. Where possible, secure contractual remedies covering sudden loss of access driven by regulatory action. Liability and downtime risk should not fall solely on you.

2. Geopolitical: Compounding Crises Choke Global Shipping

Iran’s Revolutionary Guard Corps closed the Strait of Hormuz on 2 March 2026, following joint US and Israeli strikes on Tehran. Brent crude moved from the low US$70s to a peak near US$120 a barrel in early March. The World Trade Organization recorded a 95% reduction in crude vessels and a 99% reduction in LNG vessels using Persian Gulf ports across the months that followed.
The closure forced shippers to reroute toward the Panama Canal, surging demand for transit slots. PBS reporting in April documented some last-minute auctions surpassing US$4 million for a single vessel, although container traffic patterns have since normalised.
A peace deal between the US and Iran is reportedly being signed in Switzerland on Friday 19 June, and Brent has fallen back below US$80 ahead of an expected resumption of Iranian oil exports. But two compounding events set in motion by the conflict will not resolve when the strait reopens.
On 18 and 19 March, Iranian missiles struck Qatar’s Ras Laffan facility, the world’s largest LNG export plant, destroying two production trains. QatarEnergy estimates repairs will take three to five years, taking roughly 17% of Qatar’s total LNG export capacity offline and an estimated US$20 billion in lost revenue. Italy’s Edison has already had its force majeure extended into August. This hit to global LNG supply stays in place for years, not months.
At the same time, NOAA upgraded to an El Niño Advisory in early June, with conditions present and expected to strengthen into the 2026 to 2027 northern hemisphere winter. There is a one in three chance the event intensifies into a Super El Niño between October and February. The worst hydrological impacts of an El Niño historically arrive the year after onset, putting the real Panama Canal pressure into 2027, not 2026.
The canal is currently running well at 38 transits per day with Gatún Lake near maximum capacity. That is the trap. The route that absorbed all the Hormuz overflow looks healthy today, which can drive false confidence. The Canal Authority’s long-term solution, the Río Indio reservoir, will not be operational until the early 2030s.

We will be diving further into these parallel crisis events, including the Panama Canal threat and the LNG market reset, in dedicated deep-dive articles coming soon.

Sources

You should be concerned if…

You’re a European LNG importer with long-term Qatari contracts: Utilities in Italy, Belgium, and South Korea are most exposed. Force majeure cover is real, but spot market replacement costs remain elevated, and pressure will hold through summer storage refill and likely into next winter. Edison’s experience replacing nine of seventeen lost cargoes points to the current procurement reality.
You’re an Asia-Pacific shipper using Panama as a Hormuz alternative: Year-end traffic looks viable, but if El Niño intensifies on schedule, 2027 slots will be rationed first. Container vessels held up reasonably well during the 2023-24 drought at six to seven per day, but draft restrictions cost real cargo on every transit.
You run an energy-intensive or oil-dependent business: Even with the strait reopening, the Ras Laffan damage means 17% of Qatari LNG capacity is locked out for years. Expect structural energy price volatility through 2027 rather than the short-term spike most planning currently assumes.
You operate in Australia, India, or Latin America: S&P Global’s May PMI for Australia attributes weaker output and rising prices directly to the Middle East war. Seven of ten El Niño years have produced a poor Indian monsoon. Latin America faces a projected 0.6 to 1.7 percentage point GDP hit from a moderate to strong event, with 50% of regional hydro power exposed.
You’re an insurer or risk manager: War risk premiums on Gulf shipping may stay at twenty times pre-conflict levels for months, even after a ceasefire holds. Layered against the parametric climate exposure building across agriculture, correlated exposure is stacking faster than most underwriting models currently recognise.

Preventative actions

Diversify routing and book early

Pre-qualify alternative ports, carriers, and overland corridors, and model the cost of each. Book Panama Canal slots now for Q4 2026 and Q1 2027 via the canal’s forward auction system. Do not wait for the next NOAA update to act.

Audit LNG contracts for Ras Laffan exposure

If you hold long-term Qatari LNG contracts, run the maths on three years of partial supply, not three months. Review force majeure clauses for cascading trigger language. Tier two and Tier three supplier dependencies in El Niño impact zones should be mapped now.

Stress-test compounded scenarios

Treat Hormuz reopening, Ras Laffan offline for three years, and Panama transits cut by 30% as a single combined scenario, not three independent risks. The data supports this as the consensus base case, not a stretch.

Review insurance correlation

War risk and climate parametric covers were typically written as independent risks. They no longer are. Talk to your broker about layered exposure and document scenario planning that treats them as one.

Quick snippet stories

China Escalates AI-Targeted Cyber Espionage
CrowdStrike’s 2026 Technology Threat Landscape Report, released 9 June, warns that China-linked groups accounted for more than 58% of state-sponsored cyberattacks targeting the technology sector over the year to March. The report names five Chinese groups including MURKY PANDA, whose password-spraying campaign alone compromised more than 340 US-based entities. AI capabilities are the prize. Firms should harden access controls, monitor for persistent intrusions, and protect proprietary models.
Main link to resource
Microsoft Dev Tools Poisoned to Steal Passwords
Microsoft cut off access to dozens of open source projects hosted on GitHub after hackers injected password-stealing malware into projects connected to its Azure cloud and developer tools used with Claude Code, Gemini’s command line, and VS Code. At least 70 projects were disabled. This is Microsoft’s second such breach in weeks, suggesting the first clean-up did not remove the attackers. These are supply chain attacks targeting code used across many products. Rotate credentials and audit your dependencies.
Main link to resource
UAE Firms Overestimate Their Crisis Readiness
New research from risk management firm Optro, published via MIT Sloan Middle East, finds that 73% of UAE organisations are confident they can meet recovery objectives during a major disruption. When disruption actually struck, 62% failed to recover within those objectives, with roughly 35% exceeding targets by more than double. Only 19% have a formal disaster recovery plan, compared to a global average of 31%. Confidence is not capability. Run independent readiness audits and rehearse realistic scenarios rather than relying on assumptions.
Main link to resource
One in Four Australian Firms Hit by AI’s Dark Side
A new QBE Insurance study of Australian businesses with 100 to 2,000 employees finds 26% of those who experienced a cyber incident in the past year believe AI was used against them. That spans AI-assisted vulnerability identification, AI-generated malware, deepfakes, and business email compromise. Critically, 66% of incidents traced back to a supplier relationship. Train staff on AI-driven scams, verify communications, and review your third-party risk closely.
Main link to resource
Australian Manufacturing Squeezed by Weak Demand
S&P Global’s May PMI shows Australian manufacturing weakening as inflation and supply disruptions persist. The index eased to 50.7 from 51.3 in April, with new orders falling at their fastest pace in seven months. Output price inflation hit its highest level since August 2022. Critically, S&P attributes a large share of this directly to the Middle East war, with international shipping delays lengthening to the second-greatest extent in nearly four years. A clean reminder that the Hormuz story is already showing up in your local PMI numbers.
Main link to resource

Want to discuss how these risks might effect your business?
Book 30 minutes with us, free ↗

Need support?

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

Search and Destroy | Risk Updates for Weeks of 20 May - 3 June '26

Ollie Law — Wed, 03 Jun 2026 06:02:56 GMT

Hello 👋 get a brew on because these are the top emerging risks between May 20th, and June 3rd, 2026…

Review our report’s terminology here ↗

Our main risk this fortnight is…

1. Technological: Google AI Reshaping Brand Control Online

Google’s AI Overviews now dominate search results, pushing organic website links further down the page. For businesses of all sizes, this represents a fundamental loss of control over how customers discover and engage with their brands online.
Small and medium enterprises reliant on organic search traffic face an existential visibility crisis as AI-generated summaries answer user queries directly, reducing click-through rates to websites by significant margins and undermining years of search engine optimisation investment.
Larger businesses face a different but equally serious threat: AI-generated answers can misrepresent brand information, hallucinate product details, or present competitors’ offerings alongside their own, with no editorial oversight or correction mechanism available to the companies affected.
The shift means businesses are losing control not only of where their websites rank in search results, but of how their brand, products, and corporate information are portrayed and summarised by an AI system they cannot directly influence or correct.
Publishers and content creators are caught in a paradox: their content trains the AI that then replaces their traffic. Google’s dominance of the search market means opting out of indexing carries its own severe commercial penalties, leaving few viable alternatives.
Industry analysts warn that the long-term consequence is a consolidation of informational power within a single platform, where Google’s AI becomes the de facto intermediary between businesses and their customers, fundamentally altering the economics of digital marketing and brand management.

Sources

You should be concerned if…

Small and medium enterprises dependent on organic search traffic: Your primary customer acquisition channel is being structurally undermined. AI Overviews reduce the need for users to visit your website, meaning years of SEO investment may yield diminishing returns without alternative digital strategies in place.
Large enterprises and global brands: The threat is not visibility but accuracy. Google’s AI may hallucinate product specifications, misattribute reviews, or present misleading brand information to millions of users. You have no direct editorial control over these AI-generated summaries, creating reputational risk at scale.
Digital marketing and SEO professionals: The professional discipline of search engine optimisation is being fundamentally disrupted. Traditional ranking factors matter less when an AI summary captures user attention before organic results are even seen. Career and business model adaptation is now urgent.
Publishers, media companies, and content creators: Your content is being used to train AI systems that then eliminate the traffic your business model depends on. The economic feedback loop that sustained quality journalism and specialist content is breaking down, with no clear replacement revenue model.
E-commerce businesses and online retailers: Product searches increasingly receive AI-generated comparison summaries that may favour competitors, misrepresent pricing, or direct users to alternative purchasing channels. The loss of direct search-to-purchase traffic threatens conversion rates and customer acquisition costs.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Diversify customer acquisition channels beyond organic search

Businesses should reduce dependence on Google search by investing in direct audience relationships through email lists, community platforms, social media, and partnerships. Building owned channels ensures customer access regardless of algorithm changes.

Implement active brand monitoring for AI-generated content

Organisations should deploy monitoring tools that regularly audit how Google’s AI Overviews represent their brand, products, and services. Document inaccuracies systematically and use Google’s feedback mechanisms and legal channels to request corrections promptly.

Develop structured data and authoritative content strategies

Ensure all website content uses structured data markup to maximise the accuracy of AI-generated summaries. Publish authoritative, clearly sourced content that AI systems are more likely to represent correctly, reducing hallucination risk.

Engage in industry advocacy for AI transparency and accountability

Join industry coalitions advocating for regulatory frameworks that require AI search systems to disclose sources, provide correction mechanisms, and compensate content creators fairly. Collective action is more effective than individual company efforts.

Build direct-to-consumer relationships and first-party data assets

Invest in loyalty programmes, subscription models, and direct communication channels that bypass search intermediaries entirely. First-party data and direct customer relationships are the most resilient assets in an AI-mediated digital landscape.

2. Geopolitical: Myanmar Conflict Threatens Global Rare Earth Supply

Escalating armed conflict in Myanmar’s Kachin and Shan states is disrupting rare earth mining operations that supply a significant share of China’s heavy rare earth feedstock, creating a cascading vulnerability for global technology, defence, and clean energy supply chains.
Resistance forces have launched targeted offensives against junta-controlled mining regions, forcing operations to halt or relocate. These disruptions are compounding existing Chinese export restrictions on rare earth processing technology, tightening an already constrained global supply.
Heavy rare earth elements such as dysprosium and terbium, critical for permanent magnets used in electric vehicles, wind turbines, and military systems, are disproportionately sourced from Myanmar’s conflict zones, making the disruption strategically significant beyond its apparent geographic scale.
China’s dominance over rare earth refining means that even nations sourcing raw materials from alternative locations remain dependent on Chinese processing infrastructure. The Myanmar disruption therefore amplifies a pre-existing single point of failure in the global rare earth value chain.
Western governments and allied nations have accelerated rare earth diversification programmes, but new mining and refining operations require years of development. The gap between strategic intent and operational capability leaves critical industries exposed in the near to medium term.
The humanitarian dimension of Myanmar’s rare earth mining, including forced labour, environmental destruction, and conflict financing, adds regulatory and reputational risk for companies whose supply chains trace back to these sources, even indirectly.

Sources

You should be concerned if…

Electric vehicle and clean energy manufacturers: Your production timelines and cost structures depend on stable access to heavy rare earth elements for permanent magnets. Myanmar disruptions combined with Chinese export controls create compounding supply risk that could delay vehicle and turbine production.
Defence and aerospace contractors: Military systems including precision-guided munitions, fighter jet engines, and satellite components require rare earth inputs with no viable short-term substitutes. Supply disruptions from Myanmar directly threaten production schedules and national security readiness.
Technology companies and electronics manufacturers: Consumer electronics, data centre hardware, and semiconductor manufacturing all depend on rare earth elements. Even indirect exposure through component suppliers creates vulnerability that may not be visible until shortages materialise at the assembly stage.
Governments pursuing clean energy transition targets: National decarbonisation strategies assume stable and affordable access to rare earth materials. The Myanmar crisis exposes the gap between climate policy ambitions and the geopolitical reality of critical mineral supply, potentially delaying transition timelines.
ESG-conscious investors and compliance teams: Rare earth sourcing from Myanmar’s conflict zones carries significant forced labour, environmental, and conflict financing risks. Companies unable to demonstrate clean supply chains face regulatory penalties, investor scrutiny, and reputational damage under tightening due diligence requirements.

Preventative actions

Map rare earth supply chains to origin with full transparency

Organisations should trace rare earth inputs beyond first-tier suppliers to identify Myanmar or conflict-zone exposure. Engage suppliers with specific questions about sourcing and processing to uncover hidden dependencies before disruptions force reactive decisions.

Accelerate qualification of alternative rare earth sources

Begin technical qualification of rare earth materials from emerging suppliers in Australia, Canada, Brazil, and Africa now, even at higher cost. Diversifying supply requires years of testing and certification, making early investment essential for medium-term resilience.

