프론티어 AI의 시대에서 기업은 어떻게 회복탄력성을 재정의해야 할까요?

The Banking & Capital Markets sector stood out in our study for the strength of its cybersecurity posture, which likely reflects the weight of regulatory expectations around operational resilience, incident reporting and third-party oversight. In the United States, banks are subject to formal cybersecurity incident notification requirements, and in Europe, DORA has raised the bar further for ICT risk management, resilience testing and oversight of critical service providers. Even so, the sector is not immune to the next wave of cybersecurity exposure as AI is further integrated into customer interaction and data environments, particularly where new capabilities are introduced through APIs, partner integrations and shared technology platforms.

Key sector insights from the study

• The Banking & Capital Markets sector has above average visibility compared to all other sectors.
• However, many assets have insufficient cyber coverage, especially cloud accounts and landing zones, customer service AI assistants, and data center providers.
• Accelerated pace of change might create new vulnerabilities for the sector. Banking & Capital Markets assets have higher frequencies of changes that require updates in security controls than average. For example, 35% of respondents said open banking APIs and partner integrations undergo monthly or more frequent changes that require updates in cybersecurity controls.

The Wealth & Asset Management operating model depends heavily on external providers across cloud, SaaS, research, market data and outsourced back-office services. As AI expands into client service and internal workflows, the challenge shifts toward understanding a broad service ecosystem that may have access to sensitive data or connected processes, especially because faster vulnerability discovery can shorten the path from a weak external provider to lateral movement into core workflows and client-facing services.

Key sector insights from the study

• Thirty-two percent of assets in the Wealth & Asset Management sector fall into the vulnerability zone.
• A notable concern sits in ecosystems, with fewer than a quarter of respondents saying they had visibility over cloud, SaaS and data center providers, research providers, or outsourced back-office providers. This could become more significant where those providers have network access or support critical workflows.

Being a leading target of cyberattacks poses unique risks for Government & Public Sector organizations that are under pressure to modernize services, in part by adopting AI and connecting data to more digital systems. Constituent-facing AI tools and supplier-connected APIs can improve service delivery but also introduce new points of exposure. Agentic AI can connect disparate legacy systems, but it does not remove legacy vulnerabilities and can increase risk due to the potential blast radius of a compromised agent. For public sector organizations, the main challenge is whether security controls are being updated quickly enough across public services, third-party and supplier ecosystems (including vendor‑hosted data, software dependencies and outsourced service providers), and the connected interfaces that modernization efforts introduce.

Key sector insights from the study

• Eleven percent of assets in the Government & Public Sector fall into the vulnerability zone.
• This is one of the strongest sectors in the study for visibility and cybersecurity coverage over assets, potentially due to higher baseline security across Government & Public Sector organizations, given the increased likelihood and sensitivity of cybersecurity incidents.
• A possible point of concern is public-facing AI, with only 31% of respondents saying they had full visibility over AI assistants for constituent services, and only 18% saying they had full cybersecurity controls over them.
• Government & Public Sector respondents also report lower-than-average visibility and cybersecurity coverage over public and private APIs (only 31% report full visibility and 20% report full coverage), and over government-wide networks and backbone connectivity (only 33% report full visibility and 24% report full coverage).
• Accelerating internal modernization efforts might create new vulnerabilities for the sector. Only around a third of respondents said constituent service portals, public and private APIs, and remote access platforms for contractors undergo monthly or more frequent changes that require updates in cybersecurity controls.
• Despite reporting relatively low direct exposure, governments may remain highly exposed to cyber risk through critical infrastructure dependencies that are often operated outside of government itself.

Infrastructure operators face one of the clearest examples of cybersecurity risk moving closer to physical operations. Rail systems, traffic infrastructure and structural monitoring assets are increasingly connected to networks, but many remain difficult to monitor with the same rigor as enterprise systems. Frontier AI accelerates vulnerability discovery in these environments, helping adversaries identify misconfigurations, weak authentication, and exposed remote access paths in OT and monitoring systems. As connectivity expands, operators need end-to-end asset inventory, continuous monitoring and segmentation to limit how far an intrusion can spread.

Key sector insights from the study

• Seventy-one percent of assets in the Infrastructure sector fall into the vulnerability zone.
• The high share of assets in the vulnerability zone indicates that infrastructure cybersecurity risk is concentrated in physical and operational environments that are often operated outside government, where limited visibility or coverage increases the likelihood that cyber weaknesses translate into public service disruption or safety impacts.
• For rail operators, rail signaling, switches and control equipment are a notable concern, with only 9% of respondents saying they had full visibility over these assets.
• Other physical assets have low visibility including bridges, tunnels, and structural monitoring sensors (16% have full visibility) and traffic signals, controllers, and roadside equipment (27% have full visibility).
• By nature of this sector, infrastructure assets have lower than average pace of change, which provides an opportunity for organizations to improve visibility and coverage.

