Research and analysis

AI cyber security survey - technical report

Published 15 May 2024

1. Introduction

Background

The Department for Science, Innovation and Technology (DSIT) commissioned IFF Research to conduct a survey to understand how Artificial Intelligence (AI) is used by businesses in key sectors, and how businesses implement cyber security practices and processes around the AI technology they deploy.

Artificial intelligence is the broader field encompassing knowledge-based systems, data-driven and machine learning-enabled systems, including classic machine learning (supervised learning, unsupervised learning), deep learning, and reinforcement learning, referring to the development of systems that can perform tasks requiring human intelligence. The use of AI is growing. In April 2023, an estimated 16% of all UK businesses had adopted at least one AI technology[1] and with the growth of more accessible and powerful generative AI models, this number is likely to increase significantly. The growing use of AI among businesses presents huge opportunities; however, without appropriate safeguards there are also significant risks. This is particularly the case with cyber security which is an essential precondition for the safety of AI systems. It was in this context that DSIT commissioned IFF Research to carry out primary research among UK businesses.

Research objectives

The core objectives of the research were to understand:

• What types of technology are being used, and for what purpose;
• Businesses’ cyber security practices – in general terms, and specific to AI;
• Businesses’ future plans in relation to AI and cyber security; and
• How these activities and attitudes vary across businesses in different sectors and of different sizes.

This report

This report supplements the main report and provides more detail on research approach including information on cognitive interviewing, pilot fieldwork, sampling, weighting, data analysis and sample outcomes.

2. Methodology

Research design

The survey sought to create a robust sample base of businesses that were adopting at least one AI technology as well as businesses that planned to adopt AI in the future to ensure robust findings could be drawn. The quantitative research involved two stages. First, a pilot telephone survey of 20 interviews was conducted between 10th – 12th January 2024. The pilot survey revealed an initial idea of the proportion of businesses that might screen out for not using or considering using AI.

The mainstage telephone survey consisting of 350 interviews with businesses of varying size and industry sector was conducted between 24th January and 13th February 2024. Interviews lasted around 15 minutes on average. Please find a copy of the questionnaire in the Appendix.

Sectors of interest

The research targeted UK businesses currently using or considering using AI in the following sectors:

• D,E,H: Electricity, Gas and Air Conditioning Supply; Water Supply; Sewerage, Waste Management and Remediation Activities; Transportation and Storage
• C: Manufacturing
• G: Wholesale and Retail Trade
• J: Information and Communication
• K: Financial and Insurance Activities
• M: Professional, Scientific and Technical Activities
• Q: Human Health and Social Work Activities

The sectors were chosen by mapping SIC sectors where AI uptake is likely to be high, alongside Critical National Infrastructure sectors where the largest societal impacts from the exploitation of cyber security vulnerabilities are likely to exist. The chosen list of sectors was informed by several evidence sources, including ONS’ “Understanding AI uptake and sentiment among people and businesses in the UK, June 2023” report, and the Department for Digital, Culture, Media & Sport’s (DCMS) “AI Activity in UK businesses”, report.

Sampling

The sample for the survey was sourced from Market Location, a commercial database of UK businesses. It was not possible to know at the point of drawing sample whether or not businesses were in-scope for the survey, therefore it was necessary to screen for this with a question at the point of recruitment. A sample of 21,000 businesses was purchased in order to ensure there were enough records to call through in order to achieve the desired number of interviews for both the pilot and mainstage fieldwork.

3. Pilot fieldwork

Ahead of the mainstage quantitative fieldwork, IFF Research piloted the questionnaire between 10th – 12th January 2024. These interviews were conducted via telephone by IFF interviewers, therefore under conditions that replicate how the mainstage fieldwork will run.

A total of 20 interviews were conducted, 12 with businesses currently using AI and 8 with those planning to adopt it in the future. The average survey length was 14 minutes and 53 seconds.

Achieved interviews and response rate

A total of 1,200 records were loaded for the pilot. Table 3.1 sets out the call outcomes for the records called.

