A new PwC survey suggests that massive AI systems and cybersecurity investments are not yet translating into resilience against threats, as organizations are not so well prepared for attacks on their AI infrastructure yet.
The 2027 Global Digital Trust Insights survey delivered by PwC this October, based on responses from 3,934 business and technology leaders across 71 countries, found that attacks targeting AI systems are the cyber threat organisations feel least prepared to address.
Namely, half (50%) of security leaders admitted attacks on AI systems are one of their biggest preparedness gaps. Cloud-related threats are close, with 40%, third-party breaches stand at 34%, and ransomware follows suit at 33%.
Concerns grow, as AI capabilities develop rapidly. Many would say, too rapidly for cybersecurity to catch up. AI developers and independent bodies testing advanced new models are even debating potential slowdown, though opinions differ on whether the industry-wide limitations or individual controls should be applied. OpenAI Sam Altman even suggests that we, as society, should accept certain risks in order not to stall the technology that can bring much larger benefits.
In the meantime, PwC says frontier AI models are increasingly capable of finding previously unknown software vulnerabilities and exploiting them with limited human intervention. Among AI-enabled attacks, autonomous botnet compromises (53%), adversarial attacks (52%) and data poisoning (52%) were the threats security and risk leaders felt least prepared to handle.
The most challenging parts of being prepared to an AI-targeting attack is that the attackers are probably use same or similar systems to break the cybersecurity shields.
“AI is creating both a new class of security risk and one of the biggest opportunities defenders have had in decades. The challenge is building trust and control at the same speed as adoption.”
Phil Venables, Partner at Ballistic Ventures
Payment experts PaySpace Magazine interviewed last December also identified that as one of the greatest cybersecurity dilemmas.
Amidst this changing landscape, organisations are increasing their investment in cybersecurity. Vast majority (84%) of security and finance leaders surveyed by PwC expect their cyber budgets to increase over the coming year. That is six percentage points higher than last year.
Large share of the additional spending would go to AI tools. Fifty-eight percent of security leaders rank AI among their top cyber budget priorities. In this respect, data protection and trust remain the most common spending priority. It was cited by 51% of respondents. Securing against AI-enabled attacks was mentioned by 46%, while securing AI and autonomous agents concerned 45% of those surveyed.
However, higher spending does not necessarily mean that organisations have already addressed the basics. Companies have implemented, on average, only three of seven key data risk measures covered by the survey. Just 5% have fully implemented all seven measures, down from 7% last year. Only 49% have fully implemented data classification policies, and 48% have fully implemented data loss prevention across key data egress channels. Just 39% of security, risk and operations leaders say they have fully formalised and integrated operational continuity plans that specifically address cyber threats.
At the same time, lower readiness levels when it comes to AI systems doesn’t automatically turn into larger consequences for the companies in question. It seems that most organisations still apply AI with quite limited autonomy. Organisations are most comfortable using autonomous agents for defined and repeatable tasks.
As for cybersecurity itself, only 22% would allow AI agents to execute defensive actions completely autonomously, without human approval. Another 38% would allow partial autonomy, while 36% would keep humans in charge of execution while using AI for support. More than half of respondents rank AI reliability and maturity among their top three obstacles to greater agent autonomy.
