Despite considering cyberattacks one of their main risks, many companies have still not modernised their security due to inertia, lack of guidance, and difficulty in demonstrating the preventive value of these investments. In the face of AI models capable of exploiting vulnerabilities, BCG experts conclude that cybersecurity must be urgently addressed by top management and not solely delegated to technology leaders or treated as a strictly technical issue.
The cybersecurity strategy in the age of AI requires coordination across the entire company, both top-down and bottom-up. Just as CEOs have taken the lead in AI innovation, they must assume their leadership role with precise communication and a clear delegation of responsibilities. This decision can make the difference between a secure organisation and an insecure one.
Measures to protect the organisation
The BCG report highlights that chief executives do not need to be cybersecurity experts, but they must understand that AI increases both the risk and the power of attacks. In fact, a survey by the consultancy revealed that 35% of organisations have suffered a significant impact from AI-based attacks in the past twelve months, with an average of 3 major breaches and 25 incidents of sensitive data.
As attacks are inevitable, the priority is resilience, not just prevention. In this sense, it is up to the CEO to promote five basic measures:
1. Protect the crown jewels: This includes not spreading the budget evenly and identifying the assets whose loss would be critical for companies (IP, sensitive data, credentials, operating systems). In practice, this would mean bringing together their business, IT, and security teams to create a map of these assets and an explanation of why each one is vital for the organisation. There should also be a risk statement approved by the Board of Directors.
2. Assume that prevention will fail: The idea is to shift from a protocol of "avoiding the attack" to "containing it quickly". To do this, it is necessary to plan for what happens when it fails through a crisis action manual aimed at executives.
3. Manage the risks of the AI ecosystem: AI greatly increases dependence on third parties such as hyperscalers, model providers, SaaS copilots, tools, and plugins. Therefore, the CEO must avoid the company becoming excessively dependent on a single provider or model, just as they control the risk of financial concentration.
4. AI security by design: At this point, the BCG report recommends changing the company’s mindset by promoting the philosophy of “security by design”, meaning that security and development work together from day one, rather than it becoming a sort of after-the-fact patch.
5. Create a multifunctional team with the power to react quickly: Clear coordination of roles and responsibilities in critical moments, with real decision-making capacity, for which it will be necessary to activate constant monitoring protocols and focus on what is essential, always under the assumption that a security breach will occur at some point.
