Your risks are connected. Your defenses are not.

Close the gaps attackers exploit

Cyber risk rarely comes from a single system or decision. Risks stretch across a connected environment of cloud platforms, data and third parties that can't be understood in isolation. A weakness in one area can quickly create exposure to another, making a coordinated view of risk essential for effective cyber resilience.

Some organizations are adapting. One healthcare CISO who responded to our survey said their organization’s cybersecurity decisions increasingly involve clinical and operational teams instead of solely being handled by IT.

Risk-based controls also need to incorporate third-party providers and cloud service platforms that operate outside the direct control of a business. Protection depends on understanding which systems, information and providers support critical operations and where visibility is incomplete.

At the same time, third parties are becoming an important source of defensive capability.

Just over half (52%) of leaders said cybersecurity talent and skills shortages are a main challenge their organization faces in building effective cybersecurity. Third-party partners can provide the support they need.

Virtually all (96%) of our survey respondents said their organizations are using some level of outsourced capabilities for cybersecurity threat detection and response. Yet only one in four said external cybersecurity providers are integrated with internal processes, using automation and shared tooling.

Third parties play a critical cybersecurity role

Q: Does your organization use outsourced capabilities for cybersecurity threats?

Source: Grant Thornton’s Cyber & Risk Survey, October 13, 2026, N=1,100

Like other third-party providers, though, cybersecurity partners need a well-defined role. Responsibilities for prevention, detection and response should be clearly defined across internal and external teams. Then the boundaries and connections should be tested through tabletop exercises before an incident occurs.

Protecting systems by controlling access

Q: Please select your top cyber investment priorities for the next 12 months. (Select up to 5).

Source: Grant Thornton’s Cyber & Risk Survey, October 13, 2026, N=1,100

Cybersecurity expenditures, meanwhile, should be tied to the likelihood of individual risks and their consequences. Business leaders in our survey selected identity and access management (IAM) as their top cyber investment priority, followed by data protection and software-as-a-service (SaaS) and cloud security.

Securing AI systems appeared lower on the list, but it is important to note that IAM, data protection and other responses are also building blocks for the comprehensive defense of AI solutions. These building blocks can form part of a larger risk management strategy.  

IAM can reduce AI solution risks as well as other threats, such as third-party access risks and cloud security risks. The prominence of these investments in cybersecurity budgets indicates business leaders understand the urgency behind interconnected risks, even if they are struggling to mitigate them. 

Fight speed with speed

Business leaders’ two most urgent fraud concerns are AI-related. As AI tools deliver increasingly sophisticated phishing emails to inboxes, 58% said cyber-enabled fraud such as phishing is their top fraud concern. Deepfake and AI-enabled fraud ranked second at 55%. 

Cyber-enabled and AI schemes top fraud concerns

Q: What are your top concerns around fraud? (Select up to 5)

Source: Grant Thornton’s Cyber & Risk Survey, October 13, 2026, N=1,100

This is just one sign that AI has permeated the risk management and cybersecurity universe from every direction. Attackers use AI tools to create deepfake videos, phishing messages, fake identities and bots that continuously attack systems until they find a weak point they can breach. 

The AI-powered tools that organizations use throughout their operations create new vulnerabilities, particularly related to cybersecurity. Yet just 26% of IT leaders said their organization has advanced, integrated AI governance with data-driven monitoring, while 57% of business leaders identified AI governance and the use of AI as a top source of future risk or regulatory scrutiny.

Organizations need AI capabilities to match the sophistication and speed of AI-powered threats. Despite this, adoption remains limited in many of the functions that need it most. Broadly or fully deployed AI is rare in internal audit (12%), regulatory compliance (13%) and fraud detection (21%). Only 37% identify AI cybersecurity enhancements as a top cyber investment priority.

AI adoption remains limited

Q: Which best describes your organization’s use of AI for internal audit, regulatory compliance and fraud detection?

Source: Grant Thornton’s Cyber & Risk Survey, October 13, 2026, N=1,100

Some organizations are moving faster, especially within certain industries and sectors. One banking industry CTO in our survey described expanding AI-enabled fraud and threat detection capabilities while strengthening identity controls and real-time monitoring across digital banking channels, creating more effective detective controls.

