Most organizations have not rehearsed how they would handle an AI-related security incident, even as their security teams put AI to wider use, according to new research.
ISACA's 2026 State of Cyber report found that 71% of organizations have not run any AI incident response exercises. Just 3% have mature, formal runbooks for AI-specific incidents and 30% have not begun to address their response at all.
Those exercises would cover scenarios such as sensitive data exposed through AI systems, AI-enabled phishing, fraud and social engineering and misuse of generative AI by employees or insiders.
AI Adoption Outpaces Readiness
Adoption is moving faster than preparation according to the report's findings. Some 37% of organizations use AI to automate threat detection and response, up eight percentage points on 2025, while 35% use it for routine security tasks and 29% for endpoint security.
Security professionals are shaping that rollout, with 54% saying they or their team helped develop, onboard or implement AI solutions. Some 60% have contributed to AI policies in their organization.
At the same time, ISACA said AI allows attackers to operate "at the speed of intent," automating attacks that once took days or weeks.
"Organizations can effectively use AI for preventing and detecting cyber threats. However, its governance should be non-negotiable," said Chris Dimitriadis, ISACA's global chief strategy officer.
He said governance is needed both to keep employees' use of AI safe and to protect businesses from AI-generated threats, and pointed to CMMI's AI Maturity Model as a benchmark. ISACA owns the CMMI Institute.
Cyberattacks Rise as Teams Stretch
Among the European IT and cybersecurity professionals surveyed for the 2026 report, 38% said their organization faced more cyber-attacks than a year earlier and 54% expect one to happen within the next 12 months. Social engineering was the most common attack, cited by 46%, and ISACA said it is increasingly supported by AI.
The cybersecurity workforce is feeling it. Some 72% said their job is more stressful than five years ago, with the more complex threat landscape the main cause, while 56% said their teams are understaffed and 55% underfunded.
Beyond the threat landscape, 57% blamed unrealistic expectations and too much work, and 35% said staff were not sufficiently trained or skilled.
A fifth of companies take no action on burnout. Among those that do, 55% offer flexible hours and 46% encourage staff to take breaks and vacation.
Dimitriadis said budgets are too often "sunk into crisis response" instead of the workforce and training needed to prevent attacks.
"Better funding and a clear plan for improving cyber resilience should be a C-suite priority," he added.