1. “27 seconds is now an eternity.”
Last year, the fastest recorded adversary breakout time fell to just 27 seconds, down from 51 seconds the year before. With frontier AI, adversaries can now take over a network almost immediately, making 27 seconds feel like an eternity.
Cyber defence is becoming a race measured in seconds. When the speed of cyberattacks is compressing the time available to detect, assess and respond, continuous visibility across IT and operational technology assets is critical to identifying vulnerabilities before they can be exploited.
Build cyber confidence:
KPMG’s Asset Management and Vulnerability Management solution with ServiceNow helps organisations identify exposure earlier, prioritise vulnerabilities and respond with greater confidence.
2. “Agents are now the apex predators.”
AI is giving attackers capabilities that once required nation-state resources, transforming the speed, scale and economics of cyberattacks. But AI can also shift the economics of defence. For decades, the economics of cybersecurity favoured the attacker: attacks were cheap; defence was expensive. AI is beginning to rewrite that equation. As the economics of attack change, security testing must change with them, uncovering weaknesses before adversaries can exploit them.
Build cyber confidence:
KPMG’s AI-Assisted Security Testing helps organisations test their defences against evolving threats and identify weaknesses earlier.
3. “Invisible agent actions are creating
invisible risks.”
AI agents don’t just generate answers. They act. They call tools, access systems, trigger processes and use memory. And when those actions are invisible, so is the risk.
As agents become more autonomous, visibility must extend beyond prompts and model outputs to the actions they take across tools, processes, memory and underlying systems. Without that visibility, organisations cannot reliably identify when an agent steps outside its approved boundaries.
Trust starts with visibility. Because you cannot govern what you cannot see.
Build cyber confidence:
KPMG’s Agentic AI Runtime Governance solution helps organisations observe agent behaviour, monitor actions and intervene when activity moves outside defined parameters.
4. “Agents should have KPIs and retirement plans.”
As AI agents become part of the workforce, they need to be managed like one. Every agent should have a clear purpose, an accountable owner, defined responsibilities, access boundaries and lifecycle controls. And when an agent no longer performs as intended, it should be improved, constrained or retired, with a clear record of why.
The principle is simple: If AI agents are joining the workforce, they need job descriptions, managers, performance reviews and clear exit plans.
Build cyber confidence:
KPMG’s Identity and Access Management and Non-Human Identity solution helps organisations govern agents from deployment through to retirement.
5. “Human oversight plus agents is the new
operating model.”
Work can be automated. Accountability cannot.
AI agents can increasingly execute complex, multi-step processes without constant human intervention. But autonomy cannot become an excuse for abdication.
The answer is not to have humans approve every step. It is to put them on the loop: setting objectives and boundaries, defining when an agent must escalate, and reviewing the outcomes. AI can take over the work, but it cannot take over accountability.
Build cyber confidence:
KPMG’s Agentic AI and Security Governance Blueprint helps organisations establish clearer roles, guardrails and accountability as AI agents become part of the workforce.
6. “The autonomous enterprise changes the
trust model.”
An AI agent is no longer just software you use. It is an identity you authorise to act. When software starts acting on your behalf, trust can no longer be assumed. It must be proven. Policies alone cannot provide assurance over autonomous activity. Organisations require verifiable evidence of what an AI agent did, what it accessed and whether it operated within its authority. In an autonomous enterprise, trust is not a policy. It is evidence.
Build cyber confidence:
KPMG’s Agentic Control Assurance solution embeds control and evidence into agent-enabled workflows, supporting clearer accountability and auditability.
7. “Cyber confidence cannot stay in the
tech department.”
Every supplier, system, operation and critical business relationship can create risk. So cyber can no longer be managed as a standalone technology issue. Confidence must be built across the enterprise, connecting how organisations defend against threats, govern cyber and AI risk, and scale transformation securely.
Cyber risk follows the business, so cyber confidence has to as well.
Build cyber confidence:
KPMG’s Third-Party Trust Intelligence solution uses AI agents to support a more connected and responsive approach to third-party risk management.
8. “It is a false choice to move safely or quickly.
You can have both.”
Speed without control produces mistakes faster. A wrong answer delivered at machine speed is still a wrong answer. That is why the choice between moving quickly and moving safely is a false one. Controls should not be barriers added after innovation happens. They should be built into how AI operates from the start. Safety and speed are not opposites when controls are designed in from the start.
The goal isn’t to slow AI down. It’s to make speed safe.
Build cyber confidence:
KPMG’s AI Governance in the Age of Shadow AI solution with CrowdStrike helps organisations govern AI usage while continuing to innovate.
9. “More than ever, defence is the best offence.”
Don’t wait for an attack to find out whether your defences work. Adversaries will use every technology and technique available to find a way in. Organisations need to apply the same mindset to defence, testing critical environments as an attacker would to uncover weaknesses before they can be exploited.
To build a stronger defence, you must test it like an attacker.
Build cyber confidence:
KPMG’s SAP Security solution with SecurityBridge helps organisations improve visibility, identify vulnerabilities and strengthen protection across critical SAP environments.
10. “Legacy thinking will not address frontier challenges.”
The fundamentals haven’t changed. The frontier has.
The greatest emerging risks are often the ones organisations have the least time to prepare for. Quantum computing, for example, could challenge the encryption methods organisations rely on today. Waiting until that threat materialises may leave insufficient time to understand exposure and prepare a response.
The same applies to frontier AI. The fundamentals of governance still hold, but they must operate continuously as agents create code, access data, make decisions and take action. You don't need to reinvent governance for every new technology. You need governance that can keep pace with it.
The fundamentals haven’t changed. The frontier has.
Build cyber confidence:
In Taming Schrödinger’s cat: Why firms should integrate quantum readiness into their digital strategy now, Gerry Chng, Partner and Head of Cyber, Advisory at KPMG in Singapore, explains why quantum readiness should be incorporated into digital strategy now.
