Hello 👋 get a brew on because these are the top emerging risks between May 6th, and 20th, 2026…
Review our report’s terminology here ↗
Our main risk this fortnight is…
1. Economic: Building Systems for Continuous Disruption
Supply chain shocks no longer arrive one at a time. ASPI analysis argues disruptions now emerge as continuous, concurrent, and cascading pressures, overwhelming traditional crisis response models built for sequential, isolated incidents. Organisations must shift from reactive firefighting to systemic resilience architecture.
The concept of “systems of disruption” reframes supply chain risk as an interconnected web rather than a chain of discrete events. A pandemic, a trade war, a cyberattack, and a climate disaster can strike simultaneously, each amplifying the others, making linear risk management frameworks dangerously obsolete.
COVID-19 exposed a critical weakness: expecting teams to maintain 24/7 crisis operations across overlapping emergencies is unsustainable. Burnout, decision fatigue, and institutional exhaustion degrade response quality precisely when stakes are highest, a lesson many organisations have still not structurally addressed.
The World Economic Forum’s 2025 and 2026 Global Risks Report reinforces this reality, identifying supply chain disruptions among the top risks over the next two years, compounded by geopolitical fragmentation, technological acceleration, and environmental instability occurring in parallel rather than in sequence.
McKinsey research estimates that companies can now expect supply chain disruptions lasting a month or longer to occur every 3.7 years on average, with financial losses amounting to significant shares of annual revenue, making resilience investment an economic imperative rather than a discretionary cost.
Leaders must build agile, adaptive systems that distribute decision-making, rotate crisis leadership, and embed resilience into everyday operations rather than treating it as an emergency-only function. The organisations that thrive will be those designed for permanent turbulence, not temporary disruption.
Sources
To Prepare for Supply Chain Shocks, Focus on Systems of Disruption | ASPI The Strategist | May 2026
Global Risks Report 2025 | World Economic Forum | January 2025
Risk, Resilience, and Rebalancing in Global Value Chains | McKinsey Global Institute | August 2020
Supply Chain Disruptions and the Effects on the Global Economy | World Trade Organization | 2024
Building Resilient Supply Chains, Revitalising American Manufacturing | The White House | June 2021
You should be concerned if…
Operations and supply chain leaders in multinational organisations: The era of managing one crisis at a time is over. If your crisis playbook assumes disruptions queue up neatly, your teams will face overlapping emergencies with frameworks designed for a simpler world. Structural redesign of response capacity is now urgent.
C-suite executives and board members responsible for enterprise risk: Concurrent disruptions compound financial exposure in ways traditional risk registers do not capture. Boards that treat resilience as a supply chain department issue rather than a strategic governance priority are underestimating the speed at which cascading failures erode enterprise value.
Workforce and human resources leadership: COVID-19 proved that sustained crisis operations break people. If your resilience strategy depends on the same team operating at surge capacity indefinitely, you are building on a foundation that will collapse. Workforce rotation, mental health infrastructure, and distributed decision-making are operational necessities, not perks.
Small and medium enterprises with limited redundancy: Larger firms can absorb concurrent shocks through diversified suppliers and geographic spread. SMEs operating with lean inventories, single-source dependencies, and small crisis teams face existential risk when multiple disruptions overlap, which is now the norm rather than the exception.
Government policymakers and critical infrastructure operators: Cascading supply chain failures do not respect sectoral boundaries. A logistics disruption can trigger a pharmaceutical shortage, which strains healthcare, which affects workforce availability, which deepens the original disruption. Systems thinking must replace siloed crisis management in national resilience frameworks.
These items are generic assumptions. We recommend considering your own unique risk landscape against your critical dependencies. If you don’t know what they are, get in touch.
Preventative actions
Design for concurrent disruption, not sequential crisis
Organisations should stress-test their crisis response frameworks against multiple simultaneous scenarios rather than single-event tabletop exercises. War-gaming overlapping disruptions reveals bottlenecks, capacity gaps, and interdependencies that only appear under compound pressure.
Rotate crisis leadership and distribute decision authority
Build tiered crisis teams with clear rotation schedules and delegated authority so no single group bears continuous operational burden. Empowering regional and functional leaders to act autonomously during overlapping emergencies prevents central bottlenecks and reduces burnout.
