PwC warns insurers face growing AI and third-party cyber threats

Cyber budgets are set to increase over the next year as organisations respond to emerging AI threats, according to security and finance leaders surveyed by PwC, but results suggest significant gaps in preparedness persist.

PwC’s 2027 Global Digital Trust Insights Survey found that 84% of respondents anticipate increased cyber spending, up from 78% last year, as businesses seek to strengthen their defences against an increasingly complex threat landscape.

The survey, which gathered responses from almost 4,000 business and technology executives across 71 countries and territories, revealed particular concerns within the insurance sector over AI-related attacks and third-party vulnerabilities.

Among insurance respondents, 51% identified attacks targeting AI systems as one of the threats they were least prepared to address, broadly in line with the global figure of 50%.

However, insurers expressed greater concern about third-party breaches, with 41% citing these as a key vulnerability compared with 34% globally. Third-party threats ranked second among insurance respondents, ahead of cloud-related threats at 40%.

Despite growing investment, the findings suggest organisations are struggling to keep pace with evolving cyber risks.

Almost two-thirds (58%) of security leaders ranked AI among their top cyber budget priorities for the coming year, yet only 39% of security, risk and operations leaders reported having a fully formalised and integrated operational continuity plan specifically addressing cyber risks.

Chris Mills, partner, risk advisory at PwC Bermuda, said: “Cybersecurity needs to be embedded in C-suite decision-making from the outset. The survey shows that many organisations remain underprepared for an increasingly complex and fast-changing cyber landscape. Organisations that strengthen cyber readiness today will be better equipped to adapt, innovate and compete with confidence.”

The survey also highlighted shortcomings in cyber governance, with fewer than half of respondents strongly agreeing that cyber risk was a standing agenda item at board level (47%) or at executive leadership meetings (45%).

Although one-third of CEOs and security and risk leaders said their organisations had established dedicated AI leadership roles, including a chief AI officer or AI board, implementation of broader data-risk controls remained limited.

On average, organisations had implemented just three of seven key data-risk measures, while only 5% had fully implemented all seven, down from 7% last year.

While AI is creating new vulnerabilities, it is also emerging as a critical tool for strengthening cyber defences.

Security leaders identified threat detection and alerting (50%) and phishing detection and response (42%) as priority areas for AI deployment.

However, just 22% said they would authorise fully autonomous AI agents to execute cyber defence activities, reflecting continued concerns about the reliability, accountability and oversight of emerging technologies.

More than half (55%) ranked the reliability and maturity of AI technology among their three biggest barriers to increasing agent autonomy, while 46% cited accountability and explainability in AI decision-making.

Workforce capabilities also remain a challenge, with 44% of chief information security officers identifying skills in AI oversight and governance as a major obstacle.

Anthony Fellowes, director, digital at PwC Bermuda said: “AI is reshaping both sides of the cyber equation. While it introduces new risks and broadens the attack surface, it also has the potential to significantly enhance how organisations defend themselves. The challenge is not whether to adopt AI, but how to do so in a way that builds confidence, strengthens security and delivers meaningful business outcomes.”

The findings also point to a growing emphasis on managing technology concentration and supply chain exposures, issues of particular relevance to insurers navigating interconnected digital ecosystems.

More than half (54%) of security and risk leaders said they were adopting multi-cloud or hybrid cloud strategies, while 47% were strengthening regional data and technology redundancy and 37% were localising infrastructure within specific jurisdictions.

Meanwhile, half of respondents were making changes to vendor, third-party and supply chain risk management in response to geopolitical developments.

Organisations are also increasingly turning to managed services to address shortages of specialist cyber and AI talent, with AI emerging as the leading focus area, cited by 53% of respondents.

PwC said organisations must strengthen cyber governance and accountability, protect critical operations, secure emerging technologies and address third-party and technology concentration risks to build resilience against increasingly sophisticated threats.

The findings underline the challenge facing insurers and other financial services businesses as they seek to harness AI’s potential while managing the additional exposures created by its rapid adoption.

Did you get value from this story? Sign up to our free newsletters and get stories like this sent straight to your inbox.