Summary
- ISACA surveyed more than 1,800 cybersecurity professionals globally for its 2026 State of Cybersecurity report.
- Only 8% said their organisations regularly conduct AI-specific response exercises, while 64% said none had been conducted.
- AI use inside security operations is already widespread, creating a preparedness gap between adoption and rehearsed response.
Only 8% of organisations represented in ISACA’s latest global cybersecurity survey regularly conduct incident-response exercises focused specifically on AI, despite widespread use of the technology inside security operations.
The 2026 State of Cybersecurity report gathered responses from more than 1,800 cybersecurity professionals worldwide and examined staffing, budgets, threats, operational practice, and the growing role of artificial intelligence.
Sixty-four per cent of respondents said their organisation had not conducted an AI-related incident-response exercise. Another 17% said AI scenarios were incorporated into broader cyber exercises, while 16% said their organisation planned to run exercises in future.
The research also found uncertainty around playbooks. Forty-eight per cent of respondents either did not know whether their organisation had an AI incident playbook or said no such playbook existed.
Those figures contrast with the speed at which AI is being incorporated into security work. Only 13% of respondents said they did not use AI in security operations. Among those using it, 41% reported automating threat detection or response, up from 32% in 2025, while 40% used it for routine security tasks.
The resulting preparedness gap is not limited to a hypothetical malicious model. ISACA’s exercise categories include sensitive-data exposure through AI systems, AI-enabled phishing or fraud, and misuse of generative AI by employees or insiders.
Each of those scenarios crosses existing incident disciplines. A sensitive prompt entered into an external model may require privacy and data-loss processes; an autonomous agent acting outside policy could involve identity and application teams; and AI-enhanced fraud may arrive through the same collaboration and payment channels used in conventional social engineering.
That overlap can make ownership unclear. Organisations may have mature ransomware exercises and established crisis roles while lacking agreement over who takes control when an AI system itself becomes part of the incident.
Response exercises are useful partly because they expose those organisational gaps before an event. A tabletop can reveal whether logs exist, whether a model interaction can be reconstructed, who has authority to disable an AI service, how business users are notified, and whether third-party providers can supply the required evidence.
The issue is becoming more significant as AI moves from optional employee tools into production workflows. An assistant that generates text has limited operational authority; an agent connected to customer data, code repositories, financial systems, or cloud infrastructure can create substantially different failure modes.
The survey is based on self-reported responses and its global population should not be treated as a direct measurement of every UK or European organisation. It nevertheless provides a useful indicator of maturity: adoption of AI in cyber operations is already commonplace among respondents, while dedicated rehearsal remains rare.
That mismatch resembles earlier phases of cloud and ransomware preparedness, when deployment or exposure often expanded before incident processes caught up. AI compresses that cycle because capabilities and integrations are changing quickly, leaving playbooks vulnerable to becoming obsolete before they are tested.
Regular AI-specific exercises are not necessarily required as a separate programme for every organisation. ISACA’s finding that some respondents incorporate AI into broader cyber exercises suggests another model: treating AI as part of existing incident management while ensuring scenarios reflect the different evidence, autonomy, and data flows involved.
The important gap is between systems that organisations already rely on and incidents they have actually rehearsed. ISACA’s latest data suggests that gap remains substantial.
