Report by ISACA
State of Cyber 2026: Global Update on Workforce Efforts, Resources, and Cybersecurity Operations
Key Findings
16% of organizations plan to conduct AI-related incident response exercises in the future.
45% of cybersecurity professionals expect a cyber-attack on their organization in the next year.
49% of organizations report having open cybersecurity positions.
55% of organizations report difficulties retaining qualified cybersecurity professionals.
48% of cybersecurity professionals say their organization either does not have AI incident playbooks or the playbook status is unknown to them.
Enterprises face social engineering attacks (45%), vulnerabilities (39%), and remote access attacks (24%), with remote access increasing 5 percentage points from 2025.
Only 8% of organizations conduct AI-specific response exercises regularly.
64% of enterprises have not conducted any AI-related incident response exercises.
Only 13% of cybersecurity professionals do not use AI in their security operations.
41% of cybersecurity professionals use AI to automate threat detection and response, up from 32% in 2025.
40% of cybersecurity professionals use AI to automate routine security tasks, up from 28% in 2025.
33% of cybersecurity professionals use AI for endpoint security.
45% of cybersecurity professionals report that LLM SecOps is a skill gap, a 12-point increase from 2025 and a 21-point increase from 2024.
51% of cybersecurity professionals are involved in developing, onboarding, or implementing AI solutions, up from 40% in 2025 and 29 percent in 2024.
56% of cybersecurity professionals say they or someone from their team were involved in developing a policy governing AI use in their organization.
68% of cybersecurity professionals report that their roles have become more stressful over the past five years.
71% of cybersecurity professionals cite the increasingly complex threat landscape as the main cause of increased stress, up from 63% in 2025.
35% of cybersecurity professionals report experiencing an increase in cyber-attacks compared to a year ago.
42% of cybersecurity professionals have high confidence in their organization's cybersecurity team's ability to detect and respond to cyber threats.
58% of organizations believe their cybersecurity team is understaffed, up from 55% in 2025.
52% of cybersecurity professionals cite high work stress as the leading reason people leave their roles, up from 47% in 2025.
35% of cybersecurity teams are increasing their reliance on AI or automation to address technical skills gaps, a 12-point increase from 2025.
27% of cybersecurity teams are training non-security staff for security roles.
26% of cybersecurity teams are increasing use of contract employees or outside consultants.
17% of organizations include AI incident response in broader cyber incident response exercises.
The percentage citing the increasingly complex threat landscape as the main cause of stress drops 18 percentage points from 81% in 2024 to 63% in 2025.