Geopolitics and cyber buying: what a seller should not assume

A buyer asks whether the security design should change because of geopolitical risk. That can sound like a threat-intelligence question, a sovereignty question, a supply-chain question or all three at once.

The sales response should not begin with a dramatic headline.

The World Economic Forum Global Cybersecurity Outlook 2026, published 12 January 2026, reported that 64% of organisations in its survey were accounting for geopolitically motivated cyberattacks in their risk-mitigation strategies. Among the largest organisations in the survey, 91% reported changing cybersecurity strategy because of geopolitical volatility. [Source: World Economic Forum, 12 January 2026.]

Those are global survey findings. They do not establish that one customer faces a specific state-backed threat or must buy a particular control.

“Geopolitical risk” can mean different things.

A customer may be worried about where data is processed. Another may care about supplier concentration. A third may be reviewing critical infrastructure exposure, software dependencies or access by privileged administrators.

Do not choose the concern for them.

Ask which business process, supplier relationship, system or regulatory requirement has triggered the review. Then identify the decision that must be made.

That keeps the conversation commercial and evidence-led.

External research can explain why a risk is receiving executive attention.

It cannot prove that the proposed product solves the customer’s specific exposure.

If the buyer is worried about supplier concentration, a detection feature may not answer the problem. If the concern is data location, a generic security certification may not settle the architecture question. If the concern is access from a particular jurisdiction, the relevant evidence may be identity, operational ownership or service-location documentation.

Match the proof to the decision.

Customers may use words such as sovereignty, residency, localisation and control interchangeably.

Sellers should not.

The buyer may be asking where data is stored, where support is delivered, which legal entity contracts, who can administer the environment, which subcontractors participate or whether the customer can operate during a cross-border disruption.

Each is a different question.

If the product material answers storage location but not support access, say exactly that. Do not let one location statement become a universal sovereignty claim.

Geopolitical risk can make customers look harder at the organisations and components behind a service.

Map the dependency that matters.

Is the buyer concerned about a software component, a hosting provider, an implementation partner, a managed service, a support location or a critical upstream platform?

The sales team should know which supplier owns which part of the service and where evidence exists.

A broad statement such as “our supply chain is secure” is unlikely to help.

The same World Economic Forum report said 31% of respondents had low confidence in their nation’s ability to respond to major cyber incidents, up from 26% in the previous year, while confidence varied significantly by region. [Source: World Economic Forum, 12 January 2026.]

That variation is another reason not to generalise.

A seller working across India and APAC should expect different buyer concerns, regulatory environments and operating dependencies without turning those differences into cultural stereotypes.

Ask the customer what matters in its context.

Geopolitical concerns can quickly enter sanctions, data law, government policy or contractual territory.

The seller can identify the question and provide approved product or service evidence.

The seller should not decide that a law applies, that a jurisdiction is safe, or that a customer has met a regulatory obligation unless the authorised legal or compliance owner has established it.

That boundary keeps the deal moving without turning sales language into legal advice.

A strong conversation ends with a map, not a fear statement.

Name the external risk the customer cares about. Identify the affected system or dependency. Record the evidence already available. Separate supplier-controlled and customer-controlled decisions. Route legal or policy interpretation to the right owner. Define what would need to be tested or documented before the customer can decide.

Geopolitics can change the questions a cybersecurity buyer asks.

It does not change the seller’s evidence rule.

Relevant programme: Build multi-party cyber-risk and evidence judgment through the ASTRA Cybersecurity Sales Specialist programme: https://www.astraready.com/programmes/