Invest in recycling and circular economy capabilities for rare earths

Urban mining and rare earth recycling from end-of-life electronics, magnets, and batteries can reduce primary material dependence. Organisations should invest in or partner with recycling operations to build secondary supply capacity as a strategic buffer.

Engage with government critical mineral programmes and stockpiling initiatives

Companies should actively participate in national and allied critical mineral strategies, including stockpiling programmes, joint procurement arrangements, and research funding for substitute materials. Collective action reduces individual company exposure and builds systemic resilience.

Conduct scenario planning for prolonged rare earth supply disruption

Model the impact of a sustained six-to-eighteen month disruption in heavy rare earth supply on production, revenue, and contractual obligations. Identify which products or programmes are most exposed and develop contingency plans including design modifications to reduce rare earth intensity.

Quick snippet stories

Global Food Inflation Risks Rise as Hormuz Tensions and El Nino Converge
The Strait of Hormuz disruption threatens fertiliser and grain shipments from the Gulf, while a developing El Nino pattern risks reducing agricultural yields across Asia and Latin America. The convergence of geopolitical and climate risks could trigger food price spikes affecting import-dependent nations most severely. Governments and importers should diversify sourcing and build strategic food reserves. Main link to resource
$670 Billion in Planned US Data Centres Face High Storm Exposure
A significant share of planned US data centre investment is concentrated in regions with elevated hurricane, tornado, and flood risk. As AI demand drives rapid construction, operators risk building critical digital infrastructure in climate-vulnerable zones. Investors and operators should mandate catastrophe modelling and climate-resilient design standards before committing capital.
Main link to resource
The Hidden Cost of a Single Chip Fab Disruption
Semiconductor fabrication plants operate continuously, and even brief disruptions can destroy in-process wafers worth millions and take weeks to restart. This matters because the semiconductor industry is already under immense geopolitical and capacity strain; additional disruptions cascade into virtually every industry from automotive to healthcare. Manufacturers should invest in redundant systems and multi-site production strategies.
Main link to resource
Marine Insurance’s Overlooked Role in Supply Chain Resilience
Rising geopolitical tensions, piracy, and climate-related maritime hazards are increasing cargo losses, yet many businesses underestimate marine insurance as a risk management tool. Inadequate coverage leaves firms exposed to catastrophic financial loss when shipments are delayed, damaged, or seized. Companies should review marine insurance portfolios against current threat levels.
Main link to resource
UK Supply Chains Unprepared for Major Shocks, Report Warns
A parliamentary report warns that UK supply chains remain dangerously exposed to major disruptions including conflict, pandemics, and climate events. Critical sectors including food, energy, and pharmaceuticals lack sufficient stockpiles and contingency planning. Businesses and policymakers should stress-test supply chains against severe scenarios and invest in domestic resilience. Main link to resource

Want to discuss how these risks might effect your business?
Book 30 minutes with us, free ↗

Need support?

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

Canvas: How a single vendor becomes a critical infrastructure risk

Umaima Farhan — Wed, 27 May 2026 05:38:26 GMT

Canvas is the learning management system that powers 41% of North American universities. The education software provider controls exams, grades, and student communications for 275 million users worldwide.

On May 7, 2026, hackers breached Canvas and demonstrated a systemic vulnerability: when one vendor fails, entire regional education systems collapse at the same moment. The extortion group ShinyHunters claimed to have stolen 3.65 terabytes of data from approximately 9,000 educational institutions. But the scale obscures the real lesson.

Canvas is the operational backbone of modern universities. It hosts lecture materials, manages enrollment, delivers exams, stores private communications between students and faculty, and maintains grades. When it goes offline, entire institutions grind to a halt.

On May 7, 2026, at precisely 1:20 p.m. PDT (UTC-7), Canvas went offline globally. The University of Melbourne, RMIT, Griffith University, Adelaide University, University of Canberra, and the Queensland University of Technology were all affected simultaneously. The National University of Singapore (NUS) and the Singapore Institute of Management (SIM) were named in the global breach list. In New Zealand, the University of Auckland, Auckland University of Technology, and Victoria University of Wellington were affected.

The absence of a regional response mechanism meant universities across ASEAN and Oceania had to wait for an American vendor to resolve an American security failure. The cost and complexity made it feel like an unnecessary hedge. But when the vendor failed, improvisation became the only option.

What we know about ShinyHunters

ShinyHunters’ page for a recent AT&T target.

ShinyHunters is an extortion collective active since 2020. The group does not deploy ransomware that encrypts data. Instead, it steals data and threatens to publish it unless the target pays. ShinyHunters is a prolific and fluid cybercriminal group that specializes in data theft and extortion, typically gaining access through voice phishing and social engineering attacks that often involve impersonating IT personnel or trusted members.

The Attack: Two breaches, same root cause

On April 29, Instructure, an education technology company that develops the Canvas Learning Management System (LMS), detected unauthorized activity in its Canvas platform. ShinyHunters claimed responsibility on May 3 and launched a public extortion campaign with an initial May 7 deadline, later extended to May 12.

Instructure took Canvas offline on May 7 for investigation and restored service the following day. On May 7, the attackers injected JavaScript directly into roughly 330 institutional Canvas login portals, replacing them with defacement messages during final exams and AP testing. Students logging in to submit assignments saw a ransom note instead of their courses.

Instructure replaced the defacement with a maintenance message, but the underlying access remained open. This gap exposed how quickly containment claims can be outpaced by reality. (Source: Hackread.com)

The May 7 defacement was not a new intrusion. It was ShinyHunters demonstrating that Instructure’s May 2 “containment” claim was false. The same access paths remained open.

Why This Happened: The procurement failure

Cost avoidance dominated risk prevention. Migrating from one LMS to another costs $5-15 million and requires 18-24 months of planning, faculty retraining, and curriculum redesign. Once embedded, Canvas becomes the path of least resistance. Changing it becomes prohibitively expensive.

Procurement committees optimized for the wrong metrics. LMS selection typically compares user interface, features, and price. Nobody asks,

“What happens if this vendor is compromised during finals week?”

The question is too uncomfortable. The answer is too costly to implement.

Institutional inertia is frictionless. Canvas dominates North America and Europe. Regional procurement teams chose the established global standard rather than invest in localized alternatives. The economics pointed toward Canvas.

While Moodle remains the dominant LMS in Australia and New Zealand, Canvas has seen a fivefold increase in adoption in less than a decade, with its clean interface, responsive support, and frequent updates making it an appealing option for many institutions, particularly larger universities and those offering blended or online-first programs.

When ShinyHunters struck on May 7, multiple continents’ worth of universities went offline at exactly the moment institutional leverage was highest.

What was stolen

275 million records at last count.

The exfiltrated data included names, email addresses, student ID numbers, and messages among users. Instructure said it had found no evidence that passwords, birth dates, government IDs, or financial information were involved.

Private messages are the most damaging element. Canvas inboxes frequently contain pastoral and welfare discussions, disability accommodations correspondence, grade disputes, mental health disclosures, and Title IX disclosures (reports related to sexual harassment, discrimination, and misconduct). Even without passwords or financial data, the messaging corpus alone is sufficient to enable highly targeted social engineering against millions of students.

If this piece is valuable, consider spreading the word and sharing on your feed today. After all, resilience is about community and communication.

1. Concentration risk treated as a feature, not a threat

In Oceania, the picture is concentrated: Moodle dominates with approximately 56% market share, with Canvas as a rapidly growing second choice. When a single platform controls 25-40% of institutional operations depending on the region, its compromise becomes a regional emergency rather than a customer-specific incident.

Why did universities allow this? The answer is uncomfortable, because the alternative was worse.

Switching costs are so high that institutions choose the known risk of Canvas over the unknown risks of alternatives. This is not unique to education: healthcare systems face the same dynamics as Epic (54% market share), governments with Microsoft, and finance with Swift. And in many cases, subscribers simply haven’t assessed the risk and validated their systems.

2. Containment claims were never verified

Instructure’s status page reported no incidents on May 8, while students on Reddit were still posting screenshots of the defacement. The gap between the status page saying nothing while the defacement was still visible to users is worth noting.

Rather than wait for Instructure’s assurances about containment, University of Technology Sydney, RMIT, Adelaide University, and the Queensland Department of Education made a decisive choice: they temporarily disabled Canvas access entirely as a precautionary measure. This was not a defensive panic. It was institutional self-protection.

This stands as a textbook example of responsible cybersecurity governance: when a vendor’s containment claims cannot be independently verified, the burden of proof shifts to the institution, not to the vendor. These four institutions understood that the cost of temporary access denial was far lower than the cost of a breach spreading unchecked through their systems during the most critical academic period of the year.

3. No offline redundancy for critical workflows

When Canvas went offline, courses were unreachable. Exams cannot be administered. Grade books were inaccessible. Most institutions had never pre-staged offline assessment infrastructure. No university had built parallel exam delivery systems. The absence was due to the perceived prohibitive cost and operational complexity. When the platform failed, improvisation became the only option available.

4. No regional incident coordination

ASEAN and Oceania have no unified procurement standards for education vendors.

No regional security baseline exists. The Asia Pacific region captures 21.60% of global LMS revenue and is expected to witness robust growth, with Australia, China, Japan, India, Singapore, Malaysia and other developing countries focusing on funding platforms to facilitate online training and education, yet there is no coordinated policy framework governing vendor security requirements across these countries. (Source: Fortune Business Insights)

The absence of coordination created a cascading vulnerability. When Canvas went offline, nine universities in ASEAN and Oceania made independent decisions about extensions, rescheduling, and continuation. Some disabled access entirely. Others waited. There was no shared incident response protocol. No unified communication to students. No coordinated demand for vendor transparency. Each institution improvised in isolation, unable to pool resources or information.

This is different from North America, where major university systems can coordinate through regional education consortiums. It is different from Europe, which has unified data protection frameworks (GDPR). ASEAN and Oceania have neither. The Office of the Australian Information Commissioner (OAIC) stated that affected Australian users must first lodge privacy complaints directly with Instructure or their institution and allow 30 days for a response.

Additionally, state and territory government schools are governed by state privacy laws rather than federal privacy laws, adding further fragmentation to breach response.

The result: a single vendor’s failure becomes a regional problem with no regional solution. Universities cannot negotiate collectively. They cannot demand shared security standards. They cannot even share incident information in real time. The cost of this fragmentation is borne entirely by institutions during the crisis.

The ransom decision

On May 12, Instructure confirmed it had paid an undisclosed sum to ShinyHunters.

The company received digital attestations claiming that the data was deleted. ShinyHunters updated their announcement saying they were no longer seeking payment from impacted institutions and claimed the stolen data had been deleted.

The stolen data does not expire when a ransom gets paid.

Attackers hold onto exfiltrated records and run phishing campaigns weeks or months later, often when awareness has faded. Institutions using Canvas should treat this as ongoing.

Instructure faced a deadline set by attackers, imminent reputational damage, millions in remediation costs, and an avalanche of lawsuits. The ransom decision reflected the constraints the company faced under extreme pressure.

The precedent problem

The willingness to pay matters beyond Instructure. In May 2026, ShinyHunters is operating under a model of third-party integrator compromise: find a vendor that sits in the middle of hundreds of institutions, breach the vendor once, and the downstream reach multiplies across every customer in their portfolio. We mentioned this threat in our latest weekly threat update concerning state-backed hackers.

Earlier in 2026, ShinyHunters claimed breaches of Infinite Campus, a widely used K-12 student information system, and publisher McGraw Hill. In October 2025, the group claimed over a billion records from a Salesforce breach that also touched McGraw Hill and Instructure. The pattern across these incidents is the same: go for the shared vendor, not the individual institution.

The threat here is that when you comply to ransomware demands, payment signals to the broader ecosystem that the model works.

Immediate lessons for ASEAN and Oceania institutions

Do Not Assume Vendor Containment Claims

Instructure claimed containment May 2; attackers remained until May 7
Require third-party forensic audit before service resumption (vendor pays)
Contract must define “containment”: all access paths verified closed, no similar vulnerabilities
Include service credits for missed timelines or false claims

Build Offline Exam Infrastructure Now

Maintain fallback exam server; train proctors on offline protocols
Establish manual grading workflow independent of vendor
Run quarterly drills; practice before you need it
Cost is minimal versus disrupted finals

Minimize Sensitive Data in Canvas

Auto-delete messages after 6 months
Move disability accommodations, mental health, Title IX records to separate secure system
Breach exfiltrated data is actively used in phishing; limit future damage

Independent Emergency Communications

Canvas down = your notification system down; build redundancy
Use email, SMS, and voice IVR independent of vendor
F24, our crisis communication partner, provides exactly this: reliable notifications when your primary system fails
Test quarterly

The Ecosystem Problem: This is not unique to education

Healthcare: Epic Systems controls roughly 54% of the U.S. hospital market, with growing presence in Australia and New Zealand. A compromise of Epic’s infrastructure would disrupt patient care across multiple continents simultaneously.

Government: Microsoft dominates government IT infrastructure globally. Entire government agencies run on Office 365, Azure, and Windows, creating single points of failure at scale. We have already seen notable examples of Microsoft failures through the likes of the CrowdStrike crisis in 2024.

Finance: Swift handles approximately 11 million financial transactions per day across 11,000 financial institutions. A compromise of Swift would be a global financial catastrophe.

Canvas is not an anomaly. It is one data point in a pattern of institutional decisions that prioritize short-term cost avoidance over systemic resilience.

What might happen next

ASEAN and Oceania universities will face a choice: invest in resilience or wait for the next crisis.

Regional procurement standards: mandatory vendor audits, API key rotation SLAs, tenant isolation attestations
Data residency rules that incentivize regional vendor diversity
Cross-border incident coordination frameworks for information sharing during crises
Contingency funding for LMS migration during high-risk periods
None of this exists. ASEAN and Oceania provide minimal regulatory pressure for protections the market doesn’t yet require

The uncomfortable truth

Universities knew. Procurement teams knew. IT leaders knew. Single-vendor concentration is risky. The Canvas breach did not create this knowledge. It just proved it at a scale that could no longer be ignored.

