Majority of UK firms exposed to cyber-threats amid AI transformation push

Amid the scramble to adopt artificial intelligence tools at any cost, most organisations don’t realise how the technology is leaving them exposed to new threats. According to a new study from Accenture, nine-in-ten organisations lack the maturity to defend against modern, AI-centred cyber-threats.

In the heat of the pandemic, many organisations rushed to open up digital platforms, which could enable their staff to operate from home. It was far from an ideal situation, and came with big risks – as by hurrying the development and release cycle, each system exposed firms to risks from hackers looking to exploit the situation. However, amid a dire situation, it was a risk many firms felt was worth the leap of faith.

Entering 2026, many organisations have taken a similar leap – though for a less discernible reward. While firms mostly knew what they would get by enabling their pre-existing staff to complete the duties they were already trained for, from home; the alleged benefits of AI are still to manifest, even three years into the hype. Worse – many organisations this time seem oblivious to the trade-off they are participating in.

A new study from Accenture has found that, when asked how they feel about generative AI, only 36% believe its implementation is revealing gaps in their cyber-security plans. Meanwhile, in actuality, 90% lack the maturity to defend against threats which look to exploit AI.

Considering this sizeable gap, Accenture’s next prediction should be especially concerning. Across all industries, the firm’s economic analysis anticipates 80% growth in AI adoption – with industries focusing on sensitive data leading the charge. Education will approach 64% adoption in the next five years, Accenture asserts, while professional services will also clear the half-way threshold, at 54% of operations. Financial services, information technology and health are among the other leaders.

At the same time, as risks within the firm increase, while externally, hostile actors look to deploy AI to hack and scam employees, companies are not doing enough to prepare their workforce. Of a poll of 1,000 UK workers, 37% had never received cybersecurity training – including 44% of over-55s.

Just 20% had been trained to recognise deepfakes or AI-generated phishing emails, meanwhile – and the shortfall in training was found to be even more significant in smaller companies, where 79% of microbusinesses – with fewer than 10 employees – and 55% of small firms (from 10 to 49 employees) offer no cybersecurity training at all.

Overall, this suggested a majority of UK companies were in what Accenture believes is the “exposed zone” – the most vulnerable category, where 63% of firms lacked both cohesive cyber strategies and the necessary capabilities. These firms lack the ability to design and operationalise cyber-risk strategies, to help secure their transformations – which, as has been noted, are increasing – and to build consumer trust.

Kamran Ikram, Accenture’s security lead in the UK & Ireland, commented, “Recent cyber-attacks prove no organisation is untouchable, and these results show a growing threat from AI-driven social engineering where attackers target trust instead of technical flaws. There remains a serious skills and training gap across the board. Organisations must look to be resilient in every area of their operations and supply chain, which means ongoing education on cyber threats. Businesses can’t rely on patchy preparedness when attackers are advancing by the day.”