EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients.
How EY can help
-
EY Center for Board Matters. We support board members in their oversight role by helping them address complex boardroom issues. Find out more.
Read more
Companies are putting the spotlight on their technology governance, signaling an increasing emphasis on cyber and AI oversight to stakeholders.
In the past year, according to company disclosures, the increased sophistication of cyber threats has prompted companies to enhance their cybersecurity defenses, while adversaries have also advanced their attack methods. Ransomware attacks rose by over a third, and generative AI (GenAI) — rather than traditional AI — is emerging as a key feature of the threats, often in the form of deepfakes, and the company response.
Deepfakes are just one example of threat actors’ using GenAI for malicious purposes and are now the second most common type of cybersecurity incident, behind malware.¹ However, some argue that today’s biggest risk is the loss of sensitive company information when employees use unapproved AI services.²
One recent survey of full-time employees across industries and regions in the United States found that 78% of employees report using AI tools in the office and 58% admit to providing sensitive company information to large language models.³ At the same time, organizations are increasingly using GenAI as part of their toolkit to respond to cyber risks.⁴ Board oversight of these areas is critical to identifying and mitigating risks that may pose a significant threat to the company. This article explores how technology oversight disclosures and related governance practices are evolving to meet the challenges of this moment. We aim to help boards and management teams understand the disclosure landscape and the underlying governance practices it reflects and identify opportunities to strengthen and better communicate the rigor of their governance approach in an area of stakeholder focus.