AI adoption rises as cybersecurity staff feel squeezed

ISSA and Omdia have published a new study on the cybersecurity workforce and AI adoption in security teams. The survey found that 83% of organisations are using or planning to adopt AI for cybersecurity.

The eighth edition of the Life and Times of Cybersecurity Professionals study points to a widening gap between investment in security tools and the experience of the people expected to use them. While organisations are spending on AI-based systems, many security professionals say their jobs have become more difficult and that they have little influence over the decisions shaping their work.

The most common uses of AI in cybersecurity include automating scanning and testing, cited by 50% of respondents, predictive risk analysis at 48%, and threat detection at 38%. Yet 68% said the job has become harder over the past two years, even as AI adoption has increased.

The study also found that 25% of organisations have increased spending on AI without a defined strategy linking it to their staff or broader security programme. This suggests many employers treat AI as a procurement decision rather than a workforce and governance issue.

Workforce strain

Pressure on staff remains a central theme. Nearly half of respondents said they had considered leaving their role in the past 18 months, and 57% of that group had thought about leaving cybersecurity altogether.

Decision-making appears to be another source of frustration. The research found that 71% said technology decisions are made without input from the security team.

Leadership structures are also shifting. Full-time Chief Information Security Officer appointments fell from 76% to 63% in a year, while earlier correspondence about the findings said virtual CISO roles had risen from 5% to 16% over two years.

Jimmy Sanders, President of ISSA, pointed to a longer-term pattern in the data.

"Eight years of data point to the same conclusion. The profession is struggling not because talent is scarce, but because organizations are not investing enough in the people they already have. That is the leadership opportunity in front of us right now," Sanders said.

People first

The study goes beyond AI to examine job satisfaction, skills shortages, organisational culture, and the changing role of the senior security leader. Its findings suggest workplace support and inclusion matter more to professionals than headline spending on tools.

Leadership commitment was cited by 39% of respondents as the top driver of job satisfaction, ahead of compensation and technology investment. Among those entering the profession, 54% said an apprenticeship, internship, or mentor is one of the most valuable ways to build a career.

Melinda Marks, Practise Director, Cybersecurity at Omdia and lead researcher on the study, said the data shows that technology alone will not solve recruitment and retention problems.

"AI will not close the cybersecurity skills gap on its own. Organisations getting the most from their security programs need to invest in their people first. Training, inclusion, and clear career paths are not soft benefits. They are what makes everything else work," Marks said.

The findings reflect a broader debate across the security industry over whether automation reduces pressure on teams or simply raises expectations while threat volumes continue to grow. The report suggests many practitioners feel it is the latter, particularly where boards and executives adopt new systems without changing operating models or involving those who manage day-to-day security work.

That sense of exclusion may help explain why dissatisfaction persists even as employers increase spending. If security teams are judged against faster-moving attack patterns and larger technology estates, AI tools may add another layer of responsibility rather than remove existing burdens.

Role of community

The survey also points to professional support networks as an important part of retention. Respondents valued mentoring and career development, indicating that informal support structures remain significant in a field marked by skills shortages and high turnover.

Dr. Shawn Murray, Immediate Past President of ISSA, said those relationships can matter as much as any formal programme.

"What sustains people in this profession long-term is not any one technology or program. It is connection. Access to peers who understand the work, mentors who have navigated the same challenges, and a community where your development is taken seriously. That is what professional associations exist to provide, and it is something no AI tool replaces," Murray said.