IBM’s annual X-Force Threat Intelligence Index shows how cyber criminals took full advantage of global uncertainty in 2021, especially in the manufacturing industry

Today, IBM Security released the results of its annual X-Force Threat Intelligence Index. As cyber criminals become increasingly innovative in leveraging global uncertainty, more than ever companies and policy makers need to join forces to share threat intelligence, best practices and improve standardization and innovation to combat cyber threats.

 

By Julian Meyrick, Managing Partner & Vice President, Security Strategy Risk & Compliance, Security Transformation Services Software, IBM Security

 

In 2021 cybercriminals took full advantage of global uncertainty, a weakened supply chain and unpatched vulnerabilities to successfully infiltrate organizations across the globe and make their pay day. IBM’s X-Force Threat Intelligence Index identifies the biggest cyber threats in 2021, and how ransomware and vulnerability exploitations together were able to ‘lock-down’ businesses around the world.

Instead of chasing the money, cyber criminals now chase leverage, all through our supply chains. Last year, manufacturing surpassed the financial industry as the most attacked sector. Manufacturing faced the most attacks in Asia (32%), North America (27%), and Europe (26%), indicating the strategic shift in attackers’ targeting.

With nearly 1 in 2 attacks on manufacturing occurring due to unpatched vulnerabilities, and 2021 also witnessing a 50% increase in disclosed vulnerabilities in Industrial Control Systems, it’s is clear that cyber threats are a growing concern across all industrial sectors.

The Charter Of Trust, a global initiative of leading companies advancing cybersecurity, is calling for both industry and governments to work together and share know-how and best practices, but also to extend operational collaboration to government agencies and other public sector entities.

The need for bringing together the cybersecurity capabilities of public and private sector partners to enhance cyber resilience has never been greater.

Since its inception, the Charter Of Trust has been promoting multilateral efforts in regulation and standardization.

And the sense of urgency to create common security standards and enhance collaboration is growing.

In the European Union, for instance, there is a strong focus on building a cybersecurity ecosystem across the EU Member States, through the EU’s Cybersecurity Strategy for the Digital Decade.

In the US, President Biden’s Executive Order on “Improving the Nation’s Cybersecurity highlights the persistent cyber threat to the United States and calls on the government and private sector to partner to address these ever-evolving cyber threats through requirements on software supply chain security, threat information sharing, and enhanced cybersecurity standards.

But while governments are addressing cybersecurity measures, companies should not wait for regulation to take effect, but rather strengthen their partnerships with other private players as well as with governments. The Charter has always advocated for more joint public-private initiatives across the entire supply chain in various sectors, for a more collective and coordinated readiness to act on threats.

If there’s one thing the 2022 X-Force Threat Intelligence Index shows, it’s that it is essential that industries are prepared for cyber risks – and preparation requires access to information.

Whether in manufacturing, financial services, or the energy sector, cybercriminals are becoming increasingly more resilient, resourceful, and stealthy in their pursuit of businesses’ critical data. It’s paramount that we all recognize that public-private partnership and collaboration on threat sharing will be central to building a coordinated defense against these threats.

Read more about the global and regional results in the X-Force Threat Intelligence Index below:

You may also like

Decrypting the Future: Global Timelines for PostQuantum Cryptography and why they matter
icon Post-Quantum Cryptography

Decrypting the Future: Global Timelines for PostQuantum Cryptography and why they matter

The transition to post-quantum cryptography is not a future problem — it is a present one. The threat of adversaries harvesting encrypted data today for decryption once quantum computing matures means that organizations with long-lived data and systems are already exposed. Waiting for cryptographically relevant quantum computers to arrive before acting is not a viable risk management strategy.



Exposure is not uniform across sectors. Financial services, government and defense, operational technology, and healthcare face the sharpest quantum risk, driven by decades-long data retention obligations, slow system replacement cycles, and the societal consequences of cryptographic failure. For these sectors, PQC readiness has moved from best practice to strategic imperative.



