Before the Davos Noise

A hybrid-threat reading of the Global Risks Report 2026

Happy New Year. Before the Davos (stress) cycle starts turning risk into slogans, it is worth reading the World Economic Forum’s Global Risks Report 2026 while it is still fresh and calm enough to analyse on its own terms. Davos itself runs from 19 to 23 January 2026, so the timing matters (World Economic Forum).

The way the report is put together adds to its value. Now in its 21st edition, it’s based on a structured dataset of expert opinions, not just one person’s view. The Global Risks Perception Survey 2025–2026 collected input from over 1,300 experts between 12 August and 22 September 2025. It also uses the Forum’s Executive Opinion Survey, which has more than 11,000 business leaders in 116 countries identify the top risks for their countries over the next two years. The report includes expert insights from interviews and workshops held from May to November 2025.

This is important for understanding hybrid threats because it is not just about events themselves. It is also about what powerful institutions think is happening, what they support, what they regulate, and what messages they send to markets and the public. What people believe shapes policy, and policy shapes the environment.

The report’s framing is blunt: rules and institutions that have long underpinned stability are under siege in a new era in which trade, finance and technology are wielded as weapons of influence. That is hybrid competition, even if the label is not used.

Money, war, and peace, as one system

The report’s immediate-term question is simple: “Please select one risk that you believe is most likely to present a material crisis on a global scale in 2026.” Geoeconomic confrontation comes first at 18%, followed by state-based armed conflict at 14%. In this dataset, economic confrontation is currently seen as more crisis-producing than direct armed conflict in the near term.

In protection, risk, and resilience work, this is not abstract. When economics hardens into coercion, operating environments can change fast: sanctions exposure, export controls, capital restrictions, supply-chain reliability, protest dynamics, and the “permission structure” for escalation. The report notes that the escalating use of sanctions, regulations, capital restrictions, and weaponization of supply chains is increasingly treated as a geoeconomic strategy.

This is not a WEF-only story. The Munich Security Report 2025 warns about the specter of “policy-led geoeconomic fragmentation” into competing blocs (securityconference.org). The IMF has been tracking the same direction of travel, noting that new trade restrictions have more than tripled since 2019 and that financial sanctions have expanded as geopolitics pushes into the economic domain (IMF).

Money is leverage. Leverage becomes coercion. Coercion increases uncertainty and resentment. Uncertainty and resentment fuel hybrid operators, both state and non-state.

The cognitive front is no longer a metaphor

The report is unusually direct about information integrity and connects it to social fracture. It describes how information is vulnerable to manipulation for political outcomes or economic gain, contributing to grievances, hardened beliefs, reduced critical thinking, and extremist amplification. It also notes one of the strongest interconnections in the survey: societal polarization tightly linked to misinformation and disinformation.

It then gets concrete about synthetic media. The integrity of online news is increasingly under threat because distinguishing authentic from synthetic content is becoming more difficult. It cites Reuters Institute data: 58% of respondents globally are concerned about how to distinguish truth from falsehood in online news.

In the AI section, the language sharpens further. It describes “information chaos” as deepfakes and AI-generated misinformation become so ubiquitous that it becomes impossible to distinguish truth from deception, breaking consensus on basic facts and raising the risk of violence.

Deepfakes already show up in both trivial and high-consequence ways: in October 2025, President Trump shared an AI-generated “sombrero and moustache” meme video depicting Democratic leaders such as Hakeem Jeffries, and Vice President JD Vance publicly dismissed it as a joke (ABC News). In January 2024, New Hampshire authorities investigated a robocall that cloned President Biden’s voice to discourage primary voting, and the FCC later moved forward with a $6 million penalty against the consultant behind the operation (docs.fcc.gov). And in March 2022, a deepfake video circulated that appeared to show Ukraine’s President Zelenskyy urging surrender, which he rapidly debunked publicly, showing how synthetic “leader statements” can be weaponized during kinetic conflict (Reuters). The European External Action Service’s 3rd report on Foreign Information Manipulation and Interference (March 2025) maps the digital infrastructure deployed by foreign actors, mainly Russia and also China, to manipulate and interfere in the information space of the EU and partner countries.(Europese Dienst voor extern optreden).

For protective teams, this stops being theory very quickly: impersonation, reputational sabotage, “evidence denial” during crises, and rapid mobilisation of hostility around an individual or organisation.

I explored one slice of this dynamic in When Your Ally Starts Campaigning In Your House, where influence is not only external pressure but an internal narrative operation. This report helps explain why those campaigns land harder during economic anxiety and political fatigue.

Cyber and infrastructure: where disruption meets narrative

The 2026 risk landscape places cyber insecurity in the top 10, and the report treats disruptions to critical infrastructure as a named risk category with cascading consequences across systems. That is the hybrid pattern in practice: technical disruption plus economic loss plus an information fight over attribution, competence, and legitimacy.

Here, too, the wider reporting aligns. ENISA’s Threat Landscape 2025 frames itself as a snapshot of prevailing threats faced by EU member states and EU-based organisations (enisa.europa.eu). The UK National Cyber Security Centre’s Annual Review 2025 is explicit that cyber risk is now tied to national and economic security, and it summarises lessons from incident handling and resilience priorities across the period it covers (ncsc.gov.uk). Canada’s National Cyber Threat Assessment 2025–2026 describes state and non-state actors and how the cyber threat landscape is expected to evolve over the next two years (Canadian Centre for Cyber Security). Cyber disruption rarely stays cyber. It becomes social friction, political pressure, and loss of trust, especially when it targets critical systems or high-profile people and institutions.

