AI cyber security survey - technical report
Published 15 May 2024
1. Introduction
Background
The Department for Science, Innovation and Technology (DSIT) commissioned IFF Research to conduct a survey to understand how Artificial Intelligence (AI) is used by businesses in key sectors, and how businesses implement cyber security practices and processes around the AI technology they deploy.
Artificial intelligence is the broader field encompassing knowledge-based systems, data-driven and machine learning-enabled systems, including classic machine learning (supervised learning, unsupervised learning), deep learning, and reinforcement learning, referring to the development of systems that can perform tasks requiring human intelligence. The use of AI is growing. In April 2023, an estimated 16% of all UK businesses had adopted at least one AI technology[1] and with the growth of more accessible and powerful generative AI models, this number is likely to increase significantly. The growing use of AI among businesses presents huge opportunities; however, without appropriate safeguards there are also significant risks. This is particularly the case with cyber security which is an essential precondition for the safety of AI systems. It was in this context that DSIT commissioned IFF Research to carry out primary research among UK businesses.
Research objectives
The core objectives of the research were to understand:
- What types of technology are being used, and for what purpose;
- Businesses’ cyber security practices – in general terms, and specific to AI;
- Businesses’ future plans in relation to AI and cyber security; and
- How these activities and attitudes vary across businesses in different sectors and of different sizes.
This report
This report supplements the main report and provides more detail on research approach including information on cognitive interviewing, pilot fieldwork, sampling, weighting, data analysis and sample outcomes.
2. Methodology
Research design
The survey sought to create a robust sample base of businesses that were adopting at least one AI technology as well as businesses that planned to adopt AI in the future to ensure robust findings could be drawn. The quantitative research involved two stages. First, a pilot telephone survey of 20 interviews was conducted between 10th – 12th January 2024. The pilot survey revealed an initial idea of the proportion of businesses that might screen out for not using or considering using AI.
The mainstage telephone survey consisting of 350 interviews with businesses of varying size and industry sector was conducted between 24th January and 13th February 2024. Interviews lasted around 15 minutes on average. Please find a copy of the questionnaire in the Appendix.
Sectors of interest
The research targeted UK businesses currently using or considering using AI in the following sectors:
- D,E,H: Electricity, Gas and Air Conditioning Supply; Water Supply; Sewerage, Waste Management and Remediation Activities; Transportation and Storage
- C: Manufacturing
- G: Wholesale and Retail Trade
- J: Information and Communication
- K: Financial and Insurance Activities
- M: Professional, Scientific and Technical Activities
- Q: Human Health and Social Work Activities
The sectors were chosen by mapping SIC sectors where AI uptake is likely to be high, alongside Critical National Infrastructure sectors where the largest societal impacts from the exploitation of cyber security vulnerabilities are likely to exist. The chosen list of sectors was informed by several evidence sources, including ONS’ “Understanding AI uptake and sentiment among people and businesses in the UK, June 2023” report, and the Department for Digital, Culture, Media & Sport’s (DCMS) “AI Activity in UK businesses”, report.
Sampling
The sample for the survey was sourced from Market Location, a commercial database of UK businesses. It was not possible to know at the point of drawing sample whether or not businesses were in-scope for the survey, therefore it was necessary to screen for this with a question at the point of recruitment. A sample of 21,000 businesses was purchased in order to ensure there were enough records to call through in order to achieve the desired number of interviews for both the pilot and mainstage fieldwork.
3. Pilot fieldwork
Ahead of the mainstage quantitative fieldwork, IFF Research piloted the questionnaire between 10th – 12th January 2024. These interviews were conducted via telephone by IFF interviewers, therefore under conditions that replicate how the mainstage fieldwork will run.
A total of 20 interviews were conducted, 12 with businesses currently using AI and 8 with those planning to adopt it in the future. The average survey length was 14 minutes and 53 seconds.
Achieved interviews and response rate
A total of 1,200 records were loaded for the pilot. Table 3.1 sets out the call outcomes for the records called.
Table 3.1 Summary of call outcomes during the pilot
Description | Number |
---|---|
Pilot sample available | 1,200 |
Completed | 20 |
Screen out (S2/A1/B1) - Organisation has not used AI and is not considering deploying AI in the future (average of 12% of connected calls) | 131 |
Respondent refusal | 44 |
Refusal - not available during fieldwork period | 10 |
Contact made – no definite outcome | 526 |
No direct contact made with respondent | 381 |
Unobtainable (e.g. wrong number, out of service) | 88 |
Profile of pilot respondents
Tables 3.2 and 3.3 show the completes broken down by business size and sector (no quotas were set for the pilot).
