State of AI Cybersecurity in 2026: What the Data Tells Us About What’s Coming Next

AI didn’t just change the cybersecurity conversation in 2025. It torched the old playbook and started writing a new one — in real time. Here’s what 1,800+ security professionals say about the road ahead, and why coasting is no longer a survival strategy.

The cybersecurity industry has always been a grudge match between attackers and defenders. New tools emerge, bad actors adapt, rinse, repeat. But something fundamentally different is happening right now.

AI hasn’t just entered the ring. It’s fighting for both sides simultaneously — expanding where attacks land, sharpening the weapons threat actors wield, and reshaping the defenses organizations depend on. All at once. Nobody asked for this pace. We got it anyway.

The State of AI Cybersecurity 2026 report captures this shift in granular detail across five chapters, drawing on survey data from security professionals worldwide. This final chapter steps back and asks the question everyone in the industry is wrestling with: where does this actually go from here, and what should security leaders do about it right now?

The short answer? The priorities haven’t changed much. But the consequences of ignoring them have gotten dramatically worse.

Key Takeaways

AI adoption outran security governance — again. 77% of organizations now run gen AI in their security stack, but only 37% have a formal AI policy. The gap between deployment speed and protective oversight widened year over year.

Attackers aren’t waiting around. 73% of security professionals say AI-powered threats are already hitting their organizations, with hyper-personalized phishing, automated exploit chaining, and adaptive malware leading the charge.

The skills gap matters more than the budget gap. The number one barrier to defending against AI threats isn’t money — it’s insufficient knowledge and experience with AI technology. You can’t purchase your way out of that.

Practitioners and executives see different realities. Only 25% of hands-on security operators strongly agree that AI tools improve their work, compared to 56% of CISOs. The people closest to the tools are the hardest to impress.

Managed services and platform consolidation are accelerating fast. 85% of security professionals prefer managed SOC capabilities over building in-house, and 93% now favor integrated platforms over point products.

The fundamentals still win. Despite the hype, the top priorities for the next 12 months — AI-powered tools, integration, readiness, and awareness training — are almost unchanged from last year. The basics aren’t boring. They’re essential.

AI Adoption Moved Faster Than Anyone Expected

Let’s set the stage. In 2025, generative AI and early agentic systems went from controlled experiments to full-blown production deployments. Organizations didn’t dip their toes in. They cannonballed.

Gen AI tools are now woven into the SaaS platforms teams use daily. AI agents are getting their hands on internal data and systems. Low-code and no-code platforms let business users spin up their own AI automations without so much as filing an IT ticket. The report found that 77% of organizations are already running generative AI or large language models somewhere in their cybersecurity stack. Agentic AI — where systems take autonomous or semi-autonomous action — is in use at 67% of organizations.

That pace is staggering. And honestly, it makes sense. Businesses see real productivity gains. Teams move faster. Customers get served better. The ROI case is irresistible, and no executive wants to be the one who pumped the brakes while competitors blew past them.

But that speed is creating security problems that nobody’s toolbox was designed to fix.

Here’s where it gets uncomfortable: 92% of security professionals say they’re concerned about the use of AI agents across the workforce and their security impact. And 44% are extremely or very concerned about the security implications of third-party LLMs like Copilot or ChatGPT. That’s nearly half of all security professionals losing sleep over the exact tools their colleagues in marketing and sales are cheerfully rolling out.

The disconnect isn’t hard to understand. AI systems interact with data, make decisions, and take actions in ways that existing security tools were never designed to monitor. When an AI agent autonomously accesses a database, summarizes sensitive records, and fires them through an API, that chain of events doesn’t look like a traditional data breach. But the damage is identical.

The Attack Surface Has Gotten Bigger — and Weirder

The first chapter of the report makes this uncomfortably clear: AI hasn’t just expanded the attack surface. It’s warped its shape entirely.

When every SaaS tool ships with an AI assistant baked in, when employees experiment with public models on company data during lunch breaks, and when agents operate with varying degrees of autonomy across the enterprise, “the perimeter” becomes a fantasy. Every AI integration is a potential entry point, every agent a potential insider threat, and every public model interaction a potential data leak waiting to happen.

