man in yellow jacked looking over city at night
Man contemplating the skyline of hong kong

How can you redefine resilience for the next frontier of vulnerabilities?

EY research explores how cybersecurity leaders are using recent frontier AI threat revelations as a catalyst to build resilience.


In brief

  • CISOs, boards and the C-suite need to take decisive steps over the next 12–18 months to build resilience following recent frontier AI revelations. 
  • EY research found that 36% of organizations’ assets have inadequate visibility and cybersecurity controls, making them vulnerable to AI-enabled attacks.
  • A leading cohort of “Secure Creators” is transforming cybersecurity to move at machine speed and is coordinating better across the enterprise to build resilience.

Frontier AI has changed the enterprise cybersecurity resilience challenge. Organizations must still protect their most critical assets, but resilience increasingly depends on their ability to see, govern and respond across the assets, identities and dependencies that sit outside their clearest line of sight.

Recent revelations about frontier AI models’ ability to discover and exploit vulnerabilities caught many organizations flat-footed. Verifying and patching weaknesses remains essential, but the deeper challenge is ongoing and structural. In a nonlinear, accelerated, volatile and interconnected (NAVI) environment, inflection points happen more frequently and rapidly, in ways that cascade across organizations, often pushing resilience to the brink. A future inflection point may take the form of a fully automated cyberattack, a quantum-enabled adversary or a cybersecurity risk we are yet to imagine.

In this environment, resilience must be redefined to encompass more than just incident recovery. Cybersecurity leaders must help their organizations continuously understand where vulnerability is accumulating, prioritize what matters to the “minimum viable enterprise” and respond at a speed closer to the threats now forming.

The 2026 EY Global Cybersecurity Leadership Insights Study shows where vulnerability might be accumulating. Based on a survey of more than 800 cybersecurity leaders and analysis of 475 asset types, we found that 36% of organizations’ assets fall into an area we have named the “vulnerability zone,” or the group of assets with below-average visibility and cybersecurity coverage.   

36%
36%
of organizations’ assets fall into the vulnerability zone, on average.

Why the vulnerability zone matters now

A by-product of the common “crown jewels” approach to cybersecurity — focusing protection on your most valuable assets — is the gradual formation of a segment of assets that aren’t adequately protected.

While this trade-off may have been acceptable in the past, adversaries have increasingly found vulnerabilities “on the perimeter,” chaining together attacks across organizations to reach more valuable assets. Frontier AI — and already publicly-accessible AI models — accelerates this paradigm, making underprotected assets more easily reachable by a broader swath of adversaries and flattening the time from vulnerability discovery to exploitation. According to the CrowdStrike 2026 Global Threat Report, the average eCrime breakout time fell to 29 minutes, highlighting how quickly adversaries can move from initial access to lateral movement.1

Encouragingly, the “Secure Creator” cohort, respondents we identified in past studies as organizations with more advanced cybersecurity functions than their peers, again emerged. In this year’s study, only 30% of Secure Creators’ assets fall in the vulnerability zone on average, compared to 42% of “Prone Enterprises,” the lagging cohort.

Secure Creators were better prepared for the frontier AI inflection point because they had strategies that better cover the attack surface (a strategy we covered in our 2023 study). They have been able to respond and adapt to AI-enabled threats more quickly because cybersecurity was already integrated into their organization-wide resilience strategies.

The chief information security officers (CISOs), boards and C-suites who champion these strategies and minimize the vulnerability zone will be better prepared when the next inflection point materializes.

Aerial drone night shot of city street lights in Lugano
1

Chapter 1

Identifying the vulnerability zone

The vulnerability zone is concentrated in certain asset categories and varies by sector. It will evolve as pace of change accelerates.

For many boards, C-suites and regulators, revelations about frontier AI risk solidified cybersecurity as a critical facet of resilience. For CISOs, building resilience for future cybersecurity inflection points requires understanding how three shifts are reshaping risk across their organization’s assets:

  • Rapid AI experimentation and adoption are expanding and augmenting the attack surface.
  • Increasingly complex third-party and software supply chains are introducing risk into assets beyond organizations’ direct control.
  • AI-enabled adversaries can exploit vulnerabilities in underprotected assets to move laterally across organizations.

