AI and geopolitics drive cybersecurity investment: key points for SMEs

Cybersecurity has ceased to be a technical expense and has become a strategic decision. A recent PwC study, based on responses from 3,934 business, technology and security leaders in 71 countries —including 116 Spanish executives—, confirms that artificial intelligence and geopolitical tension are driving a new wave of investment in digital protection. For an SME, the takeaway is not "spend more," but "spend better" and understand that risk has changed shape.

AI, the top budget priority

The data is conclusive: 58% of organizations globally and 52% of Spanish ones place AI among their main budget priorities in cybersecurity. AI is no longer just a promise of the future; it is a specific line of spending. But the same study warns of an uncomfortable shift: for the first time, attacks targeting artificial intelligence systems top the list of threats for which companies feel least prepared. This is acknowledged by 50% of the security officers surveyed globally and 57% in Spain.

In other words, SMEs are investing in AI to defend themselves, but at the same time they are opening a new attack surface that they do not yet control. Among the risks of greatest concern are AI-controlled botnets, adversarial attacks and data poisoning. In the Spanish case, 48% cite adversarial attacks as one of their main concerns, while 47% cite artificial intelligence-driven adaptive malware.

Geopolitics: risk is no longer only digital

Geopolitical tension is also reordering priorities. The report highlights that cyberattacks promoted by state actors are increasingly extending beyond purely digital environments to affect operational technologies and critical infrastructure. As a result, 50% of companies are reviewing the management of risk from suppliers, third parties and supply chains, a percentage that rises to 56% among Spanish companies.

For an SME, this has a very concrete translation: the software provider, integrator or cloud service you use are part of your risk perimeter. It is not enough to protect your equipment; you must demand guarantees from whoever supplies you with technology. And we are not talking only about large corporations: any business that depends on a digital supply chain is exposed.

Quantum computing, the pending subject

Another of the emerging challenges identified by the study is quantum computing. Despite the implications this technology could have for current cryptographic systems, only 21% of companies worldwide —and 22% in Spain— are implementing quantum-resistant security measures. At the same time, 44% of Spanish organizations continue to evaluate the potential impact of this technology.

In other words: almost half of Spanish companies know that the problem exists, but have not yet moved from evaluation to action. In an SME, the recommendation is not to rush into migrating all cryptography, but to start by inventorying where the most sensitive data is stored and which algorithms protect it. It is background work that should be planned years in advance, not weeks.

Continuity plans: the gap between saying and doing

The PwC study warns that increased investment alone does not guarantee greater resilience. Currently, only 39% of security, risk and operations officers state that they have fully formalized and integrated business continuity plans to respond to cybersecurity incidents. Spain presents a more favorable situation, with 50% of organizations stating that they have these mechanisms.

«Cyber resilience must be consolidated as a strategic pillar of the business, integrated from the outset into senior management decision-making,» says Jesús Romero, lead partner for Business Security Solutions at PwC Spain.

The quote points to a governance problem, not only a technology one. And there SMEs have an advantage: by having smaller structures, they can integrate cybersecurity into decision-making with less bureaucracy than a large corporation. The key is to do it before the incident, not after.

The oversight paradox

The report also observes greater involvement of management teams in overseeing cyber risks. However, that concern is not yet consistently translated into business decisions: although nine out of ten leaders say they have oversight mechanisms, only 34% globally and 41% in Spain consider that business decisions usually incorporate a specific assessment of cyber risk.

Translated into the life of an SME: having a committee or a security officer does not mean that every business decision —opening a new sales channel, hiring a SaaS, outsourcing billing— goes through a risk filter. That is the gap that should be closed.

What we recommend at ForgeNEX

Given this panorama, we propose a practical, staged approach, designed for small teams with limited budgets:

1. AI and data inventory. Before investing in defensive AI tools, identify which AI systems you use, what data feeds them and who has access. Without an inventory there is no control.
2. Supplier review. Apply the same criterion as 56% of Spanish companies: demand security guarantees from your critical suppliers and document that assessment.
3. Minimum viable continuity plan. You do not need a hundred-page document; you need to know what you do in the first 24 hours after an incident. Formalize it and practice it.
4. Cryptographic roadmap. Start by inventorying algorithms and sensitive data. Quantum computing is not urgent today, but migration takes years.
5. Risk governance in decisions. Incorporate a simple question into every project: what cyber risk does this introduce and who assumes it?

As we already analyzed in Cybersecurity in SMEs: from the firewall to business risk, the pending leap is not technical but one of mindset. And the new wave of investment described by the study confirms that this leap is already happening in companies that want to keep operating. AI can help find flaws before the attacker does, as we saw in GPT-6 Cyber, but it also opens doors that you need to know how to close.

The study concludes that cybersecurity is ceasing to be an exclusively technological matter and becoming a strategic element that conditions the ability of organizations to innovate, grow and operate in a context marked by artificial intelligence, regulatory complexity and geopolitical uncertainty. For an SME, that means the next conversation about cybersecurity should not start with the firewall, but with the business.

Source: Computerworld. Analysis and adaptation: ForgeNEX.