That’s why sensitive data exposure sits at the top of the worry list. A full 61% of respondents named it as their primary concern, followed by potential violations of data security and privacy at 56%. These are the risks with the most immediate, tangible consequences — regulatory fines, reputational destruction, and the kind of headlines no CISO wants to star in.

The security controls organizations are deploying tell a revealing story. Identity and role-based controls lead the way at 60%, followed by data loss prevention tools at 54%. Model monitoring and drift detection comes in at 42%, while limiting use to self-hosted models sits at 41%. Prompt filtering and input/output controls — arguably one of the most direct defenses against AI-specific attacks — is only in place at 34% of organizations. And 4% have literally no controls in place at all.

Let that sink in. Data loss is the single biggest fear, and barely half have deployed DLP tools for their AI systems. There’s a canyon between what security teams worry about and what they’ve done about it.

It gets worse. Fewer organizations reported having a formal AI policy this year (37%) compared to last year (45%). The percentage with no plans to create one at all jumped from 3% to 8%. In the year AI adoption exploded, governance somehow went backwards. That’s not just a red flag. It’s a fire alarm.

Attackers Are Already Using AI — and Defenders Can Feel It

Chapter two of the report digs into the threat side, and it’s not a fun read.

Nearly three-quarters (73%) of respondents say AI-powered cyber threats are already having a significant impact on their organization. This isn’t handwringing about theoretical future risks. This is happening now. Today. In your environment.

Hyper-personalized phishing leads the worry list at 50%, and for good reason — researchers are tracking phishing email volumes at all-time highs, and the messages have gotten eerily convincing. The days of spotting a phishing email by its broken grammar are long gone. But automated vulnerability scanning and exploit chaining (45%), adaptive malware (40%), and deepfake voice fraud (40%) are all breathing down its neck.

What’s really changed is the orchestration. The report highlights growing evidence that attackers are using AI to run end-to-end operations, with alleged cases of large-scale cyber-espionage executed with minimal human involvement. When AI handles reconnaissance, initial access, privilege escalation, and exfiltration in one coordinated chain, traditional defenses — built to recognize known patterns — don’t stand a chance.

The confidence numbers are telling. Despite a brief uptick from 2024 to 2025, defender confidence has slipped again. Nearly half (46%) agree they’re not adequately prepared for AI-powered threats. The geographic spread is striking with Japan is the most anxious, with 77% saying they’re not prepared, while Brazil is the most bullish, with 79% confident their capabilities are up to scratch.

The number-one thing holding defenders back? Insufficient knowledge and skills related to AI. Not budget. Not headcount. Knowledge. Organizations are writing checks. They just can’t buy their way out of a skills gap that the entire industry is racing to close at the same time.

Defensive AI Is Working — But Trust Is Still a Sticking Point

On the tools side, the picture brightens up. A full 96% of cybersecurity professionals agree that AI can meaningfully improve the speed and efficiency of their work. Anomaly detection and novel threat identification (72%) lead the impact list, followed by automated response and containment (48%) and vulnerability management (47%).

But here’s the catch. CISOs and executives were the most enthusiastic — 56% strongly agreed that AI improves defensive capabilities. Security operations practitioners? Only 25% strongly agreed. The people who sit in front of these tools every day are the least impressed by them.

That gap should make every vendor nervous. It could mean practitioners are better at separating genuinely useful AI from slick marketing decks. Or it could mean the tools aren’t delivering for the people who need them most. Either way, it’s a problem.

The trust question goes deeper still. While 89% of respondents say they have good visibility into how their AI tools reason, 74% are limiting AI autonomy in their SOC until explainability improves. Only 14% let AI take independent remediation actions with no human in the loop. The vast majority (70%) run a “human in the loop” model — AI recommends, a person approves.

That creates an awkward paradox. Organizations need AI speed to counter AI-powered threats, but they’re (rightly) nervous about giving machines the keys. Threading that needle — building real trust without gambling on reckless automation — is one of the defining challenges of the next year.

And there’s a consistent blind spot at the top. Executives think AI operates autonomously in their SOC far more often than it actually does — 18% believe AI has high autonomy, versus 14% overall. Leaders keep telling themselves they’ve deployed cutting-edge capabilities. Practitioners keep living in a more honest reality.

Managed Services Are Becoming the Default Play

One of the loudest signals in the report: 85% of security professionals now prefer to get new SOC capabilities as a managed service rather than building in-house.

