Only 22% of security leaders would authorize fully autonomous AI cyberdefense, even as 84% of surveyed leaders anticipate larger cybersecurity budgets.
By Holt Hackney
Companies are preparing to spend more on cybersecurity as artificial intelligence creates new threats and opportunities, but a new global survey suggests executives remain reluctant to give autonomous AI systems full control over their defenses.
According to PwC’s 2027 Global Digital Trust Insights Survey, released Oct. 1, 84% of surveyed security and finance leaders expect their cybersecurity budgets to increase over the next 12 months, compared with 78% last year.
Yet only 22% of security leaders would authorize fully autonomous execution by AI agents for cyberdefense, reflecting concerns about the reliability, accountability and oversight of increasingly sophisticated systems.
The findings, based on responses from 3,934 business and technology executives across 71 countries and territories, highlight a growing challenge for enterprise architects and technology executives: how to incorporate AI into critical business systems without surrendering control over decisions that could have significant operational consequences.
AI Investment Outpaces Confidence
Nearly three in five security leaders, or 58%, identified AI among their leading cybersecurity budget priorities for the coming year.
At the same time, half of security leaders ranked attacks targeting AI systems among the cyber threats their organizations were least prepared to address. That exceeded concerns about cloud-related threats, cited by 40%, third-party breaches at 34% and ransomware at 33%.
The survey also identified several emerging threats associated with AI-enabled attacks.
Among security and risk leaders, 53% identified compromise by autonomous botnets as a threat they were among the least prepared to address, while 52% cited adversarial attacks and an equal percentage identified data poisoning.
These concerns are emerging as organizations explore using AI for their own defensive operations.
Half of security leaders identified threat detection and alerting as a priority application for AI in cyberdefense, while 42% prioritized phishing detection and response.
However, enthusiasm for AI-assisted cybersecurity has not translated into comparable support for allowing agents to operate independently.
More than half of respondents, 55%, identified AI reliability and technological maturity among their three greatest barriers to increasing agent autonomy in security operations. Another 46% cited accountability and explainability in AI decision-making.
Among chief information security officers, 44% identified workforce skills in AI oversight and governance as a leading obstacle.
Governance Remains a Weak Point
The findings suggest that organizations are still developing the governance structures needed to support increasingly autonomous technology.
Only 39% of surveyed security, risk and operations leaders reported having fully formalized and integrated operational continuity plans specifically addressing cyber risks.
Companies also reported implementing an average of just three of seven key data-risk measures examined in the survey. Only 5% had fully implemented all seven measures, down from 7% the previous year.
Meanwhile, one-third of surveyed CEOs and security and risk leaders said their organizations had established dedicated AI leadership roles, such as chief AI officers or AI boards.
Despite those developments, only 47% strongly agreed that cybersecurity risk was a standing item on their boards’ agendas. An even smaller share, 45%, said it was regularly addressed at executive leadership meetings.
The results raise questions about whether corporate governance practices are keeping pace with the technological capabilities organizations are introducing.
For enterprise architects, the findings underscore the importance of designing systems in which AI decision-making operates within clearly defined authorization boundaries.
Such an approach can involve separating an AI agent’s ability to recommend or initiate actions from its authority to execute them, while incorporating human approval, monitoring and auditability into enterprise workflows.
Resilience Becomes an Architectural Priority
The research also indicates that organizations are reconsidering how their technology environments are structured to withstand disruptions.
More than half of security and risk leaders, 54%, reported adopting multicloud or hybrid cloud strategies. Another 47% were strengthening regional data and technology redundancy, while 37% were localizing infrastructure within specific jurisdictions.
Half said they were changing vendor, third-party and supply chain risk management practices in response to geopolitical developments.
These measures reflect concerns extending beyond individual cyberattacks to the resilience of interconnected technology systems.
PwC identified stronger governance, protection of critical operations, management of technology concentration risks and more effective use of AI agents among the priorities for organizations seeking to improve cyber resilience.
The broader implication is that increasing cybersecurity investment alone may not resolve the challenges created by autonomous AI.
Organizations must also determine how AI systems are governed, which decisions require human intervention and how responsibility is assigned when automated actions produce unintended results.
For enterprise architects, that creates a potentially expanded role in establishing the controls, dependencies and governance structures supporting AI-enabled operations.
PwC’s findings suggest that while organizations increasingly recognize AI’s defensive potential, confidence in autonomous execution remains limited.
The challenge ahead may be less about whether AI can perform cybersecurity tasks and more about whether enterprises can establish the architectural safeguards needed to trust it.