Cybersecurity outsourcing and AI need stronger risk oversight

Cybersecurity capabilities need integrated oversight

A business can buy cybersecurity expertise and deploy artificial intelligence (AI) while still lacking the oversight to manage the risks they bring. Grant Thornton found that roughly three-quarters of 1,100 business leaders interviewed identified cybersecurity incidents as one of the greatest risks to firm performance over the next two years. Yet barely half were highly confident that their organization could identify a sophisticated cyberattack. This gap makes oversight a practical concern for leaders deciding how to strengthen their defenses.

Oversight depends on how these capabilities connect to daily operations and who is accountable for decisions. For outsourced security providers, that means alignment with internal processes through automation and shared tools; for AI, it means governance supported by monitoring and usable data. Grant Thornton identifies weaknesses in both areas and recommends closer coordination across risk functions. As a professional-services firm that sells advice on managing these risks, it has a commercial interest in demand for that work.

Outsourcing is widespread, while provider integration remains limited

The oversight question starts with staffing: businesses struggling to hire cybersecurity specialists turn to third-party security firms for help. Grant Thornton describes suppliers as “becoming an important source of defensive capability,” making provider relationships part of an organization’s security readiness. External expertise gives these businesses access to skills they struggle to build internally, but managing that expertise remains their responsibility.

External help is already widespread. “Virtually all (96%) of our survey respondents said their organizations are using some level of outsourced capabilities for cybersecurity threat detection and response,” Grant Thornton said. The figure covers respondents generally, including organizations that outsource only part of their detection and response work.

Widespread use raises a separate question: how do suppliers connect to internal operations? Only one-quarter of business leaders said their third-party cybersecurity providers were “integrated with internal processes, using automation and shared tooling,” according to Grant Thornton. Reviewing that connection therefore means examining how the provider’s work enters internal processes, how automation supports the exchange and whether both parties can use shared tools. These connections help determine how external expertise informs risk decisions and fits with assigned responsibilities.

Limited connections can also reflect a deliberate choice about exposure. Grant Thornton offers concern about risk exposure as one possible explanation for uneven links between vendors and internal systems, alongside customer–vendor relationships that may be insufficiently developed. Leaders therefore need to understand why each restriction exists and how responsibilities remain clear within it. A business can preserve necessary limits on supplier access while defining how the provider’s work reaches the people responsible for acting on it.

AI creates additional governance demands

The need to connect capability with oversight also applies to AI, though the responsibilities differ. Grant Thornton found that only 26% of business leaders reported “advanced, integrated AI governance with data-driven monitoring.” Governance means the arrangements for overseeing AI use, with monitoring data helping the organization understand what is happening. This measure concerns oversight of AI deployments, while the provider finding concerns the connection between external cybersecurity services and internal work.

AI oversight already shapes how leaders assess future exposure. Nearly six in 10 said their company’s AI use and limited ability to govern it represented “a top source of future risk or regulatory scrutiny,” according to Grant Thornton. Their concern links deployment decisions to the organization’s ability to manage the resulting responsibilities. As AI use grows, leaders need to decide who oversees each use and what information those people need.

The risks also extend to how others use AI against the organization. Grant Thornton describes AI-enabled fraud as a growing business risk, and 55% of leaders identified it as a major fraud concern. More respondents were worried about traditional phishing, fraudulent messages designed to trick recipients, and other cyber-enabled fraud. Security planning therefore needs to address AI-enabled fraud while maintaining attention to these established threats.

Shared data, definitions and ownership support better decisions

Managing these exposures across the business requires information that different functions can use together. Grant Thornton recommends a unified “risk intelligence” perspective: a common understanding of risk built from that information. The approach brings together cybersecurity, compliance with rules, forensic investigation of incidents and internal audit’s assessment of controls. It aims to reduce gaps in visibility and strengthen oversight of new technology that may be vulnerable.

A common understanding starts with consistent interpretation. “Cybersecurity, compliance, forensics and internal audit need a shared view of risk and data,” Grant Thornton said. Common definitions establish what information means, while standardized data gives teams consistent formats and categories to work with. Without that agreement, bringing information together can still leave leaders with conflicting interpretations of the same exposure.

Consistent interpretation supports decisions when someone owns the response. Grant Thornton recommends: “Establish common definitions, standardized data and clear ownership so leaders can see how exposures connect and use that understanding to guide strategy and investment.” Clear ownership identifies who must assess the information, make decisions and follow through. An investment review for a security service or AI deployment should therefore examine the processes, information and responsibilities that will support oversight across those four functions.

Even with these arrangements, risk information is only useful if it keeps up with changing conditions. Grant Thornton encourages businesses to use AI for automated monitoring because “periodic reviews are not fast enough to meet the challenges posed by AI-powered threats.” Automated monitoring can update information between scheduled assessments, giving responsible teams a more current basis for decisions. The aim is to track exposure at the pace the threats demand.

Using AI for monitoring also creates another AI application that needs oversight. Leaders evaluating it should specify who is responsible, how its monitoring data will be understood across functions and how the organization will act on what it detects. The governance weakness respondents identified makes these decisions part of the monitoring investment itself. Approval should include responsibility for operating the technology and for the decisions its output informs.

Main highlights

Connect outsourced security to internal operations: While 96% of respondents use outsourced cybersecurity capabilities, only one-quarter report integration through automation and shared tools. Security owners need clear processes for acting on provider findings while preserving necessary limits on supplier access.
Assign ownership for AI oversight: Only 26% of leaders report advanced, integrated AI governance with data-driven monitoring. Assign responsibility for each AI deployment and define the information its owners need to assess exposure, including emerging fraud risks.
Build a shared view of risk: Cybersecurity, compliance, forensics and internal audit need common definitions, standardized data and clear ownership to connect exposures and guide investment. AI-based monitoring can provide updates between periodic reviews, with explicit responsibility for reviewing its findings and acting on them.