Table 3.1 Summary of call outcomes during the pilot

Description	Number
Pilot sample available	1,200
Completed	20
Screen out (S2/A1/B1) - Organisation has not used AI and is not considering deploying AI in the future (average of 12% of connected calls)	131
Respondent refusal	44
Refusal - not available during fieldwork period	10
Contact made – no definite outcome	526
No direct contact made with respondent	381
Unobtainable (e.g. wrong number, out of service)	88

Profile of pilot respondents

Tables 3.2 and 3.3 show the completes broken down by business size and sector (no quotas were set for the pilot).

Table 3.2 Profile of businesses by size

Size of business	Frequency
Micro: 1-9 employees	12
Small: 10-49 employees	3
Medium: 50-249 employees	3
Large: 250+ employees	2

Table 3.3 Profile of businesses by sector

Sector of business	Frequency
Manufacturing	1
Wholesale and Retail Trade	1
Information and Communication	6
Professional, Scientific and Technical activities	11
Human Health and Social Work Activities	1

Pilot findings

Generally, the pilot revealed that the questionnaire worked well and did not require significant changes for the mainstage fieldwork. Only two main changes were made to the questionnaire following conclusion of the pilot.

Question B1 consisted of a list of different AI technologies which were read out to respondents for them to say for each one whether their organisation is currently using it (including piloting), not currently but have plans to adopt in the future, or has no plans to use it. This question was revised for the mainstage to include specific examples of the different AI technologies, in order to help businesses recognise AI tools they may be utilising. The question was also updated to clarify that we are interested in existing AI tools as well as AI tools they are developing themselves.

Question C3 asked businesses to summarise the specific cyber security practices or processes they have in place explicitly regarding the AI technology they deploy, or those they plan to have in place for future AI technologies. During the pilot fieldwork this was an open text question, however, the pilot responses were used to introduce some pre-codes for the question based on the most common responses. This reduces the time the interviewer spends on the question and subsequently saves the respondent time.

4. Mainstage fieldwork

Mainstage fieldwork was conducted using Computer Assisted Telephone Interviewing (CATI) between 24th January and 13th February 2024. Interviews lasted an average of 15 minutes.

The interviewing team asked to speak to the person responsible for cyber security within the organisation. Participants interviewed held a range of roles, often within the remit of IT or operations, such as: Head of IT, IT director / manager, Operations director / manager, Business development manager, and Office manager.

Interview targets

This research sought to interview a total of 350 UK businesses, split equally among seven (grouped) sectors as shown in Table 4.1.

Table 4.1 Interview targets by sector

Sector	Target
D, E, H: Electricity, Gas and Air Conditioning Supply; Water Supply; Sewerage, Waste Management and Remediation Activities; Transportation and Storage	50
C: Manufacturing	50
G: Wholesale and Retail Trade	50
J: Information and Communication	50
K: Financial and Insurance Activities	50
M: Professional, Scientific and Technical Activities	50
Q: Human Health and Social Work Activities	50

Achieved interviews and response rate

Profile of participating businesses

A total of 350 interviews were achieved, split by size and sector in Table 4.2.

Table 4.2 Profile of participating businesses

Sector	Micro (1-9)	Small (10-49)	Medium (50-249)	Large (250+)	Total
D, E, H: Electricity, Gas and Air Conditioning Supply; Water Supply; Sewerage, Waste Management and Remediation Activities; Transportation and Storage	11	21	13	5	50
C: Manufacturing	18	16	8	8	50
G: Wholesale and Retail Trade	20	12	10	8	50
J: Information and Communication	23	18	6	3	50
K: Financial and Insurance Activities	27	15	4	4	50
M: Professional, Scientific and Technical Activities	23	11	11	5	50
Q: Human Health and Social Work Activities	14	17	9	10	50
Total	136	110	61	43	350

Call outcomes and survey response rate

A call outcome is defined as a definite response to the survey invitation, i.e. whether an interview was achieved, or whether an interview could not be achieved and the reason was established. Among the 10,924 businesses called at least once, the response rate for the survey was 3% (shown in Table 4.3). This included businesses where no final outcome was reached, for example where the interviewing team were not able to get through to the right person, where an appointment had been made to call back at a later date, or where a or where the call went to answerphone. Among the 2,193 businesses where a definite call outcome was achieved, the response rate was 16% (shown in Table 4.4).

