Despite soaring use of artificial intelligence in the workplace, most organisations remain critically unprepared to manage the risks, according to ISACA’s annual AI Pulse Poll, which surveyed 3,029 digital trust professionals worldwide.
The 2025 poll reveals that 81% of respondents believe employees within their organisation use AI, whether it is permitted or not, yet only 28% of organisations have a formal AI policy.
Concerningly, just 22% of organisations provide AI training to all staff, while 89% of tech professionals say they will need AI training within the next two years to advance their careers or even keep their current roles.
The disconnect between widespread AI adoption and lagging oversight is creating growing risk particularly in the face of escalating threats like deepfakes. In fact, 66% of professionals expect deepfake cyberattacks to become more sophisticated within the next 12 months, yet just 21% of organisations are currently investing in tools to detect or mitigate them.
ISACA Board Director Jamie Norton said as more employees embrace AI tools to boost efficiency, the absence of formal policies and AI-specific cybersecurity measures leaves organisations increasingly vulnerable to manipulation, reputational harm and data breaches.
“AI is already embedded in daily workflows, but ISACA’s poll confirms governance, policy and risk oversight are significantly lacking,” said Norton. “A security workforce skilled in AI is absolutely critical to tackling the wide range of risks AI brings, from misinformation and deepfakes to data misuse.
“AI isn’t just a technical tool, it’s changing how decisions are made, how data is used and how people interact with information,” he added. “Leaders must act now to establish the frameworks, safeguards and training needed to support responsible AI use.”
Sixty-eight per cent of respondents say that the use of AI has resulted in time savings for them and their organisation, and more than half (56%) believe that AI will have a positive impact on their career in the next year.
The technology is being used in a range of ways, including:
- To create written content (52%)
- To increase productivity (51%)
- To automate repetitive tasks (40%)
- Analysing large amounts of data (38%)
- Customer service (33%)
While strides have been made in AI policies and training, they still have a way to go. Only 28% of organisations have a formal, comprehensive policy in place for AI (up from 15% last year). Though 59% of organisations say they permit the use of generative AI (up from 42% last year), 32% of respondents say there is no AI training provided to any employees, 35% provide training only to those in IT-related positions, and only 22% train all employees.
Also, while many are using AI, they may not all fully understand it, 56% say they are just somewhat familiar with AI, with only 6% saying they are extremely familiar and 28% consider themselves to be very familiar.
Sixty-one percent are very or extremely worried that generative AI will be exploited by bad actors, and 59% believe that AI-powered phishing and social engineering attacks are now more difficult to detect.
Additionally, only 41% believe organisations are adequately addressing ethical concerns in AI deployment, such as data privacy, bias and accountability. And only 30% have a high degree of confidence in their ability to detect AI-related misinformation.
Only 42% of respondents say AI risks are an immediate priority for their organisation, including these top risks they cited:
- Misinformation/disinformation (80%);
- Privacy violations (69%);
- Social engineering (63%);
- Loss of IP (53%); and
- Job displacement (40%).
Respondents, however, recognise the vital importance of AI skills. Nearly a third say that organisations are increasing jobs for AI-related functions in the next 12 months, and 85% of respondents agree or strongly agree that many jobs will be modified due to AI.
While 84% of digital trust professionals consider themselves to have just a beginner or intermediate level of expertise in AI, 72% believe that AI skills are very or extremely important for professionals in their field right now. Eighty-nine per cent say they will need AI training within the next two years to advance their careers or even keep their current roles, and 45% say it is needed within the next six months.
