Grant Thornton survey: Organizations prioritize integrated cyber and risk management, but lack the capabilities to enable it

— 67% of business leaders identified enterprise risk management and governance as a top priority
— 57% identified AI governance and AI use as a top source of future risk or regulatory scrutiny
— 55% cited deepfake or AI-enabled fraud as one of their organization’s top fraud concerns
— 96% reported using outsourced capabilities for cybersecurity threat detection and response
— 73% said better analytics and monitoring would improve response to fraud, misconduct and regulatory events

CHICAGO--(BUSINESS WIRE)--A new survey from Grant Thornton revealed that while business leaders recognize the need for a more connected approach to cyber and risk management, many organizations have yet to build the capabilities needed to manage today's increasingly interconnected threats.

Grant Thornton's 2026 Cyber & Risk Survey of 1,100 business leaders found that two-thirds (67%) identified enterprise risk management and governance as a top risk and compliance transformation priority over the next 24 months. Yet fewer than half (48%) said their organizations have implemented integrated risk management or an enterprise-wide operating model to address risk. At the same time, 61% said insufficient integration across risk functions creates an incomplete view of organizational risk.

"Many organizations have visibility into individual risks but lack a clear view of how those risks connect across the enterprise," said Tony Buffomante, national managing partner of Cyber & Risk services at Grant Thornton Advisors LLC. "Creating that shared view requires common risk definitions, integrated data, clear ownership and governance that spans functions and business segments. Without it, leaders risk spending too much on their cyber and risk programs and lack the ability to quickly mitigate risks and enable broader operational resilience.”

The survey also found that data, analytics and reporting ranked alongside enterprise risk management and governance as the top transformation priority, with 67% of respondents having identified it as a key focus area. However, more than two-thirds (68%) said data quality, availability and visibility limit risk management integration.

"Organizations are generating more risk data than ever. But data alone doesn't improve decision making," said Tom Puthiyamadam, national managing partner of Advisory Services at Grant Thornton Advisors LLC. "Executives need intelligence that identifies patterns, anticipates tomorrow’s problems and empowers them to lead more effectively. It is critical that these insights are timely and actionable.”

AI is transforming the risk landscape

AI is driving both the threats organizations face and the tools needed to defend against them. Business leaders cited cyber-enabled fraud such as phishing (58%) and deepfake or AI-enabled fraud (55%) as their top fraud concerns, signaling how quickly AI has become embedded in the risk landscape.

While 57% of business leaders identified AI governance and AI use as a top source of future risk or regulatory scrutiny, only 26% of IT leaders reported having advanced, integrated AI governance with data-driven monitoring. Adoption also remains limited in key risk functions, with broad or full AI deployment reaching just 12% in internal audit, 13% in regulatory compliance and 21% in fraud detection.

"Organizations cannot afford to face AI-powered threats with traditional approaches alone,” said Buffomante. “As bad actors use AI to accelerate fraud, phishing and other attacks, companies need equally powered sophisticated governance, monitoring and defensive capabilities to keep pace."

Cyber resilience requires a connected defense

As organizations become more dependent on cloud platforms, third parties and interconnected technologies, cyber resilience depends on understanding how risks interact across the enterprise.

Nearly two-thirds (65%) of IT function respondents cited data quality, availability and visibility as a top cyber resilience challenge, followed closely by technology limitations (62%) and IT architecture complexity (62%). Additionally, 58% said third-party and supply chain dependencies limit their organization's ability to manage cyber risk effectively.

Talent shortages are also driving organizations to rely on external providers for cybersecurity support. More than half (52%) of business leaders identified cybersecurity talent and skills shortages as a key cybersecurity challenge, and 96% reported using outsourced capabilities for cybersecurity threat detection and response.

However, just 25% said those providers are fully integrated with internal processes through shared tools, automation and coordinated workflows, highlighting an opportunity to enhance the operating model and strengthen collaboration between internal and external teams.

Resilience starts before the crisis

When fraud or cyber incidents occur, organizations have little time to define responsibilities, establish communication channels or engage outside support.

Yet preparedness gaps remain. Just 35% of leaders completed a full cyber breach simulation within the past six months, while 13% last conducted one more than a year ago and 4% have never conducted one.

The survey data also confirmed that preparation extends beyond simulations. Business leaders identified data quality, availability and visibility (70%), along with the quality and completeness of evidence (62%), as the biggest limitations in fraud and misconduct response. Looking ahead, 73% said better analytics and monitoring would strengthen their ability to respond to fraud, misconduct and regulatory events.

Compliance needs to keep pace with change

As AI regulations evolve and enforcement priorities shift, compliance leaders are being asked to respond to an increasingly complex environment. Yet, many organizations lack the capabilities to keep up. In fact, just 29% of business leaders described their risk and compliance management program as advanced or leading, while 50% cited regulatory complexity and change as a top obstacle to effective risk, compliance and controls management.

What’s more, technology adoption has not kept pace with those compliance demands. Only 13% of organizations have broadly or fully deployed AI for regulatory compliance, and just 40% said they are using AI for regulatory change monitoring. The gap is equally evident in SOX modernization, where 58% identified AI and automation as a priority, but only 38% reported having a highly or fully automated SOX program.

At the same time, leading organizations are placing greater emphasis on aligning compliance requirements, control owners and business strategy as part of a more integrated approach. According to the survey, nearly two-thirds (65%) of risk and compliance leaders identified integrated risk and strategy alignment as a top priority for strengthening compliance and risk program resilience over the next two years.

However, significant barriers remain, with siloed structures (69%) and data quality (66%) cited as the leading obstacles to effective enterprise risk management integration by risk and compliance leaders.

Continuous monitoring is becoming a business imperative

As risks change more rapidly, organizations have found that periodic audits alone are no longer enough. Business leaders cited data quality, availability and visibility (63%) and keeping pace with evolving risks (60%) as the top internal audit challenges, underscoring the growing need for continuous monitoring and more timely risk insights.

Despite that need, adoption remains limited. In internal audit, only 8% of organizations have implemented continuous monitoring and dynamic risk assessments that enable real-time responses, while 24% use full-population analytics across all areas.

To see additional findings from Grant Thornton’s Cyber & Risk Survey, visit: https://www.grantthornton.com/insights/survey-reports/advisory/2026/cyber-and-risk-survey.

About Grant Thornton in the U.S.
Grant Thornton delivers professional services in the U.S. through two specialized entities and their affiliates: Grant Thornton LLP, a licensed, certified public accounting (CPA) firm that provides audit and assurance services — and Grant Thornton Advisors LLC (not a licensed CPA firm), which exclusively provides non-attest offerings, including tax and advisory services.

Grant Thornton LLP, Grant Thornton Advisors LLC and their respective subsidiaries operate as an alternative practice structure (APS). The APS conforms with applicable laws, regulations and professional standards, including those from the American Institute of Certified Public Accountants.

“Grant Thornton” refers to the brand under which the member firms in the Grant Thornton International Ltd (GTIL) network provide services to their clients and/or refers to one or more member firms. Grant Thornton LLP and Grant Thornton Advisors LLC serve as the U.S. member firms of the GTIL network. GTIL and its member firms are not a worldwide partnership and all member firms are separate legal entities. Member firms deliver all services; GTIL does not provide services to clients.