More AI Adoption, Greater Cyber Risk, and the Hidden Economics of Artificial Intelligence

AI is becoming easier to access, but harder to manage. The next competitive advantage will belong to organisations that can turn AI capabilities into measurable productivity gains without exposing themselves to unacceptable risks.

Artificial intelligence has a paradox at its core. The technology is becoming cheaper, more accessible, and increasingly capable of performing tasks that once required specialised human expertise. Businesses are integrating AI into their operations, governments are encouraging adoption, and investors are looking for the next wave of productivity growth.

Yet, at the same time, concerns about AI-enabled cyberattacks are intensifying. Organisations are discovering that more capable AI systems can create new vulnerabilities, expose weaknesses in legacy software, and increase the cost of protecting critical infrastructure.

These are not separate developments. They are connected consequences of the same technological shift. Three recent news stories illustrate why this matters.

An analysis by the European Commission's Joint Research Centre found that the share of firms using AI across EU strategic sectors increased from 7% in 2021 to 18% in 2025. Meanwhile, more than 300 scientists called for tighter controls on advanced AI systems amid concerns about their potential to enable cyberattacks. In the financial sector, Bank of America reportedly deployed 1,000 external contractors to help patch software vulnerabilities exposed by advanced AI models.

The question is no longer simply whether organizations should adopt artificial intelligence. It is whether they can integrate it effectively, capture its economic benefits, and manage the risks that emerge as the technology becomes more powerful.

1. AI Adoption Is Growing, but Transformation Remains Uneven

The European data offers a useful starting point. Between 2021 and 2025, AI adoption across the EU's strategic sectors increased from 7% to 18%. Media, energy, and electronic communications emerged as leading adopters, while mobility, tourism, and agri-food recorded comparatively lower levels of adoption.

The increase is significant, but the headline figure deserves closer examination. Using AI does not necessarily mean that an organisation has transformed its business model or improved its productivity.

A company using generative AI to draft marketing content is adopting the technology. A manufacturer using AI to optimise production schedules, anticipate equipment failures, reduce waste, and improve quality is integrating it into its operating model.

The distinction is important because the economic value of AI depends on more than access to a model. It depends on how the technology interacts with existing processes, organizational structures, employee capabilities, data infrastructure, and decision-making systems. This helps explain why AI adoption can rise rapidly without producing an equivalent increase in productivity.

Many organizations begin with applications that are relatively inexpensive, easy to deploy, and require limited changes to existing workflows. These applications can generate useful efficiency gains, but they may not fundamentally alter how the organisation creates value.

Deeper integration is more demanding. It often requires process redesign, investment in data quality, changes to employee responsibilities, and greater coordination between technology teams and business units.

The result is an emerging divide between organisations that use AI as a productivity tool and those that redesign their operations around its capabilities.

For business leaders, this distinction may become more important than adoption rates themselves. The competitive question is not simply how many employees have access to AI. It is how much better the organisation performs because of it.

2. The Next AI Advantage Will Come From Organisational Change

Technology adoption is often discussed as if purchasing a new system automatically creates value. History suggests otherwise.

The economic benefits of general-purpose technologies frequently depend on complementary investments. Electricity required factories to redesign production processes. Computers required businesses to rethink information management. The internet required new distribution channels, customer experiences, and business models.

Artificial intelligence is likely to follow a similar pattern. A model can generate code, summarize documents, analyze information, or automate parts of a workflow. But the benefits depend on whether an organisation can incorporate these capabilities into its broader system of work.

Consider a logistics company that introduces AI to improve demand forecasting. If the forecasting model produces better predictions but procurement, inventory planning, and distribution decisions remain unchanged, the benefits may be limited.

If the company redesigns its planning processes around those predictions, connects the model to relevant operational data, and gives employees the authority and skills to act on its recommendations, the potential value becomes much greater.

The same principle applies to banking, manufacturing, healthcare, energy, and other sectors. This is why organizational change should not be treated as a secondary component of AI implementation. It is one of the mechanisms through which technological capability becomes economic value.