Table 3.2 Profile of businesses by size
Size of business | Frequency |
---|---|
Micro: 1-9 employees | 12 |
Small: 10-49 employees | 3 |
Medium: 50-249 employees | 3 |
Large: 250+ employees | 2 |
Table 3.3 Profile of businesses by sector
Sector of business | Frequency |
---|---|
Manufacturing | 1 |
Wholesale and Retail Trade | 1 |
Information and Communication | 6 |
Professional, Scientific and Technical activities | 11 |
Human Health and Social Work Activities | 1 |
Pilot findings
Generally, the pilot revealed that the questionnaire worked well and did not require significant changes for the mainstage fieldwork. Only two main changes were made to the questionnaire following conclusion of the pilot.
Question B1 consisted of a list of different AI technologies which were read out to respondents for them to say for each one whether their organisation is currently using it (including piloting), not currently but have plans to adopt in the future, or has no plans to use it. This question was revised for the mainstage to include specific examples of the different AI technologies, in order to help businesses recognise AI tools they may be utilising. The question was also updated to clarify that we are interested in existing AI tools as well as AI tools they are developing themselves.
Question C3 asked businesses to summarise the specific cyber security practices or processes they have in place explicitly regarding the AI technology they deploy, or those they plan to have in place for future AI technologies. During the pilot fieldwork this was an open text question, however, the pilot responses were used to introduce some pre-codes for the question based on the most common responses. This reduces the time the interviewer spends on the question and subsequently saves the respondent time.
4. Mainstage fieldwork
Mainstage fieldwork was conducted using Computer Assisted Telephone Interviewing (CATI) between 24th January and 13th February 2024. Interviews lasted an average of 15 minutes.
The interviewing team asked to speak to the person responsible for cyber security within the organisation. Participants interviewed held a range of roles, often within the remit of IT or operations, such as: Head of IT, IT director / manager, Operations director / manager, Business development manager, and Office manager.
Interview targets
This research sought to interview a total of 350 UK businesses, split equally among seven (grouped) sectors as shown in Table 4.1.
Table 4.1 Interview targets by sector
Sector | Target |
---|---|
D, E, H: Electricity, Gas and Air Conditioning Supply; Water Supply; Sewerage, Waste Management and Remediation Activities; Transportation and Storage | 50 |
C: Manufacturing | 50 |
G: Wholesale and Retail Trade | 50 |
J: Information and Communication | 50 |
K: Financial and Insurance Activities | 50 |
M: Professional, Scientific and Technical Activities | 50 |
Q: Human Health and Social Work Activities | 50 |
Achieved interviews and response rate
Profile of participating businesses
A total of 350 interviews were achieved, split by size and sector in Table 4.2.
Table 4.2 Profile of participating businesses
Sector | Micro (1-9) | Small (10-49) | Medium (50-249) | Large (250+) | Total |
---|---|---|---|---|---|
D, E, H: Electricity, Gas and Air Conditioning Supply; Water Supply; Sewerage, Waste Management and Remediation Activities; Transportation and Storage | 11 | 21 | 13 | 5 | 50 |
C: Manufacturing | 18 | 16 | 8 | 8 | 50 |
G: Wholesale and Retail Trade | 20 | 12 | 10 | 8 | 50 |
J: Information and Communication | 23 | 18 | 6 | 3 | 50 |
K: Financial and Insurance Activities | 27 | 15 | 4 | 4 | 50 |
M: Professional, Scientific and Technical Activities | 23 | 11 | 11 | 5 | 50 |
Q: Human Health and Social Work Activities | 14 | 17 | 9 | 10 | 50 |
Total | 136 | 110 | 61 | 43 | 350 |
Call outcomes and survey response rate
A call outcome is defined as a definite response to the survey invitation, i.e. whether an interview was achieved, or whether an interview could not be achieved and the reason was established. Among the 10,924 businesses called at least once, the response rate for the survey was 3% (shown in Table 4.3). This included businesses where no final outcome was reached, for example where the interviewing team were not able to get through to the right person, where an appointment had been made to call back at a later date, or where a or where the call went to answerphone. Among the 2,193 businesses where a definite call outcome was achieved, the response rate was 16% (shown in Table 4.4).