10% of businesses screened out because they confirmed their organisation does not use AI and is not considering deploying it in the future. However, this proportion increases to 48% when based on records where a definitive outcome was reached. The high proportion of businesses screening out and subsequent lower response rate was expected due to the specific eligibility requirement of businesses needing to be using or have plans to use AI.

Table 4.3 Unadjusted response rate

Description	Number	%
Total records called at least once	10,924	100%
Completed	350	3%
Screen out - Organisation does not use AI and is not considering deploying AI in the future	1,059	10%
Respondent refusal	486	4%
Respondent unavailable during fieldwork	234	2%
Contact made – no definite outcome	2,707	25%
No direct contact made with respondent	5,056	46%
Over quota	64	1%
Unobtainable (e.g. wrong number, out of service)	968	9%

Table 4.4 Adjusted response rate based on a definitive call outcome

Description	Number	%
Definitive call outcome	2,193	100%
Completed	350	16%
Screen out - Organisation has not used AI and is not considering deploying AI in the future	1,059	48%
Respondent refusal	486	22%
Respondent unavailable during fieldwork	234	11%
Over quota	64	3%

Of the 350 businesses that took part in the survey, 239 were currently using AI. These businesses as a proportion of all those for whom we have a definite answer on whether or not they use AI, equates to 21%. This is slightly higher than the ONS finding in April 2023 which reported an estimated 16% of all UK businesses had adopted at least one AI technology.[2]

Reasons for not using AI

Respondents who confirmed during the survey that they do not use, or have plans to use, any Artificial Intelligence tools within the business were asked what has prevented their organisation from implementing AI technologies.

Among the 193 businesses who answered, the most common reason provided was that they have not identified a need for AI, including deeming it irrelevant for their sector or industry (44%). 10% said they have not thought about AI or do not know enough about it and they have no interest in it, for example preferring human interaction (9%). 8% deemed AI unnecessary due to the small size of their business, 6% said they lack the time or resources to set it up and 6% had concerns about the security of AI models and systems, including data security and confidentiality.

Data analysis and weighting

Large and medium-sized businesses are over-represented in this survey compared to the business population. This was a deliberate decision - the Department needed a good-sized sample base of these types of businesses. Weighting by size and sector was therefore considered. However, as the number of interviews is small, the weights were deemed too large to apply and would have had a considerable negative impact on the effective base size. Specifically, it would have meant that it would not be possible to report the findings of businesses of a particular size or sector. The survey results cannot therefore be considered representative of the business population, however, can still provide useful insight into the behaviour of businesses that took part.

5. Appendix: Questionnaire

Screener

ASK TELEPHONIST

S1. Good morning / afternoon. My name is and I’m calling from IFF Research. Please can I speak to [IF NAMED CONTACT: ] [IF NO NAMED CONTACT: the person responsible for cyber security in your organisation]?

IF NECESSARY:

These could include individuals in your organisation who hold roles such as:

• Chief Information Officer (CIO)
• Chief technical officer (CTO)
• Chief Information Security Officer (CISO)
• Director of Security
• Head of Cyber Security/Information Security
• Senior IT role (e.g. IT director)

ADD IF NECESSARY: We’re conducting a survey on behalf of the Department for Science, Innovation and Technology to improve the department’s understanding of how Artificial Intelligence (AI) is used by businesses in key sectors and of how businesses implement cyber security practices and processes around the AI technology they deploy. The insights from this survey will provide invaluable information for policy development in this space.

