Research from ISACA shows that 35% of European organizations cannot determine whether they have been targeted by an AI-driven cyberattack. Furthermore, 71% struggle to detect AI-powered phishing and social engineering attacks.
According to the latest AI Pulse Poll from ISACA, the gap is growing between the speed of AI-driven threats and the ability of organizations to recognize and manage these risks. Half of the surveyed professionals see misinformation and disinformation as the greatest AI risks, followed by privacy violations and social engineering.
AI does not only play a role in cybercrime but is also being deployed defensively. For instance, 43% indicate that AI has improved the detection of and response to cyber threats, while 34% specifically use it to strengthen cybersecurity.
AI adoption without sufficient oversight
68% of European organizations allow AI use, and 74% allow generative AI. The most common applications are creating written content, increasing productivity, and automating repetitive tasks. Yet, only 42% have a formal, comprehensive AI policy, and 33% do not require employees to disclose when AI has been used in their work. 37% of respondents say they do not know if an AI policy is under development within their company.
This lack of governance creates blind spots. For example, 87% of professionals are concerned about unauthorized AI use by employees, and 26% see the lack of trust in the protection of intellectual property and sensitive information as the biggest challenge.
Nevertheless, AI is on its way to becoming an indispensable part of the workload. 75% state that AI illiteracy is no longer an option and that AI skills are extremely important in their profession. Only 40% of companies train their employees on AI. AI adoption is rising faster than AI readiness. Still, 7 out of 10 employees say their responsibilities have not yet changed or increased due to AI compared to last year.
Training and regulation as the key
More than half of professionals do not feel sufficiently trained to manage AI risks. For instance, 54% need additional training within six months, and 79% within a year. Yet, 21% of organizations still do not offer any formal AI training. Risks range from misinformation and disinformation (87%) to privacy violations (75%) and an increasing skills gap (41%).
The European AI Act is the most frequently mentioned governance framework at 45%, but 26% of organizations still do not follow any framework at all. According to Chris Dimitriadis, Chief Global Strategy Officer at ISACA, it is crucial to invest now in the necessary expertise to adequately manage AI risks.