10% of businesses screened out because they confirmed their organisation does not use AI and is not considering deploying it in the future. However, this proportion increases to 48% when based on records where a definitive outcome was reached. The high proportion of businesses screening out and subsequent lower response rate was expected due to the specific eligibility requirement of businesses needing to be using or have plans to use AI.
Table 4.3 Unadjusted response rate
Description | Number | % |
---|---|---|
Total records called at least once | 10,924 | 100% |
Completed | 350 | 3% |
Screen out - Organisation does not use AI and is not considering deploying AI in the future | 1,059 | 10% |
Respondent refusal | 486 | 4% |
Respondent unavailable during fieldwork | 234 | 2% |
Contact made – no definite outcome | 2,707 | 25% |
No direct contact made with respondent | 5,056 | 46% |
Over quota | 64 | 1% |
Unobtainable (e.g. wrong number, out of service) | 968 | 9% |
Table 4.4 Adjusted response rate based on a definitive call outcome
Description | Number | % |
---|---|---|
Definitive call outcome | 2,193 | 100% |
Completed | 350 | 16% |
Screen out - Organisation has not used AI and is not considering deploying AI in the future | 1,059 | 48% |
Respondent refusal | 486 | 22% |
Respondent unavailable during fieldwork | 234 | 11% |
Over quota | 64 | 3% |
Of the 350 businesses that took part in the survey, 239 were currently using AI. These businesses as a proportion of all those for whom we have a definite answer on whether or not they use AI, equates to 21%. This is slightly higher than the ONS finding in April 2023 which reported an estimated 16% of all UK businesses had adopted at least one AI technology.[2]
Reasons for not using AI
Respondents who confirmed during the survey that they do not use, or have plans to use, any Artificial Intelligence tools within the business were asked what has prevented their organisation from implementing AI technologies.
Among the 193 businesses who answered, the most common reason provided was that they have not identified a need for AI, including deeming it irrelevant for their sector or industry (44%). 10% said they have not thought about AI or do not know enough about it and they have no interest in it, for example preferring human interaction (9%). 8% deemed AI unnecessary due to the small size of their business, 6% said they lack the time or resources to set it up and 6% had concerns about the security of AI models and systems, including data security and confidentiality.
Data analysis and weighting
Large and medium-sized businesses are over-represented in this survey compared to the business population. This was a deliberate decision - the Department needed a good-sized sample base of these types of businesses. Weighting by size and sector was therefore considered. However, as the number of interviews is small, the weights were deemed too large to apply and would have had a considerable negative impact on the effective base size. Specifically, it would have meant that it would not be possible to report the findings of businesses of a particular size or sector. The survey results cannot therefore be considered representative of the business population, however, can still provide useful insight into the behaviour of businesses that took part.
5. Appendix: Questionnaire
Screener
ASK TELEPHONIST
S1. Good morning / afternoon. My name is and I’m calling from IFF Research. Please can I speak to [IF NAMED CONTACT: ] [IF NO NAMED CONTACT: the person responsible for cyber security in your organisation]?
IF NECESSARY:
These could include individuals in your organisation who hold roles such as:
- Chief Information Officer (CIO)
- Chief technical officer (CTO)
- Chief Information Security Officer (CISO)
- Director of Security
- Head of Cyber Security/Information Security
- Senior IT role (e.g. IT director)
ADD IF NECESSARY: We’re conducting a survey on behalf of the Department for Science, Innovation and Technology to improve the department’s understanding of how Artificial Intelligence (AI) is used by businesses in key sectors and of how businesses implement cyber security practices and processes around the AI technology they deploy. The insights from this survey will provide invaluable information for policy development in this space.