These shifts do not affect all assets equally. Identification of the vulnerability zone helps CISOs understand these changes on a more granular level and improve visibility and coverage of assets where they see risk accumulating.

Our research also measures how frequently assets undergo changes that require updated security controls. Frequently updated assets, like an AI tool for inventory management or a cloud-hosted administrative system, can create visibility and coverage gaps for cybersecurity functions that are not prepared for a high pace of change. In fact, our survey’s respondents cited velocity of technology change as the biggest difficulty in keeping accurate asset registers. 

Though respondents from different sectors received sector-specific lists of assets, every respondent’s asset list was grouped into the following categories:

  • AI systems and tools
  • Cloud assets
  • Data assets
  • Ecosystems and third parties
  • Network infrastructure
  • Non-AI digital assets
  • OT and physical assets

OT and physical assets (57% of assets in the vulnerability zone), ecosystems and third parties (49%), AI systems and tools (47%), and network infrastructure (38%) were most likely to fall in the vulnerability zone.


It is not surprising to see OT and physical assets as the category most likely to fall in the vulnerability zone; these assets are often outside the cybersecurity function’s remit. In the past, this might have been an acceptable risk for boards. Now, as physical AI proliferates and previously firewalled assets are increasingly connected to networks — all while the threat to OT from frontier AI grows — CISOs should be leading the effort to protect these assets. This starts by gaining better visibility of the attack surface.

 

Ecosystems and third parties, the second-most represented category in the vulnerability zone, are increasingly important for organizations’ critical operations, from software and cloud infrastructure to logistics and service delivery. As their criticality grows, they increasingly require persistent, privileged access to internal networks and environments, which materially expands the attack surface. Agentic AI may intensify these dynamics, as effective deployment requires AI vendors to have pervasive access across multiple functions or across entire organizations. 

 

Adversaries are capitalizing on this exposure, frequently targeting third parties as an initial access vector before pivoting laterally into primary target environments. To decrease this exposure without limiting critical third-party relationships, CISOs should close foundational control gaps found by our survey: 47% of organizations fail to properly segment their environments, and 59% lack comprehensive asset telemetry, reducing visibility and delaying detection.

47%
47%
of organizations fail to properly segment their environments.
59%
59%
of organizations lack comprehensive asset telemetry.

AI systems and tools were the third-most represented category in the vulnerability zone. AI poses challenges for both the visibility and coverage elements of the vulnerability zone calculation. Visibility is challenged in multiple ways. The generative AI rollout often creates shadow usage and untracked data flows as employees adopt tools outside approved channels, while agentic AI introduces additional blind spots through proliferating agents, identities, tool connections and autonomous actions that are difficult to inventory and monitor. Coverage gaps compound the issue because many security teams do not yet apply consistent controls, testing, monitoring or governance to AI systems and tools that evolve quickly and connect to sensitive data and workflows.

Network infrastructure, with 38% of assets in the vulnerability zone, is the fourth-most represented category, but a top concern for CISOs. Adversaries, especially nation-state actors, are increasingly targeting perimeter devices like VPN gateways, firewalls, routers and edge network appliances, as initial access vectors. Compared to modern cloud services or endpoint software, many of these kinds of networking devices have characteristics like custom firmware or slow patch cycles that will make them even more susceptible to frontier AI-enabled threats. It is critical for CISOs to move these assets out of the vulnerability zone by improving their visibility and cybersecurity coverage.

Sector vulnerability zone analysis


Our analysis reveals sectoral patterns in the vulnerability zone. Broadly, sectors more dependent on OT assets — like Infrastructure, Mining & Metals, Power & Utilities, Oil & Gas and Chemicals — have more assets in the vulnerability zone. Most of the sectors with the fewest assets in the vulnerability zone — Government & Public Sector; Banking & Capital Markets; Insurance; Aerospace, Defense & Mobility — typically have regulatory regimes that enforce stricter security rules.