The question now is whether that proof will translate into actual change. History suggests it will not. Each major breach generates outrage, media attention, and vendor commitments to improve. Within months, procurement patterns return to normal. The next breach becomes someone else’s problem until it becomes yours.

For institutions in ASEAN and Oceania, the Canvas incident should be a trigger for genuine risk assessment. It should prompt procurement teams to ask uncomfortable questions about concentration, switching costs, and institutional resilience. It should force hard conversations about budget priorities.

But this is difficult. Most universities are trapped in a system where the short-term cost of change exceeds the perceived long-term risk of failure.

That calculation will only change when the cost of failure becomes unavoidable. By then, it may be too late.

Umaima Baboojee is a Resilience Advisor at Fixinc and a analyst and regular contributor to Unbreakable Ventures. Umaima holds a Master’s in Crisis and Security Management from Leiden University, specialising in the governance of crisis, and completed a double honours track in Business & Inclusive Leadership and Planet in Peril. Her undergraduate background in International Relations and International Law, with a minor in governance, laid the foundation for her interest in how organisations function under pressure and how teams align around difficult decisions.

Before joining Fixinc, she completed an eight-month internship at a crisis management consultancy, where she supported tabletop exercises, contributed to after-action reporting, assessed crisis management plans, and researched the role of AI in crisis response. She also volunteered with the Red Cross in the Netherlands, reinforcing her belief that resilience is not just about plans and frameworks but also about communication, empathy, and the lived realities of people affected by instability.

She is based in Dubai. You can connect with her on LinkedIn here.

If you need help building a crisis response plan or understanding how the current conflict may affect your operations, the same Advisors who collate these insights are available for a 30-minute consultation. Book time here.

Breaking Point | Risk Updates for Weeks of 6 May - 20 May '26

Ollie Law — Wed, 20 May 2026 10:55:26 GMT

Hello 👋 get a brew on because these are the top emerging risks between May 6th, and 20th, 2026…

Review our report’s terminology here ↗

Our main risk this fortnight is…

1. Economic: Building Systems for Continuous Disruption

Supply chain shocks no longer arrive one at a time. ASPI analysis argues disruptions now emerge as continuous, concurrent, and cascading pressures, overwhelming traditional crisis response models built for sequential, isolated incidents. Organisations must shift from reactive firefighting to systemic resilience architecture.
The concept of “systems of disruption” reframes supply chain risk as an interconnected web rather than a chain of discrete events. A pandemic, a trade war, a cyberattack, and a climate disaster can strike simultaneously, each amplifying the others, making linear risk management frameworks dangerously obsolete.
COVID-19 exposed a critical weakness: expecting teams to maintain 24/7 crisis operations across overlapping emergencies is unsustainable. Burnout, decision fatigue, and institutional exhaustion degrade response quality precisely when stakes are highest, a lesson many organisations have still not structurally addressed.
The World Economic Forum’s 2025 and 2026 Global Risks Report reinforces this reality, identifying supply chain disruptions among the top risks over the next two years, compounded by geopolitical fragmentation, technological acceleration, and environmental instability occurring in parallel rather than in sequence.
McKinsey research estimates that companies can now expect supply chain disruptions lasting a month or longer to occur every 3.7 years on average, with financial losses amounting to significant shares of annual revenue, making resilience investment an economic imperative rather than a discretionary cost.
Leaders must build agile, adaptive systems that distribute decision-making, rotate crisis leadership, and embed resilience into everyday operations rather than treating it as an emergency-only function. The organisations that thrive will be those designed for permanent turbulence, not temporary disruption.

Sources

You should be concerned if…

Operations and supply chain leaders in multinational organisations: The era of managing one crisis at a time is over. If your crisis playbook assumes disruptions queue up neatly, your teams will face overlapping emergencies with frameworks designed for a simpler world. Structural redesign of response capacity is now urgent.
C-suite executives and board members responsible for enterprise risk: Concurrent disruptions compound financial exposure in ways traditional risk registers do not capture. Boards that treat resilience as a supply chain department issue rather than a strategic governance priority are underestimating the speed at which cascading failures erode enterprise value.
Workforce and human resources leadership: COVID-19 proved that sustained crisis operations break people. If your resilience strategy depends on the same team operating at surge capacity indefinitely, you are building on a foundation that will collapse. Workforce rotation, mental health infrastructure, and distributed decision-making are operational necessities, not perks.
Small and medium enterprises with limited redundancy: Larger firms can absorb concurrent shocks through diversified suppliers and geographic spread. SMEs operating with lean inventories, single-source dependencies, and small crisis teams face existential risk when multiple disruptions overlap, which is now the norm rather than the exception.
Government policymakers and critical infrastructure operators: Cascading supply chain failures do not respect sectoral boundaries. A logistics disruption can trigger a pharmaceutical shortage, which strains healthcare, which affects workforce availability, which deepens the original disruption. Systems thinking must replace siloed crisis management in national resilience frameworks.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Design for concurrent disruption, not sequential crisis

Organisations should stress-test their crisis response frameworks against multiple simultaneous scenarios rather than single-event tabletop exercises. War-gaming overlapping disruptions reveals bottlenecks, capacity gaps, and interdependencies that only appear under compound pressure.

Rotate crisis leadership and distribute decision authority

Build tiered crisis teams with clear rotation schedules and delegated authority so no single group bears continuous operational burden. Empowering regional and functional leaders to act autonomously during overlapping emergencies prevents central bottlenecks and reduces burnout.

Embed resilience into daily operations rather than emergency protocols

Resilience should not be a plan activated during a crisis but a permanent operating principle. Integrate scenario planning, supplier diversification reviews, and disruption simulations into routine quarterly business processes so adaptive capacity becomes institutional muscle memory.

Invest in real-time visibility and early warning systems

Deploy supply chain monitoring tools that aggregate geopolitical, environmental, and operational risk signals into a single dashboard. Early detection of converging threats provides the lead time needed to activate mitigation strategies before cascading failures take hold.

Build mutual aid networks and cross-sector partnerships

No organisation can absorb continuous disruption alone. Establish pre-negotiated agreements with industry peers, logistics partners, and government agencies for resource sharing, alternative routing, and coordinated response during compound crises to distribute the burden across a wider network.

2. Technological: State-Backed Ransomware Threatens Private Enterprise

State-sponsored ransomware operations are escalating against operational technology and critical infrastructure, with cybersecurity experts warning that the line between espionage, sabotage, and financially motivated cybercrime has effectively dissolved as nation-states weaponise ransomware for strategic objectives.
Groups linked to Russia, China, North Korea, and Iran are increasingly deploying ransomware not just against government targets but against private enterprises that form the backbone of national infrastructure, including energy companies, hospitals, logistics firms, and manufacturing operations that serve entire populations.
The 2021 Colonial Pipeline attack demonstrated how a single ransomware strike on a private company can cascade into a national crisis, shutting down fuel supply across the US East Coast for days. More recently, the 2023 attack on logistics firm DP World Australia paralysed container operations at major ports, disrupting supply chains across the country for weeks.
The healthcare sector has been particularly devastated. The 2024 Change Healthcare ransomware attack, attributed to the ALPHV/BlackCat group with suspected Russian links, disrupted prescription processing and insurance claims for thousands of US pharmacies and hospitals, directly affecting patient care and exposing sensitive medical data of over 100 million individuals.
Private businesses often underestimate their exposure because they do not consider themselves geopolitical targets. Yet state-backed actors deliberately target private firms that control critical chokepoints, knowing that disrupting a single logistics provider, energy distributor, or healthcare processor can paralyse services that millions depend on daily.
Cybersecurity agencies including CISA and the UK’s NCSC have issued repeated warnings that operational technology environments remain dangerously under-protected, with many industrial control systems running legacy software, lacking network segmentation, and offering threat actors lateral movement pathways from corporate IT into physical infrastructure.

Sources

You should be concerned if…

Private enterprises operating critical infrastructure or essential services: If your company distributes fuel, processes medical claims, operates ports, or manages logistics networks, you are a strategic target regardless of your size. State-backed actors select victims based on systemic impact, not profile, and your disruption becomes a national crisis.
Operational technology and industrial control system operators: Legacy OT environments with poor network segmentation are the primary entry vector for state-backed ransomware moving from IT systems into physical infrastructure. If your industrial controls are connected to corporate networks without robust isolation, your physical operations are exposed.
Healthcare organisations and pharmaceutical supply chains: The Change Healthcare attack proved that a single compromised node in health infrastructure can disable prescription services, delay care, and expose millions of patient records. Any organisation in the healthcare value chain that lacks robust cyber resilience is both a target and a liability.
Small and mid-sized suppliers to critical industries: State-backed actors increasingly exploit smaller vendors as entry points into larger targets. If your cybersecurity posture is weaker than your clients’ and you have network access or data-sharing agreements with critical infrastructure operators, you represent a high-value attack vector.
Boards and executive leadership teams without cyber literacy: Ransomware is no longer an IT department problem; it is a strategic, geopolitical, and operational risk that can halt revenue, trigger regulatory action, and destroy stakeholder trust overnight. Leadership teams that delegate cyber risk entirely to technical staff are governing blind.

Preventative actions

Segment operational technology networks from corporate IT

Implement strict network segmentation between IT and OT environments to prevent lateral movement by attackers. Ensure industrial control systems cannot be reached directly from compromised corporate email or administrative systems, which remain the most common initial access vectors.

Conduct tabletop exercises simulating state-backed ransomware scenarios

Move beyond generic cyber incident drills. Simulate scenarios where attackers have nation-state resources, persistence, and strategic objectives. Test your organisation’s ability to maintain operations, communicate with regulators, and recover critical systems under sustained, sophisticated attack conditions.

Audit and harden supply chain cyber dependencies

Map all third-party vendors with access to your systems or data, assess their cybersecurity maturity, and enforce minimum security standards contractually. The weakest link in your supply chain is the most likely entry point for state-sponsored actors targeting your operations.

Maintain offline, immutable backups of critical systems and data

Ensure that backups for essential operational systems are stored offline and tested regularly for restoration integrity. State-backed ransomware groups increasingly target backup infrastructure to maximise leverage, making air-gapped copies a non-negotiable defence layer.

Engage with national cybersecurity agencies and threat intelligence sharing

Register with CISA, NCSC, or equivalent national agencies to receive timely threat advisories and indicator-of-compromise feeds relevant to your sector. Participate in industry-specific information sharing and analysis centres to benefit from collective early warning intelligence.

Quick snippet stories

Asia’s Tech Boom Masks Deeper Oil Crisis Vulnerability
Asia’s technology-driven economic growth is masking significant exposure to the ongoing global oil crisis, with energy-intensive manufacturing and logistics costs rising sharply. The risk is that governments, buoyed by strong tech sector performance, delay necessary energy diversification and fiscal buffers, leaving economies dangerously exposed if oil disruptions deepen or tech demand softens simultaneously. Main link to resource
Malaysia Warns of Silent Supply Chain Shockwaves
Malaysia’s Trade Minister Tengku Zafrul has warned that supply chain disruptions are hitting the nation in waves that are difficult to detect until damage is done. The concern is that cascading second and third-order effects on Malaysian manufacturers and exporters are being underestimated, with smaller firms particularly vulnerable to input shortages and margin compression before policymakers can intervene effectively. Main link to resource
US-China Rare Earth Deal Delivers Limited Relief
A recent US-China rare earth agreement offers only marginal supply chain relief as Beijing retains tight export controls over critical minerals essential to defence, electronics, and clean energy industries. The risk remains that strategic dependency on Chinese rare earth processing persists despite diplomatic optics, leaving Western manufacturers exposed to future supply weaponisation during geopolitical escalation. Main link to resource
Tariff Uncertainty Set to Intensify for Agricultural Exporters
New Zealand’s agricultural sector faces renewed tariff volatility as global trade negotiations stall and retaliatory measures accelerate. The risk is that exporters who adjusted to the initial tariff environment may be caught off guard by a second wave of escalation, compressing margins further and disrupting established market access strategies at a time when input costs are already elevated. Main link to resource
Political Risk Shifts From War Zones to Contested Systems
Willis warns that political risk is migrating from traditional conflict zones into contested economic and regulatory systems, including trade networks, sanctions regimes, and digital infrastructure governance. The implication is that businesses previously insulated from geopolitical exposure now face disruption through regulatory fragmentation, sanctions overreach, and the politicisation of supply chains, requiring a fundamental rethink of where political risk actually resides. Main link to resource

Want to discuss how these risks might effect your business?
Book 30 minutes with us, free ↗

Coming soon at Unbreakable Ventures

We are excited to share some new releases and improvements for our fortnightly update. These include an interactive flow chart of industry-specific threats, characterised through our core threat categories. This will allow you to see how stories we’ve been monitoring for those two criteria fluctuate over time.

Additionally, we will share our Disruption Risk chart that shows the specific events happening within the selected industry. For example, it will show the count of how many significant cyber attacks have affected ports, or how tariffs are impacting trade, giving you a visual overview of this week’s threats.

And finally, we have noticed that hundreds of the stories we’re not able to squeeze into our updates are going to waste. So we will provide a small widget in these articles, allowing you to view external articles on stories that didn’t make it into the update.

Watch this space for these fresh updates, and make sure to subscribe to get the most out of them.

Need support?

