PwC Report: AI Becomes Top Enterprise Security Challenge, Half of Executives Unprepared for AI Attacks
A PwC survey reveals AI is now the primary cybersecurity concern for global enterprises, with 58% prioritizing it in budgets while half admit to being unprepared for attacks targeting AI systems.
The '2027 Global Digital Trust Insights' report published by international accounting firm PwC in early October identifies artificial intelligence as the biggest cybersecurity challenge facing enterprises today. The survey covered 3,934 business and IT executives across 71 countries. Among the 1,819 respondents holding senior roles such as AI Director, CIO, or CISO, 50% identified attacks targeting AI systems as the crisis they are least prepared to address. This proportion exceeds concerns about cloud-related threats (40%), third-party data breaches (34%), and ransomware (33%).
As AI capabilities advance rapidly, this preparedness gap poses increasingly critical risks. The report notes that top-tier AI models can now discover previously unknown software vulnerabilities with extreme precision and exploit them through complex attack paths with almost no human intervention. When asked about the five types of AI-driven attacks they are least prepared for in the next year, executives cited compromise by autonomous botnets (53%) as their top fear, followed closely by adversarial attacks (52%)—which manipulate AI outputs via subtle input changes—and data poisoning (52%), which corrupts models by introducing misleading data into training sets.
Regarding expenditure, 84% of respondents expect their cybersecurity budgets to increase in 2027, up 6 percentage points from last year's expectations. Notably, 58% of enterprises list AI as the top priority for their cybersecurity budgets, ahead of cloud service security (46%) and data protection/trust (39%). Within AI-specific investments, 'Responsible AI Governance and Compliance' ranks first (42%), indicating that companies are attempting to mitigate security risks through governance even as they deploy AI. However, PwC also observed a disconnect between intent and capability: only 39% of respondents have fully formalized operational continuity plans specifically for cyber threats, while 23% have no formal plan at all.