Your sector’s vulnerability zone

Select your industry and sector below to read more about its vulnerability zone.

Asian man watching the Singapore skyline at night
2

Chapter 2

Gain complete visibility to minimize the vulnerability zone

Partial visibility of your assets is no longer adequate as threats from frontier AI expand the attack surface.

Our study found that 70% of cybersecurity leaders believe their most significant risks are located in blind spots.

With boards and C-suites now more attuned to cybersecurity risk following recent frontier AI vulnerability revelations, CISOs should use this moment to invest in enterprise-wide visibility.

70%
70%
believe their most significant cybersecurity risks are located in blind spots.

Our research found that many cybersecurity functions are starting from behind. According to our analysis of open text survey responses, respondents’ biggest challenges in achieving asset visibility are dependency complexity, resource constraints and asset data governance.2 Only 43% of respondents use automated methods to identify and inventory assets, and 45% said they were confident that their asset inventory is complete and up to date. 


The exclusive use of manual, disconnected asset identification methods in a world where adversaries can — in seconds — locate and exploit vulnerabilities in systems invisible to cybersecurity is a threat to enterprise resilience.

These methods are also out of sync with how future, agentic AI-enabled organizations will be organized and operated. In agentic AI environments, where software agents can create and use identities, permissions and tool connections at machine speed, manual asset identification methods are too slow and fragmented to maintain an accurate view of what exists, how it interacts and where risk is accumulating.

“In agentic environments, visibility must shift to real-time, machine-readable mapping of agents, identities, permissions and execution paths as they form,” said Maez de Guzman, EY Global Cybersecurity Managed Services Emerging Markets Leader. “Control depends on identity, continuous telemetry and AI-driven discovery, with graph-based exposure analysis surfacing emergent risk. Organizations with architectures that can observe, reason and act at runtime can collapse the window between risk formation and remediation.”

Secure Creators, our survey’s leading cohort of respondents, appear better prepared for frontier AI-enabled threats because they are closer to full enterprise visibility and better understand the interconnections between their assets. This is reflected in significantly higher satisfaction with configuration management databases (85% versus 45% of Prone Enterprises), giving CISOs a more reliable view of what matters most and where exposure concentrates.

Leading CISOs are building on this foundation by shifting toward autonomous, AI-assisted discovery, prioritization and remediation, supported by continuous telemetry and threat-based exposure monitoring. They pair these capabilities with clear, cross-functional ownership for remediation and integrate security into software development lifecycles. This positions organizations to adopt AI more safely and operate effectively in autonomous, agent-driven environments.

“Leading cybersecurity functions need to use the lessons they learned securing software development by building cybersecurity into AI agent development lifecycles,” Ganesh Devarajan, EY Americas Consulting Cyber Risk Leader, said. “This build-out should include automated discovery of AI models and agent‑to‑agent communications.” 

Beyond asset visibility, Secure Creators are also more advanced than their peers at network, identity and dependency mapping — a critical capability in a world where AI-enabled adversaries are increasingly targeting identity and trust mechanisms as entry points to quickly move laterally across enterprises. Secure Creators, who are more likely to highly rate their network mapping abilities (67% give high ratings vs. 59% of prone enterprises), are building extended visibility maps across their organizations.

As the very concept of an “identity” evolves with the agentic AI rollout, CISOs who have the best fundamental understanding of their attack surface and the interplay between networks and dependencies will be best positioned to manage the proliferation of non-human, dynamic and machine-speed identities.

Sunset on Saigon riverside,  in Ho Chi Minh city, Vietnam
3

Chapter 3

How to build resilience for the next cybersecurity shock

The current moment is a catalyst for firms to more deeply integrate cybersecurity into enterprise resilience, before the next inflection point hits.

In a NAVI world, inflection points beget more inflection points, meaning boards and C-suites need to think beyond the threats posed today by frontier AI models. In our survey, conducted in the weeks before the recent frontier AI revelations, only 45% of cybersecurity leaders felt prepared for AI-enabled threats. Just 21% are prepared for quantum-enabled threats.

