PwC’s 2027 Global Digital Trust Insights survey finds 84% of security and finance leaders expect an increase in cybersecurity budgets over the next 12 months, up from 78% a year earlier. The research polled 3,934 business and technology leaders across 71 countries and territories.
Despite rising investment intentions, the survey shows organisations are not equally ready for emerging risks: half of respondents (50%) identified attacks against AI systems among the threats their organisations are least prepared to handle.
Investment priorities and gaps in readiness
Fifty-eight percent of security leaders named AI as a priority area for cybersecurity investment over the coming year. Yet only 39% of respondents report having a fully formalised and integrated continuity plan that comprehensively addresses cyber risk.
Among other top concerns, cloud-related risks ranked second (40%), incidents involving third parties were cited by 34%, and ransomware attacks by 33%.
Governance, leadership and decision-making
One third (33%) of CEOs and security and risk leaders said their organisation has created a dedicated AI leadership role or body (for example, a chief AI officer or AI board). Regular leadership-level treatment of cyber risk is still not universal: 47% agreed that cyber risks are consistently on board agendas and 45% said they are regularly discussed at senior executive meetings.
AI reshapes both defence and offence in cybersecurity
PwC’s respondents highlight that AI accelerates and enhances defensive capabilities but also expands attackers’ toolsets. Security and risk leaders feel least prepared to handle incidents such as autonomous botnet attacks (53%), adversarial (deception-based) attacks (52%), and data poisoning (52%).
Detection and alerting of threats (50%) and recognising and handling phishing attacks (42%) were cited as the most important cybersecurity use cases for AI. However, trust in autonomous AI agents is limited: only 22% would permit AI agents to perform cybersecurity tasks fully autonomously.
The main barriers to wider autonomous AI use include technology reliability and maturity (55%), accountability and explainability of AI-driven decisions (46%), and a lack of employee skills required to oversee and govern AI (44% among CISOs).
Durojaiye Peter, PwC CEE Chief Commercial Technology Officer, emphasised that AI investments must align business objectives with security preparedness. Nagy Dániel, director of PwC’s Central and Eastern Europe cyber defence advisory team, underlined that cyber resilience needs to be embedded into executive decision-making.
Balancing autonomy and human oversight
The survey underscores that accelerating attack speed and complexity make human-only responses increasingly insufficient. Gyimesi Csaba, director of PwC Hungary’s cyber defence team, highlighted the need for governance that preserves human control, continuous risk assessment and an approach that enables AI tools to deliver business value while minimising risk.
Only 22% of respondents would allow full autonomy for AI agents in cybersecurity tasks, reflecting persistent concerns about autonomous operation.
Steps organisations are taking to strengthen cyber resilience
Respondents report a range of measures to improve resilience: 54% follow a multicloud or hybrid cloud strategy, 47% are building regional data and technology reserves, and 37% are placing infrastructure within specific jurisdictions to reduce concentration risks in the value chain.
Geopolitical shifts are also influencing cyber risk practices: 50% of respondents are changing supplier and third-party risk management, including strengthening supply chain security. Many organisations are using managed services to address capability gaps; 53% cited AI-related managed services as a focus area. Nevertheless, a shortage of specialised cybersecurity and AI talent remains a significant challenge.
Six strategic focus areas
PwC recommends organisations concentrate on six strategic areas to manage fast-evolving AI technologies and cyber threats effectively:
- Strengthening cybersecurity governance: improve accountability and decision-making on risk.
- Ensuring operational continuity: protect critical business processes and increase resilience.
- Securing data and AI: proactively manage risks from emerging technologies.
- Reducing ecosystem risk: lower exposure to third parties, supply chains and technological concentration.
- Supporting business value creation: use reliable technologies and data to achieve corporate objectives.
- Enabling safe and effective AI agents: design operating models that allow AI agents to help defend against agent-enabled attacks.
PwC concludes that future cybersecurity strategies must align technological innovation with deliberate risk management and organisational resilience.
About the survey
PwC’s 2027 Global Digital Trust Insights survey collected responses from 3,934 business and technology leaders in 71 countries and territories. The research examined how leaders manage cybersecurity challenges in a rapidly changing digital environment and where notable capability gaps remain.
The seven data risk-management measures referenced in the survey are: data classification policies; data loss prevention on primary data egress channels; broadly applied data encryption, tokenisation and/or anonymisation solutions; data governance controls across the data lifecycle; data quality assurance capabilities; discovery and cataloguing of structured and unstructured data; and data minimisation approaches.
