Research by cybersecurity consultancy CyXcel has revealed 29% of UK businesses surveyed have only recently implemented their first AI risk strategy, with 31% not no AI governance policies set up. The is despite a third of businesses recognising AI as a potential cybersecurity threat. The blind spot in AI risk preparedness leaves businesses prey to data leaks and breaches, operational disruptions, and regulatory fines, the company says.
Of those surveyed, 18% of UK and US organisations are unprepared for AI data poisoning, a form of cyberattack that targets the training data of AI and machine learning models. Moreover, 16% have no policies in place to fight cloning and deepfake incidents.
Megha Kumar, Chief Product Officer and Head of Geopolitical Risk at CyXcel, stated there is a catch 22 situation, where companies want to adopt AI solutions but simultaneously worry about its risks. “Organisations want to use AI but are worried about risks – especially as many do not have a policy and governance process in place.”
He said CyXcel’s Digital Risk Management (DRM) platform can help respond to mounting threats. “The CyXcel DRM provides clients in all sectors, especially those that have limited technological resources in house, with a robust tool to proactively manage digital risk and harness AI confidently and safely.”
The CyXcel DRM platform is designed to provide businesses with insight into growing AI risks. It combines cyber, legal, technical, and strategic expertise to help manage threats and improve digital resilience. The company says its DRM platform also helps implement governance and policies that will mitigate possible risks.
The DRM platform provides strategies for – AI, Cyber, Supply Chain, Geopolitics, Regulation, Technology (OT/IT), and Corporate Responsibility, available through a dashboard where users can manage digitals risks using solutions proffered by the platform.
Legal and technical insights come from expertise coded into the platform, so users can see trends, the potential impact of risks, and emerging threats. It advises on possible strategies for combatting danger and vulnerabilities.
The DRM also offers a “full-spectrum dispute resolution and litigation service” aimed at reducing the time needed for organisations to follow regulations and laws related to various digital threats. For businesses with strict regulations in place, CyXcel’s DRM covers 26 sectors legally required to follow regulations like the EU’s NIS2 and DORA (Digital Operational Resilience Act). These sectors are considered essential infrastructure, with each classified as Critical National Infrastructure (CNI) in regions like the US, UK, and EU.
CyXcel CEO, Edward Lewis, spoke on the evolving and complex landscape of cybersecurity regulation. “Governments worldwide are enhancing protections for critical infrastructure and sensitive data through legislation like the EU’s Cyber Resilience Act, which mandates security measures like automatic updates and incident reporting. Similarly, new laws are likely to arrive in the UK next year which introduce mandatory ransomware reporting and stronger regulatory powers.”
Businesses worldwide are at the mercy of digital breaches and attacks, including, by its own admission CyXcel itself. Commercially, legally, and strategically, CyXcel’s DRM platform is designed to tackle the issues it’s also at risk from.
CyXcel clients are typically bound by stringent cybersecurity laws, which, if broken, can result in fines and reputational damage. Similarly, if CyXcel’s advice falters, the company itself could be on the hook for failed compliance and breaches.
The company is at pains to stress thet it’s facing the same digital risks as its clients. CyXcel’s marketing materials state that the company’s commitment to risk isn’t advisory, it’s ‘personal.’
