AI threats top cyber concern for Irish organisations

AI-related threats are now the top cyber concern for organisations in Ireland, according to EY Ireland's latest Cyber Leaders Index, with 35% of respondents ranking them as their biggest worry.

The research, based on responses from 161 cybersecurity professionals and senior leaders, points to a shift in how organisations view cyber risk as they become more reliant on AI, digital services and external suppliers. Almost half of those surveyed, 47%, said rapid advances in AI and a more intense threat environment were making it harder to maintain control.

Cyber budgets have so far held up despite that pressure. A quarter of respondents said cybersecurity spending had increased over the past six months, while 75% said budgets were unchanged. None reported a reduction.

EY's findings suggest concern is moving away from traditional employee-related risks towards threats linked to AI systems and the wider technology environment. More than one in five respondents, 22%, pointed specifically to rogue or compromised AI models being used for hacking, while 13% cited unforeseen threats emerging from AI systems. Employee-related concerns were named by 14%, up from 9% a year earlier.

Changing priorities

That shift is also influencing how organisations spend and plan. Some 28% said they had moved part of their cybersecurity budget to support AI adoption after recent incidents involving trusted or autonomous AI systems. Nearly a third, 31%, now see cybersecurity as an enabler of safe AI adoption rather than only a defensive function.

Future spending priorities reflect that change. Five of the top six planned investment areas were directly linked to AI, led by AI governance, risk management and oversight at 41%. Controls to prevent or contain rogue AI behaviour were cited by 34%, while 30% pointed to continuous security testing of AI systems.

Puneet Kukreja, Resilient Nation Leader and Head of Cyber Markets, EY Ireland, said: "The pervasive nature of AI means that organisations are no longer facing isolated cyber risks. Instead, they are operating within highly connected environments where disruptions to cloud infrastructure, supply chains, geopolitics and critical infrastructure can have far-reaching consequences. AI may be giving rise to a new category of critical infrastructure in its own right as it evolves from software to infrastructure. Building a Resilient Nation starts with building resilient organisations. That means moving beyond plans alone and engineering resilience into how critical services are designed and operated, so they can continue to function under pressure. Positively, our survey suggests that Irish organisations do recognise the investment required to respond to this changing environment, with cyber budgets remaining resilient. The opportunity now is to make sure that investment supports prevention, while also prioritising organisations' ability to maintain critical services and recover quickly when disruption occurs."

Resilience risks

The survey also asked leaders where they see the main risks to resilience over the next year. Direct cyberattacks ranked first at 34%, followed by breaches at third-party suppliers at 31% and major outages caused by rogue AI at 25%.

Those findings underline how heavily organisations now depend on connected systems and outside providers. Supply chain disruption emerged as the leading geopolitical resilience concern across every sector covered by the survey, cited by 78% of respondents in industry, advanced manufacturing and telecoms, 72% in government and infrastructure, 71% in consumer and retail, and 55% in life sciences and health. Even so, only 12% of all respondents said geopolitics had a significant impact on their resilience strategy.

EY describes this build-up of vulnerabilities across technology, governance, operations and recovery as "resilience debt". The report argues that businesses need to focus less on recovery after failure and more on designing systems and services that can continue to function during disruption.

Confidence gap

Many organisations expressed confidence in their ability to keep operating during a major incident, but the figures also showed clear limits. While 85% said they were confident their organisation could continue operating at an agreed minimum level after a major cyberattack, only 26% said they were very confident. A further 59% said they were somewhat confident, while 14% said they were not very or not at all confident.

The results were similar for AI-specific incidents. Some 88% said they were at least somewhat prepared to detect, contain and respond to a rogue trusted AI agent operating with authorised access, while 11% said they were not prepared. On leadership decision-making during an AI-related cyber crisis affecting either the organisation or a critical third party, 86% expressed some confidence and 14% said they were not confident.

The growing demands on cyber leaders were another theme in the research. Almost half of respondents, 47%, said the threat environment and rapid advances in AI were making it harder to maintain control. Another 40% reported anxiety that important aspects of cybersecurity could be overlooked, and 25% said the pressure was affecting their ability to perform at their best.

Carol Murphy, Head of Clients and Industries and Consulting Partner, EY Ireland, said: "Irish organisations operate in increasingly complex and interconnected environments, meaning interdependence and resilience need to be viewed as two sides of the same coin. As organisations become more reliant on AI, cloud infrastructure, third-party suppliers and other critical technologies, resilience can no longer be considered solely through a technology lens. Encouragingly, Irish organisations are continuing to invest and adapt. The next step is to understand which services are truly critical, what they depend on, and how quickly they can be restored if disruption occurs. Resilient organisations ultimately contribute to a more resilient and competitive ecosystem and a Resilient Nation, giving businesses greater confidence to embrace AI and other emerging technologies while continuing to deliver the services their customers and communities rely on."

The role itself is expanding. More than one in five respondents, 21%, said increasingly powerful AI agents would lead to greater responsibility for AI governance, risk and compliance over the next six to 12 months. Others expect a broader remit spanning human-AI decision-making, enterprise-wide AI resilience and business continuity.

In a final warning on how organisations will be judged during future incidents, Kukreja said: "In an environment where AI is accelerating the speed at which disruption can unfold, resilience will increasingly be measured not only by whether an organisation can prevent an incident, but by whether it can retain control, keep essential services running and recover with confidence when disruption occurs. Building towards a Resilient Nation should be our North Star, with resilient organisations, infrastructure and essential services providing the foundations for Ireland to withstand disruption and continue to operate with confidence."