Call Outcome	Code	Action
Transferred	1	CONTINUE
Hard appointment	2	MAKE APPOINTMENT
Soft Appointment	3	MAKE APPOINTMENT
Engaged	4	CALL BACK
Refusal	5	CLOSE
Refusal – company policy	6	CLOSE
Refusal – Taken part in recent survey	7	CLOSE
Nobody at site able to answer questions	8	CLOSE
Not available in deadline	9	CLOSE
Fax Line	10	CLOSE
No reply / Answer phone	11	CLOSE
Residential Number	12	CLOSE
Deadline	13	CLOSE
Company closed	14	CLOSE
Request reassurance email	-	COLLECT EMAIL ADDRESS THEN CONTINUE OR MAKE APPOINTMENT

ASK ALL

S2. Good morning / afternoon, my name is NAME, calling from IFF Research, an independent market research company. We’re conducting a survey on behalf of the Department for Science, Innovation and Technology.

They wish to improve their understanding of how Artificial Intelligence (AI) is used by businesses in key sectors and of how businesses implement cyber security practices and processes around the AI technology they deploy.

The survey will only take around 10 minutes and the insights from this survey will provide invaluable information for policy development in this space. Is now a good time to run through some questions with you?

Everything you say will be treated in the strictest confidence, and the Department for Science, Innovation and Technology will not be told who has taken part. As part of our quality control procedures, all interviews are recorded automatically.

ADD IF NECESSARY: We are interested in speaking to you even if your organisation doesn’t currently use AI technologies, but it might be something you are considering deploying in the future.

Call Outcome	Code	Action
Continue	1	CONTINUE
Referred to someone else at establishment	2	TRANSFER AND RE-INTRODUCE
Hard appointment	3	MAKE APPOINTMENT
Soft appointment	4	MAKE APPOINTMENT
Refusal	5	THANK AND CLOSE
Refusal – Organisation has not used AI and is not considering deploying AI in the future.	6	THANK AND CLOSE
Refusal – company policy	7	THANK AND CLOSE
Refusal – taken part in recent survey	8	THANK AND CLOSE
Not available in deadline	9	THANK AND CLOSE
Request reassurance email	-	COLLECT EMAIL ADDRESS THEN CONTINUE OR MAKE APPOINTMENT(SEE APPENDIX FOR EMAIL TEXT)

---

REASSURANCES TO USE IF NECESSARY

The interview will take around 10 minutes to complete.

Please note that all data will be reported in aggregate form and your answers will not be reported to the Department for Science, Innovation and Technology in any way that would allow you or your business to be identified.

If you would like further information on how IFF handles and processes personal data, as well as information on your rights under data protection regulations to access your personal data, withdraw consent, or object to the processing of your personal data you can visit: https://www.iffresearch.com/privacy-policy/

If respondent wishes to confirm validity of survey or get more information about aims and objectives, they can contact:

• IFF, for queries about the research: AISecurityPractices@iffresearch.com
• DSIT, to confirm the survey is genuine: cybersurveys@dsit.gov.uk
• MRS (Market Research Society), to confirm IFF is a genuine research company: 0800 975 9596, www.mrs.org.uk

---

A. Background to organisation

READ TO ALL:

I’d like to start by getting a few details about your organisation.

ASK ALL

A1. Do you use, or have plans to use, any Artificial Intelligence tools within the business?

This could be at any level and for any task, including recent generative tools such ChatGPT, Microsoft Co-pilot, and more complex solutions including machine learning and robotic automation. We are interested in AI tools you might be developing yourselves as well as existing off-the-shelf AI tools.

DO NOT READ OUT. SINGLE CODE.

Yes	1
No	2
Don’t know	3	THANK AND CLOSE: We are looking to speak to organisations who are using or considering using AI. Thank you for your time today.
Refused	4	THANK AND CLOSE: We are looking to speak to organisations who are using or considering using AI. Thank you for your time today.

IF DOES NOT HAVE PLANS TO IMPLEMENT AI TECHNOLOGIES (A1=2)

A2. What has prevented your organisation from implementing Artificial Intelligence technologies?