It also explains why the availability of inexpensive AI tools does not eliminate the need for strategic investment. The model may be accessible. The organisational capability required to use it effectively is not necessarily so.

3. When AI Becomes a Cybersecurity Multiplier

The second development introduces a more troubling dimension. More than 300 scientists have called for stronger controls on advanced AI systems, warning that inadequate security practices could expose critical infrastructure to serious cyber risks.

Their concerns reflect a broader challenge: AI can strengthen defensive capabilities while also making certain offensive activities easier to perform.

AI systems can help security teams analyse logs, identify suspicious activity, review code, and discover software vulnerabilities. These capabilities can improve an organisation's ability to detect and respond to threats.

However, similar capabilities can potentially help malicious actors identify weaknesses, develop exploits, automate reconnaissance, or coordinate attacks. The consequences become more significant as AI systems gain the ability to carry out multistep tasks with less human intervention.

A system that merely answers a question presents a different risk profile from an agent that can interact with software, execute code, access resources, and make decisions across a sequence of actions. The latter requires stronger controls around permissions, isolation, monitoring, and human oversight.

This creates a difficult strategic balance. Organizations cannot simply avoid AI to eliminate the risk. AI is also becoming an important tool for defending systems against increasingly sophisticated threats.

Instead, they must learn to deploy the technology while anticipating how its capabilities could be misused, behave unexpectedly, or interact with existing vulnerabilities.

For technology leaders, cybersecurity must therefore become part of the AI architecture from the beginning.

For boards, it must become part of enterprise risk management rather than remain a narrowly technical concern.

And for policymakers, it raises questions about how security standards, incident reporting, international coordination, and accountability should evolve alongside increasingly capable systems.

4. Bank of America and the Hidden Cost of AI Progress

The third story makes the economic implications more concrete. According to the reported remarks of Bank of America CEO Brian Moynihan, the bank brought in 1,000 external contractors to help patch software vulnerabilities, with the additional workforce supporting thousands of existing personnel working in the area.

The bank also reported significant expenditure on software remediation and regulatory matters. At the same time, the supplied report indicated that savings from its approximately 130 internal AI projects were expected to rise from $300 million in 2026 to $700 million in 2027.

These figures illustrate a tension that business leaders should not overlook. AI can reduce operating costs in one part of an organisation while increasing expenditure elsewhere.

A business might save money by automating software development, customer support, or internal analysis. Yet it may also need to invest more heavily in vulnerability management, security testing, access controls, regulatory compliance, and technology modernisation.

The relationship is not necessarily contradictory. It is a reminder that the economics of AI must be evaluated across the entire organisation. A particularly important consideration is the difference between gross savings and net economic value.

Gross savings measure the benefits generated by an initiative. Net value considers those benefits alongside the costs required to achieve and sustain them. For AI, these costs may include:

• Model access, computing infrastructure, and integration.
• Employee training and organisational redesign.
• Data governance, compliance, and independent testing.
• Cybersecurity improvements and software remediation.
• Operational disruption, error correction, and ongoing monitoring.

Not every cost will arise from AI itself. Some organisations already have substantial technology debt, regulatory obligations, or cybersecurity weaknesses.

Nevertheless, the deployment of more capable AI can expose those weaknesses more quickly and increase the urgency of addressing them.

This distinction matters for CFOs and investment committees. The right question is not whether AI produces savings in isolation. It is whether those savings remain attractive after the organisation accounts for the investments and risks associated with deployment.

It also changes how cybersecurity should be understood. Security expenditure may appear to reduce short-term returns, but it can protect the operational continuity and financial benefits that AI is intended to create. Resilience is not separate from value creation. It helps preserve it.

5. The Productivity Puzzle: Why Adoption Does Not Guarantee Growth

The implications extend beyond individual businesses. Economists have long recognised that technological progress does not always translate immediately into measurable productivity growth.

