As AI reshapes cyber threats, EY bets on IP-led cyber platforms over traditional consulting

As the landscape of cybersecurity undergoes a significant transformation due to Artificial Intelligence (AI), professional services firms are shifting their focus from traditional consulting to developing proprietary technologies. EY's recent launch of its Cyber Performance Management (CPM) platform raises the question: does this position EY against established cybersecurity vendors? Murli Rao, Partner and Cyber Leader at EY India, asserts that this move does not create direct competition in the conventional sense. In a recent discussion with Business Today, Rao highlighted that enterprise priorities are evolving. Companies are increasingly pressured to reduce costs while navigating a rapidly changing threat environment. Integrated, intelligence-driven platforms like CPM are becoming more valuable compared to disjointed point solutions. "We made a strategic decision two years ago to transform our business model from a people-centric approach to one based on intellectual property," Rao explained. He emphasized that while competitors may excel in specific areas, no one can match EY’s comprehensive approach across the cybersecurity spectrum. The CPM platform, unveiled on July 9, is touted as the first integrated cyber platform crafted by a professional services firm. It melds AI with cybersecurity functionalities, enabling enterprises to identify vulnerabilities, trace potential attack vectors, assess business risks, and convert cyber exposure into financial implications. Furthermore, CPM can seamlessly integrate with over 50 existing security tools while allowing organizations to maintain data sovereignty and operational control. This launch arrives at a critical juncture as AI reshapes the methods behind cyberattacks. Rao pointed out that advancements in AI have dismantled many of the barriers that previously prevented unauthorized access to systems. "Today, anyone can execute an attack without needing specialized skills," he remarked, noting that AI has significantly lowered the time, resources, and expertise necessary to compromise enterprise systems. Given this shifting threat landscape, organizations are urged to reconsider their approach to cyber risk management. Instead of addressing each vulnerability individually, CPM focuses on identifying the single most effective intervention that can disrupt an entire attack chain, a strategy Rao describes as "breaking the patch cycle." Another significant obstacle for enterprises is the lack of visibility into their technological assets. "You cannot defend what you don't know," Rao stated, indicating that many organizations lack a comprehensive, real-time inventory of their hardware, software, APIs, and AI components. This lack of visibility hampers boards from accurately assessing cyber risks or recognizing which business assets are most vulnerable. EY has dedicated the last two and a half years to enhancing its AI-driven cybersecurity capabilities, establishing specialized engineering teams to tackle persistent enterprise security challenges while developing CPM. Currently, the platform is operational across eight Indian clients in sectors such as banking, insurance, manufacturing, and pharmaceuticals. Users of CPM have reported significant improvements, including a 45-60% reduction in alert noise, 30-50% faster response times, a 50-65% increase in analyst efficiency, and up to a 55% decrease in total ownership costs by consolidating multiple security tools into a unified platform. As AI accelerates the pace and autonomy of cyberattacks, Rao believes that the future of the industry lies in solutions that integrate cyber intelligence with strategic business decision-making. "Customers are seeking immediate solutions," he concluded, signaling a critical shift in the cybersecurity landscape that EY is actively preparing for.