How anxiety, AI and allocation gaps are reshaping Ireland’s cyber future

Among the most encouraging findings of the EY Ireland Cyber Leaders Index is the high level of satisfaction with cybersecurity budgets. Nearly all organisations either maintained or increased their budgets over the past 12 months, with only 1% reporting a decrease. Two-thirds held steady, and 12% of those increasing budgets did so by more than 10%.

Only 18% cited budgetary constraints as a significant challenge in managing cybersecurity in their organisations.

The findings suggests that organisations are recognising the importance of cybersecurity and are committed to sustaining or enhancing their investment.

There were notable variations between the sectors surveyed. Some 42% of general business and 30% of government respondents reported increases while just 23% of life sciences respondents reported an increase. This may be an indication of the relative maturity of the cyber functions in each of the sectors.

Cyber leaders who make a clear case for funding and show how it will be used are getting what they ask for.

However, resilience is being undermined by poor budget allocation. Priority areas like staff training, AI and data security, and talent acquisition often struggle to secure funding, even though cyber leaders consistently rank them as essential.

Compliance initiatives like NIS2 are also underfunded, with most organisations allocating less than 3% of their cyber budgets. This reveals a disconnect between strategic intent and actual investment.

Is AI adoption chipping away at cyber budgets? In another finding, there appears to be very little diversion of cyber budgets to AI. Only 12% of respondents say they’ve shifted funding to AI. A third report increased cyber budgets, suggesting AI investment hasn’t led to meaningful reductions.

Cyber budgets may be holding steady, but organisations are still facing constraints. Funding remains difficult to secure for essential areas like staff cyber awareness training, continuous security assessment (58%), and incident response planning (51%), despite their central role in resilience.

Only 13% considered evolving regulations a major cause for concern. This reflects confidence in regulatory compliance within cybersecurity programmes.

This is noteworthy given the expanding regulatory landscape, including GDPR, the Cybersecurity Act, NIS2¹, DORA, and the AI Act. In fact, compliance with NIS2 and other relevant regulations and privacy laws was cited as a cyber programme priority by 39% of respondents.

However, this confidence may be masking a deeper fragility. Despite the perceived readiness, 44% of respondents indicated that less than 3% of their cyber budget is allocated to compliance initiatives. This very low level of investment raises questions about whether organisations are truly prepared or simply believe they are. If organisations claim readiness for NIS2 and AI Act reviews but dedicate minimal funding to compliance, it suggests a blind spot: one where compliance is underfunded but overestimated, especially in the context of rising AI-related risks.

It is also noteworthy that 58% of respondents say their organisations have invested in the automation of cybersecurity compliance and assessment.

Critical Entities Resilience (CER) regulations and the Cyber Resilience Act will introduce new demands. Preparedness will require fresh investment, and trust architects should move early to secure the necessary resources.

Nearly three-quarters (72%) of respondents reported difficulty securing budget for staff cyber training and awareness, making it the top budgetary concern. Two in five cyber leaders identify talent as their next step in preparedness, yet funding for training remains elusive suggesting a disconnect that will potentially threaten organisation resilience.

This is particularly striking given that staff training is widely recognised as a critically important, if not the most essential, component of cybersecurity.  It also suggests that cyber training is still seen as a one-off exercise. But the human side of cybersecurity needs consistent investment.

Cyber leaders are also facing challenges when it comes to hiring and retaining talent for their teams. 30% of respondents identified a lack of skilled personnel as a key challenge. This is not surprising given the general shortage of skilled and qualified IT professionals across the economy.

This issue was most acute in the life sciences sector where 36% of respondents identified a lack of skilled personnel as a key challenge. This may reflect the combination of industry specific and cyber skills required by the sector.

The consequences could be particularly severe with two in five (40%) respondents saying hiring and retaining talent is one of the steps they plan to take to enhance their cyber preparedness over the next 12 months.

One effective response to the cybersecurity talent shortage is to cultivate talent from within. Numerous upskilling programmes, such as those offered by Enterprise Ireland and Skillnet Ireland, provide accessible pathways for organisations to train employees in cybersecurity and related digital skills.

The acceleration of AI adoption is reshaping cyber priorities. 48% of respondents now rank AI and data security as a top focus for the year ahead.

The EU AI Act is already having an impact with nearly half (47%) of the organisations surveyed claiming to have updated their data handling and monitoring practices in response to the legislation. In addition, 39% have updated their data protection impact assessment systems.

Somewhat surprisingly, 44% of respondents identified AI and data security as an area of challenge when it comes to obtaining budget allocations and approvals. This may reflect internal competition for limited AI budgets, not reluctance to invest in cybersecurity. Leaders want impact, and every team wants a share.

Cyber leaders need to lead AI adoption to protect their own budgets and claim their share of what will surely be an expanding AI budget. Embedding cybersecurity into AI efforts positions the function as a driver of growth and advantage. There is already some evidence of cyber budgets being diverted to AI with 12% of respondents saying it has occurred.

While 68% of respondents say that protecting against supply chain and third-party cyberattacks is a top priority, only 4% list third-party vendor risk as a main concern. Cyber leaders fight for budget, with 21% stating that funding is hard to secure, but fail to treat the issue as strategic.

The gap between awareness and prioritisation is especially alarming in light of the recent cyberattack that caused days of disruption at several European airports after the check-in system used by many airlines and airports was hit by a ransomware attack².

Our survey further shows that 27% of respondents plan to strengthen supply chain security in the next year. Life sciences leads at 30%, while government lags at 22%, likely due to more rigid procurement processes rather than lack of focus.

These findings suggest that Ireland’s cyber leaders are underestimating the supply chain threat. They acknowledge its existence but don’t follow through when prioritising actions and initiatives.

Third-party cyber risk remains loosely regulated unless a breach triggers GDPR or privacy penalties. New frameworks like NIS2 and the EU AI Act are increasing accountability, but enforcement is uneven. M&A activity also introduces external vulnerabilities that organisations need to manage carefully.