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

Ctrl Alt Delete | Risk Updates for Weeks of 22 April - 6 May '26

Ollie Law — Wed, 06 May 2026 04:59:46 GMT

Hello 👋 get a brew on because these are the top emerging risks between April 22nd, and May 6th, 2026…

Review our report’s terminology here ↗

Our main risk this fortnight is…

1. Technological: AI Blame Game Masks Human Negligence

An AI chatbot built on Anthropic’s Claude model deleted an entire company database after being given overly broad instructions, wiping out critical business data for a small firm and raising urgent questions about how organisations govern autonomous AI tool use. The incident, reported by The Guardian, has sparked a wave of media coverage framing the AI itself as the culprit, but the deeper lesson is about human oversight failures at every stage of the chain.
The root cause of this incident is not a rogue AI but a series of human decisions: someone chose to connect an AI tool directly to a live production database, someone failed to implement adequate safeguards or backup protocols, and someone issued instructions without sufficient specificity or constraint. At each of these junctures, a human being either actively decided or passively neglected to enforce basic data protection and operational controls.
This pattern mirrors virtually every major cyber incident in history. From the 2017 Equifax breach to the 2020 SolarWinds attack, post-incident analysis consistently reveals that human error, negligence, or poor governance was the enabling condition. AI tools like Claude are powerful but fundamentally lack judgment about organisational context, data criticality, or irreversibility of actions. That judgment must come from the humans who deploy them.
The trend of employees bypassing corporate AI policies is already well documented in banking sectors across Southeast Asia. In Malaysia, Thailand, and Vietnam, bank workers have been found using large language models on personal laptops to process sensitive financial data, circumventing their employers’ formal AI usage restrictions. These shadow AI practices expose institutions to data leakage, regulatory breach, and reputational damage, and they are driven by the same root cause: insufficient human governance, training, and enforcement.
As organisations accelerate AI adoption, the gap between the speed of deployment and the maturity of internal governance frameworks is widening. Until resilience thinking, AI literacy, and clear accountability structures catch up, incidents like this will multiply. The technology is not the threat. The threat is the assumption that powerful tools can be deployed without proportionately powerful oversight.

Sources

You should be concerned if…

Small and medium-sized businesses adopting AI tools without dedicated IT governance: This incident is a direct warning. SMEs often lack the internal expertise or resources to implement proper sandboxing, backup systems, and access controls when integrating AI into workflows. The temptation to connect powerful AI tools directly to critical systems without adequate safeguards is highest where technical staffing is thinnest, and the consequences of a single error can be existential for a small firm.
Financial institutions and regulated industries in Southeast Asia and globally: The documented pattern of bank employees in Malaysia, Thailand, and Vietnam using personal devices and unsanctioned LLMs to process sensitive data represents an active, ongoing regulatory and data security risk. If your organisation has not audited how staff are actually using AI tools, as opposed to how policy says they should, you are likely already exposed.
Chief Information Security Officers and IT leadership across all sectors: Every AI tool connected to internal systems represents a new attack surface and a new vector for accidental data destruction. If your AI governance framework was written before 2025, it is almost certainly inadequate for the current generation of autonomous agent-capable models that can execute multi-step actions on live systems.
Boards of directors and senior executives with fiduciary responsibility: Liability for AI-caused damage does not rest with the AI vendor. It rests with the organisation that deployed the tool and the decision-makers who approved or failed to govern its use. Courts and regulators will increasingly look to board-level accountability when AI tools cause material harm.
Employees using AI tools in their daily work: Individual workers are often the last line of defence. If you are issuing instructions to an AI tool that has access to sensitive or irreplaceable data, the responsibility for understanding what that tool can do, and what it might do if your instructions are ambiguous, falls partly on you. The excuse that “the AI did it” will not protect careers or organisations.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Never connect AI tools directly to production databases or critical systems without sandboxing

Establish a mandatory architecture rule: AI tools must operate in isolated environments with read-only access to production data by default. Any write or delete capability must require explicit human authorisation through a separate approval workflow, not a natural language prompt. Backup and rollback procedures should be tested regularly and must be in place before any AI integration goes live.

Conduct an immediate shadow AI audit across your organisation

Survey and technically audit how employees are actually using AI tools, including on personal devices, through browser-based interfaces, and via third-party plugins. The gap between official policy and actual practice is where risk lives. Implement monitoring tools that can detect when sensitive data is being uploaded to external AI services, and pair enforcement with education rather than relying solely on prohibition.

Build AI literacy programmes that emphasise human accountability, not AI fear

Training should focus not on demonising AI but on building genuine understanding of how these tools work, where they fail, and what safeguards are non-negotiable. Every employee who interacts with an AI system should understand the concept of irreversibility, the importance of specificity in instructions, and their personal accountability for outcomes. Frame AI as a power tool: immensely useful, but dangerous without training and respect.

Establish clear escalation and incident response protocols for AI-related failures

Organisations should have a documented playbook for what to do when an AI tool causes unintended harm, including data destruction, data leakage, or erroneous outputs that affect customers or operations. This playbook should include immediate containment steps, communication templates, regulatory notification timelines, and a post-incident review process that feeds back into governance improvements.

Embed AI governance into existing risk management and compliance frameworks

AI oversight should not be a standalone initiative. It should be integrated into enterprise risk management, internal audit cycles, and compliance programmes. Assign clear ownership at the executive level, include AI risk in board reporting, and ensure that governance evolves at the same pace as the technology being deployed. What was adequate governance six months ago is likely insufficient today.

2. Geopolitical: Pacific Drug Superhighway Threatens Regional Stability

Fiji has transformed from a low-crime tourist destination into a critical transit hub on what law enforcement and analysts now call the Pacific “drug superhighway,” a network of maritime routes linking Latin American cocaine and methamphetamine producers, principally Mexico’s Sinaloa cartel and Ecuadorian trafficking networks, to the lucrative consumer markets of Australia and New Zealand. Multi-tonne seizures in Fijian waters and on Fijian soil have escalated from kilograms in the late 2010s to 4.8 tonnes of methamphetamine in January 2024 and 2.64 tonnes of cocaine in January 2026, representing a structural shift in transnational organised crime that is overwhelming Pacific Island law enforcement capacity.
The crisis extends far beyond drug trafficking. Fiji is now experiencing cascading social consequences including what UNAIDS data describes as one of the fastest-growing HIV epidemics in the world, with new diagnoses rising from 147 in 2020 to over 1,500 in 2024, driven substantially by intravenous drug use. Between January 2024 and August 2025, Fiji Police recorded over 3,000 drug-related arrests, the majority involving offenders aged 18 to 35, signalling a generational public health and social stability crisis.
State corruption is a defining feature of this crisis, not a side effect. Twenty-seven Fiji police officers were charged in 33 drug-related cases between January 2023 and October 2025. The country’s Counter Narcotics Bureau was effectively dissolved in September 2025 after officers from the unit itself were arrested for drug offences. Former Prime Minister Frank Bainimarama and former Police Commissioner Sitiveni Qiliho have been convicted of obstruction of justice, with allegations that a joint military-police drug raid near Nadi was actively stopped under Qiliho’s authority.
Australian and New Zealand organised crime networks, including the Comancheros, Alameddine network, and KVT gang, are exploiting Pacific Island states as operational bases, recruitment grounds, and transit points. Australia’s “Section 501” deportation policy, which returns convicted criminals to their countries of origin or heritage, has been repeatedly identified by Pacific police chiefs as a primary accelerant of gang proliferation across the region, effectively exporting Australian organised crime infrastructure into nations with limited law enforcement capacity.
Regional and international responses are scaling but remain outpaced by the threat. The Australian-funded Pacific Policing Initiative, endorsed in August 2024 at AU$400 million over five years, is the centrepiece of the multilateral response, complemented by formal US DEA engagement in Fiji since mid-2025 and the UNODC’s landmark Pacific Transnational Organised Crime report. The January 2026 Vatia cocaine bust, a joint Fiji Police, AFP, and DEA operation, demonstrated improved intelligence-sharing capability, but Fiji’s Police Minister has labelled the situation a “national emergency” and Prime Minister Rabuka publicly considered but ultimately declined to declare a formal State of Emergency in May 2026.

Sources

You should be concerned if…

Tourism operators, resort chains, and travel insurers with Pacific Island exposure: Fiji’s positioning as a safe, idyllic destination is under direct threat. The combination of drug-related violent crime, police corruption, potential states of emergency, and military roadblocks materially changes the risk profile for tourism investment, guest safety, and insurance underwriting across the region. Reputational contagion may spread to neighbouring Pacific Island destinations even if their direct exposure is lower.
Australian and New Zealand communities, particularly Pacific Islander diaspora populations: The demand side of this crisis sits in Sydney, Melbourne, Auckland, and Christchurch. Australian and New Zealand drug consumption, described by the AFP as an “insatiable appetite,” is the economic engine powering the destruction of Pacific Island societies. Diaspora communities face the double burden of watching their homelands destabilised while their young people in Australia and New Zealand are recruited by outlaw motorcycle gangs and syndicate networks like the KVT and Comancheros.
Maritime logistics, shipping, and port operators in the Pacific: The discovery of narco-submarines off Solomon Islands, ship-to-ship drug transfers outside Fiji’s exclusive economic zone, and cocaine concealed in shipping containers at Pacific ports means that legitimate maritime operators face heightened regulatory scrutiny, potential criminal liability for unwitting involvement, and increased insurance costs. The Pacific maritime domain is now an active theatre of transnational crime.
Pacific Island governments and their security institutions: The Fiji experience demonstrates that organised crime does not merely transit through weak states; it actively corrupts them. The dissolution of Fiji’s Counter Narcotics Bureau, the conviction of a former police commissioner, and the investigation of senior officers should be treated as a warning that no Pacific Island security institution can be assumed to be free of infiltration. The corruption risk scales with the value of the drugs moving through each jurisdiction.
International development agencies and donor governments: Billions of dollars in development aid flow to the Pacific region annually. If organised crime is corrupting the very state institutions that development programmes rely on for implementation, the effectiveness of that aid is compromised. Development strategy must now integrate organised crime as a first-order threat to governance, public health, and economic stability across the Pacific.
Global health organisations and HIV/AIDS response agencies: Fiji’s HIV epidemic, with diagnoses increasing roughly tenfold in four years and 33 babies born with HIV in the first half of 2025 alone, is a direct consequence of the methamphetamine crisis and represents a public health emergency that is not receiving proportionate international attention or funding.

Preventative actions

Reassess Pacific regional risk profiles beyond traditional natural disaster and climate frameworks

Risk managers, insurers, and corporate strategists with Pacific exposure should immediately update their risk models to incorporate transnational organised crime as a structural, not episodic, threat. The Pacific drug highway is not a temporary disruption; it is a permanent feature of the regional risk landscape driven by immovable economic incentives: sky-high Australian and New Zealand street prices for cocaine and methamphetamine. Scenario planning should model escalation pathways including further state corruption, expanded cartel territorial presence, and the potential for violent inter-syndicate competition in island nations with minimal security capacity.

Advocate for reform of Australia’s Section 501 deportation policy

The policy of deporting convicted criminals to Pacific Island nations has been identified by multiple Pacific police commissioners and transnational crime analysts as one of the single greatest accelerants of organised crime proliferation in the region. Organisations with regional interests should engage with policy forums and government consultations to push for alternatives that do not simply export criminal networks into jurisdictions with a fraction of Australia’s law enforcement resources. At minimum, deportation should be accompanied by structured intelligence-sharing with receiving nations and funded post-deportation monitoring programmes.

Strengthen maritime domain awareness and due diligence for Pacific shipping operations

Any organisation operating vessels, managing ports, or routing cargo through the Pacific should implement enhanced due diligence protocols including crew vetting, cargo anomaly detection, and real-time reporting to regional coordination centres such as the Pacific Transnational Crime Coordination Centre and the Pacific Fusion Centre. The discovery of narco-submarines and ship-to-ship transfers outside exclusive economic zones means the threat operates in waters where no single nation has effective surveillance, making industry self-reporting and cooperation with naval patrols essential.

Fund and support institutional integrity programmes in Pacific law enforcement

The AU$400 million Pacific Policing Initiative is a necessary but insufficient response if the institutions it strengthens are themselves compromised. Donor governments and multilateral agencies should condition funding on transparent integrity vetting, independent anti-corruption oversight, and whistleblower protection mechanisms. The Fiji Counter Narcotics Bureau collapse is a case study in what happens when capability is built without corresponding accountability architecture.

Integrate public health response with counter-narcotics strategy

Fiji’s HIV epidemic cannot be addressed in isolation from the drug crisis that is driving it. International health organisations, donor governments, and Pacific Island health ministries should develop integrated response plans that combine harm reduction, treatment access, and community education with enforcement and interdiction efforts. The current approach of treating drug trafficking and its public health consequences as separate problems is failing.

Quick snippet stories

Bushfire Destroys $1.8 Million Wine Business, Exposing Underinsurance Risk
An Australian couple lost their entire wine business to bushfire, turning a $1.8 million investment to ash. The story underscores a persistent and under-discussed risk: many small agricultural and rural businesses carry insufficient insurance to cover full asset replacement, particularly for bespoke operations like vineyards where rebuilding costs exceed market valuations. As bushfire seasons intensify under changing climate conditions, small business owners in fire-prone regions should conduct annual insurance adequacy reviews, ensure policies cover not just structures but stock, lost revenue, and business interruption, and maintain defensible space and emergency response plans as both physical and financial safeguards. Main link to resource
Singapore Manufacturing Grows, but Conflict-Driven Cost Inflation Persists
Singapore’s factory activity continues to expand, but the ongoing Iran conflict is inflating input costs and disrupting supply chains across the manufacturing sector. The risk lies not in contraction but in margin erosion: manufacturers absorbing higher raw material, energy, and logistics costs may sustain production volumes while profitability deteriorates, a pattern that can mask vulnerability until a demand shock exposes it. Businesses reliant on Middle Eastern energy flows or shipping routes through contested waters should lock in supply contracts where possible, diversify sourcing, and stress-test financial resilience against sustained cost elevation rather than assuming conflict-driven inflation is temporary. Main link to resource
When Supply Chains Go Dark, Risk Compounds Invisibly
Research from the London School of Economics highlights a growing and underappreciated threat: supply chain opacity, where disruptions in lower-tier suppliers go undetected until they cascade into visible failures. The core risk is that most organisations lack visibility beyond their immediate, first-tier suppliers, meaning that a factory closure, sanctions exposure, or natural disaster three or four tiers deep can trigger production halts with zero early warning. Companies should invest in multi-tier supply chain mapping tools, require key suppliers to disclose their own critical dependencies, and build buffer inventory for components with concentrated or opaque sourcing. Main link to resource
Reinsurance Costs Signal Structural Shift in Climate Risk Pricing
Carrier Management reports that reinsurance pricing is hardening further as insurers and reinsurers reprice portfolios in response to escalating natural catastrophe losses. The risk for businesses is not just higher premiums but potential coverage withdrawal from high-exposure regions, leaving assets effectively uninsurable. This pricing shift reflects a structural reassessment of climate risk, not a cyclical market correction, meaning organisations in exposed geographies should engage insurers proactively, invest in physical resilience measures that improve insurability, and explore parametric or alternative risk transfer mechanisms before traditional coverage becomes unavailable or unaffordable. Main link to resource
Mining Sector Recovers Cents on the Dollar from Insurance Claims
Mining Magazine reports that mining companies are recovering only a fraction of insured losses from major claims, highlighting a widening gap between assumed coverage and actual payouts. The risk is that mining operators are making capital allocation and investment decisions based on insurance protection that may not materialise when needed, particularly for complex, multi-peril events involving environmental liability, business interruption, and regulatory shutdown. Mining executives and risk managers should conduct forensic reviews of policy wordings, engage specialist loss adjusters before incidents occur, and consider whether self-insurance reserves or captive structures provide more reliable protection for high-severity, low-frequency events. Main link to resource

Want to discuss how these risks might effect your business?
Book 30 minutes with us, free ↗

Need support?