Embed resilience into daily operations rather than emergency protocols
Resilience should not be a plan activated during a crisis but a permanent operating principle. Integrate scenario planning, supplier diversification reviews, and disruption simulations into routine quarterly business processes so adaptive capacity becomes institutional muscle memory.
Invest in real-time visibility and early warning systems
Deploy supply chain monitoring tools that aggregate geopolitical, environmental, and operational risk signals into a single dashboard. Early detection of converging threats provides the lead time needed to activate mitigation strategies before cascading failures take hold.
Build mutual aid networks and cross-sector partnerships
No organisation can absorb continuous disruption alone. Establish pre-negotiated agreements with industry peers, logistics partners, and government agencies for resource sharing, alternative routing, and coordinated response during compound crises to distribute the burden across a wider network.
2. Technological: State-Backed Ransomware Threatens Private Enterprise
State-sponsored ransomware operations are escalating against operational technology and critical infrastructure, with cybersecurity experts warning that the line between espionage, sabotage, and financially motivated cybercrime has effectively dissolved as nation-states weaponise ransomware for strategic objectives.
Groups linked to Russia, China, North Korea, and Iran are increasingly deploying ransomware not just against government targets but against private enterprises that form the backbone of national infrastructure, including energy companies, hospitals, logistics firms, and manufacturing operations that serve entire populations.
The 2021 Colonial Pipeline attack demonstrated how a single ransomware strike on a private company can cascade into a national crisis, shutting down fuel supply across the US East Coast for days. More recently, the 2023 attack on logistics firm DP World Australia paralysed container operations at major ports, disrupting supply chains across the country for weeks.
The healthcare sector has been particularly devastated. The 2024 Change Healthcare ransomware attack, attributed to the ALPHV/BlackCat group with suspected Russian links, disrupted prescription processing and insurance claims for thousands of US pharmacies and hospitals, directly affecting patient care and exposing sensitive medical data of over 100 million individuals.
Private businesses often underestimate their exposure because they do not consider themselves geopolitical targets. Yet state-backed actors deliberately target private firms that control critical chokepoints, knowing that disrupting a single logistics provider, energy distributor, or healthcare processor can paralyse services that millions depend on daily.
Cybersecurity agencies including CISA and the UK’s NCSC have issued repeated warnings that operational technology environments remain dangerously under-protected, with many industrial control systems running legacy software, lacking network segmentation, and offering threat actors lateral movement pathways from corporate IT into physical infrastructure.
Sources
Colonial Pipeline Cyber Attack: A Timeline | TechTarget | 2021
DP World Australia Cyber Attack Disrupts Port Operations | Reuters | November 2023
Change Healthcare Cyberattack Exposes Data of Over 100 Million People | TechCrunch | October 2024
CISA Warns of Ongoing Cyber Threats to Critical Infrastructure | CISA | 2024
You should be concerned if…
Private enterprises operating critical infrastructure or essential services: If your company distributes fuel, processes medical claims, operates ports, or manages logistics networks, you are a strategic target regardless of your size. State-backed actors select victims based on systemic impact, not profile, and your disruption becomes a national crisis.
Operational technology and industrial control system operators: Legacy OT environments with poor network segmentation are the primary entry vector for state-backed ransomware moving from IT systems into physical infrastructure. If your industrial controls are connected to corporate networks without robust isolation, your physical operations are exposed.
Healthcare organisations and pharmaceutical supply chains: The Change Healthcare attack proved that a single compromised node in health infrastructure can disable prescription services, delay care, and expose millions of patient records. Any organisation in the healthcare value chain that lacks robust cyber resilience is both a target and a liability.
Small and mid-sized suppliers to critical industries: State-backed actors increasingly exploit smaller vendors as entry points into larger targets. If your cybersecurity posture is weaker than your clients’ and you have network access or data-sharing agreements with critical infrastructure operators, you represent a high-value attack vector.
Boards and executive leadership teams without cyber literacy: Ransomware is no longer an IT department problem; it is a strategic, geopolitical, and operational risk that can halt revenue, trigger regulatory action, and destroy stakeholder trust overnight. Leadership teams that delegate cyber risk entirely to technical staff are governing blind.
Preventative actions
Segment operational technology networks from corporate IT
Implement strict network segmentation between IT and OT environments to prevent lateral movement by attackers. Ensure industrial control systems cannot be reached directly from compromised corporate email or administrative systems, which remain the most common initial access vectors.
Conduct tabletop exercises simulating state-backed ransomware scenarios
Move beyond generic cyber incident drills. Simulate scenarios where attackers have nation-state resources, persistence, and strategic objectives. Test your organisation’s ability to maintain operations, communicate with regulators, and recover critical systems under sustained, sophisticated attack conditions.
Audit and harden supply chain cyber dependencies
Map all third-party vendors with access to your systems or data, assess their cybersecurity maturity, and enforce minimum security standards contractually. The weakest link in your supply chain is the most likely entry point for state-sponsored actors targeting your operations.
Maintain offline, immutable backups of critical systems and data
Ensure that backups for essential operational systems are stored offline and tested regularly for restoration integrity. State-backed ransomware groups increasingly target backup infrastructure to maximise leverage, making air-gapped copies a non-negotiable defence layer.
Engage with national cybersecurity agencies and threat intelligence sharing
Register with CISA, NCSC, or equivalent national agencies to receive timely threat advisories and indicator-of-compromise feeds relevant to your sector. Participate in industry-specific information sharing and analysis centres to benefit from collective early warning intelligence.
Quick snippet stories
Asia’s Tech Boom Masks Deeper Oil Crisis Vulnerability
Asia’s technology-driven economic growth is masking significant exposure to the ongoing global oil crisis, with energy-intensive manufacturing and logistics costs rising sharply. The risk is that governments, buoyed by strong tech sector performance, delay necessary energy diversification and fiscal buffers, leaving economies dangerously exposed if oil disruptions deepen or tech demand softens simultaneously. Main link to resourceMalaysia Warns of Silent Supply Chain Shockwaves
Malaysia’s Trade Minister Tengku Zafrul has warned that supply chain disruptions are hitting the nation in waves that are difficult to detect until damage is done. The concern is that cascading second and third-order effects on Malaysian manufacturers and exporters are being underestimated, with smaller firms particularly vulnerable to input shortages and margin compression before policymakers can intervene effectively. Main link to resourceUS-China Rare Earth Deal Delivers Limited Relief
A recent US-China rare earth agreement offers only marginal supply chain relief as Beijing retains tight export controls over critical minerals essential to defence, electronics, and clean energy industries. The risk remains that strategic dependency on Chinese rare earth processing persists despite diplomatic optics, leaving Western manufacturers exposed to future supply weaponisation during geopolitical escalation. Main link to resourceTariff Uncertainty Set to Intensify for Agricultural Exporters
New Zealand’s agricultural sector faces renewed tariff volatility as global trade negotiations stall and retaliatory measures accelerate. The risk is that exporters who adjusted to the initial tariff environment may be caught off guard by a second wave of escalation, compressing margins further and disrupting established market access strategies at a time when input costs are already elevated. Main link to resourcePolitical Risk Shifts From War Zones to Contested Systems
Willis warns that political risk is migrating from traditional conflict zones into contested economic and regulatory systems, including trade networks, sanctions regimes, and digital infrastructure governance. The implication is that businesses previously insulated from geopolitical exposure now face disruption through regulatory fragmentation, sanctions overreach, and the politicisation of supply chains, requiring a fundamental rethink of where political risk actually resides. Main link to resource
Want to discuss how these risks might effect your business?
Book 30 minutes with us, free ↗
Coming soon at Unbreakable Ventures
We are excited to share some new releases and improvements for our fortnightly update. These include an interactive flow chart of industry-specific threats, characterised through our core threat categories. This will allow you to see how stories we’ve been monitoring for those two criteria fluctuate over time.
Additionally, we will share our Disruption Risk chart that shows the specific events happening within the selected industry. For example, it will show the count of how many significant cyber attacks have affected ports, or how tariffs are impacting trade, giving you a visual overview of this week’s threats.
And finally, we have noticed that hundreds of the stories we’re not able to squeeze into our updates are going to waste. So we will provide a small widget in these articles, allowing you to view external articles on stories that didn’t make it into the update.
Watch this space for these fresh updates, and make sure to subscribe to get the most out of them.
Need support?
At Fixinc, we are passionate about helping people get through disasters. That’s why our team of Advisors bring you this resource free of charge. If you need help understanding these threats and building a plan against them, the same Advisors are here to help over a 30-minute online call. Once complete, if you like what was provided, you can choose to provide a donation or subscribe to Unbreakable Ventures to support this channel.
