KPMG survey shows banks boosting AI and cybersecurity spend

Banks are no longer treating AI, cybersecurity, data, and payments as separate fix-it projects. KPMG’s banking technology survey of 200 U.S. executives shows those priorities converging into one modernization agenda, and that shift changes how KPMG teams should scope, staff, and sell work across financial services.

What the survey says banks are buying

KPMG’s read on the market is blunt: technology remains central to how banks compete, operate, and grow, and the highest-priority investments for 2026 cluster around data-driven insights, cybersecurity, fraud prevention, digital customer experience, enterprise transformation, and data modernization. The headline for KPMG people is that the buyer is not looking for a single-point solution anymore. A bank that wants better AI is also asking about data quality, controls, cloud architecture, model risk, fraud exposure, and the operating impact on payments and transactions.

The survey’s most important number is 80 percent. That share of banking executives expects AI to significantly disrupt their business and operating models in the next three to five years, which makes AI a board-level planning issue rather than an isolated innovation effort. For KPMG consultants and auditors, that means the opening conversation with a bank is increasingly about how AI fits into enterprise transformation, not whether a team should launch one more pilot.

Why cyber and AI are being planned together

The cyber findings show why banks are bundling these agendas. KPMG says 76 percent of banking executives saw an increase in cyberattacks over the last year, 92 percent are increasing budgets to address cyber risk, and 84 percent are raising cybersecurity investment specifically because of risks introduced by AI. That is a strong signal that security teams and transformation teams are now inseparable in banking conversations.

The survey also points to the threats that are forcing that convergence. The top emerging risks include AI-introduced vulnerabilities in code at 63 percent, deepfakes at 62 percent, AI bots at 57 percent, and securing agentic technologies at 50 percent. For KPMG account teams, that means a pitch about generative AI is no longer complete unless it addresses controls, identity, fraud monitoring, and governance. For delivery teams, it means the client may want both speed and reassurance in the same workstream, which raises the value of people who can translate technical risk into business consequences.

What this means for KPMG account teams

For KPMG financial-services teams, the practical implication is that single-discipline selling will look increasingly thin. A client asking about AI is likely to ask about data modernization, model risk, cyber resilience, payments strategy, and transaction processing in the same meeting. That favors integrated teams that can connect audit, advisory, risk, and tax capabilities around one transformation story instead of sending separate specialists with separate messages.

It also changes how proposals get built. The strongest solution designs will combine implementation advice with control design, because banks are trying to modernize under regulatory pressure and budget constraints. That makes execution support as important as thought leadership, especially for clients that want faster delivery but cannot afford a weak control environment. The firms that win will be the ones that can say, credibly, that AI, cyber, and data live in the same operating model.

Payments modernization is part of the same play

KPMG’s survey makes clear that payments are not a side topic. Banks are looking to modernize Wires platforms at 20 percent and ACH platforms at 26 percent, while 70 percent plan to implement RTP instant payments and 72 percent plan to implement FedNow over the next year. That makes payments one of the clearest examples of convergence, because modernization work now sits next to cyber, data, and customer experience rather than apart from them.

The largest institutions are moving even further ahead. Among banks with $100 billion or more in assets, 71 percent prioritize designing interoperable systems for tokenized deposits and stablecoins, compared with 24 percent overall. KPMG says the biggest drivers of payments modernization are cost reduction or operational efficiency at 82 percent, regulatory requirements at 68 percent, legacy systems at 59 percent, and changing customer expectations at 57 percent. For KPMG teams, that suggests large-bank conversations will increasingly revolve around architecture, resilience, and interoperability, not just product upgrades.

The broader market is pushing in the same direction

KPMG’s global tech report for financial services reinforces the same message. Based on a survey of 760 financial-services technology leaders worldwide, it found 89 percent consider themselves innovators or fast followers. It also says 2.5 times more organizations expect to reach the highest level of AI maturity within the next year, and 58 percent expect to reach the highest level of cybersecurity maturity within the year. The takeaway is that banks are moving, but they are moving on shared infrastructure, which is why AI, cyber, and data keep collapsing into one agenda.

That matters because more than 40 percent of the value from digital technologies comes from foundational and core platforms. In other words, the expensive part of transformation is not the headline feature, it is the plumbing underneath it. For KPMG professionals, that is a reminder that the firm’s most useful work in banking may be the less glamorous work of architecture, controls, operating model design, and implementation support.

Profits are up, but so is pressure to modernize

The backdrop from McKinsey makes the moment even more interesting. Its 2026 Global Banking Annual Review says global banking net income rose to $1.3 trillion in 2025, but also warns that AI is remaking the industry at an unprecedented pace. That combination of strong earnings and intense disruption helps explain why banks have room to invest, yet still feel pressure to do it quickly and carefully.

The strategic challenge for clients is that healthy profits do not remove structural risk. They simply buy time to modernize, and time is what many legacy banks are short on. That is where KPMG’s advisory model becomes relevant: clients need help turning profit into durable transformation, not just buying more technology.

Customers trust banks, but they fear failure

The Integris 2026 banking trust and technology report adds an important customer lens. Nearly 9 in 10 customers are confident their bank keeps information secure, but 40 percent still name hackers stealing bank data as their top concern. Another 52 percent worry AI systems could mistakenly freeze account access. That combination says customers still trust banks, but their tolerance for cyber or AI failures is low.

The executive side is under strain too. In the same survey, 45 percent of executives expected technology budgets to rise 40 percent or more in 2026, while 64 percent said they do not have full visibility into total IT spending across their institution. That is a planning problem as much as a technology problem, and it explains why banks will keep asking outside advisers for help linking spend to risk, value, and accountability.

Why the competitive pressure keeps rising

CSI’s 2026 Banking Priorities report points in the same direction, with 85 percent of respondents saying institutions adopting AI will gain a significant competitive advantage. That makes AI less of a novelty than a competitive baseline, especially when combined with the cyber and data pressures already showing up in KPMG’s survey. Banks are not just testing new tools; they are trying to defend market position while redesigning the systems that support growth.

For KPMG people, the message is clear. The most valuable banking work will sit at the intersection of transformation and trust, where AI, cyber, payments, and data are planned together and delivered as one program. That will favor teams that can speak across service lines, manage implementation risk, and help banks move fast without losing control.