Artificial intelligence is changing digital transformation from the digitisation of processes to the delegation of analysis, decisions and actions. AI is fundamentally transforming the cybersecurity landscape and accelerating digital transformation across public, private, governments and in all businesses.

AI is no longer simply a technology that supports business processes. It is becoming a core component of organisational decision-making, security operations, risk management, digital services and innovation.

However, the rapid adoption of AI has created a significant challenge: the speed of technological innovation is outpacing the development of effective governance, security controls, regulatory oversight and organisational accountability. This has led to the emergence of ungoverned AI, the use of AI systems without sufficient visibility, risk assessment, human oversight, data protection or clearly defined responsibility. The strategic objective is not to slow innovation, but to establish the confidence, controls and capabilities necessary to innovate responsibly at scale.

Current Industry Snapshot:

AI adoption is widespread, but scaling agentic capabilities and translating productivity gains into enterprise value remain uneven, with operating costs influencing usage and software-buying decisions. Meanwhile, rising breach costs, AI-enabled attacks, vulnerability exploitation and third-party exposure are intensifying cyber risk. AI-assisted detection, event correlation, incident triage and automated response are increasingly reducing manual effort, while extensive security AI and automation are associated with lower breach costs.

• Broad AI Adoption – Stanford’s 2026 AI Index reports AI adoption at 88% of surveyed organisations in 2025
• Agentic Scaling Gap – McKinsey’s August 2026 survey reports 40% of respondents at organisations are scaling AI agents, versus smaller organisations remained at 22%.
• Productivity Versus Enterprise Value – 80% report improved individual productivity, but only 37% attribute any enterprise EBIT impact to AI, about 6% meet the survey’s high-performer definition.
• Software Delivery and Buying Decisions – 32% report deciding against buying at least one software product or feature because it could be built internally with agentic coding tools; about 20% report AI operating costs constraining usage.
• Breach Economics – IBM’s 2026 study reports a US$4.99 million global average breach cost, up 12% over its 2025 study.
• AI-Enabled Attacks – One in four malicious breaches in IBM’s 2026 study was AI-enabled, a 56% increase over the prior study; these breaches averaged US$6 million.
• AI as a Defensive Advantage – IBM’s 2026 report associates extensive security AI and automation with US$1.93 million lower average breach costs than no use.
• Exposure and Ecosystem Risk – Verizon’s 2026 DBIR reports vulnerability exploitation at 31% of breaches and third-party involvement at 48%; ransomware was also involved in 48%.
• Fast Growing AI Adoption – AI-assisted threat detection, security event correlation, incident triage & automated response are fast growing in replacing manual efforts in the existing security posture.

Risks and challenges: The barriers to trusted AI:

The risk landscape combines familiar cyber weaknesses with AI-specific behaviour which needs a proper governance missing by which it leads to misleads or data exploits. OWASP is used to identify prompt injections, sensitive information disclosures, supply-chain exposures, data and model poisonings, improper output handlings, excessive agency, retrieval weaknesses, misinformation and unbounded consumption among its 2025 LLM application risks to remediate and digitise the cybersecurity models.

Some of the Key Risks and Challenges in Todays Threat Environment:

1. Shadow AI and Sensitive-Data Leakage: Critical documents or material enters unapproved services, retention arrangements or training pipelines are vulnerable.
2. Prompt Injection and Unsafe Tool Use: Untrusted content influences behaviour or triggers unauthorised actions.
3. Excessive Permissions and Unmanaged Agent Identities: An agent’s error or compromise creates wider access or change than intended.
4. Hallucinations, Bias and Automation Over-Reliance: Unsupported or inconsistent outputs distort business decisions and customer outcomes.
5. Model, Data and Retrieval Supply-Chain Compromise: Untrusted components or corrupted knowledge undermine integrity and confidentiality.
6. AI-Generated Software Defects: Faster development increases vulnerable code or unsupported dependencies.
7. Cost Escalation and Unclear Value: Token consumption, repeated retries, integration and review costs erode benefits.
8. Accountability, Skills and Regulatory Fragmentation: Unclear ownership and inconsistent obligations delay decisions or leave gaps.

From AI Policy to a Trusted-AI Operating Model:

NIST’s AI Risk Management Framework and its Generative AI Profile provide a voluntary basis for organising lifecycle risk management. A practical implementation connects governance, contextual risk assessment, measurement and active management to existing cyber, privacy, procurement and operational processes.

1. Discover and Classify – Maintain an inventory of AI systems, embedded AI features, agents, data sources & suppliers. Record purpose, owner, affected stakeholders, data sensitivity, permitted actions & business criticality. Assess use-case risk rather than treating all AI as equally dangerous.
2. Establish Decision Rights – Business owners remain accountable for outcomes; security, data, privacy & legal teams define control requirements; delivery teams implement them; independent assurance challenge evidence. Record residual-risk with expiry dates & named authorities.
3. Build strong Technical Foundation – Use approved model access, identity-based permissions, protected secrets, data controls, approved retrieval sources, independent tool authorisation & central logging. A gateway enforces consistency but cannot replace application-level controls.
4. Evaluate before Release – Test utility, factuality, privacy, robustness, access boundaries, failure modes and cost under realistic conditions. Define acceptance thresholds before testing. Reassess significant changes to models, prompts, tools, data or business purpose.
5. Apply Proportionate Autonomy – Start with advisory, permit bounded and reversible actions only within verified limits. Require explicit approval for high-impact changes, sensitive external disclosures & other actions. Oversight requires time, context & authority to intervene.
6. Monitor and Recover – Link incidents to model and configuration versions, source data and tool actions while minimising sensitive logging. Detect behavioural change, revoke access when necessary, stop execution safely and restore service through tested fallback procedures.
7. Measure value and Retire weak Use Cases – Assess successful outcomes, quality and total operating cost against a pre-AI baseline. Scale only where benefits survive the cost of controls and human review; redesign or retire low-value deployments.

