AI-related threats now outweigh employee-related concerns as the leading cyber worry for organisations in Ireland, as rapid advances in AI create a faster-moving and more complex risk environment. That’s according to the EY Ireland Cyber Leaders Index 2026, which surveyed 161 cybersecurity professionals and senior leaders across Ireland.
More than one-third (35%) of cyber leaders now identify AI-related threats as their biggest cyber concern, while almost half (47%) say rapid advances in AI and the heightened threat environment are making it harder to maintain control.
Encouragingly, organisations appear to recognise both the scale of the challenge and the investment required to address it. One quarter (25%) reported an increase in cybersecurity spending over the past six months, while the remaining 75% said budgets were unchanged, and none reported a cut.
The findings point to a shift in how organisations think about cyber resilience as they rely more on AI, digital services and interconnected supply chains. AI is not only creating new risks; it is exposing weaknesses and dependencies across increasingly interconnected systems. The report describes these accumulated weaknesses as “resilience debt”: where gaps in technology, governance, operations and recovery capabilities can make it harder for organisations to withstand disruption and keep critical services running.
Puneet Kukreja, Resilient Nation Leader and Head of Cyber Markets at EY Ireland, said:
“The pervasive nature of AI means that organisations are no longer facing isolated cyber risks. Instead, they are operating within highly connected environments where disruptions to cloud infrastructure, supply chains, geopolitics, and critical infrastructure can have far-reaching consequences. AI may be giving rise to a new category of critical infrastructure in its own right as it evolves from software to infrastructure. Building a Resilient Nation starts with building resilient organisations. That means moving beyond plans alone and engineering resilience into how critical services are designed and operated, so they can continue to function under pressure.
Positively, our survey suggests that Irish organisations do recognise the investment required to respond to this changing environment, with cyber budgets remaining resilient. The opportunity now is to make sure that investment supports prevention, while also strengthening organisations’ ability to maintain critical services and recover quickly when disruption occurs is prioritised.”
AI exposes growing resilience debt
With AI-related threats being now the biggest cyber concern for leaders in Ireland, more than one in five (22%) specifically point to the threat from rogue or compromised AI models being used for hacking, while 13% cite unforeseen threats emerging from AI systems. Employee-related concerns were cited by 14%, up from 9% last year, but the findings show worries that once centred on human behaviour are increasingly moving towards AI systems and technology risk.
Organisations are strengthening trust, governance and security to expand AI use safely and protect against new AI-related threats. Following recent incidents involving trusted or autonomous AI systems, 28% say they have moved part of their cybersecurity budget to support AI adoption.
Almost one third (31%) see cybersecurity as an enabler of safe AI adoption rather than purely a defensive measure. That changing emphasis is also reflected in where organisations expect to invest next. Five of the top six future investment priorities relate directly to AI: led by AI governance, risk management and oversight (41%), controls to prevent or contain rogue AI behaviour (34%) and continuous security testing of AI systems (30%).
The findings also reflect an increasingly important distinction between AI safety and AI resilience: while safeguards remain critical, organisations also need the ability to retain control and keep essential services operating when AI models, platforms or controls are tested.
From resilience debt to resilience engineered
As organisations rely increasingly on AI, technology, suppliers and digital infrastructure, disruption is less likely to remain contained within a single organisation or system.
Direct cyberattacks are considered the leading resilience risk over the next 12 months (34%), closely followed by breaches at third-party suppliers (31%) and major outages caused by rogue AI (25%).
Addressing this interconnected risk requires organisations to go beyond planning for disruption towards deliberately building resilience into how critical services are designed and operated. This is what the author of the EY Cyber Leaders Index describes as “Resilience Engineered”, where systems are designed to continue functioning under pressure, helping organisations maintain essential services while disruption is unfolding rather than solely relying on recovery after a system fails.
Against this backdrop, organisations are focusing their resilience efforts on strengthening cyber monitoring, detection and response, improving business continuity and crisis readiness, and modernising legacy technology, infrastructure and cyber hygiene.
Supply chain disruption is a particular concern – it is the leading geopolitical resilience concern across every sector surveyed, cited by 78% of respondents in industry, advanced manufacturing and telecoms, 72% in the government and infrastructure sector, 71% in consumer and retail and 55% in life sciences and health. Yet only 12% of all respondents say geopolitics has a significant impact on their resilience strategy.
Carol Murphy, EY Ireland Head of Clients and Industries and Consulting Partner, said:
“Irish organisations operate in increasingly complex and interconnected environments, meaning interdependence and resilience need to be viewed as two sides of the same coin. As organisations become more reliant on AI, cloud infrastructure, third party suppliers and other critical technologies, resilience can no longer be considered solely through a technology lens.
Encouragingly, Irish organisations are continuing to invest and adapt. The next step is to understand which services are truly critical, what they depend on, and how quickly they can be restored if disruption occurs. Resilient organisations ultimately contribute to a more resilient and competitive ecosystem and a Resilient Nation, giving businesses greater confidence to embrace AI and other emerging technologies while continuing to deliver the services their customers and communities rely on.”
Growing complexity puts pressure on leaders who lead cyber
The research also highlights the growing demands on those managing cyber risk. Almost half (47%) say the heightened threat environment and rapid advances in AI are making it harder to maintain control, while 40% report anxiety that important aspects of cybersecurity could be overlooked. A quarter (25%) say the pressure is affecting their ability to perform at their best.
The role of leaders who lead cyber is also evolving – more than one in five (21%) expect increasingly powerful AI agents to result in greater responsibility for AI governance, risk and compliance over the next six to 12 months, while others expect their roles to expand into human-AI decision-making, enterprise-wide AI resilience and business continuity.
The age of recoverability: keeping the essential services running
The report highlights recoverability – which is the ability to maintain essential services and restore critical operations quickly following disruption – as an increasingly important measure of organisational resilience.
This goes to what the author of the report describes as “Minimum Viable Business”: identifying the essential outcomes and minimum services an organisation must sustain through a serious disruption, together with the people, technology, data, infrastructure and suppliers needed to support them. Rather than seeking to protect everything equally, the approach helps organisations understand what must keep running and what needs to be restored first.
In the survey, more than eight in ten (85%) say they are confident their organisation could keep operating in an agreed minimum operating state, meaning the essential services and systems needed to carry on, following a major cyberattack. However, while 59% are somewhat confident, just over one quarter (26%) are very confident and 14% are not very or not at all confident.
The picture is similar for AI-specific incidents. Almost nine in ten (88%) say they are at least somewhat prepared to detect, contain and respond to a rogue trusted AI agent operating with authorised access, and 11% describe themselves as not being prepared. On leadership decision-making during an AI-related cyber crisis affecting the organisation or a critical third party, 86% express some confidence, and 14% are not confident.
“In an environment where AI is accelerating the speed at which disruption can unfold, resilience will increasingly be measured not only by whether an organisation can prevent an incident, but by whether it can retain control, keep essential services running and recover with confidence when disruption occurs. Building towards a Resilient Nation should be our North Star, with resilient organisations, infrastructure and essential services providing the foundations for Ireland to withstand disruption and continue to operate with confidence”,Puneet concluded.