Ground Truth | RiskMap revisited: what's happened, what's next?

Intro: 00:00:00.920 — 00:00:53

Caspar Leighton: Welcome to the Ground Truth from Control Risks. This is the place to hear insights for your organisation from our experts on what's moving in the world of strategic intelligence and security. I'm your host, Caspar Leighton, and in this episode, I'll be exploring what's going on in the six months since we published our annual risk map forecast of business risks, inviting my guests to point to what the next six months have installed. 

I'm delighted to be joined by a trio of control risks experts who will help us canter across the world of risk. With me in the studio are Claudine Fry, a partner at Control Risks, whose focus is Geostrategic Advisory.  

Claudine Fry: Nice to be here, Caspar.  

Caspar: I’m also joined by Caitlin Egan, who is a Director in our Digital Risk Practice. 

Caitlin Egan: Thanks, Caspar. 

Caspar: And beaming in from Washington, D.C. Jonathan Wood, a Principal in our Geopolitical and Country Risk Practice.  

Jonathan Wood: Hello. Great to join you. 

Client sentiment and geopolitical backdrop 00:00:53 – 00:02:38 

Caspar: Claudine. I'll come to you first. You've been spending the last six months talking to clients from multiple sectors about the top risks, what's been foremost in our clients minds? 

Claudine: Caspar, I think one of the things that's been foremost in our client’s minds has been, what on earth is going on?  
I've been in this job a long time, and I've been involved in this matter about a decade or so, if not a bit longer. And it's been a first for me, that presenting RiskMap has often been to audiences who are sort of nervously anticipating what we're going to say and who also ... there's a sort of palpable emotion as well, in virtual and in-person rooms when we've been talking about the top risks this year. 

I think people even feel a degree of anger in some cases about what's happening geopolitically. And I think that speaks to our normalization trap risk. You know, we're in this environment where geopolitical shocks and drama and turbulence have normalised, but our reactions to it all haven't really yet. And we're still sort of trying to grapple with how we manage the anxiety about uncertainty and what to do about the world and, and how rapidly it's transforming before our eyes, whether it's, you know, right from the beginning of the year and the 3rd of January, with the detention of a head of state by foreign security forces. 

With respect to thinking there, obviously, about Maduro and what happened in Venezuela on the 3rd of January, whether we're thinking about the potential for actual war within NATO over the status of Greenland or the 28th of February, start of the war in the Middle East, and of course, that is not yet resolved or whether it's the fact that the Ukraine conflict has sort of limped into a fourth year. There has just been so much going on. And so, a risk map has been an opportunity to have that conversation.  

US foreign policy and volatility 00:02:38 – 00:04:43 

Caspar: Jonathan, let me cross to your side of the Atlantic. I think a lot of what Claudine has been talking about there has been generated by one man in the White House, you might say. I remember in your article which talked about the new rules, No Rules World, you talked about an opening up of geostrategic possibilities, which now sounds like the understatement of the century. How does the last six months play out in your client's experiences?  

Jonathan: Well, I think you hit the nail on the head there, both Caspar and Claudine. The number one factor for so many of our clients over the last six months and into 2026 has been unpredictable, volatile foreign policy making by the US. 
This is really making the geopolitical weather. But as you rightly point out, it often is coming abruptly without a lot of warning, but with quite significant implications for business. And so that really has been the major challenge, is trying to understand what is driving U.S. policy, where it goes from here and really what the US is trying to accomplish strategically. 

I think we have moved into a much more national security emphasis of U.S. policy in all of the various domains here in the Western Hemisphere, but in the Middle East and in Asia as well. And so this is, as you rightly say, it's opening up new possibilities where some of the traditional underpinnings of U.S. foreign policy are being really stripped away, down to much more transactional questions about is this in national interest? 

And when we get to that point, you know, we do get some interesting configurations and reconfigurations of geopolitics. Things are on the table that have not really been on the table for 20, 30, 40, maybe even 80 years. When we think about NATO, the integrity or coherence of NATO or aspects of the US-China relationship. 

And so it's quite an exciting time. I think, for many of our clients, it's quite challenging as well, because they are having to really manage against a number of different shocks, remain adaptable, flexible, but often reactive to geopolitical developments.  

