EY

26% of organizations report their AI cybersecurity governance framework is fully rolled out and integrated across relevant business units.

97% of senior corporate security leaders agree their organization's competitive advantage in the next two years will be directly tied to the maturity of agentic AI cybersecurity defenses.

Currently, 30% of senior corporate security leaders say Advanced Persistent Threat detection is largely run with agentic AI; this rises to 62% in two years.

81% of healthcare executives believe that prioritizing cybersecurity in their business strategy is effective in overcoming challenges.

59% of healthcare organizations faced clinical consequences from cyber incidents, including delayed treatments and compromised patient trust.

68% of healthcare executives indicated that identity and access management would be the top priority for increasing investments in the coming fiscal year.

Improving cybersecurity is a top priority for 54% of state and local government IT leaders for the current fiscal year. This is seen as a higher priority than modernising legacy systems.

When it comes to challenges faced by government IT leaders in using private sector innovations, cybersecurity concerns are the most often cited barrier, mentioned by 39%.

A significant concern regarding AI is cyberattacks becoming more sophisticated due to AI, noted by 82% of state and local government IT leaders.

37% of organizations are utilizing over 50 cybersecurity tools.

58% of CISOs and cybersecurity executives say it is difficult to articulate their value beyond risk mitigation.

Only 43% of cybersecurity functions are meaningfully involved in helping other functions adopt AI.

57% of CISOs are more likely than the rest of the C-suite (47%) to say their organisation has experienced a cybersecurity incident due to cybercriminals in the past three years.

75% of CISOs say their organisation experienced a decrease in cybersecurity incidents following increased investment in AI, compared to the rest of the C-suite (68%).

21% of C-suite leaders say their organisation currently invests more than 10% of their IT budget in cybersecurity. This number is expected to roughly double to 38% next year

Currently, 27% of senior corporate security leaders say data privacy and compliance is largely run with agentic AI; this rises to 48% in two years.

Currently, 9% of organizations dedicate at least 25% of their total cybersecurity budget to AI solutions; this share is expected to rise to 48% in two years.

96% of senior corporate security leaders say AI-enabled cybersecurity attacks are a significant threat to their organization.

85% of senior corporate security leaders using AI in cybersecurity say their current cybersecurity budget is insufficient to meet AI-enabled threats.

Currently, 23% of senior corporate security leaders say deep fake and impersonation defense is largely run with agentic AI; this rises to 42% in two years.

Currently, 25% of senior corporate security leaders say third-party risk management is largely run with agentic AI; this rises to 50% in two years.

48% of senior corporate security leaders estimate at least 25% of their organization's cybersecurity incidents in the past year were enabled by AI.

99% of senior corporate security leaders are confident that strategic use of AI will transform their organization's proactive cybersecurity strategies.

Currently, 32% of senior corporate security leaders say real-time fraud detection is largely run with agentic AI; this is expected to rise to 58% in two years.

20% of organizations have optimized their AI cybersecurity governance frameworks and embedded them into organizational culture.

51% of senior corporate security leaders report having a defined AI cybersecurity governance framework that is implemented and embedded in key processes.

98% of senior corporate security leaders with an AI cybersecurity governance framework agree the framework is essential for ensuring the responsible use of AI.

99% of senior corporate security leaders are confident that strategic use of AI will transform their organization's defensive cybersecurity strategies.

Currently, 23% of senior corporate security leaders say Identity and Access Management is largely run with agentic AI; this rises to 51% in two years.

Healthcare organizations experienced an average of five different types of cyber threats that impacted their organizations in the past year.

72% of healthcare organizations experienced a moderate to severe financial impact from cyber incidents in the past two years.

Over 70% of healthcare organizations reported significant financial, operational, or clinical disruptions due to cyber threats in the past year.

60% of healthcare organizations reported operational disruptions due to cyber incidents.

52% of healthcare executives stated that training and upskilling personnel is an effective tool to combat cyber challenges.

81% of healthcare organizations believe that integrating cybersecurity into the core business strategy is effective in improving operational efficiencies to deliver better outcomes.

73% of the study's cohort of "Secure Creators" (organizations with more advanced cybersecurity functions than their peers) believe their ability to add value will grow in the future.

23% of study respondents completed a technology rationalization effort in the last two years.

Cybersecurity contributes 11% to 20% in value to each enterprise-wide strategic initiative it is involved in.

41% of respondents are undertaking a technology rationalization effort.

Only 13% of CISOs in the study said they were consulted early when urgent strategic decisions were being made.

41% of respondents are in the process of simplifying their tech platform.

"Secure Creators" (organizations with more advanced cybersecurity functions than their peers) require smaller budgets — 10% smaller on average — and are less likely to cite budgets as a key challenge.

74% of respondents reported they invested savings from optimization, automation, and outsourcing to address control weakness.

46% of respondents used savings from optimization, automation, and outsourcing to increase coverage of the attack surface.

"Secure Creators" (organizations with more advanced cybersecurity functions than their peers) were more likely to have positively impacted how external stakeholders perceive their brand (72% vs. 56% of Prone Enterprises).

For each initiative that involves cybersecurity, the median value creation figure is US$36m. This figure varies significantly by organization size, ranging from a median of US$11m per project for organizations with US$1b-US$4.9b in revenue, up to US$154m for companies with US$20b or more in annual revenue6.

"Secure Creators" (organizations with more advanced cybersecurity functions than their peers) were more likely to help other business functions implement AI than "Prone Enterprises" (48% vs. 31%).

"Secure Creators" (organizations with more advanced cybersecurity functions than their peers) were more involved in efforts to improve customer experience than their peers (53% vs. 42%).

The study found that cybersecurity simplification and automation have led to direct cost savings, with a median US$1.7m saved annually.

Cybersecurity contributes 11% to 20% in value to each enterprise-wide strategic initiative it is involved in.