Cyber Threats Are Geopolitical Statecraft
Bharat Thakrar, a board director at ISACA’s London Chapter, addressed an audience of cybersecurity leaders at Infosecurity Europe 2026 on June 3, 2026. His central message was a stark warning: executives and chief information security officers (CISOs) must fundamentally shift their perspective, treating cyber threats not as isolated internal IT issues, but as integral components of statecraft. Thakrar underscored the critical reality that cybersecurity, artificial intelligence (AI), and geopolitics are no longer distinct domains but are now inextricably intertwined, demanding a holistic and strategic response from organizations.
Thakrar cautioned that maintaining a narrow view of security, solely through the lens of IT problems, provides an incomplete and dangerously misleading context. Such a perspective, he argued, can lead to catastrophic oversights, as it fails to account for the sophisticated, politically motivated agendas driving many modern cyberattacks. To illustrate the peril of this limited viewpoint, Thakrar employed a vivid analogy, comparing the mindset of ignoring geopolitical drivers to "a turkey concluding its human caretaker is benevolent the day before Thanksgiving." This comparison powerfully highlighted the profound danger of failing to recognize hostile intent and strategic adversaries in the complex and rapidly evolving digital landscape, where the stakes extend far beyond mere data loss or system downtime.
Enterprises Caught in Geopolitical Crosshairs
The speaker emphasized a profound shift in the threat landscape: private firms are increasingly becoming direct targets of nation-state groups, and their motivations extend far beyond traditional financial gain or intellectual property theft. According to Thakrar, in this new era of digital conflict, these commercial companies can inadvertently transform into "geopolitical actors," making them legitimate targets in broader international conflicts and strategic rivalries. This redefines the scope of corporate risk, moving it from purely economic or operational to encompass national security implications.
To support this assertion, Thakrar cited the 2014 Sony Pictures Entertainment data breach as a seminal event that dramatically illuminated this trend. He noted that this incident was not merely a criminal hack but a clear demonstration of how state-aligned actors could directly target a commercial company, not for profit, but to leak sensitive material, disrupt operations, and exert political pressure. This act unequivocally proved that private entities are now subject to sophisticated geopolitical targeting. The speaker further pointed to more recent and equally concerning attacks, such as those against the satellite communications provider Viasat in Ukraine in 2022, which had significant implications for military communications, and the pharmaceutical giant Stryker in 2026. These incidents, Thakrar explained, further underscore the pervasive and escalating trend of state-aligned cyber operations being launched against critical commercial infrastructure and private enterprises globally.
Covert Foreign IT Worker Schemes Pose Insider Threat
Beyond external attacks, Thakrar also highlighted a more insidious and often harder-to-detect emerging threat: covert foreign IT worker schemes. He specifically identified North Korea as a prominent source of such schemes, where state-sponsored individuals infiltrate organizations under false pretenses. These operatives, often possessing advanced technical skills, can create significant insider access vulnerabilities that many companies, relying on traditional vetting and monitoring processes, might not detect. Thakrar raised a critical question for the audience: how many organizations would truly be able to spot these specific types of state-sponsored insider threats, suggesting that conventional detection methods are often insufficient against sophisticated personnel infiltration orchestrated by nation-states for strategic advantage.
The danger posed by these schemes is multi-faceted. Such covert workers can serve as conduits for espionage, intellectual property theft, or even pre-positioning for future sabotage, all while operating within the trusted perimeter of an organization. Their presence transforms a company's internal operations into a potential battleground for state-level intelligence gathering and disruption, making robust and geopolitically aware HR and security protocols absolutely essential.
Strengthening Organizational Defenses Against Statecraft
To translate these critical insights into tangible and actionable steps for organizations, Thakrar proposed a comprehensive four-step framework titled "ISACA’s Geopolitical Preparedness and Response Framework." He emphasized that effective response in this new threat landscape requires more than just technical solutions; it demands a fundamental shift in corporate governance and decision-making. A key component of this shift, Thakrar argued, is the necessity for executive teams to possess pre-delegated authority. This empowers them to enable swift and decisive action during a geopolitical cyber incident, bypassing bureaucratic delays that could prove catastrophic when facing a rapidly evolving state-sponsored threat.
Specific recommendations outlined by Thakrar included a complete revamp of human resources vetting processes. This goes beyond standard background checks, requiring a deeper understanding of geopolitical risks and potential state-sponsored infiltration tactics. Concurrently, he advocated for the implementation of significantly tighter access controls, not just technically, but also procedurally, ensuring that access to critical systems and sensitive data is granted strictly on a need-to-know basis and is continuously monitored for anomalous behavior. These measures, Thakrar stressed, are no longer optional enhancements but necessary adaptations to the stark reality that cyber threats are now integral components of broader statecraft strategies, demanding a coordinated, executive-level response rather than being relegated to isolated criminal or purely technical incidents.