Most Risk Leaders See the Threat. Few are ready for it.

Ask a risk leader whether geopolitics could hurt their business, and the answer is almost always yes. Verdantix's research found that 56% of leaders see geopolitical conflict as the biggest threat to their organisation. Yet many of those same leaders aren't acting on it.

That gap was the focus of our recent webinar, The Geopolitical Blind Spot: Why Almost Half of Risk Leaders Have Their Eyes Closed. Tara Lynch, Product Director at Signal AI, and Luis Niño, Senior Risk Manager at Verdantix, discussed why so many organisations keep missing the signs, and what to do about it.

The numbers at a glance

52% to 75%: the share of risk leaders rating geopolitics as a high priority, from 2025 to 2026.

56%: see geopolitical conflict as their biggest threat.

45%: say they won't increase their budget for it next year.

34%: rely on public sources such as Google Alerts, Twitter, or the BBC.

15%: ignore the topic completely.

Concern is up. Spending is down.

A year ago, risk leaders planned to increase software investment by 10 to 20% over the following 12 months. That intent has fallen. Oil is above $100 a barrel, inflation is stubborn, and leaders are protecting their reserves. The result is that investment decisions get postponed.

Luis' point is that heightened awareness isn't turning into strategic change. Many organisations know the risk is there, but they aren't acting on it.

Public sources are not intelligence

Scraping the news gives you headlines. It doesn't give you history, geopolitical context, or a sense of what a development means for your business. Signals gathered that way are narrow, late, and mostly noise.

Real risk intelligence works differently. It pulls from many sources, cleans and filters the data, and delivers the right signal to the right person so they can act.

"What can I do about it?"

Many leaders conclude there's nothing they can do, so they don't prepare. Luis calls it the ostrich problem: burying your head in the sand because the risk feels out of your control.

Sometimes the constraints are real. Canadian organisations that, a year or so earlier, would never have expected 50% trade tariffs with the United States found that shipping goods early only helps if you can store them, afford the storage, keep cash flowing, and avoid spoilage. But the answer isn't to do nothing. It's to know your options before the shock arrives.

Your biggest blind spot is your third parties

Large companies often inherit legacy systems through mergers and acquisitions. Merging them is expensive, so the business runs in silos. Luis described one chief risk officer at a large computer manufacturer who runs six separate GRC systems, with nobody willing to fix it. Silos create blind spots, and third-party risk management suffers the same problem.

Supplier risk is one of the biggest concerns across every industry. "I need to monitor the risk of my fourth and my fifth party," Luis said. If a provider's supplier stops operating in a country where conditions have deteriorated, the knock-on effect can reach your operations.

Your region matters more than your sector

Luis' data showed that where you operate predicts concern more strongly than what industry you're in. In the Middle East and Africa, 63% of respondents said geopolitical risk will significantly affect their expansion, growth, and operations. That's materially higher than other regions.

Organisations near hotspots may see instability as a hard constraint. Those further away are less willing to change their plans. Either way, you need to decide deliberately rather than by default.

Plan for the shocks you can't predict

Banks are the most mature at this. They run stress test scenarios across multiple jurisdictions, including what they define as "extreme yet plausible" scenarios. The question is simple: what if this happened, and how would we respond?

Non-financial organisations can do the same. Toyota did it during COVID. It read the chip shortage early, increased its inventory of key components before production shortages materialised, kept production running, and gained market share after the pandemic.

Luis’ list of scenarios worth modelling now:

• Oil above $200 a barrel. Extreme, but plausible.
• A key Red Sea shipping route cut off, with logistics costs rising sharply.
• Tariffs doubling between two neighbouring trade partners.
• The largest microchip producer unable to operate.
• A China–Taiwan escalation, and what it would do to the AI industry and the data centres it depends on.

He also noted that events once considered unthinkable have happened recently, including Russia's invasion of Ukraine and the removal of Venezuela's president. The scenarios that look extreme are the ones you should model.

Start with the right signals, not the right tool

Luis' first step isn't a tool. It's deciding which signals your organisation actually needs and who should receive them. Stopping your reliance on Google Alerts is a good start.

AI agents can help. They can scrub the web and collect information. But risk intelligence also needs taxonomies to classify that information and quality controls to make it trustworthy. "A lot of work needs to be done," Luis said.

His analogy is medical. You can search your symptoms online and self-medicate, or you can see a trained doctor who tells you what you actually have. Specialists who understand risk the way a professional does are the proper signal.

Then identify your critical partners. Luis' example was the coffee supplier for your office: important, but you could probably survive with instant. Focus on the partners that matter, and work out what happens to your operations if they fail.

Ask the question that matters

Donald Rumsfeld once talked about "unknown unknowns", there's real truth in it. The question to ask is: where will the next shock come from?

You can't model every possible event. But you can build a list of the shocks that would affect your organisation, model each one, and plan your response.

Ask a skeptical colleague how they're going to survive if something happens to their operations. Organisations that ignored the signals throughout history have ceased to operate.

Luis' core message is that risk management is ultimately about resilience. Internal controls matter, but external shocks are what knock you off your feet. As he put it, everybody has a plan until they get punched in the face.