 

The European Commission’s current AI Act service-desk timeline states that transparency rules and associated applicable enforcement began on 2^nd August 2026. Following the Digital Omnibus amendments reflected in that timeline, Annex III high-risk system rules apply from 2^nd December 2027, and high-risk AI embedded in regulated products covered by Annex I from 2^nd August 2028. These are not interchangeable deadlines as the obligations depend on the system, organisational role, future regulatory changes and transitional provisions.

Future innovations: The next frontier of cyber digital transformation:

The next five years are likely to be shaped by the convergence of AI, automation, advanced cybersecurity, intelligent infrastructure and increasingly autonomous digital ecosystems.

The following innovations represent strategic directions rather than guaranteed outcomes: 

 

 

1. Autonomous Security Operations: AI agents could increasingly correlate threat intelligence, investigate incidents, prioritise vulnerabilities and recommend or execute containment actions. Human oversight will remain especially important for disruptive actions.
2. AI-driven Zero Trust Security: Identity, device health, behavioural analytics & contextual risk could be continuously evaluated to determine access to applications, data & autonomous tools.
3. Digital Twins & Predictive Cyber Resilience: Digital twins of infrastructure & business operations could simulate cyberattacks, system failures and recovery scenarios before real incidents occur.
4. Quantum-Resilient Cybersecurity: Migration towards post-quantum cryptography will become increasingly important for protecting sensitive information & critical digital infrastructure.
5. Privacy-Enhancing AI: Federated learning, confidential computing, differential privacy and other privacy-enhancing technologies may enable organisations to collaborate on data-driven innovation while reducing unnecessary exposure of sensitive information.
6. Human–AI Collaborative Intelligence: Future operating models may combine human judgement, creativity and accountability with AI-assisted analysis, planning and execution.

Future innovation: moving from autonomous ambition to verified capability:

The forward-looking transformations in cyber digital space primarily depend on the integration quality, economics, assurance maturity and the criticality of the workflow.

Some of the key security-controlled transformations are –

• Bounded Agentic Security Operations – AI can connect evidence gathering, investigation summaries & response recommendations. The sensible direction is verified automation of narrow tasks with playbook limits and safe escalation—not uncontrolled autonomous response across critical systems.
• Continuous AI Assurance – Evaluation pipelines can retest behaviour and controls whenever a model, tool or knowledge source changes. Evidence generated during delivery can support audit and risk review, reducing dependence on annual, document-heavy assurance.
• Identity-First Agent Ecosystems – Each agent should have an owner, declared purpose, unique identity and constrained delegation rights. Runtime policy checks become essential as agents interact with other agents and enterprise services.
• Secure-by-Design AI Engineering – Security tests, provenance checks and approval evidence can become standard components of AI delivery pipelines. Reusable, pre-approved patterns offer a route to faster innovation without repeatedly rebuilding the same controls.
• Privacy-Aware and Deployment – Flexible architectures. Smaller domain models, on-premises or edge deployment, privacy-enhancing approaches and carefully governed synthetic data may suit particular workloads. None automatically guarantees privacy, sovereignty, accuracy or lower cost; validate the complete deployment.
• Evidence-linked Cyber Intelligence – Combining approved knowledge sources, asset context and security telemetry can improve prioritisation. Outputs should show their supporting evidence and uncertainty rather than present plausible explanations as established facts.
• Resilience and Cryptographic Agility – AI transformation offers an opportunity to improve dependency mapping, recovery testing and visibility of cryptographic assets. Post-quantum preparation should remain a distinct risk-led programme, not be confused with an AI capability or a promise of immediate quantum threats.

The future of cyber digital transformation will not be defined solely by the sophistication of Artificial Intelligence, but by the trust, resilience and responsibility with which it is developed, governed and deployed. We are entering an era where intelligent technologies will increasingly shape business decisions, national infrastructure, cybersecurity operations and human experiences. The opportunities are extraordinary, but so too are the responsibilities.

Moving from ungoverned AI to trusted innovation demands more than stronger technical controls. It requires visionary leadership, ethical governance, secure digital foundations, continuous assurance and a culture that places human values at the centre of technological progress.

The future is not about choosing between innovation and security. It is about making security, trust and responsible governance the foundations upon which innovation can thrive. The ultimate ambition is to create a digital future where AI is not merely powerful, but trustworthy; where cybersecurity is not simply protective, but transformative; and where innovation delivers enduring value for organisations, economies and society.

Kavitha Srinivasulu

Persistent Systems

Vice President: Field CISO

 About the Author:

 Senior cyber risk and resilience executive with over 23 years of global leadership experience advising Boards and Executive Committees across Financial Services, Healthcare, Retail, Technology, and regulated industries. Delivered and led large-scale, regulator-driven cybersecurity, AI driven, PCI, and SOC transformations for Tier-1 banks, global healthcare organisations, and highly regulated enterprises operating across the UK, EU, USA, APAC, and ANZ. Trusted advisor to Boards, C-suite, regulators, and global enterprises, consistently delivering resilient, compliant, and scalable cyber operating models.