AI exposes gaps between cyber confidence and readiness—report

Only 28% of ransomware victims can fully restore their data.

Organisations are overestimating their cyber resilience as artificial intelligence (AI) accelerates both attack capabilities and existing data vulnerabilities, reinforcing warnings from the Cyber Security Agency of Singapore (CSA).

New industry reports released days after CSA’s advisory highlight a widening gap between perceived preparedness and actual resilience, particularly as AI adoption outpaces security and data governance.

A global study by Veeam Software found that whilst 90% of organisations are confident they can recover from a cyber incident, only 28% of ransomware victims fully restored their data. On average, firms recovered just 72% of affected data.

The findings reinforce CSA’s warning that frontier AI models can compress the time needed to identify vulnerabilities and develop exploits from months to hours, increasing the scale and speed of potential cyberattacks.

The Veeam report also showed that 43% of organisations said AI adoption is outpacing their ability to secure data and models, whilst 40% have yet to update security policies to address AI-specific risks.

Separately, research from Cloudera pointed to what it described as an “AI readiness illusion,” where adoption is widespread but foundational data capabilities lag.

Despite 96% of organisations integrating AI into core processes, nearly 80% said initiatives are constrained by limited data access. Only 18% reported that their data is fully governed.

In Asia Pacific, 85% of organisations said they have visibility over where their data resides, but 38% still struggle to use it effectively due to complex access requirements.

The combined findings suggest that AI is amplifying existing structural weaknesses rather than creating entirely new risks.

CSA had earlier urged organisations to strengthen cyber hygiene measures, including patching vulnerabilities, enforcing multi-factor authentication, and improving network segmentation, as AI-driven threats evolve.

Industry data now indicates that beyond baseline controls, gaps in data visibility, governance, and recovery validation are emerging as key risk areas.

Organisations with stronger outcomes were more likely to implement enforced security controls, conduct recovery testing, and align executive ownership of resilience, according to Veeam.