The Real Threats to Your Business Aren't What You Think: 5 Surprising Insights from a Global Report
In an era defined by volatility, organizations face a complex and unpredictable risk landscape. Leaders are constantly challenged to distinguish between headline-grabbing threats and the ground-level realities that truly disrupt operations. Navigating this environment requires clear, evidence-based insight into what is happening now and what is likely to happen next.
The BCI Horizon Scan Report 2025 provides exactly that insight, delivering a crucial benchmark for resilience professionals worldwide. By combining quantitative survey data with in-depth interviews, the report uncovers a fascinating disconnect between what organizations perceive as their greatest future threats and the issues that are actually causing the most damage today.
This post will distill the five most surprising and counterintuitive takeaways from the report. These findings challenge conventional wisdom about business risk and provide a practical guide for leaders seeking to build genuine, future-proof resilience.
1. The People Paradox: Our Biggest Disruptions Are Not Our Biggest Worries
The report reveals a stark and persistent truth: for the last five years, incidents related to staff well-being have been the most frequent and impactful disruptions. The one exception was last year, when frauds ranked first, but the long-term trend is undeniable. The 2025 report confirms this, stating, "Incidents concerning staff well-being have been the highest risk to organizations over the past twelve months," with the specific category of "Safety incidents" ranking as the single most impactful event.
The paradox lies in where organizations are focusing their future attention. Despite the clear and present danger posed by human-centric issues, practitioners’ forward-looking concerns are overwhelmingly dominated by digital threats like cyberattacks and external factors such as climate risk. The report explicitly states that "health and safety issues do not figure in either of the charts" for future risks, exposing a critical "disconnect between disruptions that occurred recently and the risk perception of the future."
This gap between current impact and future planning is a significant blind spot. As one contributor notes, resilience is fundamentally about people.
“As a crisis exercise platform dedicated to helping organisations prepare for the unexpected, we are proud to support this year’s BCI Horizon Scan Report 2025. The findings of this report underline what the community of practitioners has long understood: that resilience is ultimately a human story.”
This disconnect raises a vital question: are organizations so focused on external and digital threats that they are failing to adequately protect their most vital asset? This data suggests a critical need to rebalance resilience budgets and training priorities, ensuring that human-centric risk mitigation receives the same level of investment as its digital counterparts.
2. Weather Overtakes the Web as the Top Disruption Driver
For the first time since 2017, physical events have surpassed digital threats as the primary source of business disruption. The report finds that "Extreme weather is the single largest cause of disruption over the past 12 months," responsible for 13.3% of all disruptive incidents. The influence of major events like the Valencia floods on practitioner experience cannot be understated.
This is a monumental shift. For the previous five years, this list was consistently topped by digital threats such as cyberattacks or IT outages. The rise of extreme weather highlights the growing impact of climate change on day-to-day operations, moving it from a theoretical, long-term concern to an immediate and tangible operational challenge. This trend is not abstract; it has real-world consequences for infrastructure that was never built to withstand today's climate extremes.
“Our infrastructure was never designed for the extremes we’re seeing now. A few years ago, cold winters caused the concrete bases of our stations to crack, and in hot summers, data centre cooling becomes a critical vulnerability. If the cooling fails, things escalate very quickly. So, climate risk isn’t abstract for us, it’s a direct operational challenge that will require real investment.”
For leaders, this signals that abstract climate pledges are no longer sufficient; the focus must now be on tangible investment in hardening physical infrastructure against immediate environmental threats.
3. A Surprising Retreat from Long-Term Planning
In a world that feels increasingly uncertain, one might expect organizations to double down on long-term forecasting. However, the report reveals the opposite trend. The use of long-term trend analysis to inform business continuity has fallen to its "lowest in the past five years," with the number of practitioners using its outputs dropping from 81.3% to just 68.1% in the last year alone.
This is not an abandonment of foresight, but a strategic reprioritization. Practitioners are moving away from trying to predict every specific external threat and are instead adopting "agnostic plans." The report notes that long-term analysis now "works more as an awareness tool, whereas real attention is dedicated to internal resources and their vulnerabilities."
This data signals a pivot in resilience strategy. Rather than attempting to predict the future, leading organizations are focusing on building adaptable, all-purpose frameworks that enhance their ability to respond effectively to any crisis. The challenge for leadership is to foster an organizational culture that embraces agility and prioritizes hardening internal response capabilities over perfecting external predictions.
4. High-Touch, Not High-Tech, Still Dominates Horizon Scanning
Despite the constant hype surrounding AI and advanced analytics, the primary methods for horizon scanning remain deeply human-centric. When it comes to understanding future threats, organizations still rely on experience, collaboration, and direct engagement.
The top methods used for trend analysis are overwhelmingly based on human interaction and expertise:
- Internal risk and threat assessments (87.2%)
- External reports/industry insight (75.2%)
- Participation in industry events and conferences (55.6%)
- Collaboration with peers (52.1%)
This creates a fascinating paradox: even as resilience leaders identify artificial intelligence as a top long-term risk, their most valued tools for navigating that future are rooted in distinctly human intelligence—collaboration, peer discussion, and shared experience. The report emphasizes that "practitioner still see value in the interpersonal exchange of information." This indicates that while technology is a critical enabler, strategic investment in human networks and collaborative platforms remains the most effective defense against future uncertainty.
5. The Standard Is a Guide, Not a Goal
While the ISO 22301 standard remains the dominant framework for business continuity management, the way organizations use it is changing dramatically. The report identifies a major trend away from formal certification and toward practical alignment.
The number of organizations using the standard as a framework without pursuing formal certification has increased dramatically, rising from just over a third (36.8%) to nearly 60% in a single year. The top reasons for forgoing certification are that there is "No business requirement" (58.8%) and a belief that simple alignment is sufficient (55.0%).
This sentiment reflects a desire for practical application over procedural rigidity.
“We align closely to ISO 22301, but we’re not certified. For me, alignment means if you applied tomorrow, you’d pass. In reality, most organisations aren’t quite there, alignment gives you flexibility that certification doesn’t.”
This shift suggests that mature organizations are prioritizing practical, flexible resilience that fits their specific needs over the cost and rigidity that can sometimes accompany formal certification. The mandate for leaders is to ensure their programs deliver demonstrable resilience, whether certified or not, by focusing on practical application over procedural compliance.
Conclusion: Are You Ready for Reality?
The BCI's report is a clear call to action for leaders: pivot from a strategy of prediction to one of preparation. The data indicates that over-investment in predicting high-tech threats comes at the cost of mitigating the clear and present dangers impacting your workforce and physical operations. True resilience in 2025 is less about technology and more about building adaptive capacity, focusing on people, and prioritizing practical application over formal procedure.
The report challenges us to look beyond the headlines and assess our own preparedness with an honest eye. Looking at your own organization, is your resilience planning focused on the threats that feel the most futuristic, or the ones that are actually causing the most harm today?
