Just over half of PwC's 3,934 respondents call attacks on AI their biggest cyber gap
PwC surveyed 3,934 leaders and found 52% rank attacks on AI systems as their biggest cyber preparedness gap. Only 17% place AI risk with the CISO, so in most of the sample the security function does not own the threat it feels least ready for.
The Watch · Security desk
What happened
- The largest share of respondents, 29%, put AI risk with the CIO, CTO or technology function, and PwC says no single ownership model has emerged.
- Budgets are expected to grow, with 84% of security and finance bosses forecasting an increase, six percentage points above the 2025 figure.
- Among CISOs, 44% named AI oversight and governance skills as a top barrier to giving AI agents more autonomy.
Why it matters
- Who's exposed exposure In the 83% of responses that did not name the CISO, an attack on an AI system puts the security team in charge of containing an asset another executive is accountable for.
- What it limits constraint Where data is not fully classified, security teams have no labels to enforce when limiting what an AI tool may read or send out.
- Who has to decide decision With AI a top-five cyber budget priority for 58%, organisations have to decide which executive controls that spending while formal ownership of AI risk is still split.
Next story · Invest · Oct 8
Most of Washington's $215 million quantum prize pays only after teams reach 100 logical qubitsConfirmed2 publishers
PwC, a consulting firm, collected the responses in 71 countries and published the report on October 1 [1]. The survey measures how ready respondents feel [18]. The published summary does not include incident counts or a definition of an adversarial AI attack. Its specific figures are about who owns AI risk and where the money is going [2][6].
The three ownership models PwC reported add up to 72% of responses [15]. Take out the CISO share and 83% of respondents gave an answer other than the CISO or the cyber function when asked who is accountable for AI risk [13].
Hiring an AI executive has not settled who owns the risk [2]. A third of CEOs and security and risk leaders said they have appointed a dedicated AI role such as a chief AI officer [9]. A smaller 26% of respondents put AI risk with a dedicated AI leader or function [3]. PwC reports those figures for different respondent groups, so one cannot be subtracted from the other [3][9].
In my view, data classification and data loss prevention are the two controls most security teams already run for deciding what an AI tool may read and what it may send out. PwC links rising data risk to AI risk [11]. By its figures, 51% of organisations have not fully implemented classification and 52% have not fully implemented DLP [16].
Fewer respondents are working on hardening than are worried about attack [18][14]. Platform hardening is a top AI priority for 38% [14], 14 points below the share that called attacks on AI their biggest gap [17]. Responsible AI governance leads that list at 42%, with supply chain security third at 35% [14]. Interest in AI as a defensive tool runs higher: 50% want it for threat detection and alerting, 43% for fraud detection and 42% for phishing detection and response [12].
Agents face a second limit beyond skills [7]. Some 55% of respondents said the reliability of the technology is preventing broader adoption of agents [8].
What to watch
- Whether PwC's full report breaks out the 28% of ownership answers that fall outside the three models Infosecurity reported.
- Whether the 17% CISO share of AI risk ownership moves in PwC's next Digital Trust Insights edition.
- Disclosed incidents involving attacks on production AI systems, to set against the self-reported preparedness gap.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption35
- Hype gap+15
- Incentives40
- Confidence60
Perspective Coverage
3 publishers- Builder
- Builder 28%
- Operator
- Operator 57%
- Investor
- Investor 15%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Consulting firm PwC polled 3,934 business and tech leaders across 71 countries for its 2027 Global Digital Trust Insights report, published on October 1.
- [2]
29% of respondents said accountability for AI risk sits with the CIO, CTO or technology function; PwC said no single ownership model has emerged for AI risk management.
- [3]
26% of respondents said accountability for AI risk sits with a dedicated AI leader or AI function.
- [4]
17% of respondents said accountability for AI risk sits with the CISO or cyber function.
- [5]
84% of security and finance bosses expect budgets to increase, six percentage points higher than in 2025.
- [6]
58% said AI is a top-five cyber budget priority.
- [7]
44% of CISOs identified workforce skills in AI oversight and governance as one of their top barriers to increasing AI agent autonomy.
- [8]
55% ranked reliability of the technology as preventing broader adoption of agents.
- [9]
33% of CEOs and security and risk leaders said they have already appointed a dedicated AI role, such as a chief AI officer.
- [10]
Only around half of responding organisations said they had fully implemented data classification (49%) and data loss prevention (48%) policies.
- [11]
Data risk is proliferating, which in turn impacts AI risk.
- [12]
Organisations want to use AI in cyber defence for threat detection and alerting (50%), fraud detection (43%) and phishing detection and response (42%).
- [13]
83% of respondents did not place accountability for AI risk with the CISO or cyber function.
- [14]
Top AI priorities: responsible AI governance (42%), platform hardening (38%) and supply chain security (35%).
- [15]
The three reported AI-risk ownership models together account for 72% of responses.
- [16]
51% of organisations have not fully implemented data classification and 52% have not fully implemented data loss prevention.
- [17]
The share naming adversarial AI attacks as the biggest preparedness gap is 14 percentage points higher than the share listing platform hardening as a top AI priority.
- [18]
52% of respondents said adversarial AI attacks represent the biggest cyber preparedness gap; threats targeting AI systems are the area cybersecurity leaders feel least able to address.
Sources
3 independent publishers whose own reporting we read for this story.
- helpnetsecurity.comBotnets, adversarial attacks and data poisoning top leaders’ AI threat list
1 article · October 1, 2026
- infosecurity-magazine.comAI Threats Top Cybersecurity Preparedness Gap, PwC Finds
1 article · October 1, 2026
- securityweek.comEnterprises Struggle to Prepare for AI and Quantum Threats, PwC Says
1 article · October 1, 2026
Topics and entities
Topics
- Security of AI systems
- Cybersecurity budgets
- AI Risk Governance
- Post-Quantum Cryptography
Entities
- OpenAI
- Swimlane Inc.
- OWASP Top 10 for LLM Applications
- Global Digital Trust Insights
- PwC
- Lloyds Banking Group