Aerospace, Defense & Mobility organizations appear to have stronger core cybersecurity discipline than most sectors, but they still face pressure from AI adoption, complex supply chains and heightened geopolitical risk. Many of the most critical functions in the sector depend on external partners, from maintenance and repair to specialty hardware and component suppliers. Cybersecurity resilience depends not only on internal controls but also on how well organizations understand the security of the broader ecosystem around them, especially where suppliers may themselves be targets of state-backed activity.

Key sector insights from the study

• Seven percent of assets in the Aerospace, Defense & Mobility sector fall into the vulnerability zone.
• Broadly, respondents report better visibility and cybersecurity coverage over assets than peers in other sectors, but organizations tend to have less visibility over their ecosystems than over their other assets, including maintenance and repair partners, specialty chip and hardware supply chain partners, and avionics and component suppliers. This is a potential concern as third parties are critical to operations in this sector, particularly for defense companies whose suppliers may be targets for state-sponsored cyberattacks.
• Accelerated pace of change might create new vulnerabilities for the sector. Twenty-two percent of respondents said public and private APIs, remote access and jump hosts undergo monthly or more frequent changes that require updates in cybersecurity controls.

As industrial assets become more connected and AI-enabled, manufacturers are pushing deeper into vulnerability zones, where visibility gaps and cybersecurity controls lag behind operational integration. At the same time, frontier AI is making it faster and easier to identify and exploit these weaknesses, raising the risk to systems at the core of production.

Key sector insights from the study

• Forty-six percent of assets in the Industrial Products sector fall into the vulnerability zone.
• Asset categories in the vulnerability zone: AI systems and tools, OT and physical assets, and ecosystems.
• Industrial robots and automation systems stand out as a weak point, with only 20% of respondents saying they had full visibility over them, and only 7% saying they had full cybersecurity controls over them. Blind spots and coverage gaps are likely to become more important as these assets are increasingly connected to networks and integrated with AI.
• Supply chains were least likely to be seen as a source of cyber risk by industrial products respondents as compared to other sectors. As industrials seek greater transparency within their supply chains, control of exposure to cyber risk could be prioritized.

Mining & Metals organizations operate in environments where cybersecurity risk will increasingly reach into core production systems. As operational technology becomes more connected and more dependent on software and network infrastructure, weak visibility and weak controls can create direct operational exposure. That risk is rising as frontier AI makes it easier for adversaries to find exploits in systems that were often designed or long assumed to be secure, which increases the importance of building monitoring and protection around the industrial assets that support production.

Key sector insights from the study

• Sixty-seven percent of assets in the Mining & Metals sector fall into the vulnerability zone.
• Asset categories in the vulnerability zone: AI systems and tools, non-AI digital assets, network infrastructure, physical assets, data assets and ecosystems.
• Industrial control systems are a major weak point, with only 18% of respondents saying they had full visibility over PLC and SCADA applications, and only 11% saying they had full cyber controls over them.
• OT network infrastructure shows a similar gap, with only 18% of respondents saying they had full visibility over it, and only 16% saying they had full cyber controls over it.

Oil & Gas and Chemicals companies manage cybersecurity risk across distributed field operations, control environments and large contractor and supplier networks. As these environments become more connected, the consequences of weak visibility or poor controls rise quickly. Frontier AI adds to that risk by making it easier to identify exploitable weaknesses in control systems and supporting assets that were often built for availability and safety rather than persistent exposure to advanced cyber intrusion, which raises the importance of securing field and pipeline environments with the same rigor as the rest of the enterprise.

Key sector insights from the study

• Fifty-seven percent of assets in the Oil & Gas and Chemicals sector fall into the vulnerability zone.
• Asset categories in the vulnerability zone: non-AI digital assets, network infrastructure, cloud assets, physical assets, data assets and ecosystems.
• SCADA and control applications for field and pipelines are a significant concern, with only 18% of respondents saying they had full visibility over them, and only 13% saying they had full cybersecurity controls over them.
• Industrial control hardware is potentially at risk, with only 18% of respondents saying they had full visibility over PLCs and safety systems, and only 4% saying they had full cybersecurity controls over them.

Power & Utilities organizations face a cybersecurity environment shaped by a decentralizing value chain, increasingly connected operational assets, long-lived legacy infrastructure, and persistent geopolitical risk. As grids shift from a small number of centralized power plants to a large ecosystem of distributed assets, the expanding cyber-attack surface creates new risks. A coordinated attack on the digital platforms, communications networks or virtual power plants that orchestrate distributed energy resources could be more destabilizing than the compromise of a single physical plant.

This is compounded by deeper IT-OT integration and limited visibility across operational environments. As state-backed actors continue to target critical infrastructure, frontier AI further strengthens the attacker side by making it easier to identify weaknesses in systems historically assumed to be secure because they were specialized, isolated or difficult to access. For utilities, the priority is shifting from protecting individual assets to building visibility, control and resilience across OT networks, edge devices, field communications and third-party ecosystems that increasingly underpin reliable energy delivery.

