The new cyber battlefield: How AI is reshaping enterprise risk and resilience
By Kunal Pande, Partner and National Leader- Cyber, Risk and Compliance, KPMG in India
While the scale and scope of Artificial intelligence (AI) continue to evolve, it is simultaneously reshaping the complexity, volume and speed of cyberthreats. In an increasingly uncertain environment, companies are compelled to rethink their resilience strategies and amplify cybersecurity. Consequently, AI has emerged as both a technical and strategic capability to address these challenges, enabling organisations to strengthen defensive operations and meet regulatory demands. According to findings of the Global Cybersecurity Outlook 2026, 94 per cent of survey respondents consider AI as the most significant driver of change in cybersecurity.
Even as AI is being used to augment the velocity and sophistication of cyberattacks, organisations have an opportunity to harness these same technologies to strengthen resilience and transition to an AI-enabled cybersecurity organisation.
Today, risk management is at the core of achieving operational resilience. Artificial Intelligence, including generative AI (GenAI) and agentic AI, is the engine driving a seismic shift in how organisations anticipate, assess, and act on risk. Organisations that deploy AI strategically, stand to augment human expertise, automate and accelerate security operations, and help address some of the structural challenges in cybersecurity such as talent shortages, resource constraints, and increasing regulatory demands.
The traditional playbook comprising manual processes, backward-looking assessments, and fragmented frameworks — is being steadily replaced by intelligent systems that learn, adapt, and act in real time. Risk teams have enhanced the use of AI, such as automation and advanced data analytics tools, for various tasks for many years. Accordingly, today’s risk leaders see massive potential in moving beyond the basic AI tools at their disposal to take advantage of the latest AI advancements, including GenAI, to surface deeper risk insights, automate workflows, and turbocharge risk managers’ efficiency and productivity.
Along with building capabilities to prevent a cyberattack, companies around the world have been learning the hard way that it is equally crucial to have robust capabilities real-time detection and rapid response. Through real-world case studies one can see how AI is being applied to enable fraud prevention.
For instance, when a global software giant struggled to uncover hidden threat intelligence quickly within large volumes of data such as legal discovery responses and documents from hosting providers, it developed an AI-powered tool to address these challenges. Valuable threat indicators are often buried and difficult to find, which slows down forensic investigations and makes it harder to communicate risks to defenders and customers. With newly developed AI application, the company was able to automatically tag likely threat intelligence indicators. A chatbot was used to curate intelligence rapidly, enabling analysts to identify relevant information within seconds or minutes rather than hours. The solution significantly accelerated identification and curation of threat intelligence, reducing forensic investigation times from hours to minutes. Moreover, it enabled clearer communication of complex threat data to both internal defenders at the digital crime unit and customers, turning intelligence into actionable insights.
Cybercrime has emerged as a key trend impacting their firm’s prosperity as per respondents of KPMG 2025 India CEO Outlook. This is the primary reason why they view cybersecurity and AI integration as a critical factor and increasing investments therein. In the journey of preparedness against increasingly sophisticated cyber risks, agentic AI enables autonomous systems not just detect but also respond to cyber threats before they fully materialise. That said, organisations must carefully determine the appropriate level of human oversight, from human-in-the-loop to fully autonomous operations, based on risk and reversibility of actions. At the same time, agentic AI introduces new risks that require robust guardrails throughout the agent life cycle, and therefore requires commensurate uplift in governance infrastructure such that guardrails operate with the pace of AI enabled operations and changes
Going forward, what will separate the leaders from followers is how smartly and boldly they embrace and embed AI advances into their risk operations and governance capabilities.