Large businesses were more than seven times as likely as small ones to use artificial intelligence for cybersecurity in 2025, according to new OECD figures that show how unevenly a growing security tool is spreading.
Across the enterprises covered by the Organisation for Economic Co-operation and Development, 26.7% of large firms reported using AI for information and communication technology security, compared with 9.6% of medium-sized firms and 3.7% of small firms.
The OECD statistical release, published October 26, puts the overall share at 5.3% of enterprises in 2025. That was 23.2% higher than in 2024, a relative increase rather than a rise of 23.2 percentage points.
The figures describe reported use, not how much protection the systems provided. They also do not establish that a business needs AI to have effective security.
What AI can do in security
Security systems produce large volumes of information about logins, network activity and software behavior. AI tools can help analysts identify patterns in that information or prioritize events for review. Depending on the product, they may also help investigate suspicious activity.
These capabilities come with choices about what data a system can access, who reviews its alerts and what actions it can take. A tool that flags an unusual login still needs a process for deciding whether the activity is legitimate and responding when it is not.
False alarms can consume staff time, while missed signals can leave a real incident unnoticed. A business evaluating a product therefore needs evidence about performance in its own environment, not just a demonstration of how many alerts the software generates.
A gap between industries and company sizes
The OECD found that 18.1% of enterprises in the information and communication sector used AI for ICT security. The share was 8.9% in professional, scientific and technical activities and 2.1% in accommodation and food services.
Those industries differ in the systems they operate and the resources available to manage them. The figures do not identify a single reason for the gap. Larger organizations may have dedicated teams and more complex networks, but the release does not establish that those factors caused their higher adoption.
About one-quarter of businesses that used AI reported using it for ICT security. The denominator matters: that is a share of AI-using businesses, not of all businesses.
Basic controls still matter
Companies considering an AI security purchase should first identify the problem it is intended to solve. A small retailer may need reliable access controls and recovery procedures more urgently than another source of alerts it cannot investigate.
US cybersecurity agency CISA recommends measures including multifactor authentication, restricting access to necessary systems and maintaining recoverable backups. Its guidance for smaller businesses and managed service providers also stresses understanding providers’ access and responsibilities.
Multifactor authentication requires an additional verification step beyond a password. It can reduce the risk that a stolen password alone is enough to enter an account. Backups need to be protected and tested so that a company can actually restore its systems after a disruption.
A business outsourcing security should also agree on who receives an alert, who can respond and how quickly. An outsourced service can provide expertise, but the company still needs to understand its own access and recovery arrangements.
Adoption is not the same as resilience
The OECD separately reports that 17.7% of enterprises experienced an ICT security incident in 2023, a 28.2% relative increase from 2018. That is a different measure from AI adoption, for an earlier period. The figures cannot show whether AI prevented or caused incidents.
Our reporting on AI-assisted work and professional expertise examined another distinction: stronger output from a tool does not automatically develop the judgment needed to review it. Security teams face a similar operating question about who can interpret an alert and act on it.
For smaller firms, the commercial test is whether a tool improves a specific process at a manageable cost. For larger firms, the challenge may be integrating it with existing controls without burying staff in more warnings. In either case, adoption counts alone cannot tell management whether the business can detect an attack or recover from one.
