85% of CEOs Say Cyber Risk Threatens Prosperity: KPMG Survey

Eighty-five percent of U.S. CEOs say cybercrime and cyber insecurity will affect their organization's prosperity over the next three years — more than cited inflation, geopolitics or the pace of technology change. That figure anchors KPMG's 2026 U.S. CEO Outlook, based on a survey of 400 CEOs of large U.S. companies, and it puts cybersecurity first among the risks they listed.

By Olivia Hart

Tim Walsh, KPMG's U.S. chair and CEO, does not expect the fear to fizzle the way Y2K did. "I don't think AI is Y2K," he told Fortune ahead of the report's release. "Something's happening and it's really, really big."

Why does AI make cyber the top risk?

CEOs said AI itself drives much of the new cyber spending. The survey breaks down their specific worries:

• 78% cited AI-powered social engineering and targeted attacks
• 76% cited AI-assisted malware or phishing
• 73% cited data and privacy risks from deploying AI agents

Forty-eight percent are increasing cyber investment over the next three years, the highest share for any risk category. And 56% named cybersecurity as a challenge in rolling out AI — ahead of ethics, data readiness and cost.

Walsh had just spent two days on the West Coast meeting developers of frontier models. He said some of them are already slowing deployment over safety concerns, and he counts himself more optimistic than leaders who believe only a disaster will force checks on the technology. The survey does not test that claim; it records sentiment, and sentiment can outrun evidence.

The commercial upside, in Walsh's telling, sits in legacy systems. "There's a ton of cyber risk in the infrastructure that's out there currently," he said, because "the infrastructure is decades old." KPMG is building cyber defense models with its alliance partners, which he called a "great opportunity for KPMG but an absolute necessity for businesses." He put a number on it: "a multi-billion dollar business opportunity that we certainly plan to get after." That is his forecast, not a booked revenue figure.

What about quantum computing?

The quantum numbers show a wide gap between awareness and action. Sixty-two percent of CEOs said they know quantum computing threatens encryption but do not yet treat it as a priority. Only 4% have plans in place to address it.

Some movement exists. Thirty-four percent said quantum attacks on encryption are driving part of their cybersecurity investment, and 20% are increasing spending to comply with U.S. executive orders that require a transition to post-quantum cryptography by 2030 or 2031. That leaves a large majority of firms aware of a dated regulatory deadline but not yet acting on it.

Are CEOs cutting workers or hiring them?

Both, according to the survey — and Walsh himself advises caution with the numbers. Fifty-three percent said they plan workforce reductions in some areas over the next two to five years, up from 35% a year earlier. At the same time:

• 86% are redesigning roles, career paths and team structures for human-AI collaboration, up from 65%
• 83% are focused on retaining and retraining high-potential talent, up from 75%
• 79% are hiring people with AI and tech skills, up from 64%

Headcount still grows in most projections. Eighty-nine percent of CEOs expect to add people over the next three years, but modestly: 60% expect growth under 5%, 26% expect 6% to 10%, and 2% expect 11% to 25%.

Asked how cuts and hiring can rise together, Walsh said to read the percentages loosely. "You've got to discount the percentages," he said. "But I would say directionally I agree with all of that." He said most businesses chase productivity in parts of their operations, where they will "be able to do things with fewer people" or expand output instead.

What is happening inside KPMG?

A year ago, Walsh said, his interviews opened with two questions: when will you cut your workforce by 50%, and when will you stop hiring off campus? "Both of those things are absolutely not happening in our business," he said. "I'm not seeing a significant reduction."

What changes is the mix of people. KPMG needs more engineers and AI-skilled staff, and Walsh said the firm trains its own rather than buying all that talent. "It's my responsibility to make sure that they're talented and they've got the skills they need," he said.

KPMG has run AI agents inside its audit platform, Clara, and its tax and advisory platform, Digital Gateway, for years. People get more done and can analyze full data sets, Walsh said, but the human remains in the loop. "What we don't see is the elimination of full bodies out of the delivery at this point yet," he said — a present-tense observation that leaves the future open.

The technology is "moving faster and faster by the month," Walsh said. "Looking three months out is kind of the benchmark now." That pace pushed KPMG to launch its client technology and innovation unit as an incubator outside the main firm. "I needed to get the future KPMG out of the mothership," Walsh said, so it could "innovate and fail faster."

His remaining worry is scale. Walsh said he is "impatient" about keeping KPMG's 50,000 U.S. employees ahead of clients on the technology, and different teams need different tools from different partners. "We can't just deploy this same technology across 50,000 people," he said. "So it's complex, but complexity can't slow us down."

The survey's clearest signal: CEOs expect AI to raise the cyber stakes and reshape workforces simultaneously — and most are still deciding how fast to move.