Businesses double down on AI security as 64% now assess risks before deployment

Organizations Nearly Double AI Security Assessments

The landscape of AI security has shifted dramatically as organizations worldwide recognize the urgency of protecting their AI deployments. According to the World Economic Forum Global Cybersecurity Outlook 2026, published in collaboration with Accenture ahead of the annual Davos meeting, nearly two-thirds (64%) of business leaders now assess AI security risks before deploying tools 1

1

. This figure represents a steep rise from last year's 37%, underscoring how rapidly assessing risks before AI tool deployment has become a priority 2

2

.

The urgency stems from widespread recognition that AI vulnerabilities pose mounting threats. An overwhelming 94% of respondents identified AI as primary driver of cybersecurity change in 2026, while 87% believe that increased AI vulnerabilities have escalated beyond any other type of threat 1

1

. This marks a stark contrast to May 2025, when not a single security professional at the NCSC's annual conference could claim a strong grasp of their organization's AI system security.

Data Leaks and Leadership Concerns Drive Action

For CEOs, data leaks have emerged as the most pressing concern, with 34% citing them as their top AI-related worry 2

2

. The technical security of AI systems saw the biggest increase in concern, jumping from 5% in 2025 to 13% in 2026. Meanwhile, phishing and social engineering remain the number-one concern for chief executives when considering cyber-enabled fraud, followed closely by AI vulnerabilities and software vulnerability exploitations 1

1

.

Interestingly, CISOs maintain different priorities than their CEO counterparts. Ransomware remains the prime fear for security chiefs, with supply chain disruptions holding the second position on their nightmare lists 1

1

. Both ransomware and supply chain attacks dropped out of CEOs' top three concerns in 2026, despite ranking first and third respectively in 2025. This divergence highlights the varying perspectives within the C-suite regarding immediate versus systemic threats.

Geopolitics Reshapes Cybersecurity Strategies

Geopolitics has emerged as a dominant force shaping organizational cyber risk strategies, with 64% of organizations reporting that geopolitically motivated attacks play the biggest role in their security planning—topping the list for consecutive years 1

1

. The impact varies significantly by organization size: 91% of companies with more than 100,000 employees adjust their security plans due to geopolitical factors, compared to just 59% of those with fewer than 1,000 staffers.

This heightened awareness of data sovereignty concerns has prompted many European organizations to consider local cloud providers, according to Gartner surveys of CIOs and IT leaders 1

1

. With major events like the FIFA World Cup approaching, US organizations are preparing for politically-motivated cyberattacks, particularly given Russia's history of targeting major sporting events.

AI Adoption for Defense Despite Skill Gaps

Despite concerns about AI vulnerabilities, three-quarters (77%) of organizations now deploy AI for cybersecurity purposes 2

2

. The most common applications include phishing detection (52%), intrusion detection (46%), and automating security operations (43%). However, significant barriers remain: skill gaps affect 54% of organizations, the need for human validation concerns 41%, and uncertainty about risks troubles 39%.

Looking ahead, the WEF anticipates that highly convincing phishing, deepfake scams, and automated social engineering will become the biggest AI-enabled threats 2

2

. Prompt injections were particularly prevalent throughout last year, while AI code assistants were observed making expert developers less effective.

Cyber Resilience Remains the Foundation

While 64% of respondents claim they meet minimum requirements for cyber resilience, only 19% believe they exceed baseline standards 1

1

. Major attacks on companies like JLR and M&S, which resulted in extensive and costly downtime, illustrate the ongoing challenges organizations face in minimizing cyberattack impacts. The emphasis on cyber resilience—an organization's ability to minimize damage when systems are penetrated—continues to be reinforced by national security authorities as the key to preventing worst-case scenarios.