IF RESPONDENT SAYS THEY ARE A SMALL BUSINESS, PROBE FOR WHETHER THE BARRIER IS FINANCIAL COST, LACK OF AWARENESS OR JUST DEEM AI UNNECESSARY

DO NOT READ OUT. MULTI CODE

Concerns about the security of AI models and systems (inc. data security / confidentiality)	1	THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today.
Financial cost	2	THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today.
Organisation lacks technical resources	3	THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today.
Organisation is unclear on the purpose of using AI	4	THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today.
Have not identified a need for it (inc. not relevant for sector/industry)	5	THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today.
Haven’t thought about it / don’t know enough about it	6	THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today.
Deemed unnecessary due to small size of business	7	THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today.
Other (please specify)	8	THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today.
Don’t know	9	THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today.
Refused	10	THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today.

ASK ALL

A3. Are your organisation’s main headquarters in the UK?

DO NOT READ OUT. SINGLE CODE.

Yes	1
No	2
Refused	3	THANK AND CLOSE

IF MAIN HEADQUARTERS ARE NOT IN THE UK (A3=2)

A4. Are your products and/or services available for sale in the UK?

DO NOT READ OUT. SINGLE CODE.

Yes	1
No	2	THANK AND CLOSE
Refused	3	THANK AND CLOSE

ASK ALL

A5. Which of these best represents the size of your organisation, based on the number of employees working for your organisation, including yourself?

READ OUT. SINGLE CODE

Micro: 1-9 employees	1
Small: 10-49 employees	2
Medium: 50-249 employees	3
Large: 250+ employees	4
Don’t know	5	THANK AND CLOSE
Refused	6	THANK AND CLOSE

ASK ALL

A6. I have [SAMPLE SECTOR] as a general description of your company’s principal activity. Bearing in mind that this is a general description only, does this sound correct?

Yes	1
No	2
Don’t know	3

IF DISAGREE WITH SAMPLE SECTOR (A6=2/3)

A7. What is the main business activity of your company?

INTERVIEWER PROBE FOR THE FOLLOWING - START WITH FIRST PROBE AND ONLY USE THE OTHERS IF NECESSARY TO GET CLEAR INFORMATION • What is the main product or service of this establishment? • What exactly is made or done at this establishment?

WRITE IN. TO BE CODED TO 4 DIGIT SIC 2007.
Don’t know	2
Refused	3

B AI usage

READ TO ALL:

My next questions are about your organisation’s use of artificial intelligence (AI).

ASK ALL

B1. For the following Artificial Intelligence technologies, please could you tell me whether your organisation is currently using it (including piloting), not currently but have plans to adopt in the future, or has no plans to use it.

INTERVIEWER NOTE / ADD IF NECESSARY: We are interested in AI tools you might be developing yourselves as well as existing off-the-shelf AI tools.

READ OUT. SINGLE CODE FOR EACH

Technology	Currently using	Not used but planning to adopt in the future	Not using	Don’t know	Refused
_1 Machine learning ADD IF NECESSARY: This is a branch of artificial intelligence which focuses on the use of data and algorithms to imitate the way that humans learn, gradually improving its accuracy. Example AI tools include Microsoft Azure Machine Learning, IBM Watson and Google TensorFlow.
_2 Natural language processing and generation ADD IF NECESSARY: This is the use of artificial intelligence programming to produce written or spoken narratives from a data set, including creating computer code or transcribing audio to text in real time. Example AI tools include ChatGPT and Bard.
_3 Computer vision/ image processing and generation ADD IF NECESSARY: This is the use of artificial intelligence programming to produce, generate, analyse, interpret, and manipulate digital images. Examples AI tools include OpenCV and Viso Suite.
_4 Hardware related to AI ADD IF NECESSARY: such as Edge Computing Chips, Quantum Hardware, Application Specific Integrated Circuits (ASIC), Neuromorphic Hardware, and Field Programmable Gate Array (FPGA).
_5 Robotic process automation (RPA)

ASK ALL

B1a. Are there any other Artificial Intelligence technologies not mentioned that your organisation is currently using (including piloting) or planning to adopt in the future?

