Artificial intelligence (AI) adoption for enterprise resource planning (ERP) is moving faster than security teams can protect it.
That’s the overarching message of our latest research report, “The State of AI, Security and ERP,” for which we surveyed more than 200 cybersecurity leaders at U.S. organizations using ERP systems. These organizations are racing to integrate AI directly into their ERP code, as 88 percent are either doing so or plan to by the end of the year. Subsequently, AI is showing up in code, applications and agentic workflows, often through ERP vendors and third parties – leaving organizations with an unclear picture of their AI presence. In fact, 83 percent use embedded AI code from their ERP vendor and 61 percent are incorporating the same tools from third parties.
All of which is triggering pushback over cybersecurity concerns: The majority of survey respondents say at least one business unit has objected to implementing AI within their ERP environment, with security twice as likely to resist than any other department.
Forward Momentum
The reservations aren’t stopping adoption. Fifty-eight percent of organizations have started to use AI applications or agents that interact with their ERP systems within the last six months, and 41 percent are expected to do so by the end of the year. Meaning the trend is entering a state of ubiquity.
Companies are doing so in pursuit of improved efficiencies (as cited by 78 percent of respondents), eased staffing/resource constraints (12 percent) and reduced tech costs (9 percent). Given the benefits, business-side leaders and teams are pushing adoption, while assuming their security counterparts will handle any issues related to threats.
Concerns Rising Over AI-Enabled Threats
Security teams, however, hold a noticeably contrarian view: In listing reasons why these teams are likely to object to the use of AI in ERP systems, respondents ranked a lack of confidence in AI security at the top (as cited by 75 percent), followed by compliance risks (72 percent), concerns about bad data or hallucinations (68 percent) and a loss of control (40 percent).
What’s more, one-fifth of these teams have encountered at least one incident in which cyber criminals have leveraged AI to exploit critical business platforms, and an additional seven of ten either suspect such an incident has occurred or are concerned about it happening.
Given the elevated risks, it should come as no surprise that 41 percent of organizations are seeing their security teams slow down the adoption of AI in ERP environments due to a lack of confidence in security/compliance controls.
A Roadmap To Protected Productivity
The findings may lead one to conclude that business and security units are headed on a collision course, with one side calling for full-throttle implementation and the other begging to pump the brakes.
But it doesn’t have to be that way.
Clearly, chief information security officers (CISOs) and their teams thrive with visibility and control. If they know what AI agents are touching and what they’re doing with it, then they will harbor less uncertainty about continued deployments. And it’s not as if they’re anti-AI – 84 percent rank as a top priority the leveraging of AI to help defend against AI-based ERP risks.
Simply stated, CISOs and their teams need to know what’s actually in an ERP system before AI agents touch it; what is happening inside the system as opposed to only at the network edge; and the results of AI-generated code checks before the code goes live. This – along with vendor accountability – will go a long way toward breaking down objections.
The upshot: Organizations which get the most out of AI in ERP won’t be the ones that move the fastest. They’ll be the ones that moved the smartest, with proven controls to resolve any and all doubts.
