As cyber threats grow and digital technologies become more pervasive, businesses are increasingly using AI to strengthen cybersecurity, while individuals are taking greater control of their personal data through privacy-enhancing tools, new OECD data show.

In 2023, 17.7% of enterprises across the OECD experienced ICT security incidents, a 28.2% increase compared with 2018. As cyber threats become increasingly sophisticated and exploit advances in digital technologies, businesses are also turning to AI to strengthen their cybersecurity capabilities. In 2025, 5.3% of enterprises used AI for ICT security, equivalent to around one-quarter of all enterprises using AI.

Applications include machine-learning systems for the detection and prevention of cyber-attacks and AI-based user authentication. Adoption has accelerated rapidly, reaching a level in 2025 that was 23.2% higher than in 2024, 68.6% higher than in 2023, and more than double its 2021 level.

Despite strong growth in recent years, its use varies substantially by firm size. In 2025, 26.7% of large enterprises used AI for ICT security, compared with 9.6% of medium-sized enterprises and 3.7% of small enterprises – highlighting persistent differences in use of advanced digital security technologies.

Adoption of AI for ICT security also varies substantially across industries. In 2025, 18.1% of firms in the information and communication sector reported using AI for ICT security, far exceeding adoption rates in other industries, with the next highest share recorded in professional, scientific and technical activities (8.9%). Adoption in the ICT sector was approximately nine times higher than in accommodation and food services (2.1%). This suggests that AI-enabled cybersecurity tools are being adopted more widely in information-intensive sectors, where cyber risks and reliance on digital systems tend to be greatest.

Individuals across the OECD are increasingly taking control of their personal data online. Between 2020 and 2025, the share of individuals changing browser settings to limit cookies, which can be used to track browsing activity across websites, rose by 26.8%. The shares of individuals refusing the use of personal data for advertising purposes and restricting access to their geographical location also increased markedly, by 17.2% and 14.0% respectively. More moderate increases were observed for limiting access to social media profiles (+11.3%) and using anti-tracking software (+7.0%), which can limit the ability of websites and online services to monitor users’ activities across the internet.

These trends coincide with the growing availability of privacy controls in browsers, operating systems and online platforms, as well as increased awareness of privacy and personal data protection online. By 2025, more than half of individuals either restricted access to their geographical location or refused the use of their personal data for advertising purposes. By contrast, the share of individuals who reported reading privacy policy statements before providing personal data declined by around 8.4% over the same period.

While the use of privacy-management tools is widespread and increasing, only 4.5% of individuals across the OECD reported privacy, security or safety concerns as their main reason for non-adoption of generative AI tools in 2025. Compared to younger individuals (aged 16-24), a higher share of older adults (aged 55-74) reported avoiding AI because of privacy, security or safety concerns (5.8% versus 1.9%), while a lower share reported taking active steps to manage their privacy online. Meanwhile, younger individuals report fewer concerns about using AI, yet frequently use privacy controls, restrict access to personal data, modify browser settings, and use anti-tracking software.

While concerns about privacy, security and safety implications of generative AI are broadly similar across individuals with high and low educational attainment (3.9% and 3.5% respectively), the adoption of online privacy protections differs markedly. Individuals with higher levels of educational attainment consistently report higher rates of taking steps to manage their personal data online. For example, 68.1% refused the use of personal data for advertising purposes and 65.8% restricted access to their geographical location, compared with 39.5% and 38.9%, respectively, for individuals with low educational attainment.

For further information about this data, please visit the OECD Data Kitchen or contact the OECD Directorate for Science, Technology and Innovation at sti.contact@oecd.org.