LIVE · cybersecurity feed
Live wire
ai

Most chief audit executives can’t tell you what AI is worth yet

A recent survey indicates that while artificial intelligence (AI) tools are widely adopted within audit departments, most chief audit executives (CAEs) are not yet measuring the value derived from these technologies. The survey, conducted in May, polled 142 CAEs and found that 54% have not begun to quantify the benefits of AI in their audit functions.

ZeroDay News ·

Source: Help Net Security

A recent survey indicates that while artificial intelligence (AI) tools are widely adopted within audit departments, most chief audit executives (CAEs) are not yet measuring the value derived from these technologies. The survey, conducted in May, polled 142 CAEs and found that 54% have not begun to quantify the benefits of AI in their audit functions.

The findings highlight a significant gap between the widespread use of AI by auditors and the strategic oversight of these tools by department leaders. According to the survey, 93% of audit leaders and auditors report some level of AI use in their daily work. However, only 15% state that their department has deployed formal AI use cases that are routinely integrated into audits.

Only 38% of the 161 CAEs surveyed in May have an AI strategy in place, with most of these strategies being incorporated into the overall departmental strategy rather than existing as standalone plans for audit. Another 39% of CAEs are currently developing an AI strategy, suggesting a potential shift towards more formalized approaches.

When it comes to measuring value, a mere 7% of CAEs link AI use to cost metrics, such as reductions in external spending or avoided hiring. This indicates that the financial impact of AI on audit operations is largely unquantified by most departments.

The most common applications of AI in audit work involve drafting and planning. Sixty percent of 743 respondents use AI for engagement preplanning activities, including research and brainstorming potential risks. The same percentage also utilizes AI to draft audit issues, ratings, or reports. Smaller groups apply AI to develop planning deliverables like risk and control matrices, which map risks to their corresponding controls, and to review drafts before finalization.

Audit testing, a critical phase where auditors verify control effectiveness and which directly influences report conclusions, sees less AI adoption, with only 30% of respondents using it for this purpose. The potential for errors like hallucinations or omissions in this stage carries higher risks than in drafting, necessitating rigorous validation of AI-generated outputs and thorough documentation of how conclusions are reached, especially for regulatory or external auditor scrutiny.

The primary obstacles to effective AI integration are related to people and processes, rather than technology itself. Forty-eight percent of audit leaders and auditors cited unclear expectations for AI tool use as the most significant barrier. This was followed by variations in how individual auditors utilize the tools. Issues concerning technology, such as model selection and data access, ranked lower than human and process-related challenges.

The lack of standardized usage across individual auditors leads to inconsistent output and hinders the ability to compare performance across different engagements. To address this, Gartner suggests implementing structured use cases for high-value workflows, a practice currently being piloted by 12% of respondents.

ai
ShareXLinkedInWhatsAppFacebook

More News

view all →
breach

Criminal IP Introduces AITEM as the Next Evolution of Attack Surface Management

AI SPERA, the company behind the cyber threat intelligence platform Criminal IP, has announced AITEM (AI-Powered Threat Exposure Management), an expansion of its Attack Surface Management (ASM) offerings. AITEM aims to move beyond traditional asset discovery to provide a more comprehensive approach to understanding, prioritizing, and responding to security exposures. The platform is scheduled…

ai

AI Is Getting Really Good at Messing With Cybercriminals

Anti-cybercrime initiatives are increasingly deploying artificial intelligence to disrupt scammers by engaging them with lifelike bots, which the criminals mistake for genuine victims. This strategy aims to waste scammers' time and resources while gathering intelligence on their operations.

ai

The Third-Party Agent Problem: Why Security Built for AI You Chose Misses the Agents You Didn't

A new report highlights a significant blind spot in enterprise security architectures concerning the proliferation of third-party AI agents. The forthcoming 2026 State of Agent Security Report indicates that current security models, often designed to protect AI systems directly chosen and deployed by an organization, frequently fail to account for AI capabilities embedded within third-party…

security

Canadian cybersecurity executive arrested in federal extortion case

A Canadian cybersecurity executive was arrested in Pennsylvania on Thursday, facing federal charges of conspiracy to commit extortion. Edward Dubrovsky, 54, a co-founder and former Chief Operating Officer of CYPFER, a firm specializing in ransomware negotiation, is charged with conspiring to threaten the confidentiality of information for extortion and conspiring to commit Hobbs Act extortion,…

ransomware

FBI Arrests Ransomware Negotiation Firm Co-Founder in ShinyHunters Probe

The Federal Bureau of Investigation (FBI) has reportedly arrested Edward Dubrovsky, a co-founder of the ransomware negotiation firm Cypfer and currently associated with CyberSteward. The arrest is said to be part of the ongoing ShinyHunters investigation, specifically in connection with an incident involving FBI job applicant data.

security

Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison

A former core infrastructure engineer has been sentenced to prison for an attempted cyber extortion plot against an industrial firm. The engineer reportedly deleted administrative accounts and reset hundreds of user passwords, subsequently demanding a ransom of 20 Bitcoin to prevent further disruption to the company's servers.