AI Threats Top Cybersecurity Preparedness Gap, PwC Finds

Cybersecurity leaders report that threats targeting AI systems represent a current gap in addressing security concerns, alongside existing challenges in skills, accountability, and data protection. Adversarial AI attacks are cited as the largest cyber preparedness gap among business and tech leaders, with over half reporting this. Governance issues compound these risks, as no single ownership model has emerged for AI risk management, with opinions divided on where accountability should reside across different roles. Furthermore, data risk is increasing, impacting AI security; only about half of organizations have fully implemented necessary data classification and loss prevention policies. Despite these challenges, there is optimism regarding future investment, with a majority expecting budget increases and viewing AI integration in cyber defenses as a top priority. Areas of focus include responsible AI governance, platform hardening, supply chain security, and utilizing AI for specific defensive tasks like threat detection. Skills shortages persist, particularly regarding AI oversight, though there is a recognized appetite for AI-enabled training to address these gaps.

The narrative highlights a significant divergence between stated aspirations regarding AI integration and the practical realities of establishing necessary control structures. The primary tension exists between the recognized potential of AI for cyber defense—evidenced by the strong interest in AI-enabled threat detection and fraud response—and the palpable gaps in governance, skills, and data hygiene required to manage these systems safely. The fragmentation in ownership models for AI risk management suggests a systemic difficulty in assigning clear accountability when autonomous systems are introduced, which risks creating diffusion of responsibility rather than centralized control. Furthermore, the focus on skills as a bottleneck underscores that technological adoption is fundamentally constrained by human capital limitations; relying on AI-enabled training as a solution acknowledges that the tools themselves cannot solve the inherent organizational and cognitive challenges. This creates an implicit tension: the drive for rapid AI deployment clashes with the slow, complex process of establishing robust, multi-layered governance and skilled oversight necessary for true digital trust. The pattern suggests that the focus remains heavily on tactical implementation (tools for defense) while underinvesting in the strategic, foundational elements of systemic risk management (accountability and skills). The implication is that without reconciling the functional roles of responsibility with the technological advancements, organizations will continue to face an unstable state where innovation proceeds faster than institutional maturity. Bridge questions include: If accountability models remain fragmented, what specific organizational or legal structures are most effective at allocating liability for AI-driven security failures? How can investment in AI training be decoupled from mere retention metrics to ensure genuine skill acquisition relevant to systemic governance? What long-term consequences arise if the perceived reliability of agents is prioritized over the deployment timeline?