Fifty-two per cent of chief executives now rank cybersecurity AI adoption friction as their next greatest challenge, trailing only ethical concerns. Seventy-nine per cent still rank AI as a top investment priority. Put those two numbers side by side and the boardroom conclusion writes itself: security is the thing slowing everyone down.
KPMG, the professional services firm, polled 1,400 chief executives for its 2026 Global CEO Outlook, published 15 October 2026. Every respondent led a company with revenue above US$500 million, across twelve markets and thirteen industries.
Cybersecurity placed second among the challenges CEOs named to AI adoption, behind ethical concerns at 57 per cent and just ahead of cost at 51 per cent. Cyber and data security is also the single risk CEOs rank highest to growth over the next three years, named by 31 per cent, ahead of global economic uncertainty at 28 per cent and geopolitical instability and regulatory pressures at 26 per cent.
Cybersecurity AI Adoption Friction Is Not the Same as Evidence
Those figures invite an easy reading: cybersecurity AI adoption friction has become the drag on delivery, and the fix is to loosen controls. That reading skips a question a board cannot answer from a survey alone. A control that slows every AI project equally is a queue. A control that slows the risky ones and lets the safe ones through is doing exactly what it should.
The two look identical from the outside. Both produce complaints from delivery teams, both show up as delay in a programme report, and both get summarised the same way in a CEO survey: cybersecurity is a challenge to AI. Only one of them is a problem.
The List a Board Should Actually Ask For
A board, or a PMO reporting into one, can turn that ambiguity into evidence with a single request. Ask the security function for four things. The AI initiatives it delayed this year. The stated reason for each one. Which of those went ahead regardless, and on whose authority. What happened afterwards, good or bad.
That list does more work than the original complaint ever could. If it is full of low-risk tools, a chatbot summarising public documents, a drafting assistant with no access to customer data, the friction is sitting in the wrong place and the 52 per cent figure is a genuine problem to fix. If it holds the pilot that wanted live customer data pushed into an unapproved third-party tool, the delay was the system working, and the complaint in the survey was really a compliment nobody meant to pay.
Neither answer is available until somebody asks for the list. Most boards never do. They see the friction, read it as evidence of a problem, and move straight to loosening controls without checking what those controls actually stopped.
The Other List Tells the Opposite Story
Ask for the mirror image too: what the security team approved quickly, and why. In one governance review, an executive asked to be exempted from multi-factor authentication because the extra step slowed him down. The exemption was approved within the hour. He turned out to hold the most heavily targeted account in the organisation, and granting that exemption was the fastest decision the security team made all year.
Delays and approvals are the same control, pointed in opposite directions. A board that only ever asks why something was slow will never see the moments it moved fast for the wrong reason, and a board that only tracks speed will never see what the speed cost.
KPMG’s figures suggest most organisations are already pointed the right way on investment. Forty-five per cent say they have increased spending on cybersecurity and digital risk resilience this year, and 59 per cent are placing more focus on internal data governance and controls as part of their AI strategy. The money and the attention are moving. What both are missing is a routine check on where they actually landed. The same blind spot shows up when boards facing security budget cuts mistake a quiet year for proof the money worked, rather than asking for the evidence it actually needs.
Pick the AI project your security team pushed back on hardest this year. Ask for the reason it was slowed, and ask who checked whether that reason still holds. If nobody can answer either question, the 52 per cent figure is not describing a security problem. It is describing a governance one.
