Walsh, now KPMG’s U.S. chair and CEO, doesn’t think AI will end the same way. “I don’t think AI is Y2K,” he told Fortune in an interview ahead of the release of the firm’s 2026 U.S. CEO Outlook and what he described as a plethora of conversations about safety and cyber-risk. “Something’s happening and it’s really, really big.”

Cybersecurity ranked first among the risks CEOs listed. Eighty-five percent said cybercrime and cyber insecurity will affect their organization’s prosperity over the next three years. That’s more than said so of inflation, geopolitics or the pace of technology change. Forty-eight percent are increasing cyber investment over the next three years, the highest share for any risk. And 56% named cybersecurity as a challenge in rolling out AI, ahead of ethics, data readiness and cost.

CEOs said AI itself is a big part of why they’re spending more on cyber. Seventy-eight percent cited AI-powered social engineering and targeted attacks, 76% cited AI-assisted malware or phishing, and 73% cited data and privacy risks from deploying AI agents.

Walsh had just spent two days on the West Coast meeting with developers of frontier models. He said KPMG is working with its alliance partners to build cyber defense models, which he called a “great opportunity for KPMG but an absolute necessity for businesses.” He sees a lot of that opportunity in old systems. “There’s a ton of cyber risk in the infrastructure that’s out there currently,” he said, because “the infrastructure is decades old.” For KPMG, he added, that’s “a multi-billion dollar business opportunity that we certainly plan to get after.”

He said he’s more optimistic than leaders who think it will take a disaster to put checks on the technology. “I do think that they are already starting to pace the model deployment because of safety concerns,” he said of some model developers.

Quantum computing is a risk many CEOs see coming but few have a plan for. Sixty-two percent said they are aware of the risks quantum computing poses to encryption but don’t yet treat it as a priority. Only 4% have plans in place to address it. Thirty-four percent said quantum attacks on encryption are driving some of their cybersecurity investment, and another 20% are increasing spending to comply with U.S. executive orders that require a transition to post-quantum cryptography by 2030 or 2031.

Cuts, retraining and hiring at once

The CEOs in KPMG’s survey are responding on two tracks at once. The firm asked 400 CEOs of large U.S. companies how their workforce strategies for the next two to five years are changing because of AI. Fifty-three percent said they’re planning reductions in some areas, up from 35% a year earlier, while 86% are redesigning roles, career paths and team structures for human-AI collaboration, up from 65%. Eighty-three percent are focused on retaining and retraining high-potential talent, up from 75%. And 79% are hiring people with AI and tech skills, up from 64%.

Overall, they still expect headcount to grow. Eighty-nine percent expect to add people over the next three years, mostly in small increments: 60% expect growth of less than 5%, 26% expect 6% to 10% and 2% expect 11% to 25%.

Asked how to square those four shifts, with more CEOs planning cuts and more also retraining, redesign roles and hire for AI, Walsh said to read the numbers loosely. “You’ve got to discount the percentages,” he said. “But I would say directionally I agree with all of that.” Most businesses are chasing productivity in parts of their operations, he said, where they’ll “be able to do things with fewer people” or expand what they can do.

At KPMG, he said, the mix of people is what’s changing. A year ago, his interviews opened with some version of the same two questions: When will you cut your workforce by 50%? When will you stop hiring off campus? “Both of those things are absolutely not happening in our business,” he said. “I’m not seeing a significant reduction.”

The firm does need more engineers and more people with AI skills, Walsh said, adding that KPMG is training its own staff rather than trying to buy all that talent. “It’s my responsibility to make sure that they’re talented and they’ve got the skills they need,” he said.

KPMG has used agents for some time, and Walsh said it has seen what they do to the work. Walsh said agents have been built into the firm’s audit platform, Clara, and its tax and advisory platform, Digital Gateway, for years. People get more done with them and can analyze full data sets, he said, but the human is still needed. “What we don’t see is the elimination of full bodies out of the delivery at this point yet.”

The technology is “moving faster and faster by the month,” Walsh said. “Looking three months out is kind of the benchmark now.”

That pace is why KPMG launched client technology and innovation, as Fortune was first to reveal. Walsh called it an incubator that sits outside the main firm. “I needed to get the future KPMG out of the mothership,” Walsh said, so it could “innovate and fail faster.”

The harder job is everyone else. Walsh said he’s “impatient” about keeping the firm’s 50,000 U.S. employees ahead of clients on the technology, and that different teams need different tools from different partners. “We can’t just deploy this same technology across 50,000 people,” he said. “So it’s complex, but complexity can’t slow us down.”