— Mirko Lalli
Booking.com's European Accommodation Barometer reveals a stark divide: 94% of large hotel chains feel prepared for cybersecurity threats, while only 60% of independent properties share that confidence. This gap matters because it mirrors a broader pattern emerging across travel this week. The AI Hospitality Alliance has joined forces with Navan, Travelport, and Accelya to accelerate enterprise AI adoption, and Hospitality Net reports that property management systems are being rebuilt around machine learning and automation. The enterprises are moving fast. The independents are watching.
Meanwhile, the physical infrastructure of travel is shifting beneath our feet. Singapore Airlines quietly pulled its A380 from eleven major routes, prioritizing efficiency over spectacle. The U.S. is racing to deploy biometric controls at airports before the 2026 World Cup crowds arrive. American Airlines now lets data analytics determine who earns Executive Platinum status, decoupling elite recognition from hours spent in the air. Qatar Airways' Qsuite Next Gen blurs the line between business and first class so thoroughly they had to invent a new tier. The message is consistent: legacy systems, legacy metrics, legacy experiences are all being renegotiated.
My read for the next twelve months: DMOs and smaller operators who treat AI adoption as optional will find themselves increasingly locked out of distribution partnerships and security compliance frameworks. The question is not whether to invest but where to start. For most, cybersecurity and guest data handling are the unglamorous foundation everything else depends on. What capability gap is your organization pretending does not exist?
Sixty percent. That is the share of small European accommodations that feel prepared to handle a cyberattack. For large hotel chains, that number is 94%. This is not a gap — it is a structural fracture running through the industry.
According to Booking.com's European Accommodation Barometer 2026, the divide between large and small operators is widening across every dimension that matters. While 72% of hotel chains anticipate positive developments in the coming year, only 55% of independent properties share that optimism. Average daily rate growth has cooled — just 40% of accommodations reported increases, down from 43% in 2025. The macro story looks stable. The micro story is fragmentation.
The security problem is the real story. Twenty-one percent of small properties cite cyberattacks as a top concern, versus 9% of larger businesses. The difference is not paranoia — it is capability. Small operators lack the resources, expertise, and vendor relationships to defend against threats that are accelerating faster than their ability to respond.
Meanwhile, the industry presses forward with automation. Roiback is turning check-in into a loyalty acquisition funnel. Tern has launched agentic AI tools for advisor workflows. US airports are racing to deploy biometric screening ahead of the 2026 World Cup. The AI Hospitality Alliance just partnered with Navan, Travelport, and Accelya to push enterprise AI adoption across hotels, airlines, and distribution.
Every one of these innovations creates new attack surfaces. Every one assumes a baseline of digital infrastructure that many small operators do not have.
Here is the camera flip: the cybersecurity gap is not primarily a technology problem. It is a market structure problem. Large chains can amortize security costs across hundreds of properties. A 15-room guesthouse in the Dolomites cannot. The economics do not work — until they catastrophically do not work, when a breach destroys a business overnight.
My contrarian position: DMOs and national tourism bodies should treat cybersecurity support for small accommodations as critical infrastructure, not optional training. Subsidized security audits. Shared threat intelligence. Vetted vendor lists. This is not a nice-to-have — it is the precondition for a functioning distributed hospitality sector.
The Phocuswright data on European travel agencies regaining share against OTAs tells a related story. In mature markets, online agency share is projected to drop from 22% in 2023 to 19% by 2025. Travelers are returning to intermediaries they trust. Trust is becoming the competitive advantage.
Small operators who survive the next three years will be those who understand that security is not overhead. It is the foundation of trust. And trust is the only asset that scales.
Stop waiting for the breach that forces action. Audit your exposure this month.