AI, digital risk and governance challenges 00:04:43 – 00:06:24 Caspar:
Great. And Caitlin, of course, you come from the world of digital risk. Our risk in risk map was the AI compute contest, I guess digital risk. They cut across everything. If people have been talking about anything other than the war in the Gulf, it's been the rampant rise of AI and how it's affecting everything we do, how we think, how we act in work and at play. What if the clients you've been talking to, being most concerned about, or even excited about in the past six months? 

Caitlin: Thanks, Caspar. So, I think the compute contest is very much alive, but our clients have had fundamentally more practical questions around how to deploy AI and not lose control. So, I think the big challenge for a lot of our clients is that there is this commercial pressure to deploy AI, so they're experimenting, they're giving AI access to workflows. 
There are the broader questions around the economic side, which isn't settled. So, they're wondering sort of how to measure ROI. They're also asking us what other clients are doing in the space. But fundamentally the biggest question is they do not understand the risk they're introducing into their organization, whether that's the data that is accessed by the AI models through to how they monitor behaviour over time. 

And I think fundamentally this poses a governance question. And the challenge with AI governance is that it cannot be point in time. It has to map to the behaviour of the technology. As we optimize for AI, AI is given more access over time to workflows, to datasets, to systems. So, our clients are shifting from asking, how do we improve this tool to how do we manage what it accesses over time? How do we monitor its behavior over time, and how do we assess our rapidly changing exposure against our current risk appetite? 

How RiskMap has performed 00:06:24 – 00:08:22 

Caspar: So, Claudine, going back to you, how do you think our risks have stood the test of time?  

Claudine: Caspar, I think they've stood the test of time really well. The caveat that it is early, really, into 2026. 
We're not even at the halfway point yet. We come up with the risks roughly September, October. So, we will literally, you know, over the summer holidays that are coming up, we'll be starting to think about the risks of 2027. Right? It is a very long process and we think about them quite far in advance. So, it's always a challenge. 

And we're always we're always nervously anticipating how they're going to hold up. But I think this time they have really stood the test of time while recognizing that there is potential for us to see more dynamism with some of the risks that have been less high profile so far this year. So, I'm thinking, particularly there, of activated societies. 

I don't think we've seen perhaps as much political instability ... as we as we may have anticipated over the course of 2026. But actually, I think particularly here in Europe, the seeds are being sown for more of that activation leading to instability over the second half of this year. And, you know, we were partly motivated by Gen Z protests that erupted over the latter part of 2025. 

We were thinking about activated societies. And I think it's worth reflecting on the fact that, Nepal in particular, a country that doesn't always get a huge amount of attention, but ... it's a country that is experiencing a profoundly different political environment off the back of those Gen Z protests.

Now, earlier this year, we had a 35-year-old former rapper. As the various news reporting around Nepal likes to frequently tell us ... but you know, we have a country there where I think more than 50% of the population is under 30 demands that a change is now responsible for government, essentially, after the elections that took place there. And I think that's a sort of a sort of relatively small-scale example of what we may yet see unfolding in other parts of the world.  

US cost of living and political pressure 00:08:22 – 00:10:31 

Caspar: And of course, here in the UK, we're getting our own very British version of political instability. And I think coming out of the Gulf conflict, there's a large cost of living squeeze that's going to start washing up on many government shores.

Jonathan, how is that playing out in the US? 

Jonathan: Well, I mean, that's exactly right. When we look back at the things that were motivating activated societies, you know, the two things really stand out. The first was corruption. You know, the sense that governments and business, for that matter, are just unaccountable to the people. And the second was cost of living.

The price of everything had gotten, you know, societies proceeded through big inflationary shock. Of course, we couldn't anticipate in 2026 just how dominated it would be by this war in the Middle East. But this war in the Middle East is absolutely massively accelerating the inflationary shock worldwide. 

And that brings me to the US, where there's very much a palpable sense that this is doing significant political damage to the president and his party, the Republican Party, ahead of midterm elections later this year, where the administration has been, to some extent relatively insensitive to cost of living concerns. 

You know, last year it was the trade war and the application of tariffs for inflation. This year it is prosecuting this kinetic war in the Middle East. And, you know, a degree of sort of, you know, the messaging coming out of the administration is we are laser focused on preventing Iran from getting a nuclear weapon. 

There's going to be costs associated with that. Well, I can tell you that now. Retail petrol prices in many parts of the country are over $5 a gallon. This is a price that you see everywhere you go, all the time. And people are people's patience for these foreign policy adventures, when this is the price of them is dwindling fairly rapidly. 

