This year’s PwC Global Digital Trust Insights survey shows cyber risk being reshaped by geopolitical volatility, rapid advances in AI, and exposure that travels through interconnected ecosystems. These forces upend long-held assumptions about cyber security and what it takes for organisations to be resilient the report found.
Organisations are increasing cyber investment, particularly in AI and cloud, but foundational gaps in data protection, operational continuity and cyber risk management remain.
When PwC asked the question of its global clients, “over the next 12 months, which of the following cyber threat is your organisation least prepared to address?”, the Asset & Wealth management sector gave a much higher response to “attacks targeting AI systems” as shown below:
Over the next 12 months, which of the following cyber threats is your organisation least prepared to address?

Source: PwC 2027 Global Digital Trust Insights
This playbook sets out practical priorities leaders can act on to strengthen cyber foundations and help build an intelligent enterprise—one where strategy, technology and operations work in synchronisation, security is built in and trusted data supports smarter, faster decisions.
Strengthen cyber governance, accountability, and risk decision-making
Cyber risk may have a seat at the leadership table, but it’s not yet consistently embedded in how organisations make decisions. Stronger governance requires clear accountability and leaders should be equipped with meaningful information to weigh risk alongside business priorities.
Strengthen the foundations
- CEO: Put cyber risk on every leadership and board meeting agenda and make it a regular part of strategic and operating discussions. Make cyber security a shared C-suite responsibility with clear accountability for cyber risk beyond the CISO.
- CISO/CSO: Make cyber risk a shared business responsibility by establishing governance that creates clear C-suite and board accountability and turns technical signals into business-focused reporting. CRO: Integrate cyber risk into enterprise risk management so it’s evaluated alongside financial, operational and strategic risks.
- CFO: Quantify cyber risk in financial terms to inform investment decisions, risk appetite and enterprise planning.
- Chief data officer/chief digital officer/chief AI officer: Define enterprise capabilities and control objectives for how data is securely created, transformed, stored, accessed, and consumed.
Make your enterprise smarter
- CEO: Embed cyber insights into enterprise decision-making so leaders can anticipate change and prioritise risk.
- CRO: Connect cyber intelligence with enterprise risk, operational data and financial data to give leaders a more complete view of changing exposure.
- CFO: Connect financial, operational and risk data to give leaders a clearer view of investment priorities and enterprise exposure.
- CISO/CSO: Translate cyber risk insights into business-focused reporting so enterprise leaders can factor exposure, readiness and resilience into strategic and operational decisions.
- Chief data officer/chief digital officer/chief AI officer: Lead the shift from governance as bureaucracy to strategic enabler, with clearly defined semantics, lineage and controls that enable safe, autonomous AI actions.
Protect critical operations and build cyber resilience
Cyber resilience is ultimately tested by whether the business can operate through disruption. Continuity planning needs to move from a preparedness exercise to an integrated enterprise capability. Start by defining your minimum viable company – the smallest set of capabilities needed to keep your organisation operating through disruption – then build and test recovery plans around the technology and third parties that support it.
Strengthen the foundations
- CISO/CSO: Maintain visibility across critical assets, operational technology (OT) environments, third-party access paths and legacy systems so teams can see where disruption could reach high-value operations and create strong perimeters between IT and OT networks to prevent cross-contamination and lateral threat movement.
- COO: Embed cyber security into operational resilience, business continuity and crisis management so the organisation can recover quickly when disruption occurs. Map critical business services, sites, suppliers, workforce dependencies and technology services – including their cyber risk exposure – that support customer delivery, safety, revenue continuity and regulatory commitments.
- CRO: Stress-test operational resilience using cyber scenarios that challenge critical business services, dependencies and recovery assumptions.
- CFO: Improve resilience of financial operations by identifying critical processes, dependencies, and recovery requirements.
- CEO: Insist on continuity planning so the business is prepared to operate and recover when cyber disruption occurs.
Make your enterprise smarter
- COO: Secure intelligent workflows that bring AI, data and human decision-making together while limiting operational exposure. Define human oversight, exception handling and manual fallbacks for automated decisions that affect customers, employees, transactions or critical services.
