The concern that the KPMG US CEO keeps hearing from other executives

Corporate leaders tend to be enthusiastic about AI’s potential — and increasingly concerned about the cybersecurity challenges the technology brings.

Tim Walsh, CEO and chair of KPMG US, said the worries come up in nearly every meeting he has with fellow leaders, as AI gives bad actors new ways to try to breach corporate defenses. “The cyber risks have just elevated to places that we’ve never seen them before,” he told Business Insider.

Walsh pointed to the Hugging Face incident this past summer, in which OpenAI said an AI agent bypassed controls during an internal cybersecurity evaluation and accessed parts of the open-source AI platform’s systems.

There isn’t currently a defensive wall, he said, that’s capable of rebuffing every cyber threat.

He said KPMG is working with the frontier AI model developers and others on further protections.

The goal is to help the Big Four firm protect its business, and its clients’ businesses, Walsh said, adding that he sees it as a potential opportunity worth more than $1 billion.

Unease about AI and cyber threats showed up in a recent KPMG US survey of 400 CEOs at major US companies.

While leaders reported confidence in AI’s potential, cybersecurity was the concern they identified most often.

Eighty-five percent said cybercrime and “cyber insecurity” could affect their company’s prosperity over the next three years — more than said the same about inflation, geopolitical tensions, the pace of technological change, or other risks.

Cybersecurity was also the most commonly cited challenge to implementing AI.

It topped ethical questions, data readiness, cost management, and translating AI spending into measurable returns.

Leaders said they were particularly concerned about identity theft and data privacy, vulnerability to cyberattacks, and fraud detection and prevention.

Nearly half said they planned to increase cybersecurity investment over the next three years, citing threats including AI-powered social engineering, AI-assisted phishing or malware, and data and privacy risks tied to AI agents.

The concern is shaping the kinds of work the firm wants to do for clients.

Walsh said KPMG is building what he described as a managed cyber-defense business centered on AI, meant to serve as a “shield and defense mechanism” for companies.

KPMG already has a cybersecurity business, he said, though this would be a different offering built around AI.

The company also sees a growing need to check whether the AI systems organizations deploy are doing what they are supposed to do.

KPMG already helps clients assess AI-related controls and governance.

Walsh said the firm is developing additional services to verify that AI agents are operating as intended and give investors and others confidence that companies can control them. “Trust around AI is a real thing,” he said.