And so we can expect to see, you know, if not necessarily mass demonstrations, mass anti-war demonstrations, you know, in the streets of Washington, DC, there have been some of those, but, you know, maybe less than we might have expected. I think we can expect to see public dissatisfaction with the implications of the war show up at the ballot box in November. 

Technology and evolving threat landscape 00:10:31 – 00:11:31 

Caspar: Yeah. Cheap gas has always been a cornerstone of American society as viewed from the rest of the world. Caitlin, I guess a lot of the activation of society happens in the digital domain. What are you seeing there?  

Caitlin: So, it's interesting when I look across our five risks, I actually think that they've stayed pretty consistent, that the technology and digital side has certainly amplified some of those risks. 
For example, when I think about the organized crime risk, the cybercrime side of that, and how AI technology has rapidly changed the threat environment in the last six months ... but most interestingly, I think when we think about some of the technology vendors that our clients are reliant on to deploy ... commercial edge via AI have been involved or implicated in a lot of the geopolitics that play globally. Right, specifically thinking about what's happened in the Middle East, where technology vendors were named as targets by Iran as part of that conflict, and how that played out for some of our clients in response to the AWS outage.  

The normalization trap 00:11:31 – 00:14:22 

Caspar: So, I think before we got to this section where we're explicitly discussing how the risks have held up, we fairly well covered off the first risk, which talked about the new rules, no rules world. We've touched digital, we've touched activated societies, and we've touched on crime as well. I guess the fifth risk we had is the normalization trap, which is a bit more where we lean into the theory of how we help our clients and the kind of exercises and scenarios and all that sort of stuff. That's really the bread and butter of helping organizations across the world prepare for the world of risk they face. How has that normalization trap piece been playing out? Jonathan, maybe from you.  

Jonathan: I mean, I think many of the risks that we looked at this year really drive at the central issue for companies, which is that the assumptions that they build their companies on, they build their businesses on their strategies. 
Free international trade, you know, access to global supply chains just in time, movement of goods. These have been upended by geopolitical and domestic political developments. And volatility is the new normal. And I think we need to be wary in this environment, that we don't become complacent with the sheer level of volatility that's happening out there, and that we can really identify and focus on the risks that are material and important to our business. 

So, I can give you an example of this, which is to say that, you know, you look at the financial markets, despite all of the chaos in the Middle East, have been relatively sanguine. You know, they have been relatively they've been, you know, a bit choppy, but otherwise doing well, much less so than you would expect for a world that the IMF, the World Bank, other major financial institutions warn us is on the cusp of a major slowdown because of the energy shock and the shock to global supply chains. 

So something is happening there where either we are not fully appreciating, you know, the shoe that's about to drop in terms of potential global energy scarcity, or we are looking through to some of the other fundamental drivers of the global economy, which could be, you know, in Caitlin's world, the AI and data center build out worldwide. 

It could be demographic trends in parts of the emerging and developing world where we have these fast-growing middle classes that are producing really innovative and exciting new business opportunities, and maybe less traditional places. It could be some other, you know, some other aspect that we're that we're not fully appreciating. 

And that that I think is the normalization trap is we are so focused on many of the headlines and things that are right in front of us that we perhaps miss the broader story that's behind them, and this mismatch between what we see in the headlines and what whether it's financial markets are telling us or investment patterns are telling us, that may be hinting at that the extent in nature of that trap 

Emerging risks: data and quantum 00:14:22 – 00:18:05 

Caspar: And Caitlin in the digital sphere, in the cyber sphere, are things just moving to incredibly fast. But anything like normalization to feel like something that could trap you people just going at a helter-skelter all the time.  

Caitlin: I think that's a great way of asking the question. I think for a lot of our clients right now, they accept that security has always been a cat and mouse game, but we're really at an inflection point where AI is being adopted by threat actors. And what AI fundamentally changes is it compresses the time frame around attack success. So, for a lot of our clients, they're having to really reassess their security models for the first time in a really meaningful way. And there is a broad shift now in security operations towards vulnerability operations and moving away from human-centric security models to machine centric.  

Caspar: So, Claudine, it sounds like our risks have held up pretty well on the whole. But is there anything you know in your conversations with clients or problems that clients have come to us with? Was there something that we missed?  

