EY Cybersecurity
Big Four unit selling cybersecurity audits, risk consulting, and compliance work to large enterprises.
On the record
Checkpoint: FY2026 global revenue announcement, watch for consulting/cyber headcount trend
The call
EY's cybersecurity brand and compliance role look solid on paper, but AI is quietly thinning the junior workforce that the partner-track model was built on.
EY Cybersecurity is a big-name consulting practice owned by one of the world's largest accounting firms. It handles security compliance work, risk assessments, and security tools for companies that need to meet government rules. It is hard to replace because EY's size, brand, and legal standing let it certify that companies follow tough regulations like financial rules and data protection laws, and competitors like Deloitte or Accenture would need years to build the same trust and expertise. The problem: EY is cutting staff and partners aggressively through 2026, and artificial intelligence is automating the junior-level work (compliance evidence collection, security testing reports, control audits) that younger employees used to do to earn their way up to partner. If AI tools keep replacing billable work faster than new regulations create demand, the climb to partner may no longer be worth the sacrifice EY asks from rising talent.
Why
01
AI pressure: EY's own EYQ, IsecMapper, PARIS tools plus agentic AI rollout from Assurance. EY's AI tools speed up compliance mapping and evidence gathering, cutting the junior billable hours that used to justify headcount. Could AI do the core job? Only partly.
02
Bigger players: Deloitte, Accenture, PwC. Rival Big Four and consultancies could ship a materially different AI-native cybersecurity offer and pull analyst-ranking share from EY. Could a giant copy it? No, they are blocked.
03
What protects it. Regulatory attestation work (audits, DORA, compliance sign-off) still legally requires a named firm like EY, not a chatbot.
What would change this call
EY's October 2026 FY2026 revenue report shows consulting/cyber revenue flat or down alongside continued headcount cuts. Would show AI automation eroding billable junior work faster than new regulatory demand offsets it.
EY extends salaried, non-equity partner status beyond UK to other geographies by Q3 2026. Would show the partnership equity model is unwinding structurally, not just a UK-specific fix.
A peer like Deloitte or Accenture visibly overtakes EY in a 2026-2027 analyst ranking (Forrester, IDC, HFS). Would show a rival's AI-native offer is capturing market share EY currently holds.
EY extends salaried, non-equity partner status beyond UK to other geographies by Q3 2026. Would show the partnership equity model is unwinding structurally, not just a UK-specific fix.
A peer like Deloitte or Accenture visibly overtakes EY in a 2026-2027 analyst ranking (Forrester, IDC, HFS). Would show a rival's AI-native offer is capturing market share EY currently holds.
Key numbers
- FY25 revenue $53.2B, up 4.0%
- Consulting headcount 124,238, up 5.4%
- ~100 Australian consulting staff cut
Named risks
- AI accelerators (IsecMapper, PARIS) automating junior compliance and control-mapping work, compressing billable hours.
- Rolling consulting layoffs and UK partner de-equitization (April 2026) undermining traditional equity-track incentive.
- Declining government consulting contracts driving repeated Australian job cuts through Feb and Nov 2025.
- No public cybersecurity-specific revenue or headcount reporting limits external accountability and benchmarking.
Rivals, as read in July 2026
| Rival | Direction | Evidence |
|---|---|---|
| Deloitte | contesting | Both firms ranked as Leaders in major cyber consulting analyst reports through 2025-2026 |
| PwC | contesting | Market commentary (2026) positions PwC as stronger on incident-response readiness versus EY |
| KPMG | contesting | Jointly moved UK equity partners to salaried status alongside EY, April 2026 |
| Accenture Security | contesting | Named adjacent large incumbent competing in same 2025-2026 cyber consulting rankings |
Questions people ask
- Is EY Cybersecurity profitable?
- EY does not break out cybersecurity revenue separately. Firm-wide, EY reported FY2025 global revenue of $53.2 billion, up 4.0% in local currency from FY24, announced October 2025, with consulting the fastest-growing service line by headcount that year.
- Is EY doing layoffs in its consulting or cybersecurity practice?
- Yes. EY cut about 100 Australian consulting staff in February 2025, culled 30 partners mainly from consulting in the UK in March 2025, and cut 50+ more Australian consulting jobs in November 2025 tied to declining government contracts.
- Could AI replace EY Cybersecurity consultants?
- Partially. Forrester's Q1 2026 report credited EY's own tools, IsecMapper and PARIS, with compressing compliance timelines, meaning junior analyst work like evidence-gathering and control-mapping is already being automated, though named-partner regulatory attestation still requires human sign-off.
- Who is EY Cybersecurity's biggest competitor?
- Deloitte, PwC, KPMG and Accenture Security are the closest peers, all competing in the same analyst rankings as of 2025-2026. No single named rival is reported as visibly taking EY's cyber clients; pressure is described as internal restructuring rather than external share loss.
- Who owns EY Cybersecurity?
- EY is privately held, structured as a network of legally separate member firms under Ernst & Young Global Limited, not a single corporate entity and not publicly traded. Cybersecurity is a practice area within EY's Consulting service line, led globally by Richard Watson as of December 2025.
- Is EY Cybersecurity considered a top-tier provider?
- Yes by analyst rankings. EY was named a Leader in The Forrester Wave: Cybersecurity Consulting Services, Q1 2026 (March 2026), a third-consecutive-year Leader in Westlands Advisory's OT Cybersecurity Navigator, and a Horizon 3 Leader in HFS's inaugural 2025 cybersecurity services report.
Timeline
- 2026-04-24EY and KPMG begin moving UK equity partners to salaried, non-profit-share status
- 2026-04-09EY launches enterprise-scale agentic AI in Assurance built on Microsoft Foundry and Azure
- 2026-03EY named a Leader in The Forrester Wave: Cybersecurity Consulting Services, Q1 2026
- 2026-01EY named Leader in Westlands Advisory OT Cybersecurity Navigator, third consecutive year
- 2025-11-19EY cuts 50+ Australian consulting jobs tied to declining government contracts
- 2025-10EY announces FY2025 global revenue of $53.2 billion, up 4.0% local currency
- 2025-07EY restructuring cuts 18 global regions down to 10 super regions
- 2025-03-15EY culls 30 partners, mainly from consulting, in UK
- 2025-03EY launches EY.ai Agentic Platform with NVIDIA for tax, risk and finance domains
- 2025-02-26EY cuts about 100 consulting staff in Australia
Revision history
21 July 2026
First assessed. Defensible for now. The text above is fixed as of this date and is not edited afterwards.
In the same band
Sources
- EY announces global revenue of US$53.2b for fiscal year 2025 (2025-10)
- EY Global posts 4% growth to reach $53.2 billion in revenue in 2025 (2025-10-17)
- EY rated a Leader in The Forrester Wave: Cybersecurity Consulting Services, Q1 2026 (2026-03)
- EY named a "Verified Leader" in Industrial Cybersecurity Consulting Services (2025) (2026-04-07)
- EY - Netherlands (2025-12-03)
- EY to expand cybersecurity offering with the acquisition of J Group Consulting (2024-11-22)
- EY to cut about 100 staff (2025-02-26)
- EY to axe 30 partners in biggest executive cull for decades (2025-03-15)
- Middle managers at risk as firm reduces global regions (2025-04-03)
- EY slashes consulting arm once again with redundancies (2025-11-19)
- 100+ Big Four Partners Lose Equity as KPMG and EY End the Career-for-Life Contract (2026-04-24)
- EY reduces headcount and costs under CEO Janet Truncale (2026-03-02)