Cybersecurity - The New Frontier of ESG Risk

AI is turning cybersecurity into a systemic ESG and financial risk because the expansion of AI infrastructure simultaneously enlarges the attack surface and increases operational dependence.

• The combined capex of Amazon, Microsoft, Alphabet, Meta and Oracle rose from $162bn in 2022 to roughly $448bn in 2025, nearly tripling and exceeding $140bn per quarter by late 2025.
• Enterprise surveys entering 2026 found that 88% of companies reported revenue gains from AI adoption, 30% reported gains above 10%, and 86% planned to increase AI budgets in 2026.
• Cyber risk is being amplified by four structural forces: the digitalisation of the physical economy, supply-chain concentration, the economics of extortion and the AI inflection itself.
• Industry telemetry suggests that more than 80% of phishing emails now involve AI, with AI-generated campaigns achieving roughly 54% click-through rates versus about 12% for traditional campaigns; 87% of organisations reported an AI-driven attack in the past year.
• Deepfake incidents increased by more than 60% year-on-year in 2025, while US generative-AI-enabled fraud losses are projected to rise from $12.3bn in 2023 to $40bn by 2027; AI-assisted ransomware also reduced median dwell time from nine days to five.

Takeaway: Investors should treat cybersecurity as a material cross-sector risk and as a structural consequence of the AI investment cycle, while recognising that cybercrime estimates remain imprecise and that state-linked attacks add geopolitical exposure.