Irish organisations need to do more to manage their cyber risks: PwC

PwC’s new cybersecurity research reveals that Irish organisations need to do more to manage their cyber risk: just 17% of Irish respondents strongly agree that cyber risk is integrated into their organisation's enterprise risk management processes (Global: 41%); less than a quarter (23%) strongly agree that their organisation regularly conducts realistic incident response exercises to test preparedness (Global: 41%).

Less than two-fifths (39%) of global security, risk and operations leaders have a fully formalised and integrated operational continuity plan that specifically addresses cybersecurity threats.

At the same time, organisations around the world are doubling down on their cyber investment amid rapid advances in AI, with more than four-fifths (84%) of global security and finance leaders expecting cyber budgets to increase in 2027 — up from 78% last year — according to PwC’s 2027 Global Digital Trust Insights Survey, published today in Ireland.

The survey, which captures the views of almost 4,000 business and tech executives across 71 countries and territories, including Ireland, finds that as leading AI models are rolled out, just 34% of Irish respondents said a cyber spend priority is securing against AI-enabled attacks (Global: 46%). Over half (58%) of global security leaders rank AI as their top cyber budget priority for the year ahead, followed by cloud security (46%) and data protection/data trust (39%).

When asked specifically about the cyber threats organisations are least prepared to address, half (50%) of global security leaders identify attacks targeting AI systems amongst their top threats — ahead of cloud-related threats (40%), third-party breaches (34%) and ransomware (33%).

Leonard McAuliffe, Partner, Cybersecurity & Privacy, PwC Ireland, said: “Despite the interconnected risks, only 17% of Irish respondents report that cyber risk is integrated into their organisation’s enterprise risk management process, compared with 41% globally. Closing this gap can support clearer ownership and better-informed investment decisions as organisations respond to fast-moving threats.

“The ultimate goal of cybersecurity is not just to protect the business, but to give the business the confidence to move forward. As organisations race to capture the value of AI, cyber resilience needs to become a business capability, embedded in C-suite decision-making from the outset. The survey finds many organisations are still under-prepared for a rapidly evolving cyber landscape and organisations that get this right will be better positioned to innovate with confidence while continuing to operate through disruption.”

Unlocking AI’s defensive potential — Ireland behind global counterparts on autonomous AI agents

As cyber-attacks accelerate beyond human speed, AI is becoming an essential force multiplier for security teams. However, trust remains low — particularly around using autonomous AI agents.

Just 6% of Irish business and security respondents would authorise fully autonomous execution by AI agents for cyber defence compared to 22% for global respondents. At the same time, 37% of Irish respondents said that they would authorise AI agents to recommend actions but a human must approve every action before it runs (Global: 28%).

Rapid advances in AI, however, are proving problematic. Over two-thirds of Irish respondents (69%) rank reliability and maturity of the AI technology among their top three barriers to increasing AI agent autonomy in security operations (Global:55%); 57% said a top barrier is regulatory or compliance constraints (Global: 36%) while a similar proportion (57%) of Irish respondents cited concerns about adversarial manipulation of AI systems (Global: 42%).

The use of AI to control large networks (53%) is the top AI-enabled attack that security and risk leaders around the world are least prepared to address. This is followed by manipulation of AI systems by altering inputs (52%) and the introduction of misleading data into training programs to corrupt AI models (52%).

Security leaders rank threat alerting (50%) and phishing detection (42%) among the top priority AI areas for cyber defence.

Nearly a third of Irish respondents (31%) identify workforce skills in AI oversight and governance as one of their top barriers to increasing AI agent autonomy (Global: 44%). Supporting a strong cyber culture in the organisation is a key priority for supporting professional development and retention of cybersecurity talent (Ireland: 57%; Global: 53%).

PwC’s recent AI Performance survey found that three-quarters of AI’s economic gains are being captured by 20% of companies. This research found that these AI leaders are more likely than others to have mechanisms such as a Responsible AI framework (1.7 times as likely as other companies) and a cross-functional AI governance board (1.5 times as likely). As a result, their employees are twice as likely to trust AI outputs.