- CRO: Model interconnected cyber scenarios to understand how disruption could cascade across operations, technology, suppliers, and markets.
- CEO: Build adaptive operations that evolve with new threats, technologies and business priorities.
- CISO/CSO: Use AI and automation to unify security signals, detect threats faster, reduce manual effort and help teams respond at machine speed.
Secure data, AI and emerging technology
AI trustworthiness depends heavily on the underlying data, but data protection remains a persistent gap. This gap matters more as organisations expand their use of AI for cyber defence and consider giving AI agents greater autonomy. Building trust in AI starts with a foundation that can be trusted.
Strengthen the foundations
- CISO/CSO: Protect critical and sensitive data with consistent discovery, classification, access controls and monitoring across the enterprise.
- CTO/CIO: Protect data across the technology estate through consistent controls, access management and continuous monitoring.
- Chief data officer/chief digital officer/chief AI officer: Map critical data flows across the organisation, focusing on high-value, high-velocity and highly sensitive data in coordination with the CISO. Establish privacy controls that scale with AI adoption, including consent management, data minimisation, and privacy-by-design.
- CFO: Prioritise data quality for financial disclosures, regulatory reporting, and executive KPIs.
- CRO: Map data risks across the business processes, reports and KPIs that matter most.
Make your enterprise smarter
- CISO/CSO: Secure AI data pipelines and model environments by applying human and non-human access controls, monitoring, privacy safeguards, and security requirements in partnership with data, digital, and AI leaders.
- CTO/CIO: Build responsible AI into delivery so governance, security, and risk controls scale alongside AI adoption.
- CEO: Set expectations for trusted AI adoption with clear ownership, governance, and accountability for managing AI-related risk.
- CFO: Measure AI value alongside AI risk so investment decisions account for expected returns, exposure, and cost of controls.
- Chief data officer/chief digital officer/chief AI officer: Govern AI training data to verify that it is curated and ethically sourced, with AI pipelines accessing enterprise data products and model outputs feeding back into secure, governed environments. Build explainability into AI systems so risk, compliance, and business leaders can audit decision logic, investigate errors, and respond to regulatory inquiries.
Use trusted technology and data to create enterprise value
Cybersecurity can do more than protect enterprise value—it can help create it. As organisations modernise technology and invest in AI, cloud, and data, security should be considered alongside business value from the start. The goal is an enterprise that can innovate and grow with confidence.
Strengthen the foundations
- CTO/CIO: Modernise legacy technology that creates security exposure, limits visibility or slows the organisation’s ability to respond to change.
- CFO: Prioritise cyber investments.
- CEO: Reframe cyber security as a strategic capability tied to enterprise growth, innovation, resilience and competitive position.
- Chief data officer/chief digital officer/chief AI officer: Verify the organisation has the right talent to execute at scale, including expertise in data modelling, data engineering, data architecture, data security, and data risk management.
Make your enterprise smarter
- CTO/CIO: Build the technology foundation for AI at scale by modernising cloud, data, applications, and architecture around connected enterprise needs. Move AI beyond isolated use cases by designing platforms and workflows that connect AI to business processes and decisions.
- CFO: Invest in trusted data foundations that support reliable AI, financial reporting and faster enterprise decision-making.
- Chief data officer/chief digital officer/chief AI officer: Build data products abstracted from applications and designed for enterprise-wide reuse, providing curated, governed, and well-documented assets. Enable self-service data delivery so business users, analysts and product teams can find and consume data through controlled, governed APIs.
Other considerations
Manage ecosystem, third-party, and technology concentration risk
Cyber risk travels across the enterprise ecosystem. Cloud providers, technology platforms, suppliers, and other third parties can turn a vulnerability or disruption elsewhere into a business risk. Resilience depends on understanding those dependencies and where concentrations of risk could amplify impact.
Build the model for human-and-agent operations
The intelligent enterprise will depend on people and AI agents working together through secure platforms, trusted data, and clearly governed workflows. Leaders should pair new capabilities with human accountability, workforce development, and controls that preserve quality, resilience, and trust as autonomy increases.
Explore the full PwC 2027 Global Digital Trust Insights: Australian findings here.