War, and all that goes with it

Forecasting the international security risk landscape in 2023 is a starkly different experience from doing so for 2022. Assumptions about globalised markets and supply chains have been severely tested in recent times by populist politics, trade wars and pandemics. But few organisations had seriously considered the risk of a major regional conflict in Europe or East Asia. In 2023 war, or the prospect of war, on several timelines and triggers should be high on everyone’s risk register. 

An immediate concern is the continuing risk of escalation and overspill from the Ukraine-Russia conflict, along with tensions in the Baltics and heightened risks of cyber conflict. The Ukraine conflict has also forced a refocusing on a new, wider view of war and crisis risks. Even for companies with no direct physical exposure in Ukraine or Russia, complex commercial, operational, reputational, supply chain and sanctions risks appeared.  

Business leaders are asking what the next shock could be that they are missing or underprepared for. Many are actively considering what these impacts would look like in the event of a conflict in East Asia, given the enormous role the region plays in global trade, manufacturing and growth. The likelihood of such an event in 2023 is very low, but significant enough to warrant the planning that many companies are now engaged in.            

Amid heightened geopolitical and domestic tensions, the spectre of nuclear weapons use highlights other flashpoints, such as Israel-Iran and India-Pakistan. Iran’s advancing nuclear programme is feeding a regional shadow war of terrorist attacks, air strikes and vessel seizures that threaten global trade and energy security. North Korea will likely also return to the headlines in the coming year with a seventh nuclear test. 

For many companies, conflict-related risks are a grimly familiar feature of the operating landscape in certain regions and industries. Conflict in Ukraine is an exacerbating factor in some places where security risks are already substantial and, for example, there is dependency on grain imports. Cost or scarcity of food and energy raises social unrest risks, while great power competition threatens to fuel proxy conflicts, including in the Sahel region of Africa, the Black Sea and Syria. 

Beyond traditional war risk, the crisis in Europe has further focused minds on ‘decoupling’ questions in a way that tariffs and export controls did not. When tensions over Taiwan in 2022 reached their highest point since the 1990s, many companies’ chief concern was potential loss of semiconductor supplies, rather than the risk of war itself. The visit to Taiwan by speaker of the US House of Representatives, Nancy Pelosi, and China’s reaction were a taste of things to come, not a one-off spat, and companies’ sense of more concrete geopolitical risks has added urgency to their efforts to diversify and to mitigate potential exposure. 

It does not take a war for flashpoints to affect markets and operations. In the Taiwan case, companies must also consider more limited – but more likely – escalation scenarios, such as a localised clash or serious non-military escalation. Even without much direct physical security impact, such scenarios might involve trade and travel disruption as shipping companies and airlines take precautionary measures; a rise in cyber attacks; sanctions, import and export controls; and conflicting reputational and regulatory pressures on multinationals in and outside mainland China. 

By entering the physical security sphere, great power conflict has moved up the agenda for business leaders, but this is just the latest reason for a more strategic approach to geopolitical and domestic political risk. Conflict risks are not just a matter for corporate security directors – local or regional flashpoints can rapidly have global impacts, so supply chain and market strategies cannot be developed in isolation from geopolitical scenarios. Identifying, preparing for and monitoring these scenarios must now be an integral part of organisations’ strategic planning and decision-making processes, not a subject for localised, reactive crisis management.

The end of global networks is coming 

In 2023, expect to see the emergence of a fundamental breakdown of global networks into distinct regional or even national architectures, caused by the weaponisation of cyberspace and a clash of national interests. Digitalisation continues at a frantic pace – estimates indicate that more than 60% of the world’s GDP will be digitalised in 2023 – and the ecosystem supporting it, cyberspace, is radically transforming. While technology investments increase across the board, the principles and assets governing cyberspace are eroding. Talk of Web 3.0 or the metaverse will continue to ripple through boardrooms; reality will be very different.  

The cyber arms race will accelerate in 2023, enabled by an expanded attack surface and a significant increase in automation across the entire spectrum of cyber threats. Following the example of the Ukraine conflict, the fifth domain is now firmly anchored as a critical part of modern warfare. All threat actors are prioritising developing their capabilities, and the potential for real physical damage is at an all-time high as IT and OT (operational technology) networks converge. Critical advisories from governments and industry, focused on industrial control systems (ICS), have increased in recent years and their successful exploitation by states and criminal groups grows at an even more alarming rate.  

In parallel to this weaponisation, states are looking to exert more control over what some have already defined as their national cyberspace. In 2023, more than 75% of the world’s population will be covered by at least one data privacy regulation; combined with sanctions on specific technologies or vendors, the illusion of a truly global cyberspace is fading. The next iteration of states’ intervention in 2023 and beyond will primarily focus on restricting which technologies can be used in their cyberspace.  

The consequences of these two phenomena on organisations are existential. Network and system resilience will be tested like never before in 2023. The proliferation of vulnerabilities, connectivity and threat actors targeting current and emerging technologies will challenge even the most advanced cyber security teams. Cloud services, operational technologies and IT service providers will continue facing the most critical threats from states, criminals and activists in 2023. Further afield lies the prospect of data and system integrity risks. While organisations look to automation and AI as business enablers and security controls, threat actors have already begun weaponising these tools and will increase their focus on them.  

