Security teams adopted AI faster in 2026 than in any year before, and the governance and workforce structures meant to support that adoption have not caught up. SANS Institute’s 2026 AI Survey Insights report gives an honest read of where the field is, not where it hopes to be. The report draws on responses from 536 cybersecurity and IT practitioners globally alongside a dedicated module completed by 57 senior security leaders, including CISOs, CSOs, and security vice presidents.
“For two years now, we’ve asked security teams where they actually stand with AI,” said Matt Bromiley, the report’s author and a SANS Certified Instructor. “Both years, the honest answer has been some version of moving fast and working it out as we go. What’s changed in 2026 is how much weight is now sitting behind that answer.”
Red teaming moved from minority to majority practice in a single year: 61% of practitioners now use AI in red teamwork, up from 33% in 2025. Investigation, response, and application security have kept pace, treated as part of daily operations rather than something teams can shelve if results disappoint. Even so, just 27% of practitioners call their deployment mature production; most are still piloting AI or running it in a supporting role.
Security teams are taking on more governance duties than their infrastructure can support. 76% now hold a governance role for enterprise AI, but more than half say no formal audit frameworks exist to back it up. That shortfall tracks with what practitioners are seeing in production: 63% report significant AI shortcomings in threat detection and response, up from 45% in 2025.
Adversaries are not waiting for governance to catch up. They are folding AI into nearly every stage of the attack life cycle, from reconnaissance to exploitation to deepfake-driven social engineering, rather than relying on any single method. 78% of organisations reported confirmed or suspected AI-enabled attacks in the past year, and 95% of respondents believe threat actors are using AI.
Human expertise still anchors the defence against AI-driven threats. Nearly half of practitioners name behavioral detection as their most effective control, followed by user awareness training (45%) and human analyst review (39%), the same skills the report ties directly to closing the workforce gap.
“You can’t fix these gaps without people who can catch what the tools miss,” Bromiley said. “The teams that invest in upskilling now are also the ones positioned to get more out of the AI they have already bought, because the people running it know when to trust it and when to step in.”
That trend already shows up in the data: 73% of practitioners say AI changed their team’s training requirements in 2026, up from 51% in 2025, as oversight and integration duties get layered onto already-existing roles.
The report points to three shifts that will determine whether the readiness gap closes over the next year: building AI validation infrastructure that tracks precision, recall, and continuous comparison instead of measuring success by deployment volume; moving governance out of policy documents and into the operational controls practitioners use day to day, with sensitive-data access and AI data exposure treated as core controls rather than afterthoughts; and treating workforce development as an immediate operational need rather than a hiring goal scheduled for a future quarter.
Discussion about this post