Gartner ranks AI as four of top five enterprise risks

Gartner’s Quarterly Emerging Risk Report placed AI-related issues in four of the top five enterprise risk positions, with AI-driven cyber vulnerability discovery ranked first for a second consecutive quarter. [cite]: Help Net Security, Insurance Business

In Gartner’s report, AI strategy miscalculation debuted at No. 3. AI-driven competitive displacement debuted at No. 4, and the AI workforce preparedness gap ranked fifth. Geopolitical energy supply shocks held second place for a second consecutive quarter, making it the only non-AI risk in the top five. The firm produced the composite risk score from responses by 308 senior executives, auditors and enterprise risk management leaders. [cite]: Help Net Security, Insurance Business

Gartner said AI could enable attackers to find and exploit undisclosed software flaws before defenders can assess, prioritize and remediate them. A growing backlog of flaws may expose sensitive data and intellectual property longer and raise remediation costs. Kevin Mercado, a senior principal analyst in Gartner’s research division, said AI makes vulnerability discovery more efficient and accessible, straining traditional risk management approaches. Mercado warned that AI-driven vulnerability discovery may outpace organizational defenses without matching gains in governance, security operations and remediation. [cite]: Help Net Security, Insurance Business

Mercado warned that organizations may chase AI initiatives without testing use cases against business priorities. He added that available capabilities might go untested before organizations pursue AI initiatives. He also said expected returns might go untested before organizations pursue AI initiatives. [cite]: Help Net Security

Gartner warned that major decisions that depend on AI benefits can misfire if those benefits arrive later than planned, prove smaller than expected, or generate less economic value than predicted. Pressure to match rivals can push companies to spend on AI before understanding what a project can deliver or whether teams are ready. AI initiatives that underperform can pull budget and staff away from competing goals, and companies whose AI projects stay stuck in pilots could lose customers to rivals offering better services or lower prices through AI. [cite]: Help Net Security

Gartner ranked the AI workforce preparedness gap fifth. Job requirements may change faster than employees can build skills. Shortfalls in training and guidance can produce inconsistent AI adoption and weaker returns on AI investments. [cite]: Help Net Security

Gartner said geopolitical conflict, sanctions and damage to infrastructure may interrupt energy production and deliveries, pushing up energy and transportation costs. Companies that depend on steady energy supplies may delay operations or cut production. [cite]: Help Net Security

Gartner surveyed 225 leaders in senior risk and assurance roles in 2025 and found that 54% of organizations put AI in risk registers (logs where organizations track and manage risks) both as a standalone entry and inside other risk entries. The share tracking AI only as a standalone risk was 36% in 2024 and 23% in 2025. [cite]: Help Net Security

In a 2026 Gartner CFO survey, 17% said more than half of their AI projects delivered measurable revenue growth or cost savings. The firm’s 2026 board survey found 64% said organizations ought to assume more technology risk to create shareholder value. [cite]: Help Net Security

Gartner’s 2026 survey of audit committees found 43% anticipating an AI strategy audit within the next year. The firm said companies should clarify who oversees AI strategy and who puts it into practice. [cite]: Help Net Security

Gartner said firms should evaluate how every AI project affects competing priorities and resources, then determine how to measure its return. The firm also said companies should track how employees use AI-saved time and whether it produces measurable productivity gains. [cite]: Help Net Security

Kevin Mercado said organizations should treat AI as a portfolio of business decisions and tie investments to clear business outcomes. He said organizations should confirm readiness before expanding and create governance that enables responsible experimentation. [cite]: Help Net Security

Just 3% of organizations have met their targets for AI-driven productivity, efficiency and cost cutting. CV Viverito, senior director analyst for Gartner’s HR practice, said AI will not produce cost savings for organizations right now. She said 38% of companies are over budget on AI, while Gartner said 38% of leaders were already over budget on AI. [cite]: Yahoo Tech, Yahoo! Finance

Gartner said 85% plan to increase AI spending in 2027. Three quarters of board members expect productivity and savings returns on AI spending, yet 97% of organizations cannot cut expenses through productivity measures alone. [cite]: Yahoo Tech, Yahoo! Finance

Gartner said three quarters of leaders anticipate that AI will affect their organization, but 78% of leaders do not agree on where AI helps most in their workplace. Arj Bagga, vice president analyst in Gartner’s HR practice, said organizations need a shared view of where AI matters most to position the workforce and capture value. [cite]: Yahoo Tech, Yahoo! Finance

Gartner surveyed more than 1,800 employees and found that only 21% of AI-saved time moved into more innovative work. CV Viverito said organizations already create capacity through work redesign but struggle to make that capacity useful and valuable. She said the bigger opportunity is using AI to do previously impossible things and shift employee time into new capabilities, outcomes and growth sources. [cite]: Yahoo! Finance, Yahoo Tech

By 2028, Gartner predicts security operations center (SOC) teams will have 50% more engineers than analysts, and the SOC will not shrink by 2030. AI SOC agents already reduce alert-handling work for common and traditional detection use cases, and the firm says this marks the end of alert processing as the SOC’s primary function. [cite]: BleepingComputer

Gartner’s report says analysts should leave alert triage behind and take full responsibility for each case, including how analysts communicate response options. Gartner’s report urges analysts to stop sorting alerts one at a time and instead own each case through to resolution, while spelling out response choices, said Gartner’s AI-enabled SOC report by analyst Pete Shoard. [cite]: BleepingComputer

In a Prophet Security survey of more than 250 CISOs, SOC leaders and practitioners, 57% of respondents expect their team size to remain unchanged and 9% expect it to grow. Among teams that hunt weekly or more, 49% found malicious activity their detections had missed, compared with 8% among teams that hunt least often. [cite]: BleepingComputer

Gartner advises SOCs to stop recording alert metrics and run on cases and decisions instead. The firm wants detection engineering job descriptions and hiring requirements to cover prompt design, workflow testing and AI output validation. The firm calls exposure management the top emerging SOC capability, recommends continuous threat exposure management as a standing function, and predicts that by 2030 SOCs will be offensively driven, testing their own business like an attacker. [cite]: BleepingComputer

Gartner’s earlier Quarterly Emerging Risk Report had placed AI-enabled discovery of cyber vulnerabilities atop the global list of emerging risks, and had identified agentic AI as an AI-related emerging risk because its decisions and actions might not align with organizational policies, goals, legal requirements or ethical principles. Geopolitical energy supply shocks, the only non-AI risk in the top five, ranked second among 2026’s top emerging risks, as leaders worried about repeated energy supply shocks from geopolitical conflicts, sanctions and infrastructure disruption. [cite]: Insurance Business

Gartner’s earlier report said information integrity risk, once the top emerging concern, ranked fourth in the second quarter. The firm said it involves costly decisions and misinformed strategies as unreliable datasets, AI-generated content and politicized data reduce access to accurate information. [cite]: Insurance Business