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

How the Iran War Ended Up in Your Bedroom

Umaima Farhan — Wed, 29 Apr 2026 09:01:06 GMT

The length of this piece provides the respect this story deserves. But not everyone has time to digest it fully. That’s why in this article, the Unbreakable Ventures team has created the Karex Intelligence Map.

Explore the Mindmap

Unbreakable Ventures Karex Mindmap to support this article.

The map has seven branches: The Trigger, The Pattern, The Company, The Moat, The Health Impact, The Backstop, and The Unreported. Each one breaks down into smaller sections you can click through. The article and the map cover the same ground in different shapes. The article tells you the story; the map shows you the connections.

If you only have five minutes, click through the map. If you have twenty, read the article. If you have thirty, do both.

There is a factory in Port Klang, Malaysia, you have probably never heard of. It makes one out of every five condoms worldwide. And on April 21^st, 2026, three sentences from its CEO to a Reuters reporter rippled through pharmacies from Auckland to Dubai, Lagos, and Kuala Lumpur.

The company is Karex Berhad. The CEO is Goh Miah Kiat, known to everyone in his industry as MK. The story he just told the world about a war four thousand kilometres away is, if you read it carefully, also a story about why the modern global economy keeps breaking in the same place.

This is not Karex’s first crisis. It is their third in five years.

In 2020, the COVID-19 pandemic shut down their factories. Sales fell 40 per cent over two years. In 2020, the company posted its first full-year loss since going public on Bursa Malaysia, the countries stock exchange. MK had bet, publicly; that lockdown would drive demand up. Instead, it cratered.

In 2022, Russia invaded Ukraine. Russia happens to be a major producer of ammonia, which preserves latex, and of synthetic rubber precursors. Karex’s FY2022 annual report named the war directly, citing inflationary pressures and supply chain disruption. The company set a record for revenue and a record for losses in the same financial year.

In February 2026, Iran went to war with the United States and closed The Strait of Hormuz. By April, Karex was telling Reuters it would raise prices 20 to 30 per cent, perhaps more. MK said current shipments were taking “close to two months.”

Three different geopolitical events. Three direct hits on one factory. There is no structural reform between any of them. But there is a fundamental lesson in dealing with concurrent crises.

Why a 33km of ocean sets the price of latex

To understand how a tanker dispute in the Persian Gulf reaches a Wellington pharmacy, we should follow the chemistry.

Latex condoms need Russia’s ammonia. Non-latex condoms use nitrile, which is made from butadiene, which is made from naphtha. Roughly 60 to 70 per cent of Asia’s naphtha transits the Strait of Hormuz, arriving from Gulf countries. Lubricants are silicone-based, and also petrochemical. The foil that wraps each condom individually is aluminum, much of it produced in the UAE using cheap Gulf energy.

The result is Karex’s price list moves whenever something breaks in the Gulf or Eastern Europe. According to figures cited to CNN by Davin Wedel, who runs Karex’s US subsidiary Global Protection Corp, synthetic rubber is up 30 per cent, nitrile up 100 per cent, silicone oil up 25 per cent, and packaging foil up 20 to 30 per cent. Wedel told CNN the situation was “adding fuel to the fire” given existing US tariffs.

For those in the Gulf, this is an awkward truth: your region produces the chemistry that makes most of the world’s condoms possible. For ASEAN, Malaysia is the manufacturing hub the rest of the world does not notice until it stops working. For New Zealand, the price you will pay at the pharmacy in three to six months is being set right now on a vessel that may or may not arrive.

Karex’s largely unreported influence

The chairwoman of Karex’s board is Professor Dato’ Dr. Adeeba Kamarulzaman. She is the President of Monash University Malaysia. She is also a former President of the International AIDS Society, the chairperson of the Malaysian AIDS Foundation, a member of the WHO Science Council, and a member of the UNAIDS Advisory Group.

She chairs the board of the company at the centre of the global condom supply crisis. She also advises the international institutions most affected by Karex’s pricing decisions on HIV prevention commodities.

Both roles are fully public. Neither is a secret. They have simply not been connected by any outlet covering the price hike.

It matters because the HIV picture is already grim before condoms get more expensive. A March 2025 modelling study published in The Lancet HIV projected that an anticipated 24 per cent average reduction in international aid combined with discontinued PEPFAR support could mean between 4.43 million and 10.75 million additional new HIV infections, and between 770,000 and 2.93 million extra deaths, between 2025 and 2030 across low- and middle-income countries. The researchers noted infection rates would be 30 to 60 per cent higher in key populations such as sex workers, men who have sex with men, and people who inject drugs.

Stockpiles were already thin. UNAIDS reported in May 2025 that around a quarter of countries surveyed held six months or less of condom stock. That is the buffer Karex’s price hike now lands on top of.

The usual contingency, scaling up PrEP (pre-exposure prophylaxis) to substitute for condom-based prevention, is also wobbling. The same PEPFAR pause that emptied condom programmes also disrupted PrEP delivery in sub-Saharan Africa.

A separate Lancet HIV modelling study published in October 2025 estimated that a one-year pause of PEPFAR-funded PrEP could result in 15,739 new HIV infections over five years. You cannot replace one disrupted prevention tool with another disrupted prevention tool.

This is the room the Karex chairwoman walks into when she joins a UNAIDS Advisory Group meeting.

The product no one is writing about

As with most crisis events, there are connections that influence the other.

Karex owns Satin Oral Dams through its US subsidiary, Global Protection Corp. Dental dams are made from the same latex and nitrile facing the same supply disruption. They are used during oral sex for STI and HIV prevention, particularly among LGBTQ communities and women.

The price hike hits dental dams. Nitrile is up 100 per cent, harder than any other input. The institutions that distribute them, NHS sexual health clinics in the UK, Planned Parenthood in the US, AIDS Healthcare Foundation, Brook, GMHC, are operating on fixed budgets.

This matters because the silence is selective. The same supply chain hits both products. The same regulatory wall blocks emergency substitution for both. The difference is that one gets a global news cycle and the other gets nothing. When you watch how a crisis is told, watch what it leaves out. The populations most affected here are not the ones being asked to comment on it.

The certification moat

One could argue that Karex is integral to our health system but comes with many vulnerabilities. So, why does no one else make condoms?

Because like semi-conductors, they do not have the infrastructure to simply replicate the process. And building one is not a quick process.

Institutional buyers require the World Health Organization (WHO) prequalification of manufacturing sites. The process takes one to three years.

Across multiple sites, Karex’s deep, multi-regulator quality and market-access certifications form a barrier that is difficult for competitors to replicate quickly.

Alternatives exist like India’s HLL Lifecare, government owned and prequalified, but capacity is small. China has Guilin Latex, which has scale but also geopolitical baggage and certification gaps. Cupid Limited in India is the only company prequalified for both male and female condoms, but its male output is modest. SKYN’s polyisoprene is less Hormuz dependent, but it is a retail premium product, not an institutional bulk supply.

In an emergency, you cannot swap suppliers. The bottleneck is not rubber. The bottleneck is regulation.

A pyramid of problems

The world’s two largest condom brands are structurally dependent on outsourced manufacturing, with limited in-house production relative to their global output.

Durex, is owned by Reckitt Benckiser of Slough, UK. Trojan, is owned by Church & Dwight of Ewing, New Jersey. The exact percentage of dependency is not publicly disclosed by either side. But it’s clear there is an awkward triangle.

Karex makes Durex while competing with Durex through its own ONE, Pasante, and Carex brands. Karex makes Trojan while competing with Trojan through ONE again. The price hike pushes margin pressure onto Reckitt and Church & Dwight at exactly the moment those companies have their strongest incentive in years to find someone else to make their products.

Reckitt launched Durex Intensity, a nitrile condom, in late 2024 with a global Q1 2025 rollout. Nitrile then doubled in price. Church & Dwight launched TROJAN G.O.A.T. in January 2026 using a patent-pending Ultra Flex non-latex material. The actual chemical composition is not in public filings. Whether it really decouples from the Hormuz supply chain is anyone’s guess.

This interconnected web of suppliers is a fragile balance easily disrupted by the other. But it’s not unique to condom manufacturing. Thousands of businesses around the world are impacted by the ripple effect the Strait’s closure represents, if nothing more than through a break in a third party’s link.

When the backstop is uneven

If a condom fails or a couple cannot afford one, what comes next depends entirely on where you live. This is where the Karex story stops being only about supply chains and starts being about geography.

ASEAN. Across Karex’s home region, the legal backstop varies wildly. Malaysia’s own Penal Code Section 312 has, since a 1989 amendment, permitted abortion to preserve a woman’s life or her physical or mental health, putting Malaysia among the more permissive countries on paper.

In practice, mifepristone is not registered in Malaysia, public hospitals often require two doctors instead of the legally mandated one, and stigma keeps many providers silent. As recently as May 2025, a 21-year-old woman in Melaka received a nine-month custodial sentence for a self-managed abortion using pills bought online. The Galen Centre noted in the same piece that one in three Malaysian pregnancies in 2022 was unplanned.

The Philippines maintains a near-total criminal ban with no health exceptions. Indonesia restricts abortion to medical emergency and rape. Thailand decriminalised abortion through 12 weeks in 2022. Singapore is liberal.

The result: a single ASEAN-wide condom price hike lands on legal systems that range from progressive to punitive, and the women paying the highest cost are those in jurisdictions with the fewest legal options afterwards.

Oceania. New Zealand decriminalised abortion in 2020 and treats it as a health matter through 20 weeks.

Australia varies by state but is broadly accessible. The legal backstop is real. The pressure is therefore financial rather than legal. When retail prices rise, public health budgets like Pharmac and DHB-funded sexual health clinics absorb the difference. The system holds, but it costs more, and the cost falls on taxpayers and clinic budgets rather than on women’s legal rights.

GCC. This is where the dynamic flips most sharply. Across Saudi Arabia, the UAE, Kuwait, Qatar, Bahrain, and Oman, abortion is generally permitted only to save a woman’s life or in cases of severe foetal impairment, and access is medicalised, gatekept, and culturally constrained.

In several Gulf states, sex outside marriage remains a criminal offence. For migrant workers in the region, particularly the women working as domestic staff with confiscated passports, an unwanted pregnancy is not just a health event but a legal and immigration crisis.

The condom is functionally the only contraceptive backstop available before a pregnancy becomes a problem the legal system will not help solve. A 30 per cent price increase on that backstop has a sharper edge in the Gulf than almost anywhere else.

A modelling study by Avenir Health for the Lancet projected that USAID contraceptive cuts alone could mean 40 to 55 million extra unintended pregnancies and 12 to 16 million unsafe abortions across affected countries. That was before the Karex price hike. The Karex hike sits on top of this.

The lesson in this crisis

For New Zealand, this is a Pharmac story before it is a Woolworths story. As Olsen put it to Stuff, retailers and public buyers will be deciding whose budget swallows the increase.

Public health budgets, not retail margins, will absorb most of the impact, and that decision is being made now in offices that do not usually think about Hormuz.

For ASEAN, this is a story about your region’s manufacturing exposure. One factory cluster, three regional supply shocks in five years, no structural reform between them. Myanmar and Cambodia are already rationing fuel. Vietnamese schools have shortened hours. The next shock is not a question of if, but when.

For the Gulf, this is a mirror. The materials that make most of the world’s condoms come from your refineries, your industrial complexes, and your ports. The fragility being exposed in Port Klang is a fragility your region helped create, and one your region can help solve.

But this story is not really about condoms. It is about what happens when a single factory becomes structurally important to global health, when its supply chain runs through three of the world’s most volatile regions at once, and when no one wants to spend the money to build redundancy until the moment redundancy becomes impossible.

We need institutional reform. We need government support and investment in supply chain disruption. We need to get involved early when a significant supplier shows signs of becoming a single point of failure to critical infrastructure or public health.

Karex has been telling us this story for five years. But we’re often distracted by the topic, rather than the lesson it serves.

If you enjoyed this piece or learned something new, consider sharing with your network.

Dubai: Anxious but Functioning

Umaima Farhan — Fri, 24 Apr 2026 23:30:54 GMT

Umaima is based on the ground in Dubai. What follows is drawn from her correspondence over the past fortnight following on from her first piece, The Iran War From Dubai: What Your Newsfeed Is Not Showing You

The Return to Normal

Dubai looks normal again. The roads are moving, sports clubs are open, people are back at dinners and gatherings, and the emergency alerts that once jolted residents awake at 3 or 4 a.m. appear to have stopped. But “normal” in the UAE right now is not the same thing as ease.