To prepare for these risks — and those we are yet to imagine — organizations must build resilience strategies that deeply integrate cybersecurity and allow them to uphold their fundamental promises to stakeholders in the face of disruption. This approach requires defining and defending the minimum viable enterprise (MVE): the critical capabilities, assets and dependencies needed to sustain core commitments. Defending the MVE requires real-time signals that indicate whether it can still function as conditions change, tabletop exercises to validate its architecture, and physical and digital infrastructure to close strategic gaps.

For cybersecurity to enhance resilience, defenses need to operate much closer to machine speed and to be structurally aligned with the threat landscape. Resilience depends on continuous monitoring, high-quality intelligence and automated detection and response. With adversaries increasingly moving across legacy systems, internal dependencies, third parties and data access pathways, leaders need a connected view of the attack surface that reflects how systems interact and how failures propagate.

Frontier AI and future inflection points will expose the cost of deferred enterprise modernization. A recent survey supporting the long-term research collaboration between EY and the Saïd Business School at the University of Oxford shows that there has been a 28% increase in the number of organizations motivated to undertake large-scale transformations to improve their cybersecurity. Legacy architectures, accumulated technical debt and poorly understood complexity are resilience liabilities in the face of faster, more adaptive threats. Sustained resilience will require confronting structural weaknesses directly, rather than continuing to manage around them.

Coordinating resilience outside of your organization

Frontier AI model developers have launched ecosystem-wide initiatives in response to a new reality: vulnerability discovery is accelerating faster than most organizations can validate and remediate issues on their own. Alongside these efforts, initiatives such as CrowdStrike's Project QuiltWorks – an industry coalition that uses AI to identify, validate and prioritize vulnerabilities before they can be exploited – bring together security providers, AI researchers and organizations including EY to accelerate coordinated risk reduction.

"Project QuiltWorks is about using frontier AI to help organizations stay ahead of emerging risk," said Fabio Fratucello, Field CTO World Wide, CrowdStrike. "Powered by leading frontier AI models, QuiltWorks brings together CrowdStrike's security expertise and industry partners like EY to help identify vulnerabilities, understand how they can be chained together by adversaries, and validate risk in real-world environments. The goal is to help organizations prioritize remediation and reduce exposure before vulnerabilities can be weaponized.”

For participating organizations, these initiatives can provide earlier visibility into emerging vulnerabilities, faster validation and more coordinated remediation efforts across interconnected ecosystems. More broadly, the industry benefits when vulnerabilities are identified and addressed upstream by technology providers, reducing systemic risk and helping organizations mitigate exposure before vulnerabilities are exploited.

Resilience depend on managing cybersecurity risks from identities and SaaS providers

Only 48% of respondents are confident in their ability to quickly detect an incident in their supply chain. 

Resilience and business continuity increasingly depends on trust in third parties that support critical business processes. This arrangement looks precarious in the face of increased identity-based cyberattacks, which prey on identity protocols that require direct interaction between sensitive internal resources and SaaS providers. As highlighted in the CrowdStrike 2026 Global Threat Report, 82% of detections were malware-free, demonstrating that many modern intrusions increasingly rely on compromised identities, legitimate credentials and trusted access pathways rather than malware.

only
48%
48%
are confident in their ability to quickly detect an incident in their supply chain.

Faster vulnerability discovery and exploitation compound the issue. Many third‑party vendors — especially smaller, less-resourced firms — may be unable to provide sufficient evidence of remediation or patching of vulnerabilities exposed by frontier AI. Identifying and validating alternative providers is one workaround, but viable substitutes do not exist in many cases, particularly where critical processes rely on a small number of specialized vendors.

To combat this reality, organizations must adapt how they interact with third parties to build resilience and counteract the rise in identity-based threats. This means moving from periodic vendor assessments and “VPN and a contract” to continuous, identity‑centric, least‑privilege, monitored access patterns paired with supply‑chain assurance and runtime guardrails.