The process depends on complementary investment, workforce adaptation, infrastructure, competition, and the reorganisation of economic activity.

AI introduces the same challenge. A rising adoption rate demonstrates that firms are beginning to use the technology. It does not establish that output per worker has increased, that operating costs have fallen, or that economic welfare has improved.

Those outcomes must be measured separately. For example, an organisation may use AI to produce more reports in less time. But if those reports do not improve decisions, reduce errors, or generate additional value, the economic benefit may be modest.

Alternatively, an AI system may initially increase expenditure because the organisation must redesign workflows, improve its data, and train employees. Its benefits may emerge only after these investments are complete.

This creates a measurement problem for both corporate leaders and policymakers. Counting AI deployments is relatively straightforward. Measuring the value they generate is more difficult.

A more meaningful assessment would examine changes in output, quality, cost per transaction, decision speed, error rates, and resource utilisation, while accounting for the investment required.

It should also consider whether improvements persist over time and whether they are attributable to AI rather than other changes in the business environment. Without this distinction, organisations risk confusing technological activity with economic progress.

6. Uneven Adoption Could Widen Competitive Differences

The differences between sectors in the European analysis also deserve attention. Energy and electronic communications have relatively high levels of AI adoption, while mobility, tourism, and agri-food lag behind.

These differences may reflect a combination of factors, including capital intensity, digital infrastructure, the availability of specialised expertise, data requirements, operational complexity, and the economics of individual applications.

They should not automatically be interpreted as evidence that leading sectors will always achieve greater returns. A sector with high adoption may still struggle to translate technology into productivity gains. A sector with lower adoption may have significant opportunities to improve performance through carefully selected applications.

Nevertheless, uneven adoption can create competitive differences over time. Organisations with stronger digital foundations and greater access to specialised talent may be able to experiment more quickly, integrate AI more deeply, and spread successful applications across their operations.

Others may face higher implementation costs, limited expertise, or greater uncertainty about the benefits. If these differences persist, AI could reinforce existing productivity gaps between firms and industries. The implications are relevant to industrial strategy and public policy.

Supporting adoption may require more than making AI tools available. Depending on the sector, it may also require investment in digital infrastructure, skills development, data access, cybersecurity, and practical support for integrating AI into production. A uniform approach to AI adoption is unlikely to address every industry's constraints equally well.

7. Labour Markets Will Be Shaped by Tasks, Skills, and Organisational Design

Another consequence is the potential transformation of work. AI can automate or accelerate specific tasks without necessarily eliminating entire occupations. The effect on employment depends on how tasks are distributed across jobs, how businesses respond to productivity improvements, and whether new activities emerge.

For example, automating routine analysis may reduce the time employees spend collecting and processing information. It may also increase the value of employees who can interpret results, challenge assumptions, manage exceptions, and make decisions in complex situations.

At the same time, demand may increase for expertise in AI integration, cybersecurity, data governance, risk management, and technology oversight.

The transition will not be uniform. Some workers and organisations will adapt quickly. Others may struggle because of limited training opportunities, weak digital infrastructure, or a lack of resources for restructuring work.

For business leaders, workforce planning must therefore extend beyond estimating how many tasks can be automated. It should consider how roles will change, which skills will become more valuable, and how employees can work effectively alongside AI systems.

For policymakers, the challenge is to ensure that productivity gains are accompanied by the skills development and institutional adaptation needed to support a successful transition. The ultimate economic outcome will depend not only on what AI can do, but also on how organisations and societies choose to use it.

8. AI Risk Is Becoming an Economic Resilience Issue

Cybersecurity risks become particularly important when AI systems interact with essential infrastructure.

A serious disruption to banking, electricity, telecommunications, transport, or healthcare can affect businesses and households well beyond the organisation directly targeted.

This is an example of an economic externality: the costs of an incident may extend beyond the party responsible for the original investment or security decision.

