As AI adoption increases, are businesses prepared for the cyber risks?

Each week, we read headlines about yet another big brand or organisation facing a cyber attack. However, cyber criminals are not just targeting large companies, as Armstrong Watson’s 2026 Family, Privately Owned and Owner-Managed Business Survey shows.

Our survey found that almost one in three businesses (31%) have experienced a cyber security incident, highlighting the reality that any organisation can fall victim to an attack.

The perception of cyber risk is also beginning to change. Compared with last year’s survey responses, more business owners now view cyber threats as a genuine concern, rising from 61% in 2025 to 68% in 2026. While this suggests awareness is improving, 18% still believe they are unlikely to be targeted, although this has fallen from 29% last year.

This shift in sentiment is perhaps unsurprising. Among businesses that reported experiencing a cyber incident, the most common attacks were unauthorised access or hacking (40%), phishing and social engineering attacks (36%), payment fraud or invoice interception (34%), and malware or ransomware attacks (33%).

For many business owners, cyber security is still viewed as an IT issue, but in reality, it’s a business risk, a financial risk and a reputational risk, making it ever more important to ensure you have independent cyber assurance.

AI adoption and increased cyber risks

Artificial intelligence is also no longer a technology reserved for large corporates. In fact, 46% of respondents are already using AI within their organisations, up from 17% in 2025, while a further 23% are considering its adoption. AI promises greater efficiency, reduced administration and the ability to do more with fewer resources, and the survey found data analysis, reporting and content creation among the most common applications.

However, while businesses race to embrace AI, many may be overlooking a growing cyber risk - and the danger is not always a sophisticated hacker sitting behind a keyboard. Sometimes the greatest threat is a well-meaning employee unknowingly sharing commercially sensitive information, customer data, employee records or intellectual property with an AI platform. Once confidential information leaves the controlled environment of your business, it can be difficult to understand where it goes, how it is stored and who may ultimately have access to it.

As organisations adopt AI, they are increasingly relying on technology to drive growth, improve productivity and support decision-making. But if that technology sits on weak foundations, the consequences can be severe. A successful cyber attack, data breach or accidental disclosure of confidential information can result in financial losses, operational disruption, regulatory scrutiny and reputational damage that takes years to repair.

AI presents one of the biggest opportunities many organisations have seen in decades. But businesses that focus solely on its benefits without considering the security implications may be creating vulnerabilities they cannot yet see. The most successful businesses will not simply be those that adopt AI first - it will be those that embrace it confidently, securely and with the right safeguards in place.

How confident are you?

As AI adoption accelerates, many businesses are introducing new risks without realising it. A single phishing email, compromised account or employee sharing sensitive information with an AI platform could have serious financial and reputational consequences.

If you're unsure whether your cyber security controls, AI governance or employee awareness measures are keeping pace with technological change, now is the time to find out. When it comes to cyber security, it's far better that you uncover weaknesses yourself than have a cyber criminal do it for you.

An external cyber security review provides business owners with an objective assessment of their cyber risks, security controls, AI governance arrangements and employee behaviours. It helps organisations identify weaknesses before criminals exploit them and gives leadership teams confidence that innovation is not creating unseen risks elsewhere in the business.