AI Vulnerabilities Now The Fastest-Growing Cyber Risk

Artificial intelligence vulnerabilities were the fastest-growing cyber risk of 2025, according to 87 per cent of executives surveyed for the World Economic Forum’s Global Cybersecurity Outlook 2026, published with Accenture.

The figure places AI ahead of cyber-enabled fraud and phishing at 77 per cent, supply chain disruption at 65 per cent, exploitation of software vulnerabilities at 58 per cent and ransomware at 54 per cent.

Looking forward, 94 per cent of respondents expect AI and machine learning to be the technology that most significantly affects cybersecurity over the next twelve months, ahead of cloud at 61 per cent and quantum technologies at 37 per cent.

Sub-Saharan Africa recorded the highest exposure to cyber-enabled fraud of any region. Some 82 per cent of respondents there said they or someone in their professional or personal network had been affected by such fraud in the past twelve months, ahead of North America at 79 per cent and Latin America and the Caribbean and South Asia at 77 per cent. The global figure was 73 per cent.

The Global Cybersecurity Outlook 2026 is the fifth annual edition of the report, produced by the World Economic Forum in collaboration with Accenture and published in January. It draws on a survey conducted between 25 August and 1 October 2025, which returned 873 responses from 99 countries, normalised to 804 qualified participants from 92 countries, including 316 chief information security officers, 105 chief executives and 123 other C-suite respondents.

Assessment of AI tools nearly doubles

The Global Cybersecurity Outlook 2026 found that the share of organisations running a process to assess the security of AI tools before deploying them rose from 37 per cent in 2025 to 64 per cent in 2026.

Within that total, 40 per cent conduct periodic reviews, 24 per cent assess once, 7 per cent do not know and 29 per cent have no process in place.

Adoption of AI in defence is more widespread than its governance. Some 77 per cent of organisations have deployed AI-enabled security tools, most commonly for phishing and email threat detection at 52 per cent, intrusion and anomaly response at 46 per cent, automating security operations at 43 per cent, user-behaviour analytics at 40 per cent and threat intelligence at 39 per cent.

The leading barrier to wider adoption is insufficient knowledge or skills, cited by 54 per cent, ahead of the need to validate AI-generated responses at 41 per cent, uncertainty about risk at 39 per cent and insufficient funds at 36 per cent.

Concerns about generative AI have shifted. Data leaks are now the leading worry at 34 per cent, up from 22 per cent a year earlier, while the advancement of adversarial capabilities fell from 47 per cent to 29 per cent.

Boardroom and security desk diverge

In the Forum’s survey, chief executives and chief information security officers no longer share the same top concern.

Chief executives now rank cyber-enabled fraud and phishing first, AI vulnerabilities second and exploitation of software vulnerabilities third. In 2025 their leading concern was ransomware. Security chiefs still rank ransomware first, followed by supply chain disruption and software exploitation.

Confidence in national defences falls

Some 64 per cent of organisations surveyed now factor geopolitically motivated cyberattacks into their risk mitigation strategy, the most frequently cited consideration, followed by disinformation at 49 per cent and the convergence of IT, operational technology, internet-of-things and robotics at 42 per cent.

Confidence in national preparedness declined over the year. Across all respondents, 37 per cent expressed confidence in their country’s ability to respond to a major cyber incident targeting critical infrastructure, down from 42 per cent, while those not confident rose from 26 per cent to 31 per cent.

Confidence varied widely by region, from 84 per cent in the Middle East and North Africa to 13 per cent in Latin America and the Caribbean. Sub-Saharan Africa recorded 37 per cent confident and 39 per cent not confident.

Resilience and skills

The report found that organisations reporting insufficient cyber resilience fell globally from 22 per cent to 17 per cent, while those saying their resilience exceeds requirements rose from 9 per cent to 19 per cent.

The regional spread remains wide. Sub-Saharan Africa recorded the lowest share exceeding requirements, at 8 per cent, and the highest reporting insufficient resilience, at 32 per cent. The Middle East and North Africa led on both measures.

Skills shortages track the same pattern. Some 63 per cent of respondents in sub-Saharan Africa reported missing critical people and skills, second only to Latin America and the Caribbean at 65 per cent. Among chief executives in the region the figure was 70 per cent, the highest recorded. The roles in shortest supply globally are threat intelligence analysts, DevSecOps engineers, and identity and access management specialists.

Third-party and supply chain vulnerabilities were named as the greatest barrier to resilience by 65 per cent of large companies by revenue, up from 54 per cent a year earlier. While 66 per cent of organisations assess the security maturity of their suppliers, only 27 per cent simulate incidents or run recovery exercises with ecosystem partners.

Costs

The report cites United Kingdom government research placing the average cost of a significant cyberattack on a business at about £195,000, roughly $250,000, and World Bank analysis indicating that reducing major cyber incidents could raise GDP per capita in developing economies by 1.5 per cent.

Its principal case study is the August 2025 attack on Jaguar Land Rover, which halted global production for five weeks, affected more than 5,000 suppliers and produced £196 million, about $260 million, in direct cyber-related costs. The wider UK economy absorbed an estimated £1.9 billion, around $2.5 billion, in losses, and the UK government extended a £1.5 billion loan guarantee to stabilise the supply chain.

On enforcement, the report records INTERPOL’s Operation Serengeti 2.0, coordinated with 18 African countries and the United Kingdom, which produced 1,209 arrests and the recovery of $97.4 million.