Organisations boost AI security as data threats & risks evolve

Thales has released its 2025 Data Threat Report, showing that nearly 70% of surveyed organisations view the rapid development of artificial intelligence, particularly generative AI, as their primary security concern related to the technology's adoption.

The survey, conducted by S&P Global Market Intelligence 451 Research, captured the opinions of more than 3,000 IT and security professionals across 20 countries and 15 industries, providing insight into current and emerging data security threats faced by businesses worldwide.

The report indicates that three key concerns consistently emerged regarding artificial intelligence: the pace of development (cited as the leading risk by nearly seven in ten respondents), followed by questions over AI's integrity (64%), and its trustworthiness (57%).

Spending on generative AI security has seen a marked increase since previous years. Seventy-three percent of respondents said their organisations were now investing in AI-specific security tools, with funding sourced either from new or existing budgets. Security for generative AI has risen to become the second highest security spending priority after cloud security.

Eric Hanselman, Chief Analyst at S&P Global Market Intelligence 451 Research, described the pressures companies are facing. "The fast-evolving GenAI landscape is pressuring enterprises to move quickly, sometimes at the cost of caution, as they race to stay ahead of the adoption curve," he said. "Many enterprises are deploying GenAI faster than they can fully understand their application architectures, compounded by the rapid spread of SaaS tools embedding GenAI capabilities, adding layers of complexity and risk."

The report highlights that organisations are adapting different strategies to address AI-related security challenges. Over two-thirds have obtained security tools directly from their cloud providers, while three in five are relying on established security vendors, and nearly half are working with startups specialising in this area.

Adoption of generative AI is already well underway in many firms, with a third of surveyed organisations indicating that the technology is either being integrated into their operations or is actively transforming them. As agentic AI applications develop – those capable of decision-making or acting on data – the importance of ensuring data quality and security grows further.

The risk environment for organisations, however, remains complex. Malicious software, or malware, continues to be reported as the most persistent attack vector since 2021. This year, phishing rose to become the second most common type of attack, while ransomware dropped to third place. The report notes a modest decline in the rates of reported data breaches: 56% of respondents experienced such an incident in 2021, compared to 45% in 2025. The percentage reporting a breach within the previous 12 months also fell, from 23% in 2021 to 14% in 2025.

The report also details the shifting landscape of cyber threat actors. External sources, especially hacktivists and nation-state actors, are now seen as the most concerning, with human error falling to third place as a source of breaches in the current year's results.

Quantum computing is generating increased concern among organisations regarding the security of encrypted data. The top quantum-related risk identified by 63% of respondents is the potential compromise of today's encrypted data – the fear that quantum computers could one day break through current or future encryption protocols, exposing sensitive information. Other major threats include vulnerabilities in encryption key distribution, cited by 61%, and the so-called "harvest now, decrypt later" risk, identified by 58%, relating to the collection of encrypted data today for decryption once quantum capabilities mature.

The report found that half of surveyed organisations are reassessing their encryption strategies in response to these threats, and 60% are in the process of either prototyping or evaluating post-quantum cryptography solutions. Only one in three organisations reported that they trust telecoms or cloud providers to manage this transition.

Todd Moore, Global Vice President, Data Security Products at Thales, commented on the findings: "The clock is ticking on post-quantum readiness. It's encouraging that three out of five organizations are already prototyping new ciphers, but deployment timelines are tight and falling behind could leave critical data exposed," he said. "Even with clear timelines for transitioning to PQC algorithms, the pace of encryption change has been slower than expected due to a mix of legacy systems, complexity, and the challenge of balancing innovation with security."

The results of the 2025 Data Threat Report indicate that while there have been improvements in the overall security posture of organisations, further efforts will be required to fully address the risks and operational demands posed by emerging technologies such as generative AI and quantum computing.