Cybersecurity

The Cybersecurity Questions Leaders Are Facing Today

• How should CEOs respond to AI-powered cyberattacks?

  CEOs should respond to AI-powered cyberattacks by investing in cybersecurity fundamentals: access controls, network segmentation, automated patching, zero-trust architecture, and anomaly detection.

  This approach works because AI hasn’t created new vulnerabilities—instead, chronic underinvestment in cybersecurity has left deep weaknesses that AI-powered attacks can now find and exploit at machine speed. But most organizations plan budget increases of only around 10% annually, well short of what the threat demands.

  The most effective leadership actions are to:

  • establish a dedicated AI threat war room to probe the organization’s own systems using the same tools attackers use;
  • prioritize fundamental cybersecurity concerns, which already provide meaningful protection against AI-powered attacks;
  • address urgent risks to operational technology (OT) environments; and
  • prepare for post-quantum computing with a clear risk assessment and roadmap.

   

  Well-hardened organizations are materially more difficult targets for autonomous attacks, even for the most sophisticated AI models.

• How do we ensure our increasing cybersecurity spending reduces our actual exposure?

  Rising cybersecurity budgets don't automatically shrink risk; spending reduces exposure only when it fixes the foundational weaknesses attackers actually exploit.

  Most organizations got here the same way: years of boards and executives treating cybersecurity as a technology problem to hand down. That leaves structural gaps in identity and access management, network segmentation, patching, and anomaly detection—the same controls that decide whether an intruder can move laterally and steal data.

  Based on our experience, many large organizations will need to increase spending by up to two times their current levels or even more. But investing in six tactical priorities can meaningfully deepen an organization’s defenses.

  1. Automated patching identifies and remediates known vulnerabilities at the speed the threat demands.
  2. Zero trust architecture—continuous verification of every user, device, and system—gives AI-enabled attackers far less room to maneuver if they gain a foothold.
  3. Anomaly detection identifies unusual behavioral patterns rather than known signatures, a critical defense layer against AI-powered attacks that frequently arrive without a known identity or signature.
  4. Modernizing identity controls, including phishing-resistant multifactor authentication, limits the blast radius of a breach.
  5. Reducing legacy technical debt removes attack targets that can’t support modern security standards.
  6. Addressing supply chain risk matters because a well-defended enterprise can still be compromised through a poorly defended partner, making AI-specific cybersecurity posture a core component of supplier due diligence and third-party risk monitoring.
• How should we prepare for quantum computing cybersecurity threats?

  To prepare for quantum computing cybersecurity threats, companies can address four priorities:

  1. Map the organization’s full cryptographic exposure: every algorithm, protocol, and key in use, and the sensitivity of the data each protects.
  2. Adopt post-quantum cryptography with a hybrid approach that pairs a quantum-resistant algorithm with a classical one.
  3. Build in crypto-agility—the ability to swap cryptographic algorithms without disrupting the infrastructure or the business applications running on top of it.
  4. Make quantum readiness a key criterion in vendor procurement and third-party risk reviews.

   

  Roughly 71% of executives expect quantum-enabled attacks within five years, and nearly a third within three. With the shift to protected systems potentially taking five years or more, the time to act is now. Once powerful enough, quantum attacks could break the asymmetric protocols behind financial transactions, communications, and corporate systems, including Rivest-Shamir-Adleman, Diffie-Hellman, and elliptic-curve cryptography.

  Despite the imminent threat, just 10% of companies have a funded roadmap backed by leadership to address quantum risk, and only 38% maintain a comprehensive inventory of cryptographic standards across their environments. Companies heavy with legacy infrastructure are especially exposed to attacks, and any further delay is likely to drive up costs.