The ambition of operating a single global network for multinational organisations will be significantly challenged. While in recent years many attempted to centralise their operations and simplify their digital supply chains, the reality of nationalism in cyberspace will reverse many of these efforts. Compliance and political considerations are set to force organisations to build at best regional, at worst national networks within their own business. Ultimately, tomorrow’s digital organisation will be a fragmented one. The key to avoid the death of global networks will increasingly be decentralisation – reversing the prevailing trend towards centralisation to gain efficiencies and control. Beyond 2023, decentralised digital environments will provide greater agility, security and resilience to those that adopt them.

Managing while adapting: surviving the energy disruption

Managing energy disruption while pursuing adaptation will be the main operational risk that businesses and governments will face in 2023. Energy has returned as the main driver of global disruption, but we are not just experiencing a geopolitical event; this will be a permanent, systemic change. There will be no return to a pre-2022 stability. The world has changed, and businesses should plan not only how to survive the short-term price and supply shock, but how to thrive in a new, comprehensively rewired, global energy system.

Since the start of the Ukraine conflict, businesses in energy importing regions have been scrambling to implement emergency responses to skyrocketing prices. Many are just trying to survive through the winter of impending energy shortages. Others are looking at the next big hurdle: how to access affordable energy in 2023.

Yet today’s energy crisis is not only an importer’s headache. Apparent short-term winners among the oil and gas producing countries may have been spared the pain of high prices and inflation, but they need to contend with the vastly accelerated – and geopolitically supercharged – energy transition timetable of their key consumers. 

Companies in all parts of the world will need a strategic approach to three key drivers of disruption that will shape business operations in 2023 and beyond: the weaponisation of energy; technological advances accelerating the energy transition; and unavoidable decarbonisation targets.

These drivers are currently in tension with each other. Countries have turned to fossil fuels to ride out the energy crisis, undermining climate adaptation policies. Some observers blame the rapid uptake of wind and solar for leaving countries without reliable baseload power. The shift from coal to gas under ambitious climate policies has increased exposure to the weaponisation of energy seen in the Ukraine conflict. Trade-offs are what the energy transition looks like.

The energy crisis is not the time for neglecting renewables. On the contrary, renewable energy continues to offer a major source of long-term stability and predictability for businesses. From a new generation of nuclear power to hydrogen and great advances in battery technologies, the energy transition is set to lead the world in innovation. It is therefore important that renewables remain at the centre of operational planning for 2023 as they become more cost-effective than unsustainable alternatives.

Economic headwinds bring regulatory turbulence 

Austerity, shortage and strife will set the tone in 2023. For companies, add state interventionism, policy unpredictability and intense government scrutiny. Our top regulatory risk for the year is the turbulence caused by government responses to tougher economic conditions and greater fiscal fragility.

Governments around the world will be targeting revenue and striving to steady state finances. Wherever they turn, the corporate world will feel the heat one way or another. 

Whether it comes in the form of windfall taxes, trade restrictions or protectionist supply chain mandates, companies will be targeted when governments need to shore up their finances and bolster populist credentials. In some cases, regulatory changes will constitute short-term pain, but governments may also seize the moment to make structural and long-term changes – to taxation, to investment rules, to trading restrictions.

Closer scrutiny and policy changes will not affect sectors equally. Government moves to tame failing economies or ease public anger over higher costs of living will likely most affect the highest-profile and the highest-earning, and may include strategically sensitive sectors – think energy, think technology.

Some jurisdictions will affect companies harder than others. These will be where governments have nowhere else to turn. After more than two years of pandemic and a conflict in Ukraine, countries around the world – and not just those dependent on Russian energy or grain exports – have asked their publics for an enormous and unsustainable amount of sacrifice. That tap has run dry. Parts of the private sector have prospered just as people are experiencing the highest inflation for a generation, soaring interest rates and living costs vastly higher than anything they have known. 

Squeezing the private sector demonstrates to strained consumers and voters that governments are doing something to ease the pain of tough economic times. Following the pandemic, even governments of liberal persuasions will have fewer qualms about interventionist policies in 2023.

In some cases, governments will look to shield businesses to help them navigate through these new conditions. But where consumers are facing the prospect of tighter living conditions or higher taxes, the impact on business will be significant too – in the form of dampened demand, for example. In an era of populism and political instability, rash government intervention and decision-making may further destabilise business environments, rather than shore them up. 

Enter geopolitics, which had already pushed governments towards regulatory interventionism well before economic difficulties, shortages and populist pressures piled on in 2022. Onshoring of supply chains and export controls will have geopolitical and economic drivers.

Regulatory changes in 2023 will establish a new threshold in government intervention in the global marketplace. They will be designed to be felt, at home and abroad, on companies’ balance sheets and beyond. 

Companies will have to grapple with heightened uncertainty around access (to commodities, to utilities, to influence) and around their regulatory responsibilities (taxation levels, trade controls, operating restrictions). Staying alert to global trends while monitoring the relationship between political and economic conditions and regulatory change in specific markets will be key to anticipating and managing regulatory risk.

This means close monitoring of geopolitical and domestic political stability, government popularity and competence, populism, economic conditions, food and energy security shortages – the factors that will drive the nature, tone and targets of government policy moves, as well as reactions to them. Stand by for resistance to regulatory complexity; stand by for turbulence, including political instability and social unrest.