Half of security leaders placed attacks on AI systems among the threats they were least prepared to address, ahead of cloud threats at 40%, third-party breaches at 34% and ransomware at 33%. The findings were published on 1 October in PwC’s 2027 Global Digital Trust Insights survey.
The study gathered responses from 3,934 business and technology executives across 71 countries and territories. It measures leaders’ assessments of preparedness and investment priorities, rather than providing an independent audit of their organisations’ security controls or a count of successful attacks.
Security spending is nevertheless expected to increase. Some 84% of security and finance leaders anticipated higher cybersecurity budgets over the next 12 months, up from 78% in the previous survey. AI featured among the leading budget priorities for 58% of security leaders.
That investment comes with limited readiness to maintain operations during disruption. Only 39% of security, risk and operations leaders said they had fully formalised and integrated operational continuity plans specifically addressing cyber risks. PwC
Data protection also remained incomplete. Companies had implemented an average of three of the seven data-risk measures examined, while only 5% had fully implemented all seven, compared with 7% a year earlier. Just 49% had fully implemented data classification policies, and 48% had deployed data-loss prevention across key channels through which information leaves their organisations.
These are distinct safeguards: classification identifies information requiring protection, while loss-prevention controls help restrict its unauthorised movement. Their incomplete deployment leaves organisations pursuing AI investment while still addressing gaps in the underlying management of business data.
PwC found substantial caution about handing cyber defence to autonomous software. Only 22% would allow AI agents to execute defensive actions without human approval. A further 38% would permit partial autonomy, while 36% preferred human-led execution with AI support across all actions.
Reliability and technological maturity were among the three biggest barriers to greater agent autonomy for 55% of respondents. Accountability and the ability to explain AI decisions were cited by 46%. Among chief information security officers, 44% identified workforce skills in AI oversight and governance as a leading obstacle. pwc. com
The distinction matters because using AI to identify a possible threat does not necessarily entail allowing it to change systems or take remedial action. Respondents’ answers indicate that enthusiasm for faster detection coexists with reservations about delegating decisions and responsibility.
Half of security leaders prioritised AI for threat detection and alerting, while 42% highlighted phishing detection and response. Among security and risk leaders, autonomous botnet compromise was identified as an AI-enabled attack they were poorly prepared for by 53%; adversarial attacks and data poisoning each attracted 52%.
“More spending doesn’t necessarily translate to more security,” said Tonya Ugoretz, who leads PwC’s Cyber and Risk Innovation Institute. “It has to be done smartly.”
The survey identified responsible AI governance as the leading AI-specific investment priority, cited by 42%, followed by platform hardening at 38% and supply chain security at 35%.
Dan Wilkins, chief information security officer at the Arizona Department of Economic Security, said his organisation’s cyber budget had remained broadly flat or been cut slightly for several years. AI had redirected resources towards governance, monitoring and visibility, including dedicated policies, prompt training and controls against unauthorised use, he said.
Leadership arrangements varied. Among chief executives and security and risk leaders, 29% said AI governance accountability rested with technology leadership or the technology function, 26% with a dedicated AI leader or function, and 17% with the cybersecurity chief or cyber function.
Board oversight was also uneven: 47% strongly agreed that cyber risk was a standing item on their board’s agenda, while 45% said the same of executive leadership meetings. One-third reported dedicated AI roles, including an AI chief or board. PwC
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
