On September 22, 2026, ISACA published findings from its State of Cybersecurity 2026 survey, highlighting a gap between the use of artificial intelligence in security operations and organizations’ preparation for AI-related incidents.
The survey gathered responses from more than 1,800 cybersecurity professionals around the world. ISACA reported that 64% of enterprises had not conducted any AI-related incident-response exercises. Only 8% said their organization conducted AI-specific response exercises regularly. The report was sponsored by Wolters Kluwer TeamMate. ISACA’s survey announcement
What the survey reports
The headline finding is that 64% of enterprises had not conducted an AI-related incident-response exercise, while 8% reported conducting AI-specific exercises regularly. Separately, 17% said AI incident response was included in broader cyber incident-response exercises, and 16% planned to conduct exercises in the future. ISACA reports these as separate survey measures rather than a complete breakdown of mutually exclusive groups.
The release also found that 48% of respondents either did not know whether their organization had an AI incident-response playbook or said one had not been established.
The scenarios covered include sensitive information being exposed through AI systems, AI-enabled phishing or fraud, social engineering, and misuse of generative AI by employees or insiders. These scenarios span both external attacks and incidents involving approved tools used in unintended ways.
AI is already part of security operations
The findings describe adoption already underway. Only 13% of respondents said they did not use AI in security operations. Among those using it, common applications included automating threat detection and response (41%), routine security tasks (40%), and endpoint security (33%).
The survey also identified skills and staffing pressures. Forty-five percent of respondents cited LLM security operations (LLM SecOps) as a skills gap. Fifty-eight percent said their cybersecurity team was understaffed, and 49% reported open cybersecurity positions. Critical thinking and communication were among the frequently identified soft-skill needs.
A tabletop exercise can help teams rehearse roles and response steps before an incident occurs.
Scope of the findings
These figures come from a survey of cybersecurity professionals and reflect respondents’ reports about their organizations. They are not an audit of individual organizations’ controls or a measure of how well a particular exercise would work in practice. The survey announcement describes a global sample of more than 1,800 professionals and notes the study’s sponsorship by Wolters Kluwer TeamMate.
ISACA’s State of Cybersecurity 2026 report covers cybersecurity staffing, budgets, threats, operations, and the role of AI in security work. The full report is available through ISACA’s report page. State of Cybersecurity 2026