A confidence gap hiding inside a priority
Grant Thornton's new cyber and risk survey, drawn from roughly 1,100 business leaders, finds the usual split between stated intent and operational reality. Two thirds of respondents say they are trying to make enterprise risk management a top priority, which is the easy part of the answer to give. Fewer than half say their organization actually approaches risk management consistently across the business, which is the part that determines whether a real incident gets caught early or discovered late.
Roughly three quarters consider cybersecurity incidents among the biggest risks to their firm's performance over the next two years, yet barely half are highly confident they could identify a sophisticated attack when one occurs. That gap between perceived risk and actual detection confidence is where budget conversations tend to go wrong, because boards fund the priority they hear about without checking whether the underlying capability matches the concern being expressed in the same meeting.
The number that should worry every CIO signing off on an AI rollout
Buried inside the broader cyber findings is a specific AI governance statistic that deserves its own headline. Only 26 percent of surveyed organizations report having advanced, integrated AI governance with data driven monitoring, the kind that can actually flag a problem as it develops rather than during a scheduled review. Nearly six in ten say their AI use, paired with limited ability to govern it, is now a top source of future risk or regulatory scrutiny.
Those two numbers describe the same organization from two angles: aware of the exposure, still lacking the monitoring to catch it in time. That is a more dangerous position than outright AI avoidance, because the deployment is already live and generating risk while the governance to watch it is still being built. Any CIO who greenlit an agentic workflow this year without a comparable monitoring layer already in place is running the exact gap this survey measured.
Outsourcing detection without integrating it
Grant Thornton describes suppliers as becoming an important source of defensive capability, and the numbers back that framing: 96 percent of respondents use some level of outsourced capability for threat detection and response. That is close to universal reliance on third parties for one of the most consequential functions a security organization performs, a level of dependence that would have seemed aggressive five years ago and now reads as the industry default almost everyone has quietly settled into without much debate.
The integration behind that reliance tells a less reassuring story. Only about a quarter of respondents say third party providers are tightly integrated with internal processes, automation, and shared tooling. The other three quarters are paying for detection capability that sits next to their internal systems rather than inside them, which means alerts, context, and response time all pass through a handoff that was never built for how fast an AI enabled attack actually moves through a network. Every manual handoff in that chain is a delay an automated attacker does not have to wait through, and most contracts with these providers were negotiated before that asymmetry was obvious to anyone writing the terms.
Data quality is the obstacle underneath every other obstacle
When Grant Thornton asked what actually blocks cyber resilience, data quality and visibility topped the list at 65 percent, ahead of technology limitations, network complexity, and supply chain dependencies combined. That ranking matters because it points away from the usual budget request that lands on a CIO's desk after a close call. Most security pitches that follow an incident ask for more tooling, another dashboard, another detection layer stacked on top of what already exists. The survey results say the tooling was rarely the actual bottleneck in the first place.
A monitoring platform fed inconsistent or incomplete data will miss the same threats a cheaper platform would, no matter how much the license costs or how good the vendor's demo looked in the boardroom. Before approving another detection tool purchase, it is worth asking whether the data feeding every existing tool is clean, current, and visible across the teams that actually need it day to day, because that question tends to get skipped in favor of comparing vendor feature lists line by line instead.
AI enabled fraud arrives alongside the old kind
AI enabled fraud concerns 55 percent of leaders surveyed, a majority on its own, while traditional phishing and other cyber enabled fraud still ranks as the bigger worry overall among the same respondents. That ordering suggests AI fraud is climbing fast toward the threats security teams already know how to fight, close enough now to demand the same monitoring discipline rather than waiting for it to become the top concern on its own before building a response.
Treating AI fraud as a distinct category with its own tooling and its own team risks recreating the exact silo problem the rest of this survey describes in detail. The more durable answer is extending existing fraud and risk monitoring to cover AI generated attempts specifically, using the same data visibility work the survey already flags as the top organizational priority, rather than standing up a parallel function that competes for the same scarce analyst attention and the same already stretched budget line.
What a unified risk view actually requires
Grant Thornton's core recommendation is a unified risk intelligence perspective, with shared risk data and clear ownership spanning cybersecurity, compliance, forensics, and internal audit rather than four separate functions each keeping their own records. The firm also argues for automated, continuous monitoring, pointing out that periodic reviews, the quarterly or annual cadence most compliance functions still run on, are simply too slow for threats that adapt in real time using AI of their own.
That recommendation is an organizational redesign more than a technology purchase, and it will meet resistance from teams used to owning their own risk data and their own review cadence without outside interference. The CIOs who move first on this will be the ones willing to force that consolidation before a regulator or an incident forces it for them on worse terms and a tighter deadline. The 26 percent of organizations already running advanced, integrated AI governance are the proof that this consolidation is operationally achievable, not an abstract aspiration reserved for companies with unlimited budget and time.