A company might underinvest in cybersecurity because some of the potential consequences would be borne by customers, suppliers, or the wider economy.

As AI increases the potential speed or scale of certain attacks, the importance of shared security standards and coordinated responses may grow.

This does not mean that every AI-related incident will become a systemic crisis. The probability and severity of specific scenarios depend on the technology, the target, the security controls, and the circumstances. It does mean that AI resilience cannot be assessed exclusively at the level of individual firms.

For governments and regulators, the challenge is to encourage innovation while ensuring that organizations responsible for essential services maintain appropriate safeguards.

For business leaders, it means considering not only direct losses but also supply-chain disruption, third-party dependencies, customer impact, and recovery capabilities.

In an AI-enabled economy, operational resilience becomes part of economic competitiveness.

9. Five Priorities for Business Leaders

The combined implications of these developments suggest five practical priorities.

First, move from experimentation to measurable business outcomes. Prioritize AI applications that address clearly defined operational or strategic problems. Establish a baseline, set realistic targets, and evaluate results against actual business performance.

Second, redesign workflows rather than simply adding tools. The greatest opportunities may arise when AI changes how work is organized, decisions are made, and resources are allocated. This requires cooperation between technology teams, business leaders, and employees.

Third, build security into AI deployment. Assess software vulnerabilities, restrict agent permissions, secure sensitive environments, test for unintended behavior, and establish procedures for responding to AI-related incidents.

Fourth, invest in skills and governance. Technical capabilities alone are insufficient. Organisations also need employees who understand how to use AI responsibly, leaders who can assess its business value, and governance structures that establish accountability.

Fifth, measure the full economics of AI. Track realized savings and revenue gains alongside infrastructure, implementation, training, compliance, and cybersecurity costs. Consider the consequences of failure as well as the benefits of success.

These priorities should be adapted to each organisation's sector, maturity, and risk exposure. A bank, a manufacturer, an energy provider, and a tourism business will not have identical requirements.

The objective is to establish a common strategic discipline while recognising that effective implementation is context-dependent.

Conclusion: The Real AI Competition Is Only Beginning

The three developments tell a story that extends beyond the rapid spread of a new technology.

AI adoption is accelerating because the tools are becoming more accessible. But deeper integration still requires organisational change, specialised skills, and investment.

At the same time, increasingly capable AI systems are changing the cybersecurity landscape, potentially exposing weaknesses that organisations have neglected for years.

The resulting economic picture is more complex than a simple narrative of automation and cost reduction.

AI can create productivity gains while generating new costs. It can improve security operations while expanding the capabilities available to attackers. It can strengthen competitive advantage while potentially widening differences between organisations that can integrate it effectively and those that cannot.

For executives, the challenge is to balance growth with resilience.

For technology strategists, it is to build systems that are useful, integrated, and secure.

For economists, it is to understand when technological adoption translates into measurable productivity, broader prosperity, and sustainable competitive advantage.

The organisations most likely to succeed will not necessarily be those that adopt AI first, spend the most, or automate the largest number of tasks.

They will be those that combine technological capability with sound organizational design, effective governance, and a clear understanding of economic value. The future of AI will not be determined by adoption alone. It will be determined by how intelligently we integrate it, how responsibly we manage it, and how effectively we turn its capabilities into lasting value. That is the real challenge of the AI economy.

Editorial note: The adoption figures and corporate spending and savings estimates discussed above are drawn from the news excerpts described in this article. Forecast savings should be distinguished from realised results, and adoption statistics should not be interpreted as direct evidence of productivity growth.

Sources:

AI adoption more than doubles in almost every EU strategic sector The use of AI has increased to 18 % in firms in EU strategic sectors, but adoption patterns are different among…

Scientists urge tighter AI controls to prevent global cyber risks Call comes amid polls casting doubts on political leaders' ability to manage AI risks as US midterm elections near.

https://www.cnbc.com/2026/10/14/anthropic-mythos-bank-of-america-hiring-cost.html