PwC’s recently released 2027 Global Digital Trust Insights survey highlighted cybersecurity areas that businesses feel like they are least prepared to handle in the next 12 months. AI concerns topped the list. In fact, when asked what threat their organization was least prepared to address, 50% of respondents said attacks targeting AI systems. According to respondents, the top five AI-enabled attacks their organizations will need to address are: compromise by autonomous botnets (53%); adversarial attacks (52%); data poisoning (52%); adaptive malware or polymorphic evasion techniques (46%); and deepfake audio or video for fraud or impersonation (44%) as their top five AI-enabled attacks their organizations will need to address. "As organizations move quickly to capture AI's value, security, governance and risk management need to develop alongside it from the outset," PwC said. "This is particularly important as AI-driven operations increasingly rely on external models, platforms, data and services that can extend third-party exposure."
PwC noted that cyber operations are now a persistent feature of geopolitical competition during conflict and peacetime. Due to the ongoing turbulent geopolitical landscape, PwC expects cyber strategy to change in the next 12 months. “Companies are paying more attention to their software supply chain as they diversify suppliers and strengthen development pipelines,” the report said. “This expanding attack surface creates new blind spots, forcing organizations to rethink how they secure their rapidly evolving, interconnected ecosystems amid growing geopolitical uncertainty.” Half of respondents are adapting by making changes to vendor and third-party/supply chain risk management while other organizations are changing cyber insurance, incident response and crisis management planning (49%); expanding threat intelligence, geopolitical monitoring and government/industry collaboration (47%); and making changes to critical infrastructure location, resilience and redundancy (43%).
Rounding out respondents’ top five concerns for the next year were: cloud-related threats (40%), third-party breaches (34%), ransomware (33%) and software supply-chain compromise (33%). To protect against these risks, organizations are choosing to prioritize several key areas within their cyber budgets: investments in AI (58%); cloud security (46%); data protection and data trust (39%); network security and zero trust (35%); and threat management (33%).
In addition to allocating budget, the report offered six additional ways organizations can stay on top of an ever-changing digital environment:
- Strengthen cyber governance, accountability and risk decision-making. “Cyberrisk may have a seat at the leadership table, but it is not yet consistently embedded in how organizations make decisions,” the report said. CEOs, CISOs, CROs, CFOs and chief data officers all have a role to play in equipping the organization with meaningful information that balances risk and business priorities.
- Protect critical operations and build cyber resilience. “Continuity planning needs to move from a preparedness exercise to an integrated enterprise capability,” according to PwC. “Start by defining the smallest set of capabilities needed to keep your organizations operating through disruption, then build and test recovery plans.”
- Secure data, AI and emerging technology. Data protection remains a persistent gap, according to the report, and “the gap matters more as organizations expand their use of AI for cyber defense and consider giving AI agent greater autonomy.” It is crucial for CISOs, CTOs, chief data officers, CFOs and CROs to all work together to create a foundation that can be trusted.
- Manage ecosystem, third-party and technology concentration risk. “Cloud providers, technology platforms, suppliers and other third parties can turn a vulnerability or disruption elsewhere into a business risk,” PwC said in the report. “Resilience depends on understanding those dependencies and where concentrations of risk could amplify impact.”
- Use trusted technology and data to create enterprise value. Since organizations are modernizing and investing in technology such as AI, cloud and data, security and business value should be considered side by side from the very beginning.
- Build the model for human-and-agent operations. “The intelligent enterprise will depend on people and AI agents working together through secure platforms, trusted data and clearly governed workflows,” the report said. “Leaders should pair new capabilities with human accountability, workforce development and controls that preserve quality, resilience and trust as autonomy increases.”