INTERVIEWER NOTE / ADD IF NECESSARY: We are interested in AI tools you might be developing yourselves as well as existing off-the-shelf AI tools.

MULTI CODE.

Yes – other technology 1 (please specify)	1	WRITE IN
Yes – other technology 2 (please specify)	2	WRITE IN
Yes – other technology 3 (please specify)	3	WRITE IN
No	4	EXCLUSIVE
Don’t know	5	EXCLUSIVE

ASK IF USES A DIFFERENT TECHNOLOGY (B1A_1-3 ≠ BLANK)

B1b. And please could you tell me whether your organisation is currently using it (including piloting) or not currently but have plans to in the future.

READ OUT. SINGLE CODE FOR EACH

Technology	Currently using	Not used but planning to adopt in the future	Don’t know	Refused
DS: SHOW IF B1a_1 ≠ BLANK.
B1a_1
DS: SHOW IF B1a_2 ≠ BLANK.
B1a_2
DS: SHOW IF B1a_3 ≠ BLANK.
B1a_3

---

B1Dum

DUMMY VARIABLE, DO NOT ASK

Currently uses AI in one or more technology	1	(B1_1 = 1 or B2_2 = 1 or B1_3 = 1 or B1_4 = 1 or B1_5 = 1 or B1b_1 = 1 or B1b_2 = 1 or B1b_3 = 1)
Does not use AI in any technology but is planning to adopt in the future	2	(B1_1 ≠ 1 or B2_2 ≠ 1 or B1_3 ≠ 1 or B2_4 ≠ 1 or B1_5 ≠ 1 or B1b_1 ≠ 1 or B1b_2 ≠ 1 or B1b_3 ≠ 1) AND (B1_1 = 2 or B2_2 = 2 or B1_3 = 2 or B2_4 = 2 B1_5 = 2 or B1b_1 = 2 or B1b_2 = 2 or B1b_3 = 2)
Neither uses nor has plans yet to use a specific technology.	3	(B1_1 ≠ 1-2 or B2_2 ≠ 1-2 or B1_3 ≠ 1-2 or B2_4 ≠ 1-2 or B1_5 ≠ 1-2 or B1b_1 ≠ 1-2 or B1b_2 ≠ 1-2 or B1b_3 ≠ 1-2)

SCREEN OUT: IF B1DUM=3: We are looking to speak to organisations who are using or considering using AI. Thank you for your time today.

---

IF CURRENTLY USES AI TECHNOLOGIES (B1Dum = 1)

B1c. Please could you tell me the specific AI products you are using?

WRITE IN
Don’t know	2
Refused	3

IF CURRENTLY USES AI TECHNOLOGIES (B1Dum = 1)

B2. Please could you tell me whether your organisation is currently piloting the following technology, has used it for 1-3 years, or has used it for over 3 years.

READ OUT. SINGLE CODE FOR EACH

DS: ONLY SHOW CODES WHERE B1_1-6=1 or B1b_1-3 = 1)

	Technology	Currently piloting	Used for 1-3 years	Used for over 3 years	Don’t know	Refused
Machine learning
Natural language processing and generation
Computer vision/ image processing and generation
Hardware related to AI
Robotic process automation
B1a_1
B1a_2
B1a_3

IF PLANS TO ADOPT AI TECHNOLOGIES IN THE FUTURE (B1Dum = 2)

B3. Please could you tell me whether your organisation is planning to adopt the following technology in the next year or whether you plan to adopt it further in the future.

READ OUT. SINGLE CODE FOR EACH

DS: ONLY SHOW CODES WHERE B1_1-6=2 or B1b_1-3=2

	Technology	Currently piloting	Used for 1-3 years	Used for over 3 years	Don’t know	Refused
Machine learning
Natural language processing and generation
Computer vision/ image processing and generation
Hardware related to AI
Robotic process automation
B1a_1
B1a_2
B1a_3

IF CURRENTLY USES AI TECHNOLOGIES (B1Dum = 1)

B4. How did your organisation adopt the following technology?