Call Outcome | Code | Action |
---|---|---|
Transferred | 1 | CONTINUE |
Hard appointment | 2 | MAKE APPOINTMENT |
Soft Appointment | 3 | MAKE APPOINTMENT |
Engaged | 4 | CALL BACK |
Refusal | 5 | CLOSE |
Refusal – company policy | 6 | CLOSE |
Refusal – Taken part in recent survey | 7 | CLOSE |
Nobody at site able to answer questions | 8 | CLOSE |
Not available in deadline | 9 | CLOSE |
Fax Line | 10 | CLOSE |
No reply / Answer phone | 11 | CLOSE |
Residential Number | 12 | CLOSE |
Deadline | 13 | CLOSE |
Company closed | 14 | CLOSE |
Request reassurance email | - | COLLECT EMAIL ADDRESS THEN CONTINUE OR MAKE APPOINTMENT |
ASK ALL
S2. Good morning / afternoon, my name is NAME, calling from IFF Research, an independent market research company. We’re conducting a survey on behalf of the Department for Science, Innovation and Technology.
They wish to improve their understanding of how Artificial Intelligence (AI) is used by businesses in key sectors and of how businesses implement cyber security practices and processes around the AI technology they deploy.
The survey will only take around 10 minutes and the insights from this survey will provide invaluable information for policy development in this space. Is now a good time to run through some questions with you?
Everything you say will be treated in the strictest confidence, and the Department for Science, Innovation and Technology will not be told who has taken part. As part of our quality control procedures, all interviews are recorded automatically.
ADD IF NECESSARY: We are interested in speaking to you even if your organisation doesn’t currently use AI technologies, but it might be something you are considering deploying in the future.
Call Outcome | Code | Action |
---|---|---|
Continue | 1 | CONTINUE |
Referred to someone else at establishment | 2 | TRANSFER AND RE-INTRODUCE |
Hard appointment | 3 | MAKE APPOINTMENT |
Soft appointment | 4 | MAKE APPOINTMENT |
Refusal | 5 | THANK AND CLOSE |
Refusal – Organisation has not used AI and is not considering deploying AI in the future. | 6 | THANK AND CLOSE |
Refusal – company policy | 7 | THANK AND CLOSE |
Refusal – taken part in recent survey | 8 | THANK AND CLOSE |
Not available in deadline | 9 | THANK AND CLOSE |
Request reassurance email | - | COLLECT EMAIL ADDRESS THEN CONTINUE OR MAKE APPOINTMENT(SEE APPENDIX FOR EMAIL TEXT) |
REASSURANCES TO USE IF NECESSARY
The interview will take around 10 minutes to complete.
Please note that all data will be reported in aggregate form and your answers will not be reported to the Department for Science, Innovation and Technology in any way that would allow you or your business to be identified.
If you would like further information on how IFF handles and processes personal data, as well as information on your rights under data protection regulations to access your personal data, withdraw consent, or object to the processing of your personal data you can visit: https://www.iffresearch.com/privacy-policy/
If respondent wishes to confirm validity of survey or get more information about aims and objectives, they can contact:
- IFF, for queries about the research: AISecurityPractices@iffresearch.com
- DSIT, to confirm the survey is genuine: cybersurveys@dsit.gov.uk
- MRS (Market Research Society), to confirm IFF is a genuine research company: 0800 975 9596, www.mrs.org.uk
A. Background to organisation
READ TO ALL:
I’d like to start by getting a few details about your organisation.
ASK ALL
A1. Do you use, or have plans to use, any Artificial Intelligence tools within the business?
This could be at any level and for any task, including recent generative tools such ChatGPT, Microsoft Co-pilot, and more complex solutions including machine learning and robotic automation. We are interested in AI tools you might be developing yourselves as well as existing off-the-shelf AI tools.
DO NOT READ OUT. SINGLE CODE.
Yes | 1 | |
No | 2 | |
Don’t know | 3 | THANK AND CLOSE: We are looking to speak to organisations who are using or considering using AI. Thank you for your time today. |
Refused | 4 | THANK AND CLOSE: We are looking to speak to organisations who are using or considering using AI. Thank you for your time today. |
IF DOES NOT HAVE PLANS TO IMPLEMENT AI TECHNOLOGIES (A1=2)
A2. What has prevented your organisation from implementing Artificial Intelligence technologies?
IF RESPONDENT SAYS THEY ARE A SMALL BUSINESS, PROBE FOR WHETHER THE BARRIER IS FINANCIAL COST, LACK OF AWARENESS OR JUST DEEM AI UNNECESSARY
DO NOT READ OUT. MULTI CODE
Concerns about the security of AI models and systems (inc. data security / confidentiality) | 1 | THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today. |
Financial cost | 2 | THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today. |
Organisation lacks technical resources | 3 | THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today. |
Organisation is unclear on the purpose of using AI | 4 | THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today. |
Have not identified a need for it (inc. not relevant for sector/industry) | 5 | THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today. |
Haven’t thought about it / don’t know enough about it | 6 | THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today. |
Deemed unnecessary due to small size of business | 7 | THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today. |
Other (please specify) | 8 | THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today. |
Don’t know | 9 | THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today. |
Refused | 10 | THANK AND CLOSE: Thank you for that. The rest of the survey is only relevant to organisations who are using or considering using AI. Thank you for your time today. |
ASK ALL
A3. Are your organisation’s main headquarters in the UK?
DO NOT READ OUT. SINGLE CODE.
Yes | 1 | |
No | 2 | |
Refused | 3 | THANK AND CLOSE |
IF MAIN HEADQUARTERS ARE NOT IN THE UK (A3=2)
A4. Are your products and/or services available for sale in the UK?
DO NOT READ OUT. SINGLE CODE.
Yes | 1 | |
No | 2 | THANK AND CLOSE |
Refused | 3 | THANK AND CLOSE |
ASK ALL
A5. Which of these best represents the size of your organisation, based on the number of employees working for your organisation, including yourself?
READ OUT. SINGLE CODE
Micro: 1-9 employees | 1 | |
Small: 10-49 employees | 2 | |
Medium: 50-249 employees | 3 | |
Large: 250+ employees | 4 | |
Don’t know | 5 | THANK AND CLOSE |
Refused | 6 | THANK AND CLOSE |
ASK ALL
A6. I have [SAMPLE SECTOR] as a general description of your company’s principal activity. Bearing in mind that this is a general description only, does this sound correct?
Yes | 1 | |
No | 2 | |
Don’t know | 3 |
IF DISAGREE WITH SAMPLE SECTOR (A6=2/3)
A7. What is the main business activity of your company?
INTERVIEWER PROBE FOR THE FOLLOWING - START WITH FIRST PROBE AND ONLY USE THE OTHERS IF NECESSARY TO GET CLEAR INFORMATION • What is the main product or service of this establishment? • What exactly is made or done at this establishment?
WRITE IN. TO BE CODED TO 4 DIGIT SIC 2007. | ||
---|---|---|
Don’t know | 2 | |
Refused | 3 |
B AI usage
READ TO ALL:
My next questions are about your organisation’s use of artificial intelligence (AI).
ASK ALL
B1. For the following Artificial Intelligence technologies, please could you tell me whether your organisation is currently using it (including piloting), not currently but have plans to adopt in the future, or has no plans to use it.
INTERVIEWER NOTE / ADD IF NECESSARY: We are interested in AI tools you might be developing yourselves as well as existing off-the-shelf AI tools.
READ OUT. SINGLE CODE FOR EACH
Technology | Currently using | Not used but planning to adopt in the future | Not using | Don’t know | Refused |
---|---|---|---|---|---|
_1 Machine learning ADD IF NECESSARY: This is a branch of artificial intelligence which focuses on the use of data and algorithms to imitate the way that humans learn, gradually improving its accuracy. Example AI tools include Microsoft Azure Machine Learning, IBM Watson and Google TensorFlow. | |||||
_2 Natural language processing and generation ADD IF NECESSARY: This is the use of artificial intelligence programming to produce written or spoken narratives from a data set, including creating computer code or transcribing audio to text in real time. Example AI tools include ChatGPT and Bard. | |||||
_3 Computer vision/ image processing and generation ADD IF NECESSARY: This is the use of artificial intelligence programming to produce, generate, analyse, interpret, and manipulate digital images. Examples AI tools include OpenCV and Viso Suite. | |||||
_4 Hardware related to AI ADD IF NECESSARY: such as Edge Computing Chips, Quantum Hardware, Application Specific Integrated Circuits (ASIC), Neuromorphic Hardware, and Field Programmable Gate Array (FPGA). | |||||
_5 Robotic process automation (RPA) |
ASK ALL
B1a. Are there any other Artificial Intelligence technologies not mentioned that your organisation is currently using (including piloting) or planning to adopt in the future?
INTERVIEWER NOTE / ADD IF NECESSARY: We are interested in AI tools you might be developing yourselves as well as existing off-the-shelf AI tools.
MULTI CODE.
Yes – other technology 1 (please specify) | 1 | WRITE IN |
Yes – other technology 2 (please specify) | 2 | WRITE IN |
Yes – other technology 3 (please specify) | 3 | WRITE IN |
No | 4 | EXCLUSIVE |
Don’t know | 5 | EXCLUSIVE |
ASK IF USES A DIFFERENT TECHNOLOGY (B1A_1-3 ≠ BLANK)
B1b. And please could you tell me whether your organisation is currently using it (including piloting) or not currently but have plans to in the future.
READ OUT. SINGLE CODE FOR EACH
Technology | Currently using | Not used but planning to adopt in the future | Don’t know | Refused |
---|---|---|---|---|
DS: SHOW IF B1a_1 ≠ BLANK. | ||||
B1a_1 | ||||
DS: SHOW IF B1a_2 ≠ BLANK. | ||||
B1a_2 | ||||
DS: SHOW IF B1a_3 ≠ BLANK. | ||||
B1a_3 |
B1Dum
DUMMY VARIABLE, DO NOT ASK
Currently uses AI in one or more technology | 1 | (B1_1 = 1 or B2_2 = 1 or B1_3 = 1 or B1_4 = 1 or B1_5 = 1 or B1b_1 = 1 or B1b_2 = 1 or B1b_3 = 1) |
Does not use AI in any technology but is planning to adopt in the future | 2 | (B1_1 ≠ 1 or B2_2 ≠ 1 or B1_3 ≠ 1 or B2_4 ≠ 1 or B1_5 ≠ 1 or B1b_1 ≠ 1 or B1b_2 ≠ 1 or B1b_3 ≠ 1) AND (B1_1 = 2 or B2_2 = 2 or B1_3 = 2 or B2_4 = 2 B1_5 = 2 or B1b_1 = 2 or B1b_2 = 2 or B1b_3 = 2) |
Neither uses nor has plans yet to use a specific technology. | 3 | (B1_1 ≠ 1-2 or B2_2 ≠ 1-2 or B1_3 ≠ 1-2 or B2_4 ≠ 1-2 or B1_5 ≠ 1-2 or B1b_1 ≠ 1-2 or B1b_2 ≠ 1-2 or B1b_3 ≠ 1-2) |
SCREEN OUT: IF B1DUM=3: We are looking to speak to organisations who are using or considering using AI. Thank you for your time today.
IF CURRENTLY USES AI TECHNOLOGIES (B1Dum = 1)
B1c. Please could you tell me the specific AI products you are using?
WRITE IN | ||
---|---|---|
Don’t know | 2 | |
Refused | 3 |
IF CURRENTLY USES AI TECHNOLOGIES (B1Dum = 1)
B2. Please could you tell me whether your organisation is currently piloting the following technology, has used it for 1-3 years, or has used it for over 3 years.
READ OUT. SINGLE CODE FOR EACH
DS: ONLY SHOW CODES WHERE B1_1-6=1 or B1b_1-3 = 1)
Technology | Currently piloting | Used for 1-3 years | Used for over 3 years | Don’t know | Refused | |
---|---|---|---|---|---|---|
Machine learning | ||||||
Natural language processing and generation | ||||||
Computer vision/ image processing and generation | ||||||
Hardware related to AI | ||||||
Robotic process automation | ||||||
B1a_1 | ||||||
B1a_2 | ||||||
B1a_3 |
IF PLANS TO ADOPT AI TECHNOLOGIES IN THE FUTURE (B1Dum = 2)
B3. Please could you tell me whether your organisation is planning to adopt the following technology in the next year or whether you plan to adopt it further in the future.
READ OUT. SINGLE CODE FOR EACH
DS: ONLY SHOW CODES WHERE B1_1-6=2 or B1b_1-3=2
Technology | Currently piloting | Used for 1-3 years | Used for over 3 years | Don’t know | Refused | |
---|---|---|---|---|---|---|
Machine learning | ||||||
Natural language processing and generation | ||||||
Computer vision/ image processing and generation | ||||||
Hardware related to AI | ||||||
Robotic process automation | ||||||
B1a_1 | ||||||
B1a_2 | ||||||
B1a_3 |
IF CURRENTLY USES AI TECHNOLOGIES (B1Dum = 1)
B4. How did your organisation adopt the following technology?
READ OUT. SINGLE CODE FOR EACH
DS: ONLY SHOW CODES WHERE B1_1-6=1 or B1b_1-3 = 2
Technology | Currently piloting | Used for 1-3 years | Used for over 3 years | Don’t know | Refused | |
---|---|---|---|---|---|---|
Machine learning | ||||||
Natural language processing and generation | ||||||
Computer vision/ image processing and generation | ||||||
Hardware related to AI | ||||||
Robotic process automation | ||||||
B1a_1 | ||||||
B1a_2 | ||||||
B1a_3 |
IF CURRENTLY USES AI TECHNOLOGIES (B1Dum = 1)
B5. For what reasons does your organisation employ AI technology?
IF RESPONDENT SAYS WHAT THEY USE AI FOR, PROBE FOR WHY THEY USE AI AS OPPOSED TO AN EMPLOYEE DOING THE TASK THEMSELVES.
DO NOT READ OUT. MULTI CODE
Cyber security defence | 1 | |
Fraud detection | 2 | |
Financial savings (inc. efficiency, productivity and automation) | 3 | |
Algorithmic trading | 4 | |
Customer services | 5 | |
Inventory management | 6 | |
Recruitment | 7 | |
Other (please specify) | 8 | WRITE IN |
Don’t know | 9 | EXCLUSIVE |
Refused | 10 | EXCLUSIVE |
ASK IF USES AI TECHNOLOGY FOR CYBER SECURITY DEFENCE (B5 = 1)
B6. And how does your organisation employ AI technology for Cyber security defence?
SINGLE CODE
WRITE IN | ||
---|---|---|
Don’t know | 2 | |
Refused | 3 |
C Cyber security practices around the AI
IF USES OR IS CONSIDERING USING AI TECHNOLOGIES (B1DUM = 1-2)
My next questions are about your business’ cyber security practices surrounding AI technologies.
IF USES AI TECHNOLOGIES (B1DUM = 1)
C1. Does your organisation have specific cyber security practices or processes in place explicitly regarding the AI technology you deploy?
DO NOT READ OUT. SINGLE CODE.
Yes | 1 | |
No | 2 | |
Don’t know | 3 | |
Refused | 4 |
IF CONSIDERING USING AI TECHNOLOGIES OR DOES NOT HAVE AI TECHNOLOGIES (B1DUM = 2)
C2. Would your organisation have specific cyber security practices or processes in place explicitly regarding the AI technology once your planned AI technologies are deployed?
DO NOT READ OUT. SINGLE CODE.
Yes | 1 | |
No | 2 | |
Don’t know | 3 | |
Refused | 4 |
IF HAS SPECIFIC AI CYBER SECURITY PRACTICES OR PROCESSES (C1=1 OR C2 =1)
C3. Please could you summarise what these practices or processes < TEXT SUB if B1Dum = 1 “are”> < TEXT SUB if B1Dum = 2 “might be”>?
DO NOT READ OUT. MULTI CODE
Ensuring personal data isn’t shared with third parties | 1 | |
Firewalls for AI | 2 | |
AI-driven Attack Signal Intelligence (e.g. Vectra) | 3 | |
Other (please specify) | 4 | |
Don’t know | 5 | |
Refused | 6 |
IF DOES NOT HAVE SPECIFIC AI CYBER SECURITY PRACTICES OR PROCESSES IN PLACE (C1=2 OR C2 = 2)
C4. Please could you briefly explain why that is?
WRITE IN | ||
---|---|---|
Don’t know | 2 | |
Refused | 3 |
IF USES OR IS CONSIDERING USING AI TECHNOLOGIES (B1DUM = 1-2)
C5. Are there specific cyber security requirements or features that you expect to be built into AI companies’ models and systems?
IF YES:WRITE IN | ||
---|---|---|
No | 2 | |
Don’t know | 3 | |
Refused | 4 |
IF THEY OUTSOURCE DEVELOPMENT OF THEIR AI TECHNOLOGY (B4_1-8=3)
C6. Has your organisation identified a vulnerability or been breached as a result of the AI service deployed in your infrastructure?
PROMPT AS NECESSARY. SINGLE CODE
Yes, been breached | 1 | |
Yes, identified a vulnerability but not been breached | 2 | |
No | 3 | |
Don’t know) | 4 | |
Refused | 5 |
D General cyber security practices
READ TO ALL:
For the rest of the survey, we will be asking about cyber security. By this, we mean any strategy, processes, practices or technologies that organisations have in place to secure their networks, computers, programs or the data they hold from damage, attack or unauthorised access.
ASK ALL
D1. Which of the following governance or risk management arrangements, if any, do you have in place?
READ OUT. MULTI CODE
Board members with responsibility for cyber security | 1 | |
An outsourced provider that manages your cyber security | 2 | |
A formal policy or policies in place covering cyber security risks | 3 | |
A Business Continuity Plan that covers cyber security | 4 | |
A written list of the most critical data, systems or assets that your organisation wants to protect | 5 | |
DO NOT READ OUT: None of these | 6 | SINGLE CODE |
DO NOT READ OUT: Don’t know | 7 | SINGLE CODE |
DO NOT READ OUT: Refused | 8 | SINGLE CODE |
ASK ALL
D2. Which of the following standards or accreditations, if any, does your organisation adhere to?
READ OUT. MULTI CODE
The Payment Card Industry Data Security Standard, or PCI DSS | 1 | |
Any National Institute of Standards and Technology (NIST) standards | 2 | |
The Cyber Essentials standard | 3 | |
The Cyber Essentials Plus standard | 4 | |
ISO 27000 Standard | 5 | |
DO NOT READ OUT: None of these | 6 | SINGLE CODE |
DO NOT READ OUT: Don’t know | 7 | SINGLE CODE |
DO NOT READ OUT: Refused | 8 | SINGLE CODE |
ASK ALL
D3. Which of the following, if any, have you done over the last 12 months to identify cyber security risks to your organisation?
READ OUT. MULTI CODE
A cyber security vulnerability audit | 1 | |
A risk assessment covering cyber security risks | 2 | |
Used or invested in threat intelligence | 3 | |
Used specific tools designed for security monitoring, such as Intrusion Detection Systems | 4 | |
Penetration testing | 5 | |
Testing staff awareness and response (e.g. via mock phishing exercises) | 6 | |
DO NOT READ OUT: None of these | 7 | SINGLE CODE |
DO NOT READ OUT: Don’t know | 8 | SINGLE CODE |
DO NOT READ OUT: Refused | 9 | SINGLE CODE |
ASK ALL
D4. What was your business’ approximate turnover for the last financial year?
DO NOT READ OUT. SINGLE CODE.
IF NECESSARY: PROMPT WITH RANGES
£0 – £49,999 | 1 |
£50,000 - £84,999 | 2 |
£85,000 - £249,999 | 3 |
£250,000 - £499,999 | 4 |
£500,000 - £999,999 | 5 |
£1,000,000 - £4,999,999 | 6 |
£5,000,000 - £24,999,999 | 7 |
£25,000,000+ | 8 |
Don’t know | 9 |
Refused | 10 |
E Thank and close
ASK ALL
E1. Thank you very much for taking the time to speak to us today. Would you be willing for us to call you back regarding this particular study – if we need to clarify any of the information?
Yes | 1 | |
No | 2 |
ASK ALL
E2. In the near future we may be conducting some follow-up interviews to explore some of the areas discussed in this survey in more detail. Would it be okay to contact you about taking part in this research? Agreeing to be contacted does not mean you have to take part. You can opt-out at any time if we contact you.
Yes | 1 | |
No | 2 |
IF CONSENT TO RECONTACT (E1=1 OR E2=1)
E3. And could I just check, is [NUMBER] the best number to call you on?
Yes | 1 | |
No - write in number | 2 |
IF CONSENT TO RECONTACT (E1=1 OR E2=1)
E4. Please could I take a few more details:
Name: ………………….. | ALLOW REFUSED OPTION |
Job title: ………………….. | ALLOW REFUSED OPTION |
Email address: ………………….. | ALLOW REFUSED OPTION |
READ TO ALL
You’ve been speaking to NAME from IFF, on behalf of the Department for Science, Innovation and Technology. Thank you very much for your time today.
Would you like the Market Research Society freephone number in case you wish to check our credentials? (If yes, that’s 0800 975 9596).
[1] Understanding AI uptake and sentiment among people and businesses in the UK - Office for National Statistics (ons.gov.uk), June 2023
[2] Understanding AI uptake and sentiment among people and businesses in the UK - Office for National Statistics (ons.gov.uk), June 2023