Secure Creators are already ahead. They are more likely to have mandated and verifiable security requirements for third parties with access to their organization’s environment (55% have these requirements vs. 39% of Prone Enterprises). They are also significantly more confident in their ability to quickly detect a cybersecurity incident in their supply chain (68% vs. 30%) or in a data center (81% vs. 49%).

Expanding the cybersecurity remit over OT and physical assets is critical to enterprise resilience

OT doesn’t always fall squarely within cybersecurity’s remit, but CISOs need to be consulted when OT and physical assets are being connected to networks or enabled with AI. When consulted on these projects, CISOs should weigh two considerations:

  • Don’t connect OT by default: every new connection should be treated as a deliberate risk decision, weighing the operational benefits against the cybersecurity threat.
  • Assume legacy OT will remain vulnerable: for already connected environments running hardware that is rarely or never updated, CISOs need to defend around unpatchable systems with isolation, monitoring and compensating controls.

“Resilience in OT starts with visibility — asset identification is key,” Piotr Ciepiela, EY Global Cyber Architecture, Engineering & Emerging Technology Leader said. “While cybersecurity typically drives that effort, it’s impossible without deep coordination with OT. And even then, you have to plan for the reality that much of the OT environment can’t be patched, so resilience comes from segmenting, isolating and building controls around what you can’t fix.”

Two shifts in the cybersecurity threat landscape make OT coordination critical for resilience. The first shift is toward OT as a threat vector, with groups like Volt Typhoon demonstrating how adversaries can quietly compromise legacy OT and infrastructure systems to undermine operational resilience over time. The second shift is toward using advanced AI capabilities to identify and exploit weaknesses in connected devices, interfaces and legacy environments that aren’t as frequently updated as IT systems.

In our study, the Secure Creator cohort manages OT and physical assets better than their peers by coordinating more closely with the operations function. They are more likely to have cross-functional teams for OT coverage (61% vs. 51% of Prone Enterprises) and are more satisfied with their coordination with operations teams for the security of physical assets and OT (68% vs. 45%).


Female working on a computer trading in a futuristic style
4

Chapter 4

Steps to minimize the vulnerability zone in the age of frontier AI

CISOs should use the next 12 to 18 months to materially shrink the vulnerability zone.

Here are six steps CISOs should take to improve visibility and cybersecurity controls to minimize the vulnerability zone, while focusing on resilience and investing in modern cybersecurity technology to prepare for the next inflection point.

Piotr Ciepiela, EY Global Advisory Cyber Architecture, Engineering & Emerging Technology Leader; Maez De Guzman, EY Global Cybersecurity Managed Services Emerging Markets Leader; Ganesh Devarajan, EY Americas Consulting Cyber Risk Leader; Scott McCowan, EY Global Consulting Risk Markets Leader; AnnMarie Pino, Associate Director, Ernst & Young LLP; William Reid, Assistant Director, Ernst & Young LLP; and Joe Morecroft, Associate Director, EYGS LLP, contributed to this article.


Summary

Many organizations were unprepared for the recent frontier AI cybersecurity threat revelations. Leading CISOs, with support from their boards and C-suites, are using this moment to build cybersecurity resilience for the next inflection point. They are doing so by identifying and minimizing their organization’s vulnerability zone and by building trust across the AI lifecycle.

Related articles

When the world shifts overnight, can you operate at the speed of trust?

Risk operating models must become strategy-first, trigger-based and governance-forward. Learn how Risk Strategists are leading the way.

Reimagine your cyber guardrails to accelerate AI value

In a nonlinear, accelerated, volatile and interconnected cybersphere, enterprise-wide AI adoption is safer and faster with cybersecurity guardrails.

How can cybersecurity go beyond value protection to value creation?

The 2025 EY Global Cybersecurity Leadership Insights Study found that CISOs account for US$36m of each strategic initiative they are involved in. Read more.

Contact us
Like what you’ve seen? Get in touch to learn more.


About this article

Authors