Claudine: So, I have had a number of clients come and want to talk eagerly about the fact that its data keeping them up at night, if that's the one issue that they really find troubling. So, you know, the security of their data, and how much further localisation requirements could go, how much more complicated it could get to move data across borders, the Middle East conflict and the incidents that we've seen. The security incidents that we've seen in the Middle East directly targeting data centres.  

Caspar: Hitting a data centre probably was on most people's risk radar, right?  

Claudine: Absolutely not. And so that's prompted some reflection on how this sort of strategic thinking around how to think about... So that's prompted some reviews of the way that organizations are approaching the management of data, I think. And also, quantum is emerging on the horizon as an issue, which is sort of normalizing in conversations with clients, even outside the sort of, uh, specialist. So no longer the theoretical distance it actually is now some coming, something that is coming up with chief risk officers as well as people who are responsible for cyber security, I think. 
And although it's an emerging risk, it's one that demands attention now because the potential impact of quantum breakthroughs is so enormous.  

Caspar: When it arrives, it's going to be at the speed of light, right? 

Claudine: Definitely looking at you for a question for you, Caitlin. 

Caitlin: Faster than the speed of light. That's my answer. Okay. 

Caspar: Okay. Analyse that.  

Claudine: And I think, Caspar, if there's one other issue that, thinking back and sort of how developments have unfolded, I think the extent to which information is contested, and the challenges that raises for organizations that are trying to understand what's going on and also communicate that to employees, to stakeholders, to investors about their position on developments. 
I think that's tricky. You know, for example, we have a ceasefire in the Middle East, but is it really a cease fire? You know, definitions of war and what that means are evolving very quickly, and yes, in environments like the UK ... extremely polarized and increasingly so. And access to impartial information is. It's been an issue for a while, but I think it's one that's a growing concern for organizations, including in terms of how that plays out internally within your workforce.  

Looking ahead: next six months 00:18:05 – 00:23:46 

Caspar: Okay. So now I would like to bring the podcast around again to the forecasting phase. This was a discussion of a forecast we set back in November. As Claudine has pointed out, with a calendar accuracy, we're only halfway through the year, which is why we're all sitting here, of course. Jonathan, what do the next six months hold for you, I think. I mean, at the start of the year it was all Venezuela, the Western Hemisphere. And then suddenly President Trump decided Iran was the thing to do. But what can we look forward to or, you know, worry about it in the coming six months in, in your hemisphere and globally from your perspective? 

Jonathan: I mean, there's going to be a really busy H-2 in the Western Hemisphere, in North America and Latin America. We're going to start in just a couple of weeks here with the regional World Cup event, which has become perforce a geopolitical symbol of many different types of things, both here in the US and in the wider region. 
Everything from immigration into organized crime implications. Stuff we talked about in this map. Certainly very soon thereafter, we will have the formal reopening of negotiations on the US, Canada, Mexico trade agreement, USMCA, where, you know, there's a lot of anxiety here in the region that that agreement, which has been in place since the mid 1990s, might be substantially reconfigured if not entirely collapsed. 

You know, what it looks like going forward is certainly a big question, especially for Canada and Mexico. Right. Not too long after that, we have a brace of major regional elections. We have the Brazilian general election, where the kind of traditional right left dynamics in that country will come very much again once to the fore, followed shortly thereafter by the US midterm elections. 

We've already mentioned it, but of course, one that is pivotal to perceptions of institutional stability here in Washington and perhaps a brake on the Trump administration's sort of second half of its agenda over the next few years. And right around that same time, we are going to be hosting the Group of 20, the G-20 summit here in the US. 

I just note that President Trump has invited President XI to attend both that summit, but also to pay a state visit to the US sometime in the second half of the year. And that, you know, the next couple of months will really be a test of this strategic stability between the US and China and whether or not we see, you know, more ... good vibes and cooperation on perhaps some minor issues or if we return to some phase of trade escalation, which is for many of our clients, you know, one of their biggest concerns is this, you know, whatever's happening in the Middle East, whatever happening in the Western Hemisphere, the big geopolitical dynamic is the US-China relationship. It's big and trade is big in geopolitics, and that's something that we need to be watching very closely over the next few months.  

Caspar: Well, a fascinating H2 ahead for you, Jonathan, and your colleagues. I'm Claudine. The war in the Gulf is in a situation of sort of a ceasefire, not really a ceasefire. What do you think the dynamics are from that situation over the next six months for our clients? 

