ISACA 2026 Survey Finds AI Security Adoption Outpacing Incident Readiness
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
ISACA’s 2026 survey of 1,888 professionals finds persistent cybersecurity staffing and funding shortages as AI adoption grows. Only 8% report regular AI-specific incident response exercises, while 45% identify LLM SecOps skill gaps.
Key points
- ISACA surveyed 1,888 cybersecurity professionals globally in Q2 2026, reporting a margin of error of ±2 percentage points at a 95% confidence level.
- Among respondents, 58% reported understaffed cybersecurity teams and 55% reported underfunded security budgets.
- Sixty-eight percent said their roles had become more stressful over five years; 55% reported difficulty retaining qualified cybersecurity professionals, up from 50% in 2025.
- Soft skills remained the leading reported skills gap at 57%; LLM SecOps followed at 45%, up from 33% in 2025.
- Reported AI security uses included automated threat detection and response at 41% and routine task automation at 40%, increases of nine and 12 percentage points respectively.
- Only 20% reported mature or limited AI-specific incident runbook coverage, and 8% reported regular AI-specific incident response exercises.
- Only 9% reported mature programs with policies, assessments and monitoring for third-party AI systems, highlighting limited preparedness for vendor-related AI risk.
Article Details
- Publisher
- ISACA
- Report Period
- Second quarter of 2026
- Scope
- Global survey of ISACA members with CISM certification or registered information security job titles, covering workforce, budgets, operations, cyberrisk, attacks, and AI.
- Sample Size
- 1,888 complete responses; reported margin of error of ±2 percentage points at 95% confidence. Response counts vary by question.
- Key Statistics
- 58% of respondents reported understaffed cybersecurity teams, compared with 55% in 2025.
- 68% of respondents said their roles had become more stressful over the preceding five years; 71% identified the increasingly complex threat landscape as a stress driver.
- 45% of respondents identified LLM SecOps as a skill gap, up from 33% in 2025; soft skills remained the largest reported gap at 57%.
- 55% of respondents reported somewhat or significantly underfunded cybersecurity budgets, while 41% reported appropriate funding.
- Reported AI uses included automated threat detection and response (41%) and routine security task automation (40%), while only 8% of enterprises conducted AI-specific incident response exercises regularly.
- Recommendations
- Develop intentional workforce development pathways that help new cybersecurity professionals acquire practical skills.
- Address retention pressures through professional development, advancement opportunities, financial incentives, and improved working conditions.
- Apply existing data security, incident response, access management, and governance disciplines to AI-related risks, including dedicated incident runbooks and exercises.
- Maintain disciplined attention to security fundamentals, including exposure management and control execution.