Ivanti has published findings from its 2026 State of Cybersecurity Report: Bridging the Divide. Drawing on insights from more than 1,200 cyber security professionals worldwide, the report finds that AI is reshaping cyber security for both defenders and attackers, but defenders believe they are gaining the edge.
The report finds that cyber security professionals are 2.4x more likely to believe that defenders use AI as effectively as threat actors, if not more effectively. Additionally, that confidence level grows to 5.5x in favour of defenders using AI as effectively as, or more effectively than, threat actors over the next 24 months.
However, to effectively gain their edge, defenders must operationalise AI and automation in cyber security, but this area remains limited. Although nearly all respondents (92%) say automation reduces their team’s mean time to respond, the use of AI across critical security functions varies: 53% of security teams utilise AI for cloud security policy enforcement, 44% employ it for incident response workflows, 43% for threat intelligence correlation, and 42% for vulnerability response and remediation.
Organizations are actively exploring how best to utilise AI-based technologies, yet there remains a degree of caution. Agentic AI has not yet earned universal trust but, nonetheless, 87% of cyber security professionals say that integrating agentic AI is a priority for their teams, and 77% report at least some comfort with allowing autonomous AI systems to act without human oversight. This marks a growing, albeit cautious, trust in automated cyber security defences and signals a shift toward greater acceptance of agentic AI solutions, even as challenges persist.
Other key findings from the research include:
- Nearly half (48%) of security professionals say that IT teams do not respond urgently to cyber security concerns, while 40% believe that IT lacks an understanding of their organization’s risk tolerance. This disconnect is particularly damaging for exposure management, which relies on collaboration between security and IT to connect technical exposure to business expectations.
- The most commonly used measures fail to reflect risk context. Just 60% of security professionals use business impact analysis to inform their risk prioritisation. In fact, only half of companies (51%) use a cyber security exposure score or risk-based index, while many still rely on process metrics such as mean time to remediate (47%) or percentage of exposures remediated (41%). These latter metrics, which focus on speed and coverage, can look positive in isolation but reveal little about whether remediation efforts improve risk posture.
- 77% of organizations have already been targeted by deepfake attacks, with over half (51%) facing sophisticated, personalised phishing emails powered by deepfake technology. Further, 48% say synthetic digital content is a high/critical threat, yet only 27% are very prepared – a 21 point gap. These threats extend well beyond traditional office roles – executives are equally vulnerable. Just 30% of security professionals are confident that their CEOs could reliably identify a deepfake, underscoring a critical gap in organizational readiness and awareness.
- Cyber security teams face unsustainable stress, creating a systemic vulnerability: human burnout. Ivanti’s findings reveal that 43% of security pros report high stress and 79% say it harms physical and/or mental health. When companies cannot access the right skills, it has a significant negative effect on human burnout, security preparedness, and business outcomes. Lack of skilled talent is the number one barrier to cyber security excellence, according to survey respondents.