IT leaders can see exactly where cyber resilience breaks down. The top cyber resilience limitations are:

• Data quality, availability and visibility (65%)
• Technology limitations (62%)
• IT architecture complexity (62%)
• Third-party and supply chain dependencies (58%)

Defensive AI needs to be deployed thoughtfully, with auditable decision-making trees for transparency and measurable results defined and reviewed to confirm effectiveness and reduce hallucinations. At the same time, AI tools must be carefully integrated into the security environment using controls that reflect the sensitivity of the data involved and the consequences of misuse.

Here, too, cross-functional AI accountability is necessary to fully understand the interconnection of risks. Each AI owner should collaborate with security, compliance and internal audit teams, and an overarching owner is needed to approve use cases, monitor risks and intervene when necessary.

Make sure everyone knows their roles

One of the most crucial elements of organizational resilience is a response plan that has already been practiced before it is needed. When a fraud event occurs, organizations rarely have time to determine responsibilities, establish communication channels, identify decision-makers or engage third-party providers to assist. Those connections need to exist long before a crisis arrives.

But just 35% of leaders said they completed their last full cyber breach simulation within the past six months. Thirteen percent performed their last simulation more than 12 months ago, and 4% have never performed one.

That’s not sufficient at a time when threats are changing rapidly. It’s also not the tack the most effective leaders are taking.

One manufacturing industry chief audit executive respondent said their company has responded to the growing sophistication of AI-driven attacks by aligning cybersecurity and business continuity capabilities to bring technology, legal, manufacturing and recovery teams into the response process. That kind of preparation helps reduce downtime and limit business impact when an incident occurs.

Regularly practiced crisis simulations are just one of the necessary fraud readiness building blocks. Fraud protection requires a connection of evidence, investigative capability and decision authority long before a crisis occurs, but evidence collection is a substantial problem for many companies.

Lack of data evidence hampers response

Q: What are the main limitations when significant misconduct, fraud or compliance events occur? (Select up to 5, top 6 answers shown)

Source: Grant Thornton’s Cyber & Risk Survey, October 13, 2026, N=1,100

Business leaders identified data quality, availability and visibility (70%) and quality and completeness of evidence (62%) as the top limitations in misconduct and fraud response. Those findings suggest many organizations are attempting to prepare for incidents without first preparing the information they will need to investigate them.

Analytics deficits thwart fraud response

Q: Which of the following factors would most improve your organization's ability to prevent or respond to fraud, misconduct or regulatory events? (Select up to 5)

Source: Grant Thornton’s Cyber & Risk Survey, October 13, 2026, N=1,100

Sometimes, access to data within the organization isn’t enough for an effective fraud response. Preparations also should be made in advance for evidence to be gathered from third parties that may have relevant information. Vendor contracts should clearly spell out cooperation obligations and service controls, and leaders should consider only hiring third parties with a sterling reputation for supporting fraud investigations.

The final phase of fraud readiness happens after the incident occurs. This might be the most important step, and it’s sometimes neglected. After each incident, an owner should examine the controls, monitoring and procedures that need to be changed to prevent another incident, and test to make sure the new controls are effective.

Compliance must be adaptive by design

AI regulation is coming into focus while tariff requirements and enforcement priorities change quickly. Compliance leaders are being asked to respond to a growing number of moving pieces, yet many lack the technology needed to keep pace.

Just 29% of business leaders said their risk and compliance management program is “advanced” or “leading,” and 50% identified regulatory complexity and change as a top obstacle to risk, compliance and controls effectiveness.

Is compliance management keeping pace with risks?

Q: Which best describes the maturity of your organization’s risk and compliance management program?

Note: Percentages do not add to 100% due to rounding
Source: Grant Thornton’s Cyber & Risk Survey, October 13, 2026, N=1,100

Technology can help close that gap. AI-enabled regulatory intelligence platforms can monitor laws, regulations, enforcement actions and rule changes while helping organizations identify affected controls and compliance obligations.

