US enterprises incorporate cyber risk into larger strategic focus

Dive Brief

• U.S. companies are merging cyber risk issues into their overall enterprise risk strategy, at a time when AI adoption and business resilience are leading to significant shifts in business priorities, according to a report released Tuesday by Information Services Group, a technology research and advisory firm.
• Cybersecurity is increasingly seen as a business-critical concern, as companies accelerate their adoption of agentic AI and transform much of their technology and data infrastructure to hybrid or multicloud environments. 
• Enterprise leaders are closely integrating cyber spending decisions with overall IT strategy. In addition, C-suite and board members are taking greater accountability for business continuity, financial exposure and regulatory compliance.

Dive Insight

The report reflects significant changes among large enterprises in terms of how expanded use of AI cloud adoption has changed the conversation around overall business risk. 

AI adoption is forcing companies to rethink their corporate governance, internal controls and overall preparedness for a major cyberattack or IT outage. 

“Cybersecurity has become a core business consideration rather than a standalone technology function,” Jason Stading, director, cybersecurity at ISG, told Cybersecurity Dive. “Organizations are embedding cyber risk into AI adoption, digital transformation, and broader technology investment decisions; most enterprises recognize that security enables innovation while managing enterprise risk.”

Chief information security officers and chief information officers are playing a more strategic role in these organizations, according to Stading. They are partnering with corporate boards and executive leadership to help shape business decisions and make sure cybersecurity is integrated into overall business strategy

A June report by S&P warned that companies lacking strong internal security governance could put their credit ratings at risk. 

Authorities in the U.K., meanwhile, have pressed corporate leaders to incorporate cyber risk into their overall business strategies and sounded the alarm on the increasing number of attacks targeting critical infrastructure.