When we asked 500+global CEOs what increase they would accept on their current third-party supplier cost base to ensure supply chain resilience, the answer was striking.

The average response was 17.3%. More than seven in ten said they would pay more than 10% above their current base. Just under three in ten said they would go beyond 20%. Only 0.4% two CEOs out of 515 said they would not be willing to pay anything more at all.

This is not a casual or aspirational answer. CEOs of businesses generating more than $500 million in revenue do not approve increases of this size lightly. The figure reflects the lived experience of the last five years.

Across all five major threat categories tested, between 89% and 92% of CEOs said their business was prepared, with a formally documented and, where necessary, board-approved mitigation strategy that had been tested. On its own, this looks like a story of organizational maturity.

However, when asked how long their businesses could maintain operations without disruption to revenue or customer delivery if a major shock occurred tomorrow, the picture changed. More than half of CEOs at businesses generating more than $500 million in revenue say their organization could not maintain uninterrupted operations beyond three weeks.

The benchmark question for any board is not simply what is written in the continuity plan. It is how long the business can keep running.

CEOs are noticing the pressures on procurement and the increasing levels of compliance within procurement processes. When asked whether the procurement process was hindering AI adoption, 78% of CEOs agreed. The sentiment was widespread across markets.

The elephant in the room is that at a time when many businesses are seeking to diversify supply to reduce operational risk, they may also be asking procurement teams to take on additional workloads related to risk and compliance checks. Procurement teams risk quietly becoming an extension of corporate compliance functions. This is not necessarily wrong, but it is consuming time and limiting capacity for more transformative change.

AI adoption is moving quickly, with notable use cases emerging in procurement and supply chains where data and processes are abundant. The data suggests that CEOs are seeing measurable value from AI, although it is not full potential:

• 51% say AI is delivering measurable value in supplier risk monitoring
• 49% say the same for procurement automation
• 46% say the same for cost modeling
• 39% say the same for forecasting

The expected benefits of AI in procurement and supply chain are moving from planning to production, although full potential remains some distance away. The barriers cluster around three issues: data quality, skills, and ROI clarity.

When we asked CEOs what specific actions had materially improved their ability to maintain operations during disruption over the previous 12 months, no single strategy stood out. Supplier collaboration led the field at 37%, followed by inventory increases at 36%, investment in risk and resilience technology at 34%, multisourcing at 32%, supply chain rerouting at 32%, nearshoring at 30%, and reshoring at 24%.

Once again, what is striking is how tightly clustered the responses are. Most businesses are pulling multiple levers. There is no dominant approach at a macro level. Different strategies are being deployed in parallel.

Cyber risk is a key emerging threat for all businesses. With this in mind, we asked CEOs four direct questions about cyber resilience in their supply chains. The answers highlighted the importance of the issue:

• 45% of organizations have experienced a supply chain disruption caused by a cyber incident, internally or through a supplier, in the past 24 months
• 42% have conducted a full cyber resilience stress test across critical suppliers in the past 12 months
• 39% agree that significant business revenue would be at risk if a key supplier experienced a cyberattack
• Just 35% have real-time visibility into the cyber risk exposure of their critical suppliers

Taken together, the picture is one of high incidence, moderate testing, acknowledged exposure, and limited visibility.