AI threats top cyber concern for Irish organisations

AI-related threats have become the top cyber concern for organisations in Ireland, according to EY Ireland, based on a survey of 161 cybersecurity professionals and senior leaders.

More than a third of respondents, 35%, said AI-related threats were their biggest cyber concern. That put AI ahead of employee-related concerns, cited by 14%, although that was up from 9% a year earlier.

Almost half, 47%, said rapid advances in AI and a heightened threat environment were making it harder to maintain control. The survey also found that 40% were anxious important aspects of cybersecurity could be overlooked, while 25% said the pressure was affecting their ability to perform at their best.

Cybersecurity spending has held up despite those pressures. A quarter of respondents reported an increase in cyber budgets over the previous six months, while the remaining 75% said spending was unchanged. None said their budget had fallen.

AI risks

The results suggest concern is shifting from human behaviour towards risks linked to AI systems and connected technology. Among those surveyed, 22% pointed to rogue or compromised AI models being used for hacking, while 13% cited unforeseen threats emerging from AI systems.

Some organisations are also redirecting spending to support AI adoption. Following incidents involving trusted or autonomous AI systems, 28% said they had moved part of their cybersecurity budget to support AI adoption, while 31% viewed cybersecurity as an enabler of safe AI adoption rather than only a defensive function.

Future spending plans reflect that shift. Five of the top six investment priorities identified in the research related directly to AI, led by AI governance, risk management and oversight at 41%, controls to prevent or contain rogue AI behaviour at 34%, and continuous security testing of AI systems at 30%.

Puneet Kukreja, Resilient Nation Leader and Head of Cyber Markets, EY Ireland, said: "The pervasive nature of AI means organisations are no longer facing isolated cyber risks. Instead, they are operating in highly connected environments where disruptions to cloud infrastructure, supply chains, geopolitics and critical infrastructure can have far-reaching consequences. AI may be giving rise to a new category of critical infrastructure in its own right as it evolves from software to infrastructure.

"Building a Resilient Nation starts with building resilient organisations. That means moving beyond plans alone and engineering resilience into how critical services are designed and operated, so they can continue to function under pressure.

"Our survey suggests Irish organisations do recognise the investment required to respond to this changing environment, with cyber budgets remaining resilient. The opportunity now is to make sure that investment supports prevention while also prioritising organisations' ability to maintain critical services and recover quickly when disruption occurs."

Resilience focus

Beyond cyber threats, the research points to broader concern about resilience as organisations depend more heavily on AI, digital services and third-party suppliers. Direct cyberattacks were named as the leading resilience risk for the coming year by 34% of respondents, followed by third-party supplier breaches at 31% and major outages caused by rogue AI at 25%.

Supply chain disruption stood out as a particular issue across sectors. It was cited as the leading geopolitical resilience concern by 78% of respondents in industry, advanced manufacturing and telecoms, 72% in government and infrastructure, 71% in consumer and retail, and 55% in life sciences and health.

Even so, only 12% of respondents said geopolitics had a significant impact on their resilience strategy. That suggests many organisations see operational exposure in supply chains without fully integrating geopolitical risk into cyber planning.

Carol Murphy, EY Ireland Head of Clients and Industries and Consulting Partner, said: "Irish organisations operate in increasingly complex and interconnected environments, which means interdependence and resilience need to be viewed as two sides of the same coin. As organisations become more reliant on AI, cloud infrastructure, third-party suppliers and other critical technologies, resilience can no longer be considered solely through a technology lens.

"Encouragingly, Irish organisations are continuing to invest and adapt. The next step is to understand which services are truly critical, what they depend on and how quickly they can be restored if disruption occurs. Resilient organisations ultimately contribute to a more resilient and competitive ecosystem and a Resilient Nation, giving businesses greater confidence to embrace AI and other emerging technologies while continuing to deliver the services their customers and communities rely on."

Service continuity

The survey also examined whether organisations believed they could keep essential services running after a serious cyber incident. While 85% said they were confident they could continue operating at an agreed minimum level after a major cyberattack, only 26% said they were very confident. A further 59% said they were somewhat confident, while 14% said they were not very or not at all confident.

A similar pattern emerged around AI-specific incidents. Almost nine in 10 respondents, 88%, said they were at least somewhat prepared to detect, contain and respond to a rogue trusted AI agent operating with authorised access, while 11% said they were not prepared.

On decision-making during an AI-related cyber crisis affecting their organisation or a critical third party, 86% expressed some confidence, while 14% said they were not confident.

Kukreja said: "In an environment where AI is accelerating the speed at which disruption can unfold, resilience will increasingly be measured not only by whether an organisation can prevent an incident, but by whether it can retain control, keep essential services running and recover with confidence when disruption occurs.

"Building towards a Resilient Nation should be our North Star, with resilient organisations, infrastructure and essential services providing the foundations for Ireland to withstand disruption and continue to operate with confidence."