I believe most of the breaches still start with humans, not a piece of technology. As per Top 3 cyber-risk catalysts all rooted in human behavior research, 80% of organizations see human-related factors as the biggest driver of cyberattacks, and in India, around 28% of organizations reported a lack of security awareness among employees.
To tackle this situation, organizations need more than an annual training module. Security must be built into daily workflows, employees must feel encouraged to report suspicious activity without worrying about blame, and the same goes for the authorities to set rules that are the same for everyone.
The research pointed out that public-facing applications, valid accounts, and trusted relationships were the entry point of the major attacks investigated in 2025, and 15.5% was via trusted partners. Shadow AI is already flagged as a common risk by 31% of organizations, adding another layer that often sits outside IT’s line of sight.
How should IT leaders prepare for an environment where attackers are also using AI to make cyberattacks more sophisticated and scalable?
With the increased implementation of AI in systems, it has made attacks cheaper to run and harder to identify. The threat actors are using LLMs to write phishing emails and malicious code, and to rewrite existing malware in new languages to bypass previous detection. We expect AI to show up across more stages of the attack chain this year, while telling real content from fake keeps getting harder.
AI-based detection and response can free analysts of all of the work of scanning and triaging so they can focus on free decision-making. Confirming high-value requests to access or pay-out should never rely on how natural the message or voice sound and awareness training should include deepfakes and AI-written guidelines.
Above all, prepare for a malware attack, because bad guys are more aggressive and faster than they used to be; and then expect to have to adapt throughout the year rather than just once.
What security and governance principles must technology leaders embed into their AI approach from the start?
Our latest research shows that 81% of organisations are researching or deploying internal tools based on LLMs, and 31% already believe shadow AI is a material risk. Governance only happens when you have enough visibility to implement it.
Before information reaches any model, a methodical process should start with data classification. AI tools and agents must be granted access only to the necessary data or tools to perform their specific tasks, and AI providers and models must meet the same supplier assessment standards as other key third parties. Likewise, clear ownership and accountability for the usage of AI generated outcomes is of vital importance.
Responsible use must be enabled, not restricted by government. Under some circumstances, it is better to have a system that is sustainable, with some amounts of coverage, than a blanket ban that will lead to underground use.
What do enterprise technology decision makers need to do to stop conversations about preventing an attack and start talking about building the resilience to detect and respond when it occurs ?
That’s what building resilience is – how quickly a business can identify the cybersecurity event, mitigate its impact, and continue to operate. At Kaspersky, in 2025, we handled around 400,000 alerts, out of which approximately 3900 needed investigation.
So being active and fast is an important rule to tackle cyberattacks. In 2025, we identified as many as three high-impact, human-enabled attacks per day and reduced our time-to-respond by approximately 22% as compared to the previous year. In addition to such speed, organizations should have effective response playbooks, proven backup systems, and definitive leadership structures in times of crisis, with table-top exercises that have business stakeholders involved as well as IT.
How is the discussion around cyber risk evolving at the level of the board and other business leaders and what is the CIO’s role in that discussion?
Now boards are worried about what an attack would cost the business and how quickly it could recover. 41% of enterprises revealed that AI adoption is pushing them to increase security investment. In this, CIOs are well-positioned to bridge the technical and business conversations, describing cyber risk in terms of business and time to recover rather than patch counts or blocked threats so that the members can make better decisions around risk and investment.
What are the cybersecurity capabilities or risks you see technology leaders needing to focus on today over the next three to five years? What is one cybersecurity assumption you would challenge technology leaders to re-evaluate?
Today, corporate leaders should pay attention to identity-first security, AI governance, supply chain transparency and prepare for post-quantum cryptography. As our research highlights, over–privileged agents and compromised agent skills could be utilized to maintain access and steal data; AI agents require special attention.
I would contest the notion that more tools equate to improved security. According to our research, 86% of organizations are currently working toward consolidation, and 43% of them believe that maintaining their security stacks is too difficult and time-consuming. Using fewer, well-integrated tools to their maximum potential frequently yields more results than adding a new product.