A few weeks ago, the mood here was different. When the war opened, the group chats lit up constantly. People were refreshing news feeds at midnight, debating whether to book flights, pulling their kids from school pickups early. The television stayed on, not as background noise, but as vigil. There was a specific kind of fear that comes not from knowing what will happen, but from not knowing how bad it might get.

That first phase has passed. What replaced it wasn’t confidence. It was adaptation. Somewhere in the middle stretch, a quiet shift happened. People stopped treating every alert as a potential escalation and started filing them alongside the other anxieties of living here: traffic, visa renewals, the cost of rent. The disruption had become, uncomfortably, routine.

Now, in the last week or so, even that has eased. The emergency alerts that once jolted residents awake at 3 or 4 a.m. appear to have stopped. People I know are back at padel courts and bowling alleys, and back at Friday brunches. The news cycle, which once ran on a constant loop in living rooms, has been turned down.

We know what’s happening. We don’t need all the details anymore.

Schools, Students, and a Quiet Exhaustion

Schools across the UAE resumed in-person learning on April 20, ending seven weeks of remote classes that left families drained and frustrated. But the reopening has landed with more skepticism than relief, not least because it came just two days before the ceasefire is set to expire today, April 22 (The National, April 20, 2026).

The logistics were chaotic. The Knowledge and Human Development Authority (KHDA) initially confirmed that school buses would not run on reopening day. Then, on April 18, the Ministry of Education reversed the decision and gave the green light for buses to resume, leaving families just two days to rearrange transport plans (The National, April 18, 2026). Not all schools opened on the 20th either. Each institution required individual KHDA clearance following inspections and staff safety training, and some had not received approval in time.

The safety measures inside schools tell their own story. Blue tape now marks safe zones across corridor floors and classrooms. Schools have designated shelter-in-place areas in large interior spaces without glass windows. Evacuation routes are mapped and clearly marked, and some schools have secured agreements with nearby supermarkets and mosques to serve as off-site shelters if buildings need to be evacuated (The National, April 17, 2026).

Students received safety briefings and practice drills on their first day back. Outdoor activities remain suspended. Some canteens are closed.

Beyond the logistics, there is a deeper exhaustion. Major international exams have been cancelled across the UAE for 2026. For other qualifications, schools and awarding bodies are still working out how grades will be determined, with approaches ranging from evidence portfolios to other forms of assessed coursework.

The predictable result: motivation has collapsed, particularly among younger students who were already harder to engage through a screen. The first week of in-person learning is not focused on academics at all. Schools are prioritising emotional regulation, routine, and reconnection. Academic gap-filling starts the week after. Staff training on day one included breathing techniques and strategies for helping distressed pupils.

Officials reported over 80% attendance at KHDA-cleared campuses on day one. But that figure only counts schools that opened and students still in the country. A significant number of expatriate families left the UAE when the attacks began and have not returned.

People I have spoken to describe families who vacated apartments, pulled their children from school, and flew to India or back to home countries because they could no longer take the mental toll. Some are waiting weeks to see whether the ceasefire holds before booking return flights.

Parents who did send their children back are not celebrating. They are watching the clock.

“I do feel a little worried about them returning after what happened,” one parent told Khaleej Times, “but I trust they’ll be well cared for. If anything happens, we can always return to distance learning”.

The mood among those still overseas is starker. Several parents I know have said plainly that they will not return until a proper diplomatic agreement is in place, not just a fragile, time-limited ceasefire. For them, the repercussions of this conflict will linger regardless of what happens this week.

The core tension is timing. The ceasefire announced on April 7 expired April 22. Schools opened two days before that deadline. Every institution has been told it must be ready to switch back to remote learning at any moment. Whether the reopening survives the week depends on a diplomatic outcome that nobody in the education system controls.

The Surface and the Texture

The surface reads as stability. Malls are open. The metro runs. Restaurants are full enough. But the texture has changed. Dubai Mall, which on a normal weekend you’d avoid for the crowds, is manageable now. Weekend traffic has thinned noticeably. One friend who works in retail at Dubai Mall told me that staff have reached the point of trying to convince their own colleagues to buy things, just to keep the numbers up.

Hotels and hospitality venues are pushing staycation deals, co-working packages, and discount offers with an enthusiasm that tells its own story.

The Fazaa scheme, which offers subsidised experiences for the first sign-ups, is part of the same effort: keep people spending, keep sentiment up, keep the economy visibly moving.

There are quieter signals too. The Burj Al Arab has announced 18 months of renovation. Residents raise an eyebrow at that. Eighteen months is a long time for a renovation. The luxury retail corridors are the most telling: the footfall has dropped sharply, and Dubai’s entire identity is built on that segment. Hospitality is absorbing losses during what should be peak tourist season, before the heat makes the city uninhabitable for visitors. That window is closing without the tourists to fill it.

Markets have recovered faster than people have. UAE financial indices surged after the April 7 ceasefire, with Dubai posting its largest single-day gain in six years (AGBI, April 2026). The ADX climbed 4.75% over the past month (Trading Economics, April 21, 2026). But the optimism is evaporating. As of April 21, oil prices have surged back above $95 a barrel, peace talks have stalled, and Trump has warned the ceasefire is "highly unlikely" to be extended (TheStreet, April 21, 2026). The gains of the past two weeks may not survive the next two days.

At sea, caution hasn’t fully disappeared. Major shipping actors remain wary around Hormuz, and uncertainty around navigation risks persists. The investor recovery and the social mood are moving at different speeds.

The Cyber Layer and the Language of Calm

The cyber dimension is one that most residents are now living with quietly. The Road and Transport Authority (RTA) app went down. Banking apps have been intermittent. Officially, the story is one of resilience. The UAE is handling hundreds of thousands of attacks per day, and the framing in official communications is always active, never passive. Not we are being attacked but we are managing the volume. Residents I spoke to noticed this.

“Even if it’s something bad,” one person said, “they will make it seem good.”

That instinct, to read the register of official communications and understand what sits underneath, is now a background skill that most people here have quietly developed.

It’s part of a broader information landscape that nobody fully trusts. People are drawing from government announcements, local outlets, Reddit threads, Lovin Dubai, and Western media, and they distrust each source in a different way. Government statements are considered reliable but curated. Western coverage is seen as sensationalised. Social media is unverifiable.

“No one really knows what’s going on.”

What nobody does is say any of this publicly. The GCC’s long-standing culture of political caution hasn’t changed. If anything, the war has made people more careful. People speak in closed circles. They share opinions in private conversations, in apartments, in cars.

Online, they’re careful. “You cannot incite public disruption,” one person explained, matter-of-factly, as though describing a weather pattern. “That’s always been there. It’s not new.” The distinction between what is said in a group chat and what is said on a public platform is one that residents maintain almost instinctively.

Contingency Thinking Behind Closed Doors

The more honest conversations are happening behind closed doors, and they’ve shifted in the last few weeks from immediate safety to longer-term financial anxiety.

People are talking about what to do if the banks fail, not because they believe it’s imminent, but because contingency thinking is how you manage living in a place where you don’t control the variables. Some residents have sent money back to family in other countries. Others have been buying gold: portable, convertible, not dependent on an app that might go down. The logic is old. In a war, you hold what you can carry.

Employment anxiety runs through every sector and every demographic, and this is one of the things that surprises people who assume it maps neatly onto expat versus local.

Emiratis are worried too. Business owners who considered themselves insulated are now watching their pipelines and asking the same questions as junior employees.

Events and marketing, two industries that are foundational to how Dubai presents itself to the world, have been badly hit. International acts and large-scale productions have been cancelled or pushed to later in the year. The workers in those industries, often on flexible or project-based contracts, are the most exposed.

The workers I spoke to described an environment where the choice being offered is salary cut or termination, and when someone agrees to a cut, there is no legal recourse.

“You can’t fight it if you agreed to it,” one person said.

Whether layoffs are widespread or concentrated is genuinely hard to verify. What’s clear is that people believe they are happening, and belief shapes behaviour.

There’s also a visible population shift that is hard to quantify but hard to ignore. The empty parking space next to mine, same car, same spot, not seen in four weeks. “I’m pretty sure that person left.”

It’s not clear how many people have gone, or how permanently. The consensus is that most are waiting rather than relocating, holding elsewhere until the picture clarifies, then coming back. Dubai pays well. People don’t leave easily.

The Nightclub at 2:30

The image that stays with me from this whole period is a nightclub, sometime around 2:30 in the morning. Music, a crowd, the specific unreality of a Dubai night out in full swing, and then an alert arrives. Not panic. Not chaos. People check their phones; staff move us indoors. Then, when it passes, they go back. Back to the music, back to the dancing, back to the drinks.

That moment contains everything about where the UAE is right now. The procedure has been learned. The response is calm, almost practised. Life continues. But the alert still came. The door to indoors was still used. And everyone in that room knew, without saying it, that it could come again.

Everyone Is Emirati

There’s a phrase being used in state messaging lately. “Everyone is Emirati,” a kind of manufactured solidarity between nationals and long-term residents. It’s a subtle signal: the UAE is trying to build a narrative of shared endurance. Whether people believe it or are simply living alongside it is a different question.

What most residents seem to have arrived at is something simpler and more honest. They feel physically safe. The state has demonstrated, repeatedly and visibly, that its defence systems work.

But physical safety and psychological ease are not the same thing. The early initiatives such as free therapy and community support programmes have mostly wound down. The understanding now is that this is the new reality, and everyone has to find their own way through it.

Dubai still looks normal on the surface. Underneath, people are recalculating risk, quietly, privately, and with the particular discipline of a place that has always made stability look effortless, even when it isn’t.

Umaima Farhan is a Resilience Advisor at Fixinc and a regular contributor and Advisor to Unbreakable Ventures. She is based in Dubai. Read the first dispatch in this series, The Iran War From Dubai: What Your Newsfeed Is Not Showing You.

Stolen Faces | Risk Updates for Weeks of 6 April - 22 April '26

Ollie Law — Wed, 22 Apr 2026 05:07:47 GMT

Hello 👋 get a brew on because these are the top emerging risks between April 6th, and April 22nd, 2026…

Review our report’s terminology here ↗

Small update: Our Unbreakable Ventures fortnightly update will move to a Wednesday release moving forward. This allows our team to prepare content and launch on a day that is typically more open for you to read and listen.

Our main risk this fortnight is…

1. Societal: Middle East Crisis Threatens Global Poverty Surge

A new United Nations Development Programme report warns that the ongoing military escalation in the Middle East, centred on the Strait of Hormuz closure and broader regional conflict, could push millions of people across the Asia-Pacific region into poverty through surging energy prices, trade disruption, and collapsing remittance flows, with impacts extending far beyond the immediate conflict zone.
The UNDP analysis models the crisis through the lens of its Human Development Index and finds that countries already vulnerable, particularly South and Southeast Asian nations dependent on oil imports, migrant worker remittances, and tourism revenues, face compound shocks that could reverse years of development progress within months rather than years.
The report identifies multiple transmission channels through which the crisis radiates outward: direct energy cost inflation hitting household budgets and industrial output; disruption to maritime trade routes that carry a significant share of global oil and LNG supplies; collapse or severe reduction in remittance flows from Gulf-based migrant workers who face job losses or repatriation; and tourism revenue declines as regional instability deters travel.
Small island developing states and least-developed countries in the Asia-Pacific face disproportionate exposure because they lack fiscal buffers, strategic petroleum reserves, or diversified energy sources to absorb price shocks, meaning even short-duration disruptions can trigger food insecurity, power rationing, and social instability.
The UNDP calls for coordinated international action including emergency social protection scaling, energy subsidy targeting, remittance corridor protection, and accelerated renewable energy investment, warning that delayed responses will compound the human cost and make recovery significantly more expensive and protracted.

Sources

You should be concerned if…

Oil-importing developing nations in South and Southeast Asia: Countries like Pakistan, Bangladesh, Sri Lanka, the Philippines, and Pacific Island states are absorbing the full force of energy price inflation without the fiscal reserves or strategic stockpiles to cushion the blow. For these nations, the crisis is not abstract geopolitics but an immediate threat to household energy access, food affordability, and industrial output. The UNDP report makes clear that these economies sit at the sharpest end of the transmission chain, and that even a partial reversal of development gains could take a decade to recover.
Migrant worker communities and remittance-dependent households: Millions of workers from South and Southeast Asia employed in Gulf states face job insecurity, wage delays, or forced repatriation as the regional economy contracts under conflict pressure. The families they support, often in rural communities with no alternative income sources, lose their primary financial lifeline. Remittance flows represent a larger share of GDP than foreign aid in many of these countries, making this channel of crisis transmission particularly devastating and under-reported.
Global humanitarian and development organisations: The UNDP warning signals a potential surge in demand for emergency social protection, food assistance, and energy subsidies across multiple countries simultaneously. Organisations already stretched by existing crises face the prospect of compounding need with no corresponding increase in donor funding, particularly as major donor nations themselves grapple with the economic fallout of higher energy costs.
Multinational corporations with Asia-Pacific supply chains: The poverty surge and economic instability flagged by the UNDP translate directly into workforce disruption, demand volatility, and operational risk across manufacturing hubs and sourcing countries. Companies relying on labour-intensive production in vulnerable economies should anticipate absenteeism, wage pressure, civil unrest, and potential government interventions such as export restrictions or price controls that could disrupt supply agreements.
Insurance, sovereign debt, and credit risk analysts: The compounding effect of energy inflation, remittance collapse, and tourism decline on fiscally fragile states raises the probability of sovereign debt distress, credit rating downgrades, and currency crises. Analysts must model not just the direct oil price shock but the second and third-order effects on government revenues, social spending commitments, and political stability.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Map your exposure to remittance and energy transmission channels

Organisations and governments should urgently map their direct and indirect exposure to the crisis transmission channels identified in the UNDP report: energy import dependence, remittance flow concentration, tourism revenue reliance, and maritime trade route vulnerability. Understanding which channels carry the greatest risk for your specific context allows for targeted mitigation rather than generic crisis response.

