GFC Common Language

1
The World Economic Forum’s Global Future Council is conducting this research to better understand how cyber matters are described, discussed, and prioritized in executive decision-making. As cyber continues to affect economic growth, public trust, and national resilience, differences in terminology between technical experts and leaders can create gaps in understanding — sometimes slowing decisions or complicating collaboration across sectors and regions.

This survey aims to identify the language that best bridges those gaps. Your responses will help shape a shared, practical cyber vocabulary — one that strengthens communication between public- and private-sector leaders, supports alignment across frameworks and policies, and enables more confident and timely decisions during periods of risk. The survey takes about 5 to 7 minutes.

All responses will be analyzed in aggregate and used to support the Global Future Council’s discussions and work on cyber. Thank you for your time and contribution.
2
Which region is your primary office in?
North America
Latin America and the Caribbean
Europe
Africa
Middle East
Asia and Pacific
Other
3
What is your current level of responsibility?
Executive leadership (for example, CEO, CIO, CISO, CTO)
Senior vice president / executive vice president
Vice president
Director
Manager
Other
4
Which sector best represents your organization?
Public sector / government
Private sector (large company)
Private sector (small or medium-sized company)
Critical infrastructure operator
Multistakeholder / international organization
University / research center
Other
5
When you hear the phrase “cybersecurity,” what is the main outcome you expect at your level?
Continuity of critical services and operations
Protection of sensitive or owned data
Compliance with legal and regulatory obligations
Maintaining public or stakeholder trust
National security / resilience of critical infrastructure
Other
6
Which cybersecurity decisions fall under your direct responsibility?
Budget allocation and prioritization
Setting the organization's risk appetite
Crisis management / incident response oversight
Strategic partnerships and supply chain risk decisions
Alignment with regional / international frameworks (such as NIS2 and NIST)
Other
7
When does cyber risk become important enough to get your attention?
When there is a risk of financial loss
When operations or essential services are threatened
When legal or regulatory obligations arise
When public trust, reputation, or national security are at stake
Other
8
Which terms do you often use when discussing cyber risks with your peers?Please list any cyber risk terms you frequently use with your peers.
Resilience
Continuity
Trust
Stability
National security
Economic risks
Other
9
Which terms are behind the biggest misunderstandings or disagreements among senior stakeholders?
Critical infrastructure
Zero trust
Cyber risk versus cyber resilience
Assurance versus certification
Cyber attack / “attack back”
Other
10
Which terms do you usually avoid in senior-level discussions?
The term “cybersecurity” itself
Terms related to information systems / technical architecture
Military or defense-specific language
Framework or standard names (such as ISO 27001)
Other
11
Where do the most conflicting interpretations arise between different frameworks or standards?
Alignment between regional and global regulations
Public sector priorities versus private sector priorities
Defining what counts as “essential” versus “important” entities
Translating technical gaps into business impact
Other
12
What kind of language is most effective in building trust during cyber incidents?
Human-centered language (victim-focused)
Economic impact (costs, GDP, sector disruption)
Clear recovery indicators (such as time to resume operations)
Shared definitions of “criticality”
Other
13
Have you ever been in a situation where the lack of shared language delayed or weakened the response?
Yes, often
Yes, during high-stress incidents
No, communication has generally been clear
Other
14
If yes, please briefly explain:
If yes, please briefly explain.
15
How do cyber risks become a clearer impact in your context?
Operational disruption
Financial loss
Loss of market trust / reputational damage
Supply chain disruption
Broader economic or national impact
Other
16
What specific information — in simple terms — do you need to make confident cyber decisions?
17
Where do cyber terms today create distance, ambiguity, or defensiveness among stakeholders?
18
When you think of cybersecurity at a national or organizational level, which role best describes its function today?
Technical protection function (IT/security)
Risk management / compliance requirement
Operational continuity enabler
Economic stabilizer (protects GDP, supply chains, markets)
National security / sovereignty tool
Other
19
In your view, how directly does cybersecurity influence economic stability?
No direct impact
Indirect / secondary impact
Moderate impact on specific sectors
Direct and measurable impact on GDP, markets, or supply chains
Critical systemic dependency
20
Which of the following best captures how cyber incidents propagate beyond the organization?
Internal operational disruption
Supplier / third-party disruption
Sector-wide disruption (e.g., finance, energy)
Cross-border economic spillover
Market confidence / liquidity impact
Public trust / societal stability
21
What type of evidence would make cybersecurity investment a priority for you?
Case studies (e.g., major incidents)
Regulatory requirements
Benchmarking vs peers
Quantified economic impact (GDP loss, sector loss, etc.)
Clear return on investment (ROI / risk-adjusted return)
Impact on national competitiveness / sovereign risk
22
What is currently missing to treat cybersecurity as an investable priority (not a cost)?
Clear economic valuation models
Standardized metrics
Long-term funding mechanisms
Strong policy leadership
Market incentives
Cross-sector alignment
Other
23
Which metrics would make cyber resilience measurable in economic terms?
Financial loss avoided
Downtime reduction (MTTR)
Supply chain continuity
Impact on revenue / productivity
Risk-adjusted return (Cyber-adjusted ROI / WACC)
System-wide resilience indicators
24
How should cybersecurity investments be evaluated?
As a cost center
As risk mitigation
As compliance necessity
As an economic stabilizer with measurable return
As a strategic investment for competitiveness
25
In your experience, what most effectively drives large-scale cyber investment?
Crisis events
Regulatory pressure
Political leadership
Market demand
Demonstrated economic value / ROI
26
Where do you believe cybersecurity should sit within national or organizational strategy?
IT / digital function
Risk / compliance
Security / defense
Economic planning / finance strategy
Cross-cutting national infrastructure layer
27
What would make cybersecurity comparable to climate or energy as a global priority?
More visible crisis events
Stronger economic data
Global coordination body
Political champions
Public awareness
Clear linkage to economic impact
28
How should global cyber initiatives be funded to ensure sustainability?
Government funding
Philanthropy
Private sector investment
Blended finance
Market-driven investment with clear returns
Sovereign-backed models
29
What prevents cybersecurity from attracting large-scale capital today?
Lack of clear ROI
Perception as a technical issue
Fragmented ownership
Weak economic narrative
Competing priorities
Lack of standardized metrics
Should be Empty: