GRF 2026 Risk Report Highlights Cyber Threats and AI Governance
Summary
GRF’s 2026 risk report identifies cybersecurity and resilience as major concerns for DC-area organizations, citing social engineering and system weaknesses while recommending stronger AI governance, vendor reviews, and security assessments.
Key points
- The report addresses nonprofits, associations, NGOs, and government contractors, treating cybersecurity, business continuity, and resilience as one of three major risk themes.
- Citing ISACA’s 2025 survey, it lists social engineering at 44% and system vulnerabilities at 37% among attack vectors reported by compromised organizations.
- CompTIA research cited in the report places 43% of respondents in early AI education or experimentation and 9% at full integration with modified workflows; the survey sample was 1,026.
- GRF warns that vendors may introduce AI features after initial approval, creating data-security risks that have not undergone cybersecurity, IT, or legal review.
- The report recommends AI policies defining permitted tools and data sharing, user training, contract reviews, and scrutiny of vendors’ AI governance practices.
- Security recommendations include baseline assessments, cybersecurity frameworks, incident-reporting training, periodic audits, and consideration of continuous monitoring.
Article Details
- Publisher
- GRF
- Report Period
- 2026
- Scope
- Strategic alignment, cybersecurity, AI governance, operational resilience, and workforce risks for DC Metro nonprofits, associations, NGOs, and government contractors.
- Sample Size
- No original GRF survey sample disclosed; cited CompTIA State of Cybersecurity 2025 charts report n=1026.
- Key Statistics
- According to the cited ISACA State of Cybersecurity 2025 Report, 58% of respondents reported that attack numbers were higher than or the same as a year earlier.
- The cited ISACA compromise-vector breakdown reports social engineering, including business email compromise, at 44%, and vulnerabilities, including unpatched systems, misconfigurations, and known weaknesses, at 37%.
- The cited compromise-vector breakdown reports malware and insider threats at 26% each, ransomware at 22%, and supply-chain attacks at 21%.
- CompTIA State of Cybersecurity 2025, with n=1026, reports AI adoption at 43% in education or experimentation, 27% in low-priority systems, 20% in high-priority systems, and 9% fully integrated with modified workflows.
- The cited CompTIA cybersecurity AI-priority chart reports 37% prioritizing improvements to internal efforts, 31% defending against new threats, and 32% balancing internal and external priorities.
- Recommendations
- Establish board-led mission-alignment oversight and integrate enterprise risk management, initiative scorecards, and semiannual strategic alignment reviews.
- Implement and track cybersecurity frameworks, conduct baseline assessments and periodic audits, and consider continuous monitoring.
- Train users on cybersecurity best practices, acceptable use, incident reporting, and safe AI usage.
- Define approved AI tools and permitted data sharing; have legal, cybersecurity, and IT specialists review AI tools, contracts, and third-party governance methodologies.
- Document existing processes and system requirements before technology procurement; evaluate vendors through formal RFPs, demonstrations, sandbox testing, and integration assessments.
Countries
Industries
AssociationsBecause of the region’s unique concentration of nonprofits, associations, NGOs, and federal government contractors, these organizations face heightened exposure to federal appropriations cycles, regulatory shifts,government contractorsBecause of the region’s unique concentration of nonprofits, associations, NGOs, and federal government contractors, these organizations face heightened exposure to federal appropriations cycles, regulatory shifts,NGOsBecause of the region’s unique concentration of nonprofits, associations, NGOs, and federal government contractors, these organizations face heightened exposure to federal appropriations cycles, regulatory shifts,NonprofitsBecause of the region’s unique concentration of nonprofits, associations, NGOs, and federal government contractors, these organizations face heightened exposure to federal appropriations cycles, regulatory shifts,