Accelerate targeted social protection and subsidy programmes

Governments in exposed countries should pre-position emergency cash transfer mechanisms and energy subsidy frameworks that can be activated rapidly as household budgets come under pressure. The UNDP report emphasises that delayed social protection scaling compounds the poverty impact exponentially, so the priority is speed of deployment over perfection of targeting.

Diversify energy sourcing and fast-track renewable alternatives

The current crisis is a structural argument for reducing dependence on Gulf-sourced hydrocarbons. Countries and corporations should use this moment to accelerate renewable energy procurement, distributed generation, and energy storage investments that reduce long-term exposure to maritime chokepoint disruptions, even if the immediate crisis requires short-term fossil fuel alternatives.

Protect and diversify remittance corridors

Financial regulators and remittance service providers should ensure that alternative transfer channels remain operational and affordable if primary Gulf-based corridors are disrupted. Governments of labour-sending countries should negotiate bilateral protections for their nationals in Gulf states and establish emergency repatriation and reintegration plans.

Stress-test supply chains for poverty-driven disruption

Multinational corporations should model the impact of rising poverty and economic instability in their sourcing countries on workforce availability, production continuity, and demand patterns. Build contingency plans for scenarios where key manufacturing or agricultural regions face civil unrest, government-imposed export restrictions, or significant labour force disruption driven by the cascading effects of the crisis.

2. Technological: Mercor Breach Exposes Permanent Biometric Threat

AI hiring startup Mercor, valued at $10 billion and backed by prominent Silicon Valley investors, suffered a catastrophic data breach in which the hacking group Lapsus exfiltrated approximately 4 terabytes of deeply sensitive user data, including high-resolution video interviews, passport and identity document scans, resumes, candidate profiles, and proprietary source code, creating what cybersecurity experts describe as a near-perfect deepfake training dataset.
The breach did not originate from simple negligence at Mercor. It was the downstream result of a sophisticated software supply chain attack that compromised Trivy, a widely used open-source security vulnerability scanner, which in turn poisoned LiteLLM, an AI model proxy layer, before reaching Mercor’s systems. The attack chain, Trivy to LiteLLM to Mercor, was three layers deep, and the same supply chain compromise affected thousands of companies simultaneously, making attribution of fault to any single organisation misleading.
The nature of the stolen data is what elevates this breach from a conventional cybersecurity incident to a permanent, irreversible threat. Unlike passwords or credit card numbers, biometric data, including detailed facial geometry, voice patterns, and behavioural mannerisms captured across thousands of hours of video interviews, cannot be changed, reset, or reissued. Every affected individual now carries a lifelong vulnerability to identity fraud, deepfake impersonation, and synthetic identity attacks.
The breach raises urgent questions about the data collection practices of AI-era platforms. Mercor’s business model required job applicants to submit extensive video recordings, identity documents, and personal information as a condition of being considered for roles, often roles that involved training AI models for major technology companies. The volume and intimacy of the data collected far exceeded what traditional hiring processes demand, yet the security infrastructure protecting it was ultimately dependent on a chain of third-party tools that no single entity fully controlled or audited.
The stolen dataset has direct commercial and strategic value to hostile actors. Nation-state intelligence services, rival AI laboratories, and criminal enterprises could use the biometric data to train deepfake generation models, conduct targeted social engineering, or build synthetic identity systems. The risk is not hypothetical: a dataset of this quality and scale, combining face, voice, identity documents, and professional background, is precisely what is needed to produce convincing impersonations that could defeat video-based identity verification systems now used across financial services, corporate access controls, and government processes.

Sources

You should be concerned if…

Individuals who submitted video interviews, identity documents, or resumes to Mercor: You face a permanent and irreversible exposure. Unlike a compromised password, your face, voice, and identity documents cannot be changed. This data can be used to create convincing deepfake videos or audio that could pass automated verification checks, be deployed in targeted social engineering, or be sold to entities building synthetic identity systems. You should assume the data is in hostile hands and take protective action immediately.
Organisations using video-based identity verification or biometric authentication: The Mercor dataset provides attackers with precisely the training material needed to defeat video KYC, voice authentication, and liveness detection systems. Financial institutions, corporate security teams, and government agencies that rely on these technologies should assume the threat model has fundamentally shifted and begin evaluating the resilience of their verification systems against high-quality synthetic media generated from real biometric data.
Companies relying on open-source security tools in their software supply chain: The Trivy-to-LiteLLM-to-Mercor attack chain demonstrates that the tools organisations trust to identify vulnerabilities can themselves become the attack vector. This is not a failure of one company’s credential hygiene; it is a structural weakness in how modern software ecosystems are assembled. Any organisation using open-source scanners, proxy layers, or AI tooling without rigorous supply chain verification is potentially exposed to identical compromise patterns.
AI companies and technology platforms that collect extensive applicant or user data: The Mercor breach forces a reckoning with the question of how much personal data is truly necessary to deliver a service, and what duty of care attaches to collecting it. Platforms that require video submissions, biometric captures, or identity document uploads as a routine part of engagement must now justify that collection against the reality that no security architecture can guarantee permanent protection of permanently sensitive data.
Regulators and policymakers responsible for data protection and AI governance: The breach exposes a gap between current data protection frameworks, which were largely designed around financial and textual personal data, and the emerging reality of mass biometric data collection by AI-era platforms. The permanent, non-resettable nature of biometric exposure demands a different regulatory approach than breach notification and credit monitoring.

Preventative actions

Audit and minimise biometric data collection practices immediately

Every organisation that collects video, voice, facial imagery, or identity documents should conduct an urgent review asking a single, uncomfortable question: is this data truly necessary for the service being provided? If it is not essential, stop collecting it. If it is essential, segregate it from general data stores, encrypt it with dedicated key management, and impose strict retention limits. The Mercor breach demonstrates that data you hold is data that can be stolen, and biometric data, once stolen, creates a liability that lasts a lifetime.

Implement supply chain security verification for all third-party and open-source tools

The attack chain that compromised Mercor started three layers upstream with a trusted security tool. Organisations must move beyond trusting tools by reputation and implement continuous verification of third-party software integrity, including code signing validation, software bill of materials (SBOM) monitoring, and runtime behavioural analysis. The security scanner that protects your perimeter should itself be treated as an attack surface.

Adopt multi-layered identity verification that does not rely solely on biometrics

With high-quality biometric datasets now in adversarial hands, organisations must assume that video and voice-based verification can be spoofed. Layer biometric checks with behavioural analytics, device-binding, cryptographic attestation, and human-in-the-loop review for high-risk transactions. No single authentication factor, especially one derived from data that cannot be changed, should be treated as definitive.

Establish breach response protocols specific to biometric data exposure

Standard breach response playbooks built around password resets and credit monitoring are inadequate for biometric data incidents. Organisations should develop specific response plans that include lifelong monitoring services for affected individuals, proactive notification to financial institutions and identity verification providers, and legal frameworks for addressing the unique, permanent nature of biometric compromise.

Demand transparency and contractual accountability from AI-era platforms

Individuals and organisations providing sensitive data to AI hiring platforms, model training services, or any technology company requiring biometric inputs should demand explicit disclosure of data storage architecture, third-party tool dependencies, supply chain security practices, and breach response commitments before submitting any information. The era of trusting platforms with intimate data based solely on their valuation or investor backing should be over.

Quick snippet stories

UK Small Businesses Hit by Cash Crunch, Supplier Fears, and War Shocks
A new Federation of Small Businesses survey reveals that UK SMEs are facing a compounding crisis as the Middle East conflict drives up input costs, supply chain uncertainty erodes confidence in supplier reliability, and persistent cash flow pressures push many firms toward the brink. The core risk is a cascading failure: when small businesses cannot trust that their suppliers will deliver, they freeze investment and hiring, which in turn weakens the suppliers they depend on. SMEs should stress-test their supplier base now and build short-term cash reserves to weather delayed payments. Main link to resource
Airlines Slash Flights as Jet Fuel Crisis Deepens
Airlines are cutting routes and reducing frequencies as jet fuel prices surge amid ongoing Middle East volatility and Strait of Hormuz disruption. The risk extends beyond airline profitability into tourism-dependent economies and business travel connectivity, as reduced capacity concentrates passengers onto fewer routes and drives up ticket prices. Airlines hedged against short-term shocks may cope, but carriers and destinations without fuel diversification strategies face a prolonged squeeze that could reshape global aviation networks for years. Main link to resource
Australia’s Fuel Security Scheme Tested Under Real Conditions
Australia’s strategic fuel reserve ships are now delivering under the government’s emergency fuel security scheme, providing a live stress test of a system designed for exactly this kind of disruption. Much like the COVID pandemic, where nations closely studied each other’s public health responses to identify what worked and what failed, countries are now observing each other’s fuel crisis strategies in real time. Australia, for example, has noted the Philippines’ mandate for work-from-home policies to reduce fuel consumption, only to discover that workers running air conditioning throughout the day consumed comparable energy, highlighting how seemingly logical mitigation measures can produce unintended consequences. Main link to resource
Australian Businesses Cut Hours and Push Remote Work as Fuel Costs Bite
Australian businesses are slashing employee hours and accelerating work-from-home arrangements as the fuel crisis raises commuting and operational costs beyond sustainable levels. This may represent one of the first early signs of an employment slump beginning to set in, as reduced hours typically precede outright job losses in economic downturns. The risk is that what begins as a temporary cost-saving measure becomes structural, with businesses discovering they can operate with fewer paid hours and choosing not to restore them when conditions stabilise. Main link to resource
Security Leaders Dangerously Overconfident About Ransomware Recovery
A new industry survey reveals a significant gap between security leaders’ confidence in their ransomware recovery capabilities and the reality of actual recovery outcomes. The risk is that overconfidence leads to underinvestment in tested, validated recovery processes, with organisations assuming backup systems and incident response plans will perform under pressure without ever subjecting them to realistic simulations. Firms should conduct unannounced recovery drills that mirror real attack conditions, including encrypted backups and compromised admin credentials, to expose gaps before an actual incident does. Main link to resource

Want to discuss how these risks might effect your business?
Book 30 minutes with us, free ↗

Need support?

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

"Trust in AI is fragile" – Inside the lab building technology for Healthcare, Civil Defence, Land Asset Management w/ Greg Headley

Ollie Law — Thu, 16 Apr 2026 01:00:47 GMT

Watch the video version via YouTube.

Greg Headley is a Lead Data Scientist at Informed Solutions, a global technology consultancy with a 30-year track record of building mission-critical AI and data systems for some of the world’s most demanding environments. Originally from America with a background in geophysics (processing large-scale seismic data) Greg pivoted into data science and has spent the past three years helping operationalise AI in sectors where failure isn’t an option: healthcare regulation, policing, emergency services, and national security.

Informed Solutions is not your typical AI consultancy. They hold two Queen’s Awards for Innovation, are multiple WITSA Global ICT Excellence Award winners, and in December 2025 became one of the first ten organisations in the UK to achieve ISO 42001 certification—the world’s first international standard for Artificial Intelligence Management Systems. Their client list reads like a who’s who of critical infrastructure: the NHS, the Medicines and Healthcare Products Regulatory Agency (MHRA), His Majesty’s Inspectorate of Constabulary and Fire & Rescue Services (HMICFRS), the Metropolitan Police, the National Crime Agency, the Home Office, NatureScot, and dozens of UK government departments and private sector organisations.

What sets Informed apart is their multi-disciplinary approach. They don’t just build AI, they employ five technical disciplines working in concert: software engineering, delivery management, user-centered design, data science, and live services. It’s this combination that allows them to move beyond proof-of-concepts into production systems that work in the real world, supporting real people. Their recent work with the MHRA developed AI tools that reduced Good Manufacturing Practice compliance validation from two hours to under five minutes. A 95% efficiency gain that’s now operational.

Greg co-authored a significant paper published in the ASA Biopharmaceutical Report documenting this MHRA work, demonstrating how multi-disciplinary teams can responsibly deploy AI in safety-critical regulatory environments.

In this interview, we cover:

Greg’s decade long involvement in data-related work.
Informed Solutions emphasis on a multi-disciplinary approach to AI.
Why building trust in technology is crucial, especially in healthcare.
Why governance and standards are essential for ethical AI practices.
What digital twins are and how they can enhance crisis management and preparedness.
AI readiness assessments that help organisations understand their capabilities.
Why trust in AI is fragile and requires incremental building.
What the future of AI might look like and why it involves more specialised tools and models.
How cybersecurity is a significant concern with the rise of AI.
Why organisations should focus on user needs to ensure successful technology adoption.

Key timestamps:

00:00 Introduction and Background
02:53 The Multi-Disciplinary Approach to AI
05:58 Building Trust in High-Stakes Technology
08:45 Navigating Ethical Considerations in AI
11:52 The Role of Governance and Standards in AI
15:02 AI Readiness and Organisational Transformation
18:00 The Impact of AI on Productivity
21:13 Governance and Innovation in AI
24:13 Conclusion and Future Perspectives
45:58 The Importance of Standards in Business
52:21 Building Blocks for Smaller Businesses
53:46 Understanding Digital Twins
01:00:16 Digital Twins in Crisis Management
01:07:16 AI and Digital Twins: A Complex Relationship
01:10:15 The Dark Side of AI
01:15:40 Future Predictions: Optimism vs. Skepticism

Connect with Informed Solutions

Greg Headley

LinkedIn: linkedin.com/in/gheadley27
Published Work: A Multidisciplinary Approach for Developing Two Bespoke AI Tools (ASA Biopharmaceutical Report)

Informed Solutions

Website: informed.com
LinkedIn: linkedin.com/company/informed-solutions
ISO 42001 Announcement: Landmark Certification for Responsible AI
AI Charter: Informed Solutions AI Charter (PDF)
AI Readiness Assessment Service: informed.com/services/ai-readiness-assessment

This podcast marks the public acknowledgement of the partnership between Fixinc and Informed Solutions, bringing world-class AI and resilience expertise to Oceania and ASEAN markets.