READ OUT. SINGLE CODE FOR EACH

DS: ONLY SHOW CODES WHERE B1_1-6=1 or B1b_1-3 = 2

	Technology	Currently piloting	Used for 1-3 years	Used for over 3 years	Don’t know	Refused
Machine learning
Natural language processing and generation
Computer vision/ image processing and generation
Hardware related to AI
Robotic process automation
B1a_1
B1a_2
B1a_3

IF CURRENTLY USES AI TECHNOLOGIES (B1Dum = 1)

B5. For what reasons does your organisation employ AI technology?

IF RESPONDENT SAYS WHAT THEY USE AI FOR, PROBE FOR WHY THEY USE AI AS OPPOSED TO AN EMPLOYEE DOING THE TASK THEMSELVES.

DO NOT READ OUT. MULTI CODE

Cyber security defence	1
Fraud detection	2
Financial savings (inc. efficiency, productivity and automation)	3
Algorithmic trading	4
Customer services	5
Inventory management	6
Recruitment	7
Other (please specify)	8	WRITE IN
Don’t know	9	EXCLUSIVE
Refused	10	EXCLUSIVE

ASK IF USES AI TECHNOLOGY FOR CYBER SECURITY DEFENCE (B5 = 1)

B6. And how does your organisation employ AI technology for Cyber security defence?

SINGLE CODE

WRITE IN
Don’t know	2
Refused	3

C Cyber security practices around the AI

IF USES OR IS CONSIDERING USING AI TECHNOLOGIES (B1DUM = 1-2)

My next questions are about your business’ cyber security practices surrounding AI technologies.

IF USES AI TECHNOLOGIES (B1DUM = 1)

C1. Does your organisation have specific cyber security practices or processes in place explicitly regarding the AI technology you deploy?

DO NOT READ OUT. SINGLE CODE.

Yes	1
No	2
Don’t know	3
Refused	4

IF CONSIDERING USING AI TECHNOLOGIES OR DOES NOT HAVE AI TECHNOLOGIES (B1DUM = 2)

C2. Would your organisation have specific cyber security practices or processes in place explicitly regarding the AI technology once your planned AI technologies are deployed?

DO NOT READ OUT. SINGLE CODE.

Yes	1
No	2
Don’t know	3
Refused	4

IF HAS SPECIFIC AI CYBER SECURITY PRACTICES OR PROCESSES (C1=1 OR C2 =1)

C3. Please could you summarise what these practices or processes < TEXT SUB if B1Dum = 1 “are”> < TEXT SUB if B1Dum = 2 “might be”>?

DO NOT READ OUT. MULTI CODE

Ensuring personal data isn’t shared with third parties	1
Firewalls for AI	2
AI-driven Attack Signal Intelligence (e.g. Vectra)	3
Other (please specify)	4
Don’t know	5
Refused	6

IF DOES NOT HAVE SPECIFIC AI CYBER SECURITY PRACTICES OR PROCESSES IN PLACE (C1=2 OR C2 = 2)

C4. Please could you briefly explain why that is?

WRITE IN
Don’t know	2
Refused	3

IF USES OR IS CONSIDERING USING AI TECHNOLOGIES (B1DUM = 1-2)

C5. Are there specific cyber security requirements or features that you expect to be built into AI companies’ models and systems?

IF YES:WRITE IN
No	2
Don’t know	3
Refused	4

IF THEY OUTSOURCE DEVELOPMENT OF THEIR AI TECHNOLOGY (B4_1-8=3)

C6. Has your organisation identified a vulnerability or been breached as a result of the AI service deployed in your infrastructure?

