Just over half of PwC's 3,934 respondents call attacks on AI their biggest cyber gap

PwC, a consulting firm, collected the responses in 71 countries and published the report on October 1 ^[1]. The survey measures how ready respondents feel ^[18]. The published summary does not include incident counts or a definition of an adversarial AI attack. Its specific figures are about who owns AI risk and where the money is going ^[2][6].

The three ownership models PwC reported add up to 72% of responses ^[15]. Take out the CISO share and 83% of respondents gave an answer other than the CISO or the cyber function when asked who is accountable for AI risk ^[13].

Hiring an AI executive has not settled who owns the risk ^[2]. A third of CEOs and security and risk leaders said they have appointed a dedicated AI role such as a chief AI officer ^[9]. A smaller 26% of respondents put AI risk with a dedicated AI leader or function ^[3]. PwC reports those figures for different respondent groups, so one cannot be subtracted from the other ^[3][9].

In my view, data classification and data loss prevention are the two controls most security teams already run for deciding what an AI tool may read and what it may send out. PwC links rising data risk to AI risk ^[11]. By its figures, 51% of organisations have not fully implemented classification and 52% have not fully implemented DLP ^[16].

Fewer respondents are working on hardening than are worried about attack ^[18][14]. Platform hardening is a top AI priority for 38% ^[14], 14 points below the share that called attacks on AI their biggest gap ^[17]. Responsible AI governance leads that list at 42%, with supply chain security third at 35% ^[14]. Interest in AI as a defensive tool runs higher: 50% want it for threat detection and alerting, 43% for fraud detection and 42% for phishing detection and response ^[12].

Agents face a second limit beyond skills ^[7]. Some 55% of respondents said the reliability of the technology is preventing broader adoption of agents ^[8].