Half of global companies vulnerable to cyber attack targeting AI systems – study

Half of global companies would struggle to handle a cyber attack on their AI systems, according to a PwC report.

The 2027 Global Digital Trust Insights Survey found that 50% of security leaders at companies globally identified attacks targeting AI systems as the cybersecurity threat their organisations are least prepared to address in the next 12 months, followed by cloud-related threats (40%) and third-party breaches (34%).

Some 84% of respondents expect cyber budgets to rise in response to frontier AI models being rolled out, with 58% also ranking AI as their top cyber budget priority in the year ahead.

Respondents are concerned about AI being used to orchestrate cyber attacks. Just over half (53%) said the top AI-enabled attack threat was compromise by autonomous botnets, followed by adversarial attacks (52%) and data poisoning (also 52%).

And while AI security is the biggest perceived cyber threat, only 22% of respondents said they would authorise fully autonomous AI agents for cyber defence. Another 38% said they would allow partial autonomy and 36% said they would maintain human-led execution with AI support.

Part of that stance is down to a lack of confidence in AI systems. More than half of respondents (55%) ranked reliability and maturity of AI tech among their top three barriers to deploying AI agents as a cyber security measure, followed by 46% who said accountability and explainability in AI decision-making was a barrier and 44% who identified a lack of workforce skills in AI oversight and governance.

Anthony Fellowes, director for digital at PwC Bermuda, said: “AI is reshaping both sides of the cyber equation. While it introduces new risks and broadens the attack surface, it also has the potential to significantly enhance how organisations defend themselves. The challenge is not whether to adopt AI, but how to do so in a way that builds confidence, strengthens security and delivers meaningful business outcomes.”

Against this backdrop, 50% of security leaders ranked threat detection and alerting as their top priority AI area for cyber defence, followed by fraud detection (42%) and phishing detection and response (42%). 

Meanwhile, 54% of respondents said they are adopting multi-cloud or hybrid cloud strategies to bolster cyber resilience, followed by strengthening regional data and tech redundancy (47%) and localising infrastructure within specific jurisdictions to reduce concentration risk (37%).

The report was based on a survey of 3,934 business and tech leaders across 71 countries.