The pressure intensified after Financial Stability Board chair Andrew Bailey warned G20 finance ministers and central bank governors on August 31 that frontier AI could materially alter the speed, scale and economics of cyber risk. Bailey said its potential impact was the most immediate concern for the financial system and called for robust response and recovery capabilities at financial firms, alongside resilience among critical technology providers.
That warning reflects a shift in the threat environment. IBM’s 2026 Cost of a Data Breach Report found that one in four malicious breaches was AI-enabled, up 56 per cent from the previous year. Such breaches cost organisations an average of $6 million, about $1 million above the breach average of $4.99 million.
The same research showed AI strengthening defence. Organisations making extensive use of AI and automation in security operations saved an average of $1.93 million per breach compared with those using none. The findings underline a management dilemma: enterprises are adopting AI to improve productivity and security while creating new attack paths, dependencies and governance challenges.
The World Economic Forum’s Global Cybersecurity Outlook 2026 found that 94 per cent of respondents expected AI to be the most significant driver of change in cybersecurity this year. It also found that 87 per cent viewed AI-related vulnerabilities as the fastest-growing cyber risk during 2025, while 77 per cent of organisations had adopted AI for cybersecurity.
For boards, the issue extends beyond approving security budgets. Cyber resilience increasingly depends on decisions about business continuity, data governance, third-party exposure, identity controls and authority during an incident. Those choices affect revenue, regulatory exposure, customer confidence and the speed at which essential services can be restored.
The distinction between cybersecurity and resilience is becoming more important as attacks accelerate. Traditional programmes have often concentrated on preventing intrusion. Resilience assumes some controls will fail and asks whether an organisation can continue operating, contain damage and recover without losing control of critical functions.
AI complicates that task because it can compress the attack cycle. Advanced models can help threat actors discover vulnerabilities, automate exploitation and produce convincing impersonations at greater scale. AI-based defensive tools can also accelerate detection, triage and response, making governance and human oversight central to their effective use.
NIST, the US standards body, has been developing a Cybersecurity Framework Profile for Artificial Intelligence to help organisations manage risks associated with AI systems while using AI to strengthen cyber defence. Workshop findings published in August highlighted governance, AI attack surfaces, taxonomy, risk-based guidance and usability as recurring concerns.
The boardroom implications are significant where companies rely heavily on cloud platforms, software suppliers and other common service providers. A failure at one major supplier can interrupt many organisations at once, turning vendor concentration into operational risk. Bailey’s letter specifically urged attention to resilience among critical third parties.
Executives are therefore being pressed to test recovery plans under realistic conditions rather than relying on compliance checklists. That includes defining which systems must return first, who has authority during a crisis, how communications will be handled and whether backups, alternative suppliers and manual workarounds can function under pressure.
Governance of AI itself remains another weak point. IBM found that more than one fifth of organisations surveyed had experienced a breach targeting AI models or applications, while 92 per cent of those organisations lacked proper AI access controls. Model inversion and prompt-injection incidents were among the costliest AI-related attack types identified.
The findings also place greater emphasis on non-human identities created by AI agents, applications and automated services. These identities can hold extensive privileges while operating at machine speed, making inventory, access boundaries, secrets management and auditability increasingly important.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