The math isn’t complicated. The AI-driven threat landscape demands round-the-clock coverage, specialized expertise, and the flexibility to scale with conditions. Most organizations don’t have — and realistically can’t hire — the talent needed to run an AI-augmented SOC 24/7. Managed Security Service Providers offer a fast track to capability that would take years and serious money to build from scratch.

This connects directly to the knowledge gap. When the top barrier to AI defense is insufficient expertise, handing the operational load to specialists who eat, sleep, and breathe this stuff becomes the obvious call. Internal teams can focus on strategy — governance, risk management, business alignment — while managed partners handle the daily grind of detection and response.

The trend cuts across industries, too. From education and government to finance and tech, the preference for managed services consistently hovers above 65%, with some sectors pushing past 85%. It’s not a niche preference. It’s an industry-wide recalibration of how security gets done.

Platform Consolidation Is Picking Up Speed

The other big operational shift: organizations are done juggling fifteen different point products. In 2025, 87% of respondents preferred platform-based security purchases. In 2026, that hit 93%.

The logic is dead simple. Fewer vendors means fewer dashboards, fewer integration nightmares, fewer renewal cycles, and — most importantly — better cross-domain threat visibility. When email security, network detection, cloud monitoring, and identity protection all talk to each other natively, threats that would sneak through the gaps between siloed tools get caught.

The catch? Very few vendors genuinely deliver across the full spectrum. The distance between marketing copy and actual capability is real, and practitioners see it more clearly than executives do. This is where “AI-washing” becomes genuinely dangerous: when every cybersecurity company slaps an AI label on their product, decision-makers need to look past the branding and interrogate what’s running under the hood.

Where This Goes Next

Here’s what’s fascinating. Despite everything that’s shifted — the ballooning attack surface, the AI-powered threat surge, the rapid deployment of defensive AI — security leaders’ priorities for the next 12 months are nearly identical to last year’s.

Adding AI-powered security tools remains priority number one at 65%. Improving integration among existing solutions follows at 57%. Cyber readiness and SOC optimization round out the top four.

But there’s one notable mover. Cybersecurity awareness training for end users has climbed to 45%, now tied for first place among SOC team members alongside process and technology optimization. Government entities ranked it as their top priority overall. The industry is waking up to the fact that the human layer — still the weakest link — needs just as much investment as the technology layer, especially when AI-powered phishing turns every inbox into a minefield.

The message from the data is clear: the fundamentals still matter. Policy, governance, awareness, and integration aren’t glamorous. But they’re the foundation everything else sits on. Organizations that sprint to deploy the latest AI tools without sorting out their governance and process first are building a glass house in a hailstorm.

So Where Does That Leave Us?

AI is now a permanent fixture of the security equation — on both sides. Attackers use it to scale, specialize, and coordinate. Defenders use it to detect, respond, and contain. Neither side is packing up and going home.

What the 2026 report makes crystal clear is that the organizations best positioned for what’s coming are doing several things at once. They’re deploying defensive AI with real governance and human oversight. They’re investing in their people’s knowledge and skills, not just their technology line items. They’re consolidating tools into coherent platforms instead of stacking point solutions like Jenga blocks. And they’re partnering with managed service providers to close gaps they can’t fill on their own.

The future of cybersecurity isn’t about any single tool. It’s about building security programs that are adaptive enough to keep pace with a threat landscape moving at machine speed. The organizations that treat AI as a capability to be governed — not just a checkbox to be ticked — will be the ones still standing when the dust settles.

For security leaders reading this: don’t panic. Move with purpose. The arms race isn’t slowing down — if anything, it’s accelerating in ways that will make 2025 look quaint. But the teams that invest in the right mix of technology, people, and process — starting now, not next quarter — will be the ones writing the next chapter instead of just reacting to it.

To learn how Kiteworks can help, schedule a custom demo today.

Additional Resources

• Blog Post Zero Trust Architecture: Never Trust, Always Verify
• Video Microsoft GCC High: Disadvantages Driving Defense Contractors Toward Smarter Advantages
• Blog Post How to Secure Classified Data Once DSPM Flags It
• Blog Post Building Trust in Generative AI with a Zero Trust Approach
• Video The Definitive Guide to Secure Sensitive Data Storage for IT Leaders