Dive Brief:

• Too many organizations have gaps in their risk management and governance programs that leave them exposed to cyberattacks and other incidents with regulatory and reputational consequences, the advisory and auditing firm Grant Thornton warned in a report published on Tuesday.
• Two-thirds of business leaders told Grant Thornton that they were trying to make enterprise risk management a top priority, but fewer than half said their organizations approached risk management consistently.
• The report recommended several ways for organizations to maintain a clear picture of risks and a reliable plan for responding to them.

Dive Insight:

Roughly three-quarters of the 1,100 business leaders interviewed for the report said cybersecurity incidents were one of the biggest risks to their firms’ performance over the next two years. But barely half of leaders said they were highly confident in their organization’s ability to identify a sophisticated cyberattack when one struck.

Data quality and visibility is the biggest hindrance to organizations’ cyber resilience, Grant Thornton found, with 65% of respondents raising it as a concern. Other major challenges include technological limitations (62%), network complexity (62%) and supply-chain dependencies (58%).

Suppliers are “becoming an important source of defensive capability,” according to Grant Thornton. With businesses struggling to hire cybersecurity experts, third-party security firms are filling the resulting gap. “Virtually all (96%) of our survey respondents said their organizations are using some level of outsourced capabilities for cybersecurity threat detection and response,” Grant Thornton said in its report.

At the same time, linkages between vendors and internal systems are scattershot, perhaps reflecting concerns about risk exposure but possibly also indicating an immaturity in some customer-vendor relationships. Only one-quarter of business leaders told Grant Thornton that their third-party cybersecurity providers are “integrated with internal processes, using automation and shared tooling.”

AI figures heavily into organizations’ risk evaluations, but many firms still lack the processes and technology to adequately oversee sprawling AI deployments. Only 26% of business leaders said their organizations had “advanced, integrated AI governance with data-driven monitoring,” Grant Thornton said. Nearly six in 10 respondents said their company’s use of AI and their limited ability to govern it represented “a top source of future risk or regulatory scrutiny.”

AI-enabled fraud is growing as a source of business risk, with 55% of leaders citing it as a major fraud concern, although traditional phishing and other forms of cyber-enabled fraud still worried more respondents.

To close visibility gaps and strengthen oversight of new and potentially vulnerable technology, businesses need a unified “risk intelligence” perspective, Grant Thornton said.

“Cybersecurity, compliance, forensics and internal audit need a shared view of risk and data,” the company’s report said. “Establish common definitions, standardized data and clear ownership so leaders can see how exposures connect and use that understanding to guide strategy and investment.”

Grant Thornton also encouraged firms to use AI for automated monitoring, saying “periodic reviews are not fast enough to meet the challenges posed by AI-powered threats.”