Have you ever spent ages double-checking that your front door is locked, only to realize you left the big window in the back wide open?
It’s a feeling we all know. And honestly, it’s a perfect metaphor for what’s happening in the world of business risk right now. We’ve all been so hyper-focused on locking down our digital front doors—building stronger firewalls, training employees on phishing, and beefing up our cybersecurity—that we’re missing the massive physical risks creeping in through that back window.
A brand-new report, the 2026 FM Resilience Index, just laid this all out in stark detail. It looks at 130 countries and ranks them based on how resilient they are for businesses. And while there’s some good news, there’s also a pretty big warning sign flashing for all of us.
As Leo Kushner, a director at FM, put it, “What businesses don’t see can hurt them.” And right now, it seems like we’re not seeing the whole picture.
First, the Good News: We’re Finally Taking Cyber Seriously
Let’s start on a positive note. The global effort to get smarter about cyber threats is actually working. It’s no longer a niche IT problem; it’s a boardroom-level priority, and the results are starting to show.
The new index shows some countries making huge leaps in their cybersecurity preparedness.
- Denmark, which already holds the top spot for overall resilience, jumped an incredible 20 places in its cyber ranking.
- The Netherlands shot up by 25 spots.
- Spain climbed a solid 11 positions.
This tells us that a coordinated focus on protecting data really can move the needle. But it’s not a universal victory lap. Surprisingly, some traditional heavy-hitters like Norway and Germany actually slipped in the cyber rankings, which is a good reminder that you can never get complacent.
For those keeping score, after Denmark, the top 10 most resilient places to do business are Luxembourg, Singapore, Switzerland, and a bunch of other northern European countries. The U.S., which is broken into three zones, landed just outside the top 10, with the Midwest/Southwest region ranking highest at #11.
So, we’re getting better at locking that digital door. That’s great. But what about the foundation of the house?
The Real Story: A Perfect Storm of Physical Risks is Brewing
This is where things get a little scary. While we’ve been busy fighting digital ghosts, a very real, very physical storm has been gathering. The report highlights that things like water scarcity and fire risk are no longer separate issues—they’re starting to merge in dangerous ways.
Think about data centers. They are the beating heart of our digital economy, right? Well, they need a massive amount of water to keep their servers from overheating. So, what happens when you build a state-of-the-art data center in a region that’s running out of water?
It gets even more complicated. The global push toward green energy, which is fantastic, has an unexpected side effect. The shift to battery-based power systems can actually amplify fire risk if not managed perfectly. Add in climate change, which is driving more frequent and intense wildfires, and you’ve got a serious problem.
Dr. Louis Gritzo, a chief scientist at FM, explained it perfectly. He said, “Water is still the best way to put out a fire, and in many places, there are severe limitations on water availability.” He points out that the changing climate and the drive for electrification are creating a “very rapidly changing hazard.”
It’s a domino effect. Drier conditions lead to more fires. More fires threaten infrastructure. And the very systems we need to fight them—like water—are becoming scarcer.
Where Are the Biggest Red Flags?
This isn’t just a theoretical problem; it’s happening right now, and some places are feeling it more than others.
The report points a finger at several major economies, including China, Germany, Mexico, and Spain, as being in the bottom third for resilience against water stress. Mexico is in a particularly tough spot, ranking poorly for both water stress and fire risk quality.
But here’s a twist that really caught my eye: even the countries at the top of the overall resilience list have hidden weaknesses.
Take Singapore. It’s ranked #3 in the entire world for business resilience—a true powerhouse. But when you look at just one factor, energy intensity, it plummets to 116th place. That’s a massive gap. It suggests that even the most sophisticated economies might have a critical vulnerability they’re not paying enough attention to. Belgium, Finland, and Norway show similar blind spots.
The Most Dangerous Risk of All: Not Knowing You're in Danger
So, why isn't this a bigger conversation? Here’s the kicker from the report.
FM also surveyed 800 risk decision-makers, and what they found is truly alarming. A whopping 74% of them underestimate their exposure to major climate risks like wind and floods in the places where their most critical operations are located.
Let that sink in. Nearly three out of four leaders are operating with a dangerously incomplete picture of their own vulnerability. They think they're safe, but they’re not. This awareness gap is widest in places like China and India, but it’s a consistent problem across developed markets, too, including Australia, Canada, and the UK.
It’s a classic case of “out of sight, out of mind.” But as we’re seeing more and more, these climate hazards are no longer distant threats. They are here, and they can cripple a supply chain or shut down an operation overnight.
So, How Do We Fix This? It's About Seeing the Whole Board
Okay, so the back window is wide open. What do we do? The path forward isn't about panicking; it's about getting smarter and more realistic.
The report makes it clear that the answer lies in two key areas: better data and stronger standards.
First, businesses need to lean on accurate, objective risk assessment tools to get a true sense of their exposure. You can’t protect yourself from a threat you don’t see.
Second, building codes matter. A lot. It might not sound exciting, but rigorous building codes are one of the most powerful tools we have to reduce losses from fire and extreme weather. China, for all its underestimation of risk, has actually strengthened its resilience significantly through tough natural hazard building codes.
Other countries are following suit. Germany and Sweden recently updated their codes, with the Netherlands and Poland not far behind. They recognize that a well-built structure is the first and best line of defense.
Ultimately, building a truly resilient business isn't about choosing between cyber threats and physical ones. It’s about understanding that they are two sides of the same coin. You need to protect your data, absolutely. But you also need to ensure the building housing that data won't be threatened by a wildfire or a flood.
It’s time to stop just checking the front door and start taking a good, hard look at the whole house.