Gulf Gambit | Risk Updates for Weeks of 23 March - 6 April '26

Ollie Law — Tue, 07 Apr 2026 11:58:06 GMT

Hello 👋 get a brew on because these are the top emerging risks between March 23rd, and April 6th, 2026…

Review our report’s terminology here ↗

Our main risk this fortnight is…

1. Economic: Hormuz Closure Triggers Cascading Agricultural and Industrial Crisis Across Asia-Pacific

The Strait of Hormuz closure, now entering its fourth week, has disrupted approximately 20% of global oil and liquefied natural gas flows alongside critical fertiliser shipments, with Goldman Sachs warning of severe agricultural inflation and supply crunches affecting food production across Asia, Oceania, and beyond.
Fertiliser supply disruption threatens the entire 2026-2027 agricultural cycle across ASEAN nations, Australia, and New Zealand, as the Gulf states supply over 30% of global nitrogen and phosphate fertiliser exports, with planting seasons for key crops in the Southern Hemisphere beginning within the next three to five months.
Australian grain and cattle producers face compounding pressures from rising fuel costs for farm machinery and transport, fertiliser shortages affecting soil preparation for winter planting, and increasing feed costs for livestock operations, with industry bodies warning of production contractions visible in late 2026 harvests.
New Zealand’s agricultural export sector, contributing approximately 80% of goods exports, confronts rising input costs across dairy, meat, and horticulture operations, with fertiliser-dependent pastoral farming particularly vulnerable to supply disruptions arriving during critical autumn application windows.
Southeast Asian rice production across Thailand, Vietnam, and Indonesia faces fertiliser access constraints that could reduce yields during upcoming planting cycles, threatening regional food security and potentially triggering export restrictions that amplify global supply tightness.
The timeline for economic impact follows a predictable cascade: fuel and energy price increases visible immediately, fertiliser supply constraints affecting agricultural planning within four to eight weeks, reduced agricultural output and food price inflation materialising six to twelve months from initial disruption, and sustained cost-of-living pressures affecting consumer spending and business confidence through 2027.

Sources

You should be concerned if…

Agricultural producers and food manufacturers: Operations dependent on synthetic fertilisers face immediate procurement challenges and price escalation, with those lacking contracted supply or alternative sourcing facing potential input shortages during critical application and planting windows over the coming months.
Employers across all sectors: Cost-of-living pressures from food and energy inflation will erode employee purchasing power, driving wage pressure, workforce retention challenges, and productivity impacts as workers experience financial stress, with effects intensifying through late 2026 and into 2027.
Consumer-facing businesses: Discretionary spending will contract as households redirect budgets toward essential food and energy costs, with retail, hospitality, tourism, and entertainment sectors facing demand compression that may not align with current revenue projections.
Businesses relying on business confidence: Investment decisions, contract commitments, and expansion plans across the economy face hesitation as uncertainty over input costs, consumer demand, and macroeconomic trajectory creates decision paralysis among business leaders and financial institutions.
Supply chain managers in manufacturing and construction: Industries dependent on petrochemical derivatives, plastics, synthetic materials, and energy-intensive processes face both direct cost increases and indirect impacts through supplier stress and potential defaults.

Preventative actions

Model twelve-month cost scenarios now

Build financial projections incorporating sustained energy and food inflation through 2027. Stress-test margins, cash reserves, and credit facilities against scenarios where input costs rise 15-30% and consumer demand contracts. Identify break-even points and decision triggers for operational adjustments.

Engage suppliers on fertiliser and fuel forward contracts

Where operationally relevant, explore locking in supply agreements or forward pricing before spot market escalation fully materialises. Accept premium pricing today to avoid potential unavailability or extreme pricing six months forward.

Prepare employee cost-of-living response strategies

Develop contingency plans for wage adjustment discussions, benefit enhancements, or targeted support programmes that may become necessary as inflation erodes real incomes. Proactive communication about organisational awareness and response planning supports retention during uncertainty.

Diversify supplier geography for critical inputs

Assess whether alternative fertiliser sources from North America, Russia, or North Africa could provide supply continuity despite higher transport costs or geopolitical complexity. Partial diversification reduces total exposure even if complete substitution proves impossible.

Communicate proactively with stakeholders about timeline expectations

Ensure boards, investors, and leadership teams understand that current disruption impacts will intensify rather than resolve over the coming months. Set appropriate expectations for 2027 planning cycles reflecting probable rather than optimistic assumptions.

2. Geopolitical: UAE Positions Crisis Response as Competitive Edge

The UAE is leveraging current regional instability to strengthen its position as a global business hub, with government-backed initiatives accelerating digital infrastructure, supply chain diversification, and crisis-tested operational frameworks that differentiate it from competitors still reacting to disruption.
Dubai’s free zones and Abu Dhabi’s industrial clusters are actively recruiting businesses seeking to relocate operations away from higher-risk jurisdictions, with streamlined licensing processes now measured in days rather than weeks and regulatory sandboxes expanding across fintech, healthcare technology, and advanced manufacturing.
The Emirates’ sovereign wealth funds are deploying capital into supply chain resilience infrastructure, including expanded port automation, warehousing capacity, and logistics technology platforms designed to reduce dependency on single-corridor shipping routes affected by ongoing regional tensions.
Government-backed business continuity programmes now offer subsidised crisis management consulting, operational resilience assessments, and access to shared infrastructure facilities for small and medium enterprises lacking resources for independent contingency planning.
The strategy explicitly targets businesses reconsidering regional headquarters locations, with incentive packages bundling tax advantages, talent visa streamlining, and guaranteed infrastructure access during regional disruption events.

Sources

You should be concerned if…

Regional headquarters decision-makers: Organisations currently evaluating Middle East or Asia-Pacific hub locations face a narrowing window to secure preferential terms, as early movers lock in infrastructure access, regulatory approvals, and talent pools that late entrants will find constrained or unavailable.
Competitors to UAE-based businesses: Companies competing against UAE-headquartered rivals may face structural cost disadvantages as crisis-tested operations, streamlined logistics, and government-backed resilience programmes translate into faster market response and lower operational friction during ongoing regional instability.
Supply chain strategists: Businesses without Gulf Cooperation Council logistics nodes face increased vulnerability as shipping route disruptions favour companies with diversified regional distribution networks and pre-positioned inventory in crisis-resilient jurisdictions.
Talent acquisition teams: Organisations competing for internationally mobile professionals should anticipate talent migration toward UAE locations offering stability, infrastructure access, and quality-of-life advantages that become more attractive as alternative regional centres experience disruption.

These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.

Preventative actions

Evaluate regional hub strategy against crisis resilience criteria

Assess whether current headquarters and operational centre locations provide adequate business continuity during sustained regional instability. Map dependencies on infrastructure, logistics corridors, and regulatory environments that may face disruption. Consider whether competitive disadvantages are emerging against rivals positioned in crisis-resilient jurisdictions.

Engage UAE trade and investment authorities

If regional diversification aligns with strategic objectives, establish preliminary discussions with relevant free zone authorities and investment promotion agencies before preferential terms and infrastructure access become constrained. Early engagement provides optionality without commitment.

Stress-test supply chain resilience against Gulf region scenarios

Model operational impacts of sustained logistics disruption through traditional corridors. Identify whether pre-positioned inventory, alternative distribution nodes, or diversified supplier relationships would provide meaningful competitive advantage during extended regional instability.

Quick snippet stories

EU Faces Largest Oil Supply Disruption in History
The European Union confronts what energy experts describe as the largest oil supply disruption in market history, with Iran’s control of the Strait of Hormuz blocking 15-20% of global oil and natural gas flows. While Brussels prepares measures including reduced electricity taxes and grid tariffs, analysts warn Europe is not being sufficiently transparent with populations about crisis severity. Asian nations including Japan, South Korea, India, and Southeast Asian countries face immediate supply disruptions, with delayed impacts reaching European consumers within weeks to months. The crisis builds on 2022 Russian energy tensions, with diminishing alternative supplies as Asian allies increasingly reconsider Russian energy purchases, potentially forcing Europe toward the paradox of renewed Moscow dependency.
Main link to resource
Jubilant FoodWorks Addresses LPG Supply Constraints Amid Middle East Tensions
Domino’s Pizza operator Jubilant FoodWorks has disclosed operational adjustments responding to LPG supply constraints from Middle East disruptions, highlighting how energy dependencies ripple through consumer-facing businesses. The risk extends beyond direct fuel costs to operational continuity, as food service, manufacturing, and retail operations dependent on consistent gas supplies face potential service interruptions. Businesses should audit energy supply chains, identify single-source dependencies, and explore alternative fuel arrangements or operational modifications before constraints intensify.
Main link to resource
UK Weeks Away from Medicine Shortages as Supply Chains Strain
British healthcare faces potential medicine shortages within weeks as Middle East conflict disrupts pharmaceutical supply chains dependent on Asian manufacturing and Gulf shipping routes. The risk extends beyond developed nations, as reduced global supply and increased Western stockpiling may devastate third-world countries heavily reliant on international medical support. When wealthy nations experience scarcity, political pressure to prioritise domestic populations intensifies, potentially redirecting supplies away from nations lacking manufacturing capacity or purchasing power. Organisations should assess medical supply dependencies, identify critical medications requiring stockpiling, and consider implications for workforce health.
Main link to resource
Business Interruption Coverage Gaps Exposed by Escalating Global Disruption
Current global instability reveals significant gaps in traditional business interruption insurance, with many policies excluding war, civil unrest, cyber events, or supply chain failures from coverage. Businesses assuming insurance provides adequate protection during crisis events may face substantial uninsured losses when claims are denied on policy exclusion grounds. The risk compounds as interconnected disruptions trigger cascading failures across multiple coverage categories. Organisations should conduct immediate policy reviews with brokers, identify exclusion gaps, and assess whether supplementary coverage or increased reserves are necessary given current global conditions.
Main link to resource
New Zealand Tourism Faces Delayed Crisis as Input Costs Surge
New Zealand tourism operators report sharp increases in business costs as global disruption flows through supply chains, yet industry response may underestimate the crisis timeline. Tourism Industry Aotearoa’s chief executive describing the current summer season’s minimal impact as “a bit of a blessing” misses the critical point: the full effects of the Iran conflict and oil crisis will not materialise for six to nine months. This places maximum impact during the Southern Hemisphere summer of 2027, not the current or upcoming ski season. Businesses planning for 2027 summer operations should model significantly elevated input costs and potential demand compression from household budget constraints.
Main link to resource

Want to discuss how these risks might effect your business?
Book 30 minutes with us, free ↗

Need support?

Book your 30min call here

Help us help people just like you. Share this post today and spread the support 🤝

Unbreakable Ventures

Permission To Sail | Risk Updates for Weeks of 10 - 23 Sep '26

1. Geopolitical: Gulf Shipping Costs Squeeze UAE Trade

You should be concerned if…

Preventative actions

Reprice contracts with war risk pass-through clauses

Verify cover before booking, not after loading

Pre-qualify alternative routings and secondary ports

Rebuild inventory policy around longer, less certain transits

Put crew and traveller duty-of-care protocols in writing

Stress-test the cash impact of a sustained premium regime

2. Technological: Microsoft Patches Nearly 1,000 Flaws

You should be concerned if…

Preventative actions

Triage by exploitability and exposure, not by severity score alone

Set and enforce a remediation clock

Maintain a ring-based deployment pipeline

Close the asset inventory gap first

Apply compensating controls where patching is blocked

Rehearse the post-exploitation scenario

Risk Flow Graph

Quick snippet stories

More stories we’re following

Need support?

Chip Cartel | Risk Updates for Weeks of August 27 and September 9, ‘26

1. Economic: AI Supply Chain Concentration Risk Deepens

You should be concerned if…

Preventative actions

Map your chain to component and country of origin

Model an export control shock, not a supplier failure

Build allocation agreements ahead of scarcity

Hold strategic buffer stock on genuinely scarce inputs

Reassess counterparty and credit concentration

Diversify compute geography and contract terms

2. Technological: Ad Trackers Became Military Targeting Data

You should be concerned if…

Preventative actions

Disable advertising identifiers across the managed device estate

Restrict location permissions by policy, not by request

Publish a travel device standard for high risk destinations

Buy your own exposure and see what surfaces

Write data onward sale restrictions into supplier contracts

Brief personal device behaviour for staff at sensitive sites

Risk Flow Graph

Quick snippet stories

More stories we’re following

Need support?

Rogue Reps | Risk Updates for Weeks of 13 August - 26 August '26

1. Technological: AI Agents Now Breach Live Systems

You should be concerned if…

Preventative actions

Enforce authorisation server-side on every object

Rebuild business rules as hard technical constraints

Red-team your own systems with agentic tooling

Instrument detection for legitimate-looking abuse

Set an agentic transaction policy before you accept one

Establish a vulnerability disclosure channel and triage clock

2. Economic: Half of CEOs Fail at Three Weeks

You should be concerned if…

Preventative actions

Set three weeks as your business impact analysis red line

Pre-qualify and contract secondary suppliers

Map dependencies to tier three

Cost the resilience premium and get it approved

Run a full-scale supply disruption exercise annually

Fix the data before you buy the tooling

Risk Flow Graph

Quick snippet stories

More stories we’re following

Need support?

Slop Judgement | Risk Updates for Weeks of 29 July - 12 August '26

1. Technological: AI Detectors Are Misfiring On Humans

You should be concerned if…

Preventative actions

Log human authorship evidence for every published asset

Establish a named escalation route with each platform

Instrument reach monitoring with automated anomaly alerts

Classify AI involvement per asset and disclose accordingly

Diversify distribution away from single-algorithm dependency

Stress-test your content pipeline against a watermark scenario