Globally, the direction of travel is clear. The United States, European Union, United Kingdom, Singapore, and Australia have each established structured PQC transition frameworks, with mandatory deadlines converging around the late 2020s and 2030. Organizations operating across jurisdictions should expect compounding compliance requirements and align migration plans accordingly.



At the same time, the geopolitical dimension of PQC standardization is becoming increasingly salient. The emergence of a “splinternet” infrastructure, characterized by regionally fragmented digital ecosystems, suggests that cryptographic standards diverge along political and strategic lines. As a result, organizations must not only manage technical migration but also navigate a politically charged landscape in which interoperability, regulatory alignment, and long-term cryptographic agility become critical strategic considerations.



This paper offers a comparative overview of regional PQC transition frameworks and identifies the business and systemic risks associated with quantum-vulnerable cryptography, providing insights for organizations preparing for the transition to post-quantum cryptography. Overall, PQC migration is a strategic transformation, not a technical patch. Cryptographic inventory, governance structures, crypto-agility, and supply chain engagement are as central to success as algorithm selection — and organizations that treat PQC readiness as an architectural and organizational challenge will be best positioned as quantum risks continue to mature.
April 07, 2026
•
A Quantum Leap for Cybersecurity: The Charter of Trust’s PQC Ambition
icon Post-Quantum Cryptography

A Quantum Leap for Cybersecurity: The Charter of Trust’s PQC Ambition

The Charter of Trust is taking decisive steps to secure our digital future in the quantum era. As quantum computing advances, the risks to today’s cryptographic systems grow ever more urgent. Our dedicated working group is leading the way in raising awareness, promoting standards-based migration, and fostering collaboration across industries, governments, and academia. Together, we are committed to a proactive, well-coordinated, and risk-driven transition to post-quantum cryptography—ensuring digital trust and resilience for generations to come. Discover our vision and join us as we shape a secure digital world for the quantum age.
November 03, 2026
•
Read the Charter's contribution to the European Commission's public consultation on the Digital Omnibus Package
icon Artificial Intelligence

Read the Charter's contribution to the European Commission's public consultation on the Digital Omnibus Package

The rapid expansion of EU digital regulation has strengthened security, privacy, and trust, but it has also created overlapping obligations, inconsistent timelines, and administrative complexity. The Digital Omnibus Package provides a timely opportunity to streamline these rules, ensure greater coherence, and enable businesses to focus resources on resilience and innovation rather than redundant compliance tasks.
The Charter of Trust welcomes the Commission’s initiative to harmonize digital regulations across the EU, aiming to reduce administrative burdens while maintaining high standards of security and privacy. Representing the unified views of its Partners, this paper addresses all key legislation within the scope of the Digital Omnibus and offers comprehensive recommendations. It emphasizes the need for a unified incident reporting system, risk-based notification requirements, and fair compliance processes to minimize regulatory overlap. The Charter calls for clearer liability clauses, global recognition of certifications, and stronger supply chain security.
In data regulation, the Charter advocates ensuring alignment between the rules on data intermediation services under the DGA and B2B data sharing under the Data Act and extending exemptions to mid-cap companies, all while safeguarding trade secrets. For artificial intelligence, the paper recommends a phased approach to new requirements, integrated conformity assessments, harmonized compliance templates, and clear definitions, supported by sector-specific guidance and transparent AI categorization. The Charter also encourages the European Commission to ensure that ePrivacy reform is future-proof, fosters innovation, and reflects the needs of both businesses and consumers. Finally, it recommends robust security standards and cross-border recognition for the EU Business Wallet, with industry involvement in technical standards and integration with data access systems.
Collectively, these measures are designed to foster innovation, resilience, and trust in the EU’s digital landscape, allowing businesses to thrive in a coherent and future-ready regulatory environment.
October 14, 2025
•