Indifference, AI-driven impersonation and slow preparation for quantum computing are among the most pressing cybersecurity risks, according to five experts interviewed in a short video released by the World Economic Forum's Centre for Cybersecurity. Their answers point leaders past the usual list of malware and vulnerabilities toward governance questions: who owns security, how staff verify who they are talking to and when encryption gets upgraded.

What Happened

The video, "The Biggest Threats to Cybersecurity Today, According to 5 Experts," asks each guest to name the risk they consider most pressing. The speakers are Kemba Walden, president of the Paladin Global Institute and former U.S. acting national cyber director; Amy Hogan-Burney, deputy chief information security officer for governance and risk at Microsoft; Haley van Loon, chief executive of Crime Stoppers International; Marc van Zadelhoff, chief executive of email security company Mimecast; and Kat Duffy, senior fellow for digital and cyberspace policy at the Council on Foreign Relations.

Walden said people should worry about apathy, and that the biggest risk to cybersecurity is that "no one cares about cybersecurity." The video adds that her answer is not to frame the issue as cybersecurity at all. In her words, it is about making sure people can reach banking, clean water and reliable energy, and about making communities stronger.

RelatedJPMorgan Bars Outside AI Agents From Customer Accounts as Dimon Warns of 'Rogue Agents'

Hogan-Burney said she would like to end the idea that organizations can invest in security once and be done. She said that is impossible for individuals, businesses or governments, and that they need to keep thinking about the innovation coming their way.

Van Loon called AI-powered impersonation at scale the biggest risk to the communities her organization serves, saying it erodes trust because people are unsure who they are speaking to. She said executives and other public figures also fear that their own public statements can be used by criminals to produce more convincing fake videos and voice impersonations.

Van Zadelhoff said AI is moving every tier of attacker up a level, with beginners becoming intermediate, intermediate hackers becoming advanced and advanced hackers reaching "state actor-level expertise." He named the biggest risk as the activity of both humans and AI agents on an organization's most important data, and asked how companies keep that data from leaving the building in ways they do not intend.

Duffy said quantum computing is going to create abilities to break encryption in ways that do not fit current approaches. The video says encryption standards for a post-quantum world already exist, and that, in Duffy's view, the risk is that they are not being rolled out quickly or widely enough. She described the stakes as every private inbox, and every government's classified information, becoming readable to others, and said a central question is whether people will have equal access to quantum-safe protection.

The video closes with a figure from the forum's "Global Cybersecurity Outlook 2026": 61% of organizations say the rapidly evolving threat landscape and emerging technologies are their greatest challenge to becoming cyber resilient.

Why It Matters

None of the five named a single piece of malware or a specific vulnerability. Their answers describe management problems: whether security has a sponsor outside the technology team, whether budgets treat it as continuous, how employees confirm identities when voices and faces can be faked, and who controls what software agents can do with company data.

Walden's framing is aimed at boards and policymakers who struggle to fund work that has no visible payoff. Tying security to whether customers can bank or a utility can deliver water turns it into an operational resilience question that directors already know how to ask.

Van Loon's warning about executives' own public appearances is directly relevant to companies whose leaders give interviews, earnings calls and conference talks. Those recordings are the raw material for voice and video clones used in payment and impersonation fraud.

Duffy's point about deployment matches what U.S. agencies are now being asked to do. Federal agencies face an end-of-October deadline to submit post-quantum migration plans, and widely used software is starting to ship quantum-resistant defaults, as with OpenSSH 10.6.

Who Is Speaking

The panel mixes government, policy, nonprofit and industry voices. Two speakers lead companies with a commercial interest in the risks they describe: Microsoft sells security products, and Mimecast sells email and data protection, which overlaps with van Zadelhoff's focus on data leaving the organization. The video presents their views without data of its own beyond the forum's survey figure.

What to Watch

The forum's Centre for Cybersecurity publishes its annual "Global Cybersecurity Outlook," whose next edition will show whether organizations' concerns about AI and emerging technology are shifting. In the U.S., the post-quantum plans agencies submit this month, and any guidance on executive impersonation and verification procedures from regulators or insurers, will indicate how quickly the risks these experts describe turn into concrete requirements.