PROMPT AS NECESSARY. SINGLE CODE

Yes, been breached	1
Yes, identified a vulnerability but not been breached	2
No	3
Don’t know)	4
Refused	5

D General cyber security practices

READ TO ALL:

For the rest of the survey, we will be asking about cyber security. By this, we mean any strategy, processes, practices or technologies that organisations have in place to secure their networks, computers, programs or the data they hold from damage, attack or unauthorised access.

ASK ALL

D1. Which of the following governance or risk management arrangements, if any, do you have in place?

READ OUT. MULTI CODE

Board members with responsibility for cyber security	1
An outsourced provider that manages your cyber security	2
A formal policy or policies in place covering cyber security risks	3
A Business Continuity Plan that covers cyber security	4
A written list of the most critical data, systems or assets that your organisation wants to protect	5
DO NOT READ OUT: None of these	6	SINGLE CODE
DO NOT READ OUT: Don’t know	7	SINGLE CODE
DO NOT READ OUT: Refused	8	SINGLE CODE

ASK ALL

D2. Which of the following standards or accreditations, if any, does your organisation adhere to?

READ OUT. MULTI CODE

The Payment Card Industry Data Security Standard, or PCI DSS	1
Any National Institute of Standards and Technology (NIST) standards	2
The Cyber Essentials standard	3
The Cyber Essentials Plus standard	4
ISO 27000 Standard	5
DO NOT READ OUT: None of these	6	SINGLE CODE
DO NOT READ OUT: Don’t know	7	SINGLE CODE
DO NOT READ OUT: Refused	8	SINGLE CODE

ASK ALL

D3. Which of the following, if any, have you done over the last 12 months to identify cyber security risks to your organisation?

READ OUT. MULTI CODE

A cyber security vulnerability audit	1
A risk assessment covering cyber security risks	2
Used or invested in threat intelligence	3
Used specific tools designed for security monitoring, such as Intrusion Detection Systems	4
Penetration testing	5
Testing staff awareness and response (e.g. via mock phishing exercises)	6
DO NOT READ OUT: None of these	7	SINGLE CODE
DO NOT READ OUT: Don’t know	8	SINGLE CODE
DO NOT READ OUT: Refused	9	SINGLE CODE

ASK ALL

D4. What was your business’ approximate turnover for the last financial year?

DO NOT READ OUT. SINGLE CODE.

IF NECESSARY: PROMPT WITH RANGES

£0 – £49,999	1
£50,000 - £84,999	2
£85,000 - £249,999	3
£250,000 - £499,999	4
£500,000 - £999,999	5
£1,000,000 - £4,999,999	6
£5,000,000 - £24,999,999	7
£25,000,000+	8
Don’t know	9
Refused	10

E Thank and close

ASK ALL

E1. Thank you very much for taking the time to speak to us today. Would you be willing for us to call you back regarding this particular study – if we need to clarify any of the information?

Yes	1
No	2

ASK ALL

E2. In the near future we may be conducting some follow-up interviews to explore some of the areas discussed in this survey in more detail. Would it be okay to contact you about taking part in this research? Agreeing to be contacted does not mean you have to take part. You can opt-out at any time if we contact you.

Yes	1
No	2

IF CONSENT TO RECONTACT (E1=1 OR E2=1)

E3. And could I just check, is [NUMBER] the best number to call you on?

Yes	1
No - write in number	2

IF CONSENT TO RECONTACT (E1=1 OR E2=1)

E4. Please could I take a few more details:

Name: …………………..	ALLOW REFUSED OPTION
Job title: …………………..	ALLOW REFUSED OPTION
Email address: …………………..	ALLOW REFUSED OPTION

---

READ TO ALL

You’ve been speaking to NAME from IFF, on behalf of the Department for Science, Innovation and Technology. Thank you very much for your time today.

Would you like the Market Research Society freephone number in case you wish to check our credentials? (If yes, that’s 0800 975 9596).

---

[1] Understanding AI uptake and sentiment among people and businesses in the UK - Office for National Statistics (ons.gov.uk), June 2023

[2] Understanding AI uptake and sentiment among people and businesses in the UK - Office for National Statistics (ons.gov.uk), June 2023