Claudine: There are going to be many and varied, Caspar. The long tail of the Hormuz crisis is going to be one that we feel over the course of the rest of 2026 into 2027 and beyond. But, you know, organizations are thinking about the impact on them in a number of different respects. We have clients talking to us about whether they're going to be able to proceed with events they have scheduled over the later part of this year, because they're worried about whether there'll be enough jet fuel to ensure that guests and participants and delegates will actually be able to reach the venues of their events. 

We're working with organizations who are rethinking their spending and borrowing plans on account of anticipating how, you know, interest rates are going to be changing over the course of year. What we might see happen with inflation. And there are organizations who are trying to work out where to anticipate instability on account of difficulties with the cost of living intensifying. 

It'll be the end of 2026 and into 2027, before we're really starting to feel the effects of higher food prices, for example, which are going to be a direct consequence of the closure of the Strait of Hormuz and the broader crisis in the Middle East.  

Caspar: Right. Caitlin, you've talked a lot about the difficulties and challenges that the super-fast pace of AI is presenting to clients. I'd like to know, in the next six months what are the characteristics you see in clients that makes them best place to weather what's coming down the road when it's coming so fast and it's kind of unpredictable.  

Caitlin: So, in practice, it's the clients who elevate digital risk as an executive priority. But when I say digital risk in this context, I specifically mean AI risk in governance, right. To colour this a bit, I ran an AI training for a client last week, and on the back of that training session, two people within the business both turned around and said to me, we're now reconsidering two AI deployments we are about to roll out based on this training around the risks that we may be introducing to our business, which I think just illustrates that point. 

Secondly, clients where they are unlocking investment into strengthening the security functions that it can withstand an AI enabled threat environment. And finally, we talk a lot about this, but digital risk really touches on everything. And I think clients who recognize the digital side to a lot of their operational risks, their executive protection risks, their insider risks, and who invest in a converged operational security program. 

So uplifting online threat intelligence, for example will really strengthen their overall resilience across the organization,  

Bright spots and closing 00:23:46 - end 

Caspar: Right. We're about out of time. But before we get to the end, I'd like to ask you all, amidst all the challenges and risks we've been articulating over the last 20, 30 minutes, are there any bright spots, any sectors or any geographies that are actually pulling some success out of this very complex situation?  

Claudine: We are seeing a huge amount of resilience and adaptation play out, particularly in the wake of the Middle East crisis. Companies and countries are rethinking supply chains, transport corridors, and there are some countries which are doing a very effective job of balancing interests between different geopolitical power holders, parts of Southeast Asia, for example, India. And so, I think there are huge areas of opportunity out there.  

Caspar: Jonathan, what about your perspective? Do you see some bright spots emerging? Anyone making successes with this situation?  

Jonathan: Well, I mean, I think lots of companies are actually doing quite well out of geopolitical volatility. They are taking advantage of new market opportunities, and some of these have to do with the diversification and decentralization plays and investments that governments are making. 
Companies need to be poised to seize those types of opportunities. I think last year, including when we were writing RiskMap, we spoke a lot about how the US led trade war was producing a sort of unleashing a burst of global dealmaking and negotiating activity, some long standing trade negotiations like between the EU and India, that have been going on for years, if not decades, were rather quickly and swiftly finalized. 

And so, we were saying, you know, we are in a new rules world. There are new opportunities emerging, even as some of the older institutions, relationships, ways of doing things are changing. And companies should be, you know, keep their eye on where we have new trade deals, new investment flows, new supply chains being developed, new technological investments and innovations that might not be coming necessarily out of the US or China or some of the big economies, but might be coming from the emerging and developing world. 

You know, parts of sub-Saharan Africa where you have these tech hubs that are doing really interesting things at the edge. That's where I see a lot of opportunity, not just in 2026, but over the medium to long term.  

Caspar: Okay. Well, I think that just about brings us to the end of this edition of the Ground Truth from Control Risks. I'd like to thank you all so much for joining me here in studio, Jonathan, down the line from Washington, D.C. and Claudine and Caitlin here in London. It's been great talking to you all.  

Caitlin: Thanks, Caspar.  

Claudine: Thanks for having us.  

Jonathan: Thanks very much.  

Caspar: Thanks for listening or watching. However, you consume your podcast and do look out for the next edition of The Ground Truth from Control Risks. Bye for now.