Organizations can minimize cost considerations for transformation by making the most of the technology infrastructure already in place across all three lines of defense. Existing tools can incorporate AI capabilities to make coherent data decisions and deploy integrated intelligent workflows. This can also empower continuous visibility into compliance, rather than point-in-time testing.

 Yet just 13% of business leaders said their organization has broadly or fully deployed AI for regulatory compliance, and just 40% are applying AI to regulatory change monitoring. 

The disconnect between priority and execution extends beyond regulatory monitoring. Just 38% have a SOX program that is highly or fully automated, even though 58% said the use of AI and automation is a top SOX modernization priority.

Analytics, AI and automation are SOX priorities

Q: What are your organization's top SOX modernization priorities? (Select up to 5, top 5 answers shown)

Source: Grant Thornton’s Cyber & Risk Survey, October 13, 2026, N=1,100

As business obligations change, leaders need to include compliance requirements in strategic decisions, connecting them to accountable control owners and maintaining evidence of performance. Companies are working to fill these gaps. Almost two-thirds (65%) of risk and compliance leaders identified integrated risk and strategy alignment as a top priority for enhancing compliance and risk program resilience over the next two years.

When compliance is working effectively, regulatory changes are identified, screened for applicability and routed to affected control owners, with human review of AI-assisted monitoring and policy conclusions. Requirements need to be connected across controls and owners so changes can be traced through operations and monitored.

For example, multiple respondents in the healthcare industry said they are strengthening their controls for protecting patient health information through network and system monitoring.

Finally, compliance needs to confirm that controls work and promptly improve them when they don’t. Again, this control optimization is hampered by data concerns and a lack of integration. Risk and compliance leaders identified siloed structures (69%) and data quality (66%)  as the top obstacles to risk, compliance and controls effectiveness.

Top obstacles to improving risk, compliance and controls effectiveness

Q: What are the top obstacles preventing your organization from improving risk, compliance and controls effectiveness? (Select up to 5)

Source: Grant Thornton’s Cyber & Risk Survey, October 13, 2026, N=1,100

Always-on monitoring catches risk before it becomes exposure
 

Data shortcomings and rapidly changing threats are diminishing the value internal audit can provide to many organizations. Business leaders said data quality, availability and visibility (63%) and difficulty keeping pace with evolving threats and risks (60%) are the top challenges in internal audit as the threat environment increasingly requires continuous monitoring rather than point-in-time audits.

Top internal audit challenges

Q: What are your organization’s top internal audit challenges?

Static audit cycles are colliding with dynamic risks

Source: Grant Thornton’s Cyber & Risk Survey, October 13, 2026, N=1,100

Internal audit functions need data, technology and flexibility to continuously assess risks, potential impacts and risk management effectiveness. But expanded testing depends on timely evidence, and just 24% said they are using full-population analytics in all areas for internal audit, and just 8% are deploying continuous monitoring and dynamic risk assessments for real-time reactions to those analytics.

Continuous monitoring is rare in internal audit

Q: Which of the following best describes your organization's approach to internal audit testing?

Source: Grant Thornton’s Cyber & Risk Survey, October 13, 2026, N=1,100

Business activities and systems are changing constantly, and they often require a fresh look from internal audit before the next scheduled review. At the same time, the dual threats of cybersecurity and AI require intensified internal audit attention with careful examination of exposure, control performance and accountability.

The pace of change and the seriousness of the exposures require expanded testing with a clear definition of how timely evidence should be, how often retesting is required and what would trigger an earlier assessment. For maximum protection, continuous monitoring should be the goal. Many organizations have a long way to go to achieve it, but some are moving in the right direction.

One banking industry chief audit executive in our survey said that as more banking processes incorporate AI and automation, they have shifted toward real-time control testing to detect potential gaps much earlier than traditional audit cycles allowed.

Most importantly, control insights must reach management between audits. This requires open communication and agility on the part of management teams that might be unaccustomed to more frequent input from internal audit. But management needs to be ready to make more timely corrections, and internal audit needs to assess the follow-through and its impact.