Businesses must get ready to face AI-powered threats

In Scotland, where industries like financial services, life sciences and energy thrive – cyber risks are magnifying. Companies that are rich in data and intellectual property are lucrative targets for cyber criminals.

Organisations are hyper aware of this. Our State of Cybersecurity Resilience 2025 report shows 72 per cent of organisations globally have reported an increase in cyber threats, and 63 per cent cite an evolving threat landscape as their biggest challenge.

Gen AI in the wrong hands, with its power to automate and scale attacks, has made threats more sophisticated. Scammers can use deepfakes to impersonate senior executives and defraud people of significant sums. It's a strategic risk that undermines business operations and erodes customer trust.

​Freha Arshad, Accenture Managing Director for Security, UK

Are Businesses Prepared?

The short answer is not yet. While only 36 per cent of technology leaders acknowledge that AI is outpacing their security capabilities, the reality is that 90 per cent of companies lack the maturity needed to defend against today’s AI-powered threats. Just 34 per cent of organisations worldwide have a mature cyber strategy. Fewer still – only 13 per cent – have the advanced cyber capabilities required to counter the speed, scale, and sophistication of AI-driven attacks.

The rise of social engineering attacks means an organisation’s people and IT parameters are still paramount as a first line of defence – but these threats also mean security is now a shared responsibility across the business. Effective cybersecurity requires new ways to think about strategy and capabilities.

Real-world resilience

​Security must be embedded in governance structures and be a boardroom priority (Picture: stock.adobe.com)

A big call to action for Scottish businesses is to remove the silos. Security must be embedded into governance structures and elevated to a priority at the board – and no longer just the preserve of the CISO. This thinking also applies to the activation of new programmes. Our research found only 28 per cent of organisations embed security into transformation initiatives from the start, forcing many to retrofit defences later. This reactive approach is unsustainable.

There is also the issue of disproportionate investment. Spending on gen AI initiatives is outpacing investments in securing gen AI. This needs to be addressed. AI must be developed, deployed and operated with security integrated at every stage. Furthermore, very few organisations maintain a comprehensive inventory of AI systems, which is crucial for managing supply chain risks.

Finally, skills are equally critical. While Scotland has a growing tech talent pool, the demand for cyber security professionals is rocketing and skills shortages are rife. It’s a global problem – with 83 per cent of executives citing workforce limitations as a major barrier to maintaining a secure posture.

From vulnerability to advantage

This is not just about protecting against threats but about creating value. Organisations that demonstrate maturity in both strategy and capability, are 69 per cent less likely to experience advanced attacks and see 1.6 times higher returns on their AI investments.

Cyber threats are no longer just about stealing data – they are about manipulating it, corrupting it, and using it against businesses.

By making cybersecurity a board-level priority, fostering collaboration between business and security teams, and continuously investing in skills, Scottish businesses can navigate the new world of AI threats with confidence.

Freha Arshad, Accenture Managing Director for Security, UK