Attacks on AI systems ranked first among the threats security leaders are least ready for, even as AI tops their cybersecurity spending plans.
Key Takeaways
- 50% of security leaders named attacks on AI systems as a threat they are least prepared for, more than any other threat.
- Of all the AI threats, 53% of leaders say they are least ready for criminals who use AI to hijack large numbers of computers and use them to attack.
- 58% of security leaders rank AI as a top cybersecurity spending priority, more than any other area.
- 22% of leaders would let AI fight an attack on its own, without a person’s approval.
According to PwC’s 2027 Global Digital Trust Insights survey, security leaders say attacks on their companies’ own AI systems are the cyber threat they are least prepared to handle. PwC asked 3,934 business and technology leaders in 71 countries about the threats they face and how they plan to spend on cybersecurity.
Attacks on AI systems ranked ahead of cloud breaches and ransomware
PwC asked 1,819 security and technology leaders, including chief information security officers and chief technology officers, which threats their organization is least prepared to address over the next 12 months. Each picked a top five.
Half put attacks on AI systems in their top five. Next came threats to cloud systems (40%), breaches that come in through suppliers and other outside companies (34%), and ransomware (33%).
PwC also asked 1,976 security, technology, and risk leaders which AI-related attacks they are least prepared for. The top three were:
- AI-run botnets (53%): large networks of hijacked computers that criminals control with AI.
- Adversarial attacks (52%): attacks that trick an AI system into giving wrong answers.
- Data poisoning (52%): attacks that feed false information into the data an AI learns from.
AI is now the top cybersecurity spending priority
84% of security and finance leaders expect their cybersecurity budgets to rise, up from 78% last year. PwC named AI as a main reason for the increase.
58% of security leaders rank AI among their top five cybersecurity spending priorities, ahead of cloud security at 46%. Within that AI spending, the top priority is setting rules for how the company uses AI and making sure those rules and the law are followed (42%).
Most leaders would not let AI fight an attack without a person’s approval
PwC asked all respondents how much they would let AI agents act against an attack without first getting a person’s approval.
22% would let the agents take any action, including high-impact ones. 38% would let them act alone only on low-risk steps, with a person approving anything bigger. 36% want people to lead every action, with AI in support. The rest do not use AI agents for defense or were unsure.
Respondents were most willing to hand routine tasks to agents, such as deleting phishing emails (47%) and removing malicious software (46%).
When asked what keeps them from giving AI agents more freedom to act, 55% of all respondents cited doubts about today’s AI being reliable and developed enough as the most common answer.
How PwC ran the survey
PwC Research, PwC’s market research unit, surveyed 3,934 leaders from May through July 2026. 36% work at companies with $5 billion or more in annual revenue. The largest groups came from financial services (21%), technology, media, and telecom (20%), and industrial manufacturing and automotive (19%). By region, 32% were in Western Europe, 26% in North America, and 18% in Asia Pacific.
The survey is in its 29th year. It was previously called the Global State of Information Security Survey.
