PwC: Leaders Less Prepared for AI Cyberattacks Than Traditional Ones

What happened

PwC has found that business leaders feel less prepared to defend against attacks targeting artificial intelligence systems than against conventional cybersecurity threats. The finding comes amid a broader pattern in which organisations are adopting AI models and tools faster than they are investing in securing the data and infrastructure that underpin them.

According to the report, this gap in preparedness is specific to AI-related risks — such as attacks aimed at manipulating, poisoning or extracting value from AI models and the data they rely on — rather than a general decline in cybersecurity confidence. Leaders surveyed by PwC indicated that traditional security threats feel more manageable than those emerging from AI deployments, suggesting that existing security frameworks and practices have not fully caught up with how AI is being embedded into business operations.

Why it matters

The report points to a structural mismatch: enterprises are racing to deploy generative AI and machine learning across customer-facing and internal functions, often before the governance, monitoring and security controls needed to protect those systems are in place. As AI becomes more deeply embedded in decision-making, service delivery and data handling, the attack surface expands in ways that many organisations are not yet equipped to monitor or defend.

For leaders overseeing digital transformation, this is a signal to treat AI security as a distinct discipline rather than an extension of existing cybersecurity programmes. Models, training data and the pipelines connecting them to live systems each introduce new vulnerabilities — and the PwC findings suggest that board-level confidence has not yet caught up with the pace of AI rollout.

The Renascence take

The real story here is less about hackers and more about sequencing: organisations are shipping AI into production before they've built the muscle to secure it, and leaders know it.

Most organisations still treat AI security as a subset of IT risk, when it behaves more like a trust problem — one bad model output or data leak can undo years of carefully built customer confidence in a single incident. The fix isn't just more security spend; it's sequencing AI governance and monitoring alongside deployment, not after it, and being honest with customers and employees about what AI systems can and can't be trusted to do until that groundwork is in place.