Artificial Intelligence and Cybersecurity: Balancing Risks and Rewards

The report outlines a strategic framework for balancing the rewards of AI adoption with its inherent cybersecurity risks. It advocates for a 'shift left, expand right and repeat' approach, combining security-by-design with continuous operational resilience. The document provides a step-by-step risk management process for senior leaders, emphasizing the need for cross-disciplinary governance and the tailoring of traditional cybersecurity controls to address AI-specific vulnerabilities like data poisoning and prompt injection.

• The impact of AI on cybersecurity is categorized into three areas: AI used by threat actors to enhance attack potency, AI used by defenders to improve detection and response, and 'Cybersecurity for AI,' which addresses the expanded attack surface and new vulnerabilities inherent in AI systems.
• Threat actors are utilizing AI to significantly lower the cost of phishing while maintaining success rates, automate reconnaissance to identify organizational weaknesses, and accelerate the discovery and exploitation of zero-day vulnerabilities.
• Organizations face specific AI-related vulnerabilities including data poisoning, which can degrade model reliability; prompt injection and jailbreaking; and the risk of 'shadow AI' where AI is introduced through unsanctioned tools or passive product feature updates.
• The report proposes a 'shift left, expand right and repeat' security model: 'shift left' involves implementing safety guardrails during the building and pre-deployment stages; 'expand right' focuses on operational cybersecurity, detection, and recovery once systems are in use; and 'repeat' ensures continuous re-evaluation as technology evolves.
• Effective AI risk management requires a cross-disciplinary approach involving legal, cyber, compliance, technology, risk, human resources, ethics, and front-line business units to assess potential liabilities and business impacts.
• While basic cyber hygiene (e.g., multi-factor authentication and network segmentation) remains foundational, organizations must develop new AI-specific controls, including training data security, prompt curation, and output verification.
• The report outlines a seven-step process for senior risk owners to manage AI cyber risk: 1) understanding organizational context, 2) understanding rewards, 3) identifying risks and vulnerabilities, 4) assessing negative business impacts, 5) identifying mitigation options, 6) balancing residual risk against rewards, and 7) repeating the cycle throughout the AI life cycle.
• AI compromise can lead to novel business risks beyond traditional cyber threats, such as limited fairness due to inherent bias, reduced explainability of models, and the exposure of confidential data through accidental inclusion in training datasets.

APA

World Economic Forum (2025). Artificial Intelligence and Cybersecurity: Balancing Risks and Rewards. https://reports.weforum.org/docs/WEF_Artificial_Intelligence_and_Cybersecurity_Balancing_Risks_and_Rewards_2025.pdf

Chicago

World Economic Forum. Artificial Intelligence and Cybersecurity: Balancing Risks and Rewards. 2025. https://reports.weforum.org/docs/WEF_Artificial_Intelligence_and_Cybersecurity_Balancing_Risks_and_Rewards_2025.pdf.

Wikipedia

{{cite report |author=World Economic Forum |title=Artificial Intelligence and Cybersecurity: Balancing Risks and Rewards |date=January 2025 |url=https://reports.weforum.org/docs/WEF_Artificial_Intelligence_and_Cybersecurity_Balancing_Risks_and_Rewards_2025.pdf |access-date=23 October 2026 |via=Climate Insights Directory}}

BibTeX

@techreport{worldeconomicforum2025artificial, author = {{World Economic Forum}}, title = {{Artificial Intelligence and Cybersecurity: Balancing Risks and Rewards}}, institution = {World Economic Forum}, year = {2025}, month = jan, url = {https://reports.weforum.org/docs/WEF_Artificial_Intelligence_and_Cybersecurity_Balancing_Risks_and_Rewards_2025.pdf}, urldate = {2026-10-23}, note = {Indexed by Climate Insights Directory} }