Cyber resilience will require C-suite elevation

Organisations should embed cyber-security in their C-suite decision-making if they are to bolster their cyber defences.

Even in the face of rising AI vulnerabilities, companies around the world have only implemented, on average, three out of seven key data-risk measures across their organisations. What’s more, only 5% of those surveyed globally have fully implemented every data risk measure surveyed — down from 7% last year.

While one-third (33%) of CEOs and security and risk leaders globally say their organisations have established dedicated AI roles, including a chief AI officer or an AI board, less than half strongly agree that cyber risk is a standing agenda item at the board level (Global:47%; Ireland: 43%) or at executive leadership meetings (Global:45%; Ireland:40%).

Moira Cronin, Digital Risk and Resilience Partner, PwC Ireland, said: “To be resilient in the face of a cyber-attack you need to know the following: Will your customers and people be safe? Can you remain financially viable? Can you maintain market trust? And can you meet regulatory obligations. PwC has developed a framework ‘Minimum Viable Company’ to help with exactly that — which identifies the smallest set of capabilities that must remain operational to keep an organisation viable through severe disruption. When a major cyber-attack hits for example, companies need to think beyond business continuity and compliance, they need to identify the critical services, people, technology and suppliers that must keep operating.”

Quantum security — Ireland lags global counterparts

It is expected that quantum computing will break current encryption protocols by 2030. Nearly a third (29%) of companies around the world say that quantum-computing exposure is a cyber threat that their organisation is least prepared to address in the next 12 months.

Just 6% of Irish respondents said that they are implementing quantum-resistant security measures (Global: 21%). At the same time, 68% are either piloting, testing or exploring implementation of these measures (Global: 65%).

Bolstering cyber resilience in the age of AI — managed services a key focus

As organisations contend with a new frontier of cyber risks, they are taking action.

Half (51%) of Irish respondents will strengthen their third party/supply chain risk management over the next 12 months in response to the current geopolitical landscape (Global: 50%). A similar proportion (51%) will localise critical infrastructure while 49% will expand threat intelligence and geopolitical monitoring (Global: 43% and 47% respectively). More than half (54%) of global companies will adopt multi-cloud or hybrid cloud strategies.

The survey highlights that third party resilience is a challenge with 91% of organisations globally reporting material obstacles including difficulty enforcing service-level agreements, lack of visibility into concentration risk across vendors and issues with understanding shared security responsibility.

Moira Cronin, Digital Risk and Resilience Partner, PwC Ireland, said “What’s telling about the 91% is that third party resilience clearly isn’t an isolated supplier-management issue, it’s a resilience challenge. Organisations are increasingly dependent on third parties, but they don’t always have the leverage or visibility they need. That makes it important to understand which providers your organisation's core business depends on and where they cannot provide the assurance you need; you need to ask - can they still deliver the resilience outcome the business requires? If not, you need to mitigate the gap, explicitly accept the risk, or ultimately find an alternative.”

As cyber budgets take centre-stage, some companies are bringing in managed services to help — with artificial intelligence (53%) the leading focus area when using managed services over the next 12 months as organisations confront a shortage of specialist cyber and AI talent. Other key priority areas when using managed services are cloud security (49%), data protection (42%) and network security (37%).

Leonard McAuliffe, Partner, Cybersecurity & Privacy, PwC Ireland, concluded: “AI is changing both sides of the cyber equation. It is creating new risks and expanding the attack surface, but it can also transform how organisations defend themselves. The opportunity is to build the trust, governance and human oversight that allow organisations to use AI more confidently to secure the enterprise and create value.”

“Irish organisations need to build trust without stalling adoption. Priorities include improving AI reliability and maturity, strengthening defences against adversarial manipulation and translating regulatory requirements into clear operating guardrails. Progress in these areas would support faster threat response and more efficient cyber operations while retaining appropriate human control.”

Notes to editors

The five key priorities for Irish organisations to strengthen cyber resilience are:

1. Integrate cyber risk into enterprise risk management.
2. Formalise operational continuity plans with cyber-specific measures.
3. Strenghten third-party risk management and vendor oversight.
4. Prioritise AI security governance before autonomous deployment.
5. Launch quantum-resistant security initiatives.