The state of business resilience
Organisations increasingly recognise that security, privacy and AI risks are connected. Far fewer have the visibility and accountability to manage them consistently together. This chapter explores the distance between an integrated ambition and operational reality.
Joining the dots for true resilience
Security, privacy and AI risks do not sit in neat silos. So, organisations still treating them as three separate domains risk being caught out. Fortunately, a growing number acknowledge this, even if they are still some way off from a unified approach to cyber resilience. Rectifying this should be a priority.
Two-thirds (66%) of security professionals we polled claim that cybersecurity is impossible without privacy, while three-quarters (74%) say they manage security, privacy and AI as one connected system. They’re right to draw these strands together.
Managing the three in isolation therefore increases the likelihood of blind spots appearing between them. It’s in these gaps where resilience breaks down. A better approach would be to connect the three so that each domain strengthens the others.
Consider an employee who posts sensitive customer information in a chatbot at work. It’s simultaneously a privacy risk, a possible security breach and a governance failure. Or an IT project to connect corporate systems to an open source AI model. That model could subsequently be found to contain software vulnerabilities (security risk), share data with third parties (privacy risk) and return hallucinated or biased answers (AI governance risk).
Managing the three in isolation therefore increases the likelihood of blind spots appearing between them. It’s in these gaps where resilience breaks down. A better approach would be to connect the three so that each domain strengthens the others.
To what extent do you agree: It’s no longer possible to have effective information security without robust data privacy practices
We’re not there yet
However, despite their enthusiasm for a unified approach to cyber resilience, our respondents have not yet delivered on their vision. Three-quarters (74%) claim to manage security, privacy and AI as one connected system. Yet only 13% say they hold a single, current view across security, privacy and AI, and only a fifth (19%) claim to have one line of accountability.
Still, they are making progress. Some 29% say security, privacy and AI risk share a common risk register, with controls mapped across frameworks. This is more common in larger organisations (32% at 250+ employees vs 24% under 100 employees). Larger organisations are also more likely to agree they manage security, privacy and AI as one connected system (77% vs 68%), but no more likely to say they actually run them as one system (27% vs 26%).
This isn’t just about reducing the visibility and control gaps in which risk thrives. It can also improve accountability. And it can minimise costly and time-consuming duplication of effort through shared evidence and a single system that’s mapped to multiple frameworks. Even better, it provides a stepping stone to a continuous approach to compliance and risk management where organisations are in a state of constant readiness.
How are security, privacy and AI risk managed in your organisation?