Key sector insights from the study

• Power & Utilities is one of the more exposed sectors. Seventy-one percent of respondents are classified as “Prone Enterprises” (the laggard group of respondents), and 46% of sector assets fall into the vulnerability zone, indicating broad exposure across the sector’s asset base.
• The weakest points sit at the operational edge of the grid. Only 16% report full visibility over smart meters and field communications equipment, and only 16% report full cybersecurity coverage. Substation communications networks are similarly exposed, with 18% full visibility and 16% full coverage.
• OT visibility and control gaps create resilience risk. Only 20% have full visibility over OT networks for generation, transmission and distribution, while just 24% report full cybersecurity coverage, a critical gap as operational environments become more connected to enterprise systems, cloud platforms and AI-enabled tools.
• Cyber controls are not keeping pace with asset change. Only 4% can fully deploy required controls on a newly provisioned asset within 12 hours, while 78% take one to 30 days, a significant lag for a sector adding connected devices, distributed energy assets and third-party integrations.
• AI and geopolitics amplify an already exposed operating model. 80% agree that geopolitical competition over AI technologies is increasing external cybersecurity risk, yet only 38% say they are well prepared for AI-enabled threats and only 29% for threats arising from geopolitics, reinforcing the need to treat cybersecurity resilience as part of grid reliability.

Media & Entertainment organizations are increasingly using AI to enhance content planning, forecasting and audience engagement. At the same time, their operating ecosystem is becoming more interconnected, creating cybersecurity risks that can originate across agencies, adtech, distribution partners and content workflows, as well as in the organization’s own platforms. As frontier AI improves the speed and quality of vulnerability discovery, it can shorten the path from a weak external platform or workflow tool to broader enterprise exposure, especially in environments where revenue, audience engagement and content delivery depend on a wide set of partners.

Key sector insights from the study

• Forty-three percent of assets in the Media & Entertainment sector fall into the vulnerability zone.
• Asset categories in the vulnerability zone: AI systems and tools, non-AI digital assets, network infrastructure, OT and physical assets, data assets, and ecosystems.
• Respondents report better visibility over traditional revenue-driving assets, with 45% saying they had full visibility over customer engagement platforms and 48% saying they had full visibility over content hosting and distribution platforms.
• Visibility is weaker for potential future revenue drivers, with only 25% of respondents saying they had full visibility over AI for content demand and audience forecasting, and 48% stating they have limited to no visibility on AI for crowd management, safety, and incident prediction.

As Technology organizations roll out AI across products, internal tools and customer experiences, they are potentially exposing more software, APIs and data flows to cyber risk. Recent advances in frontier AI have shown that attackers can identify weaknesses and develop exploits faster than before, which raises the importance of knowing where AI is deployed and what data it touches. That pressure is amplified by reliance on software dependencies, cloud platforms and embedded third-party services, which expands the number of paths into the enterprise and makes it harder to keep controls aligned with how products and services are changing.

Key sector insights from the study

• Eighteen percent of assets in the Technology sector fall into the vulnerability zone.
• Nearly half of tech organizations report US$100 million+ annual cybersecurity spend (vs. 31% in other sectors). Most notably, tech organizations allocate 20% of their overall cybersecurity budget to AI, compared with 14% elsewhere.

• The visibility paradox: while 45% of tech respondents say they have complete visibility over 91%–100% of assets (vs. only 6% of other sectors), the picture changes when looking at asset categories. In particular ecosystems (22%), AI systems and tools (26%), and OT and physical assets (28%), have low visibility. Given how tech companies go to market through ecosystems, this presents opportunities for increased controls for supplier monitoring, third-party access governance, data center and cloud provider risk management, and ecosystem resilience.

• As it stands today, AI systems and tools are the most likely assets for tech organizations to fall in the vulnerability zone.
• Eighty-three percent of tech respondents believe quantum-enabled cyber threats become a real risk within the next five years. While select tech companies indicate they are prepared, now is the time to start having board and CISO-level discussions.

Telecommunications organizations are managing cybersecurity risk across large, connected networks, customer-facing applications and supplier ecosystems. That exposure is becoming more important as frontier AI lowers the effort needed to find and exploit weaknesses, while state-backed actors continue to target communications infrastructure for espionage and potential disruption. For telecom companies, this raises the value of strong visibility not only across core network assets but also across customer channels and third-party relationships, because weaknesses in those environments can give attackers a starting point for lateral movement that is difficult to detect and slow to contain.

Key sector insights from the study

• Thirty-two percent of assets in the Telecommunications sector fall into the vulnerability zone.
• Respondents have the strongest visibility and coverage over assets most central to network operations, including cell sites, towers, radios and antennas, and public and private APIs. On the other hand, ecosystem assets are most likely to fall into the vulnerability zone.
• Many customer-facing assets face cybersecurity issues, with only 28% of respondents saying they had full visibility over web and mobile account applications, and only 20% saying they had full cybersecurity coverage over them.
• Customer modems and routers are also a concern, with only 28% of respondents saying they had full visibility over them, and only 35% saying they had full cybersecurity coverage over them.