Conflict is rising, and the preconditions are worsening

WEF is clear that kinetic wars are part of the present turbulence, and it ranks state-based armed conflict as a top crisis risk for 2026 at 14%. To anchor that in a quantitative peace and conflict baseline, the Global Peace Index 2025 reports 59 state-based conflicts in 2023, the highest number since the end of WWII (Vision of Humanity). Even far from the frontline, conflict exports spill over: migration pressure, organised crime opportunities, infrastructure strain, supply-chain interruptions, and heightened hostility in information spaces.

Translating the strategic signal into operational reality
The WEF report is not a protective risk assessment, and it is not trying to be one. It defines “global risk” as a significant negative impact on a large proportion of global GDP, population, or natural resources. I translate the signals into continuity: travel and access, personal and brand targeting, critical dependencies, and the speed at which narratives can turn into incidents.

To do that, I keep coming back to a few plain questions.

Where does coercion actually bite? In the economics of access: sanctions, capital restrictions, supply-chain weaponisation, and pressure on payment systems and financial infrastructure.

Who benefits from the confusion? This is where mis(dis)information, synthetic media, and mapped influence infrastructure become operational rather than conceptual.

What does “material” look like operationally? Not global GDP. It looks like disrupted travel and access, volatile crowds and protests, communication outages, impersonation-based targeting, broken logistics, or a narrative shock that forces security decisions.

In the end, this is why I (we as security analysts, professionals, protective agents, etc.) use reports like this as a baseline, not as a script. They help identify where pressure is building across domains, but the real question is how those pressures translate into decisions, delays, and disruptions in the real world. Hybrid competition rarely arrives with a formal declaration. It arrives as friction, ambiguity, and a race to shape interpretation while systems are under stress.

That is also why I keep pulling the conversation down from “global risk” to operational consequence. If I cannot describe what a “material crisis” looks like in practice, I am still only describing the weather, not planning for it.

Once the lens is set this way, the headlines stop looking like separate stories. They start looking like variations of the same pattern: economic leverage, legal and political coercion, infrastructure vulnerability, and narrative contest, interacting in real time.

Hybrid threats are not one thing. They are the coupling of economic leverage, information manipulation, cyber disruption, and political pressure, applied in ways that exploit friction, fatigue, and uncertainty.

Seen through this lens, the early 2026 headlines stop looking like separate crises. They look like pressure-tests of the same hybrid mechanics, played out in different theatres.

Ukraine is the real-time case study for how hybrid pressure travels across domains. Repeated strikes have pushed the energy system into emergency mode, and the drone layer matters because it scales pressure cheaply. Shahed-type drones tie the battlefield to a supply and production ecosystem that runs through Russia, Iran, and overseas procurement. Add energy-market pressure and fragile logistics, and the result is a more volatile operating environment for security and protective teams: infrastructure fragility, uncertain fuel and transport conditions, higher travel friction, and faster escalation from narrative shock to real-world disruption.

What precedent is being set by the U.S. capture of Venezuela’s Nicolás Maduro, especially when Maduro himself called it a “kidnapping” in court and the operation’s legality is being debated in international forums? If “law enforcement with military support” becomes the template, where is the line between policing, coercion, and interstate conflict, and what kind of blowback does that normalize across the region?

In the Arctic, the Greenland story reads like a geopolitical thriller, but it is also a stress test for alliance cohesion. When a U.S. president argues NATO would be “more formidable” if Greenland were under U.S. control, and Denmark and others respond by reinforcing sovereignty and posture, the question becomes uncomfortable and unavoidable: can NATO absorb internal territorial pressure and still sell itself as a rules-based shield?

Inside the United States, domestic temperatures matter too. A sweeping immigration crackdown that is already producing violent confrontations and protests raises another hybrid-style question: what happens to national resilience and legitimacy when internal enforcement becomes a rolling flashpoint, and how does that shape the country’s ability to project “rule of law” narratives abroad?

Iran is another live wire. With commercial ships reportedly anchoring outside Iranian ports amid U.S. tensions and signs of increased GPS interference in the Gulf, and with protests and crackdowns adding internal volatility, the strategic question is not only “will Iran stabilize”? It is whether escalation remains contained below the threshold of open conflict, or whether a miscalculation around the Strait of Hormuz becomes the kind of shock that instantly travels through energy, shipping, markets, and narratives.

And in East Asia, the Taiwan question is not parked just because other crises are loud. With Taiwan signaling more U.S. arms sales in the pipeline after a record package, and with China demonstrating pressure through large-scale drills and coercive signaling, the question is how deterrence and provocation interact over time. Is the region moving toward stability through preparedness, or toward a new normal where constant demonstrations, information operations, and military rehearsals make one mistake harder to absorb?

So what does this bring me, operationally, on the drive into Davos season? It brings me back to continuity. What changes in travel and access this week? Where legitimacy is under strain. Which dependencies cannot fail? Which narratives can turn into an incident before verification catches up? The world will keep delivering new headlines, but the channels stay familiar. My job is to stay ahead of the friction, before friction becomes an incident.

That is the hybrid reality behind the headlines, and it is why continuity planning is not an add-on. It is the strategy. 2026....and and and.....