Security Report · raw.githubusercontent.com

Splunk CISO Survey Finds Expanding AI Duties and Persistent Security Skills Gaps

Oct 20, 2026 · Original Report (PDF) ↗

Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.

Summary

Splunk’s survey of 650 CISOs finds 96% oversee AI governance and risk management, while 78% rank data leakage as their top AI concern. Upskilling leads efforts to address security skills gaps.

Key points

Oxford Economics surveyed 650 CISOs across nine countries and nine industry groups in July and August 2025 for Splunk’s report.
CISO responsibilities are expanding: 96% oversee AI governance and risk management, 85% oversee secure software development, and 79% say their role has become significantly more complex.
Forty percent report using generative AI in security functions; 78% rank data leakage as their top AI concern, rising to 85% among generative AI users.
Eighty-three percent identify hallucination impacts as their leading agentic AI concern; the report recommends human oversight, governance guardrails, model monitoring, and audit trails.
Sixty-five percent rank upskilling existing staff as their first choice for closing skills gaps, while 79% expect some or most gaps to remain unfilled.
CISOs identify high alert volume (98%) and false-alert volume (94%) as SOC stressors; 45% report moderate employee burnout and 20% report significant burnout.
Forty-one percent cannot directly correlate security ROI with risk mitigation and remediation, while 73% say leadership sets unrealistic expectations for vulnerability remediation speed.

Article Details

Publisher: Splunk
Scope: Global survey of CISO responsibilities, executive collaboration, AI adoption and governance, security staffing, and security ROI across nine countries and nine industry groups.
Sample Size: 650 CISOs surveyed by Oxford Economics in July and August 2025.
Key Statistics: 78% of surveyed CISOs were concerned about personal liability for security incidents, compared with 56% in the previous year's report.
96% of surveyed CISOs were responsible for AI governance and risk management.
40% of surveyed CISOs used generative AI in their security functions; 6% used agentic AI.
45% of surveyed CISOs reported moderate employee burnout, and 20% reported significant burnout.
41% of surveyed CISOs said they could not directly correlate security ROI with risk mitigation and remediation activities.
Recommendations: Communicate security value through data-driven narratives linking security initiatives to business risk, cost, and revenue; invite executives to observe tabletop exercises.
Prioritize investigation and detection quality over alert quantity, using automation and shared data context to reduce noise and analyst fatigue.
Establish shared planning cycles and joint accountability with C-suite peers for security initiatives and KPIs.
Upskill security personnel and use AI to augment human expertise, freeing analysts for threat hunting and other strategic work.
Establish AI governance, privacy, and accountability guardrails; require meaningful human oversight for critical decisions, monitor models for bias, drift, and data leakage, and maintain audit trails.