On the global stage, too few organizations are implementing new technology to defend against new technology employed by attackers.
PwC’s 2027 Global Digital Trust Insights report surveys just short of 4,000 businesses and tech leaders in more than 70 countries. It seeks to understand how industry is responding to a rapidly evolving digital environment. Artificial intelligence (AI) is the nexus.
AI takes center stage in this report. An increase in the volume and speed of AI-assisted attacks goes without saying; but the report highlights that leaders identify attacks targeting their own AI systems as the top cyber threat they are least prepared to address. Compromise by autonomous botnets (53%), adversarial attacks (52%), and data poisoning (52%) are the primary concerns they are unprepared to defend.
It is worth remembering OpenAI’s statement in late 2025 that prompt engineering, like social engineering, is unlikely ever to be fully solved. Better known as prompt injection when used by an attacker, a prompt injection attack can leak data or execute unauthorized commands; and it is unlikely we can prevent it. Noticeably, prompt injection is also the #1 in this year’s OWASP top ten list of LLM application threats.
AI is also considered to be the #1 cybersecurity defense for threat detection and alerting. However, only 22% of leaders would use “fully autonomous execution by AI agents for cyber defense without human approval”. Fifty-five percent say failings in reliability and maturity are the main causes of this reluctance. Forty-four percent also highlight a lack of workforce skills in AI oversight and governance.
While this is the majority view at the time the survey was conducted, one must wonder if it is sustainable into the future. AI-assisted attacks are advancing in speed, scale and sophistication – faster than humans can counter without similar defensive speed. Only autonomous agent defense can match this speed; but an autonomous agent is not really autonomous if there is a human in the loop. It may simply become essential to use fully autonomous agents or risk repeated compromise.
Full autonomy, however, will simultaneously increase a firm’s attack surface; but life and cybersecurity are both swings and roundabouts (or six of one, half a dozen of the other in the US). And there is no single ownership model for accountability. Twenty-nine percent of leaders believe it rests with the CIO, CTO or technical sphere; 26% with a dedicated and named AI leader or function, and perhaps surprisingly, only 17% with the CISO or cyber function. Eleven percent have accountability shared across multiple functions.
The security focus on AI has a knock-on effect. Eighty-four percent of security and finance leaders expect budgets to increase, with 58% ranking AI as the top cyber budget priority.
Surveys, especially large surveys, provide an interesting snapshot of opinions. But it is useful to remember that they represent a slice in time view of opinions that are historical by the time they reach us. AI in particular is advancing so fast that opinions held a few weeks ago may not reflect our understanding and priorities today. They are also fundamentally subjective, in both questions and answers, and can provide no ground truth.