PwC’s new cybersecurity research reveals that Irish organisations need to do more to manage their cyber risk: just 17% of Irish respondents strongly agree that cyber risk is integrated into their organisation's enterprise risk management processes (Global: 41%); less than a quarter (23%) strongly agree that their organisation regularly conducts realistic incident response exercises to test preparedness (Global: 41%).
Less than two-fifths (39%) of global security, risk and operations leaders have a fully formalised and integrated operational continuity plan that specifically addresses cybersecurity threats.
At the same time, organisations around the world are doubling down on their cyber investment amid rapid advances in AI, with more than four-fifths (84%) of global security and finance leaders expecting cyber budgets to increase in 2027 – up from 78% last year – according to PwC’s 2027 Global Digital Trust Insights Survey, published today in Ireland. This press release notes Ireland results as available.
The survey, which captures the views of almost 4,000 business and tech executives across 71 countries and territories, including Ireland, finds that as leading AI models are rolled out, just 34% of Irish respondents said a cyber spend priority is securing against AI-enabled attacks (Global: 46%). Over half (58%) of global security leaders rank AI as their top cyber budget priority for the year ahead, followed by cloud security (46%) and data protection/data trust (39%).
When asked specifically about the cyber threats organisations are least prepared to address, half (50%) of global security leaders identify attacks targeting AI systems amongst their top threats – ahead of cloud-related threats (40%), third-party breaches (34%) and ransomware (33%).
Despite the interconnected risks, only 17% of Irish respondents report that cyber risk is integrated into their organisation’s enterprise risk management process, compared with 41% globally. Closing this gap can support clearer ownership and better-informed investment decisions as organisations respond to fast-moving threats.
The ultimate goal of cybersecurity is not just to protect the business, but to give the business the confidence to move forward. As organisations race to capture the value of AI, cyber resilience needs to become a business capability, embedded in C-suite decision-making from the outset. The survey finds many organisations are still under-prepared for a rapidly evolving cyber landscape and organisations that get this right will be better positioned to innovate with confidence while continuing to operate through disruption.
Unlocking AI’s defensive potential – Ireland behind global counterparts on autonomous AI agents
As cyber-attacks accelerate beyond human speed, AI is becoming an essential force multiplier for security teams. However, trust remains low – particularly around using autonomous AI agents.
Just 6% of Irish business and security respondents would authorise fully autonomous execution by AI agents for cyber defence compared to 22% for global respondents. At the same time, a further 37% of Irish respondents said that they would authorise AI agents to recommend actions but a human must approve every action before it runs (Global: 28%).
Rapid advances in AI, however, are proving problematic. Over two-thirds of Irish respondents (69%) rank reliability and maturity of the AI technology among their top three barriers to increasing AI agent autonomy in security operations (Global:55%); 57% said a top barrier is regulatory or compliance constraints (Global: 36%) while a similar proportion (57%) of Irish respondents cited concerns about adversarial manipulation of AI systems (Global: 42%).
The use of AI to control large networks (53%) is the top AI-enabled attack that security and risk leaders around the world are least prepared to address. This is followed by manipulation of AI systems by altering inputs (52%) and the introduction of misleading data into training programs to corrupt AI models (52%).
Security leaders rank threat alerting (50%) and phishing detection (42%) among the top priority AI areas for cyber defence.
Nearly a third of Irish respondents (31%) identify workforce skills in AI oversight and governance as one of their top barriers to increasing AI agent autonomy (Global: 44%). Supporting a strong cyber culture in the organisation is a key priority for supporting professional development and retention of cybersecurity talent (Ireland: 57%; Global: 53%).
Cyber resilience will require C-suite elevation
Organisations should embed cyber-security in their C-suite decision-making if they are to bolster their cyber defences.
Even in the face of rising AI vulnerabilities, companies around the world have only implemented, on average, three out of seven key data-risk measures across their organisations. What’s more, only 5% of those surveyed globally have fully implemented every data risk measure surveyed – down from 7% last year.
While one-third (33%) of CEOs, security and risk leaders globally say their organisations have established dedicated AI roles, including a chief AI officer or an AI board, less than half strongly agree that cyber risk is a standing agenda item at the Board level (Global:47%; Ireland: 43%) or at executive leadership meetings (Global:45%; Ireland:40%).
Quantum security – Ireland lags global counterparts
It is expected that quantum computing will break current encryption protocols as early as the 2030s. Nearly a third (29%) of companies around the world say that quantum-computing exposure is a cyber threat that their organisation is least prepared to address in the next 12 months.
Just 6% of Irish respondents said that they are implementing quantum-resistant security measures (Global: 21%). At the same time, 68% are either piloting, testing or exploring implementation of these measures (Global: 65%).
Bolstering cyber resilience in the age of AI – managed services a key focus
As organisations contend with a new frontier of cyber risks, they are taking action.
Half (51%) of Irish respondents will strengthen their third party/supply chain risk management over the next 12 months in response to the current geopolitical landscape (Global: 50%). A similar proportion (51%) will localise critical infrastructure while 49% will expand threat intelligence and geopolitical monitoring (Global: 43% and 47% respectively). More than half (54%) of global companies will adopt multi-cloud or hybrid cloud strategies.
The survey highlights that third party resilience is a challenge with 91% of organisations globally reporting material obstacles including difficulty enforcing service-level agreements, lack of visibility into concentration risk across vendors and issues with understanding shared security responsibility.
As cyber budgets take centre-stage, some companies are bringing in managed services to help as organisations confront a shortage of specialist cyber and AI talent. Artificial intelligence (53%) is the leading focus area when using managed services over the next 12 months. Other key priority areas when using managed services are cloud security (49%), data protection (42%) and network security (37%).
AI is changing both sides of the cyber equation. It is creating new risks and expanding the attack surface, but it can also transform how organisations defend themselves. The opportunity is to build the trust, governance and human oversight that allow organisations to use AI more confidently to secure the business and create value.
Irish organisations need to build trust without stalling adoption. Priorities include improving AI reliability and maturity, strengthening defences against adversarial manipulation and translating regulatory requirements into clear operating guardrails. Progress in these areas would support faster threat response and more efficient cyber operations while retaining appropriate human control.
By Leonard McAuliffe, Partner, PwC Cybersecurity & Privacy practice, PwC Ireland