Irish organisations lag global peers on cybersecurity risks

Irish organisations lag global peers on cyber risk, AI defence and quantum security, according to PwC’s 2027 Global Digital Trust Insights Survey.

Irish organisations remain under-prepared for a rapidly changing cyber threat landscape, with new PwC research identifying significant gaps in risk management, AI security and cyber resilience.

PwC’s 2027 Global Digital Trust Insights Survey found that just 17% of Irish business and information security leaders strongly agree that cyber risk is integrated into their organisation’s enterprise risk management processes, compared with 41% globally.

Preparedness is also an issue when organisations test their ability to respond to an attack. Less than a quarter, 23%, of Irish respondents strongly agree that their organisation regularly conducts realistic incident response exercises, compared with 41% globally.

The findings are based on a survey of 3,934 business and technology executives across 71 countries and territories, including Ireland.

Close the gap

Leonard McAuliffe, Partner, Cybersecurity & Privacy, PwC Ireland, said: “Despite the interconnected risks, only 17% of Irish respondents report that cyber risk is integrated into their organisation’s enterprise risk management process, compared with 41% globally. Closing this gap can support clearer ownership and better-informed investment decisions as organisations respond to fast-moving threats.

“The ultimate goal of cybersecurity is not just to protect the business, but to give the business the confidence to move forward. As organisations race to capture the value of AI, cyber resilience needs to become a business capability, embedded in C-suite decision-making from the outset.

👉 No tech background needed to bring your business into the AI age! Secure your Google AI Professional Certificate to complete the certification at no cost. Apply now and get started!

“The survey finds many organisations are still under-prepared for a rapidly evolving cyber landscape and organisations that get this right will be better positioned to innovate with confidence while continuing to operate through disruption.”

AI moves up the cybersecurity agenda

AI is emerging as a major investment priority for security teams. Some 34% of Irish respondents identified securing their organisations against AI-enabled attacks as a cyber spending priority, compared with 46% globally.

Globally, 58% of security leaders rank AI among their top cyber budget priorities for the year ahead, followed by cloud security at 46% and data protection and data trust at 39%.

Concerns are also growing around attacks directed at AI systems. Half of global security leaders identify attacks targeting AI systems among the cyber threats they are least prepared to address. Cloud-related threats were identified by 40%, followed by third-party breaches at 34% and ransomware at 33%.

The use of AI to control large networks, cited by 53%, ranks as the AI-enabled attack that global security and risk leaders are least prepared to address. Manipulation of AI systems by altering inputs and the introduction of misleading data into training programmes were each cited by 52%.

For cyber defence, security leaders rank threat alerting at 50% and phishing detection at 42% among their priority AI applications.

Irish businesses cautious on autonomous AI

Irish organisations remain particularly cautious about giving autonomous AI systems control over cyber defence.

Just 6% of Irish business and security respondents would authorise fully autonomous execution by AI agents for cyber defence, compared with 22% globally.

A further 37% of Irish respondents would allow AI agents to recommend actions while requiring a human to approve every action before it runs, compared with 28% globally.

Technology maturity is a major concern. More than two-thirds of Irish respondents, 69%, place the reliability and maturity of AI technology among their top three barriers to increasing AI agent autonomy in security operations, compared with 55% globally.

Regulatory or compliance constraints were identified by 57% of Irish respondents, while 57% also cited concerns about adversarial manipulation of AI systems.

Almost a third, 31%, identified workforce skills in AI oversight and governance as a leading barrier. Supporting a strong cyber culture within the organisation was identified as a key priority for professional development and retention of cybersecurity talent by 57% of Irish respondents.

Cyber resilience moves into the C-suite

The research indicates that cybersecurity is becoming increasingly important at board and senior management level.

Some 43% of Irish respondents strongly agree that cyber risk is a standing agenda item at board level, compared with 47% globally. At executive leadership meetings, the respective figures are 40% and 45%.

Globally, a third of CEOs, security and risk leaders said their organisations have established dedicated AI roles, including a chief AI officer or an AI board.

Companies have implemented an average of three out of seven key data-risk measures identified in the survey. Only 5% of organisations surveyed globally have fully implemented every data-risk measure, down from 7% last year.

Operational continuity also remains an area of concern. Less than two-fifths, 39%, of global security, risk and operations leaders have a fully formalised and integrated operational continuity plan specifically addressing cybersecurity threats.

Quantum security gap emerges

PwC’s research also identifies a gap in preparations for quantum-resistant security.

Just 6% of Irish respondents said their organisations are implementing quantum-resistant security measures, compared with 21% globally. Some 68% of Irish respondents are piloting, testing or exploring the implementation of such measures, compared with 65% globally.

Globally, 29% of companies identified quantum-computing exposure as one of the cyber threats their organisation is least prepared to address over the next 12 months.

Cyber budgets set to increase

Investment in cybersecurity is expected to continue growing. Some 84% of global security and finance leaders expect their cyber budgets to increase in 2027, up from 78% last year.

Irish organisations are also taking steps to strengthen their resilience over the next 12 months.

More than half, 51%, plan to strengthen third-party and supply-chain risk management in response to the current geopolitical landscape. The same proportion plan to localise critical infrastructure, while 49% intend to expand threat intelligence and geopolitical monitoring.

Third-party resilience remains a significant challenge internationally, with 91% of organisations globally reporting material obstacles. These include difficulties enforcing service-level agreements, limited visibility into concentration risk across vendors and challenges understanding shared security responsibility.

Moira Cronin, Digital Risk and Resilience Partner, PwC Ireland, said: “What’s telling about the 91% is that third party resilience clearly isn’t an isolated supplier-management issue, it’s a business challenge. Organisations are increasingly dependent on third parties, but they don’t always have the leverage or visibility they need.

“That makes it important to understand which providers your organisation’s core business depends on and where they cannot provide the assurance the business needs – businesses need to ask: can they still deliver the resilience outcome the organisation requires? If not, they need to mitigate the gap, explicitly accept the risk, or ultimately find an alternative.”

Managed services are another area of focus as organisations address demand for specialist cyber and AI expertise. AI, at 53%, is the leading focus area for managed services over the next 12 months, followed by cloud security at 49%, data protection at 42% and network security at 37%.

McAuliffe said: “AI is changing both sides of the cyber equation. It is creating new risks and expanding the attack surface, but it can also transform how organisations defend themselves. The opportunity is to build the trust, governance and human oversight that allow organisations to use AI more confidently to secure the business and create value.”

“Irish organisations need to build trust without stalling adoption. Priorities include improving AI reliability and maturity, strengthening defences against adversarial manipulation and translating regulatory requirements into clear operating guardrails. Progress in these areas would support faster threat response and more efficient cyber operations while retaining appropriate human control.”