What happened
Grant Thornton published a cyber and risk survey on Tuesday based on interviews with 1,100 business leaders, and its central finding is a gap between ambition and practice. Two thirds of leaders said they were trying to make enterprise risk management a top priority, but fewer than half said their organisations approached risk management consistently.
Cyber risk dominates the picture. Roughly three quarters of respondents named cybersecurity incidents as one of the biggest risks to performance over the next two years, yet barely half said they were highly confident their organisation could identify a sophisticated attack when one occurred. Data quality and visibility was the most cited obstacle to resilience at 65 per cent, ahead of technological limitations and network complexity at 62 per cent each and supply chain dependencies at 58 per cent.
Outsourcing features heavily. 96 per cent of respondents said their organisations use some level of outsourced capability for threat detection and response, a figure the report links to hiring difficulties, and suppliers are described as becoming an important source of defensive capability. The integration is often shallow: only a quarter said their third party providers are integrated with internal processes using automation and shared tooling.
AI governance is the weakest area in the data. Only 26 per cent of leaders said their organisations had advanced, integrated AI governance with data driven monitoring, and nearly six in ten said their company's use of AI combined with a limited ability to govern it was a top source of future risk or regulatory scrutiny. AI enabled fraud was cited as a major concern by 55 per cent of respondents, though traditional phishing and other cyber enabled fraud worried more. Grant Thornton recommends a unified risk intelligence view, with cybersecurity, compliance, forensics and internal audit working from shared definitions, standardised data and clear ownership, and argues that periodic reviews are not fast enough for AI powered threats.
Why this is a GRC story
The gap is governance, not tooling. Nearly every organisation has a framework. Fewer than half apply it consistently, which is the distance between a policy library and a programme that actually changes decisions.
Outsourcing expands the control perimeter. If almost everyone relies on third parties for detection and response, then vendor oversight, shared visibility and named ownership are core control activities rather than procurement detail.
AI governance remains largely aspirational. A quarter reporting advanced governance, on the same survey where most call AI a top source of regulatory scrutiny, is a predictable setup for audit findings and enforcement attention.
What to watch
Watch whether boards start asking for the evidence behind these confidence numbers, particularly the claim that a sophisticated attack would be detected. The useful internal question is whether risk, compliance, security and audit work from one set of definitions and one view of exposure, or four.
Attribution: Analysis based on Cybersecurity Dive and related public reporting. This article is original commentary, not a repost of the source material.