CISOs cautious as agentic AI adoption in security lags

Splunk reports that agentic AI is rolling out slowly in security operations, even as most Chief Information Security Officers (CISOs) warn that threat actors are becoming more sophisticated and fast-moving.

Splunk's CISO Report 2026 found that only 6% of the 650 CISOs surveyed had fully deployed agentic AI in security operations. Respondents came from nine countries, including the UK, and represented sectors such as financial services, the public sector, healthcare, manufacturing, and telecommunications.

The results highlight a tension between urgency and caution. Nearly all respondents said their responsibilities now include AI governance and risk management, but many also worry the same technologies could help attackers deceive staff and exploit organisations.

Threat actor sophistication topped the risk list: 95% cited it as their greatest risk. Improving threat detection and response was also a major priority, selected by 92% of respondents.

Other priorities included strengthening identity and access management (78%) and investing in AI cybersecurity (68%). The distribution suggests many security leaders still see foundational controls and identity management as central, even as AI adoption becomes a board-level topic.

Operational impact

Respondents linked AI to practical benefits in day-to-day security work. In total, 92% said AI enables their teams to review more security events, and 89% reported improved data correlation. The results suggest many teams already use AI in some form for analysis and triage.

The report also distinguished agentic AI from earlier automation. Among CISOs who said they had partially or fully adopted agentic AI, 39% strongly agreed it increased their teams' reporting speed, compared with 18% of those still exploring the technology.

Expectations for future gains were similarly high. Some 82% said agentic AI will increase the amount of data reviewed. The same share said it will boost correlation and response speeds.

"AI vs AI" dilemma

Alongside those anticipated gains, the survey captured widespread anxiety about attacker adoption. Some 86% said they fear agentic AI will increase the sophistication of social engineering attacks. A further 82% worry it will speed up deployments and increase the complexity of attacker persistence mechanisms.

These concerns underpin what the report calls an "AI vs AI" dilemma, in which defenders feel compelled to use AI because adversaries will do the same. That pressure comes as organisations also scrutinise how AI is governed, audited, and monitored in production environments.

Michael Fanning, Splunk's CISO, said the issue reflects a broader expansion of the role and its accountability.

"CISOs operate in the eye of the storm, at the center of constant transformation. Role responsibilities expand, threats evolve, and AI accelerates everything," said Michael Fanning, CISO, Splunk.

The report also points to rising personal stakes. More than three-quarters of CISOs said they worry about personal liability for security incidents. This was higher than the prior year's result, suggesting regulatory scrutiny and board expectations are increasing pressure on security leaders.

People and process

The research suggests many CISOs still see talent and organisational design as the main constraints on security outcomes. To address skills gaps, respondents cited upskilling existing staff, hiring full-time employees, and using contractors. The report argues that human judgement remains essential for tasks such as threat hunting and investigation.

Workforce strain also featured heavily. Nearly two-thirds of security teams experienced moderate to significant burnout. High alert volumes were cited by 98% as a stressor, while 94% pointed to false alerts. Tool fatigue was also common, named by 79% of respondents.

Many CISOs are responding by consolidating security data into a single view and improving data-driven reporting for non-technical leadership. Barriers remain: 91% cited data privacy concerns as a challenge to cross-departmental data sharing, while 76% pointed to high storage costs and 70% to a lack of shared data views.

The survey also suggests a shift in how CISOs position security within organisations. Incident reduction, Mean Time to Detect, and Mean Time to Respond were identified as leading metrics used to communicate security value to senior leadership. Joint accountability across the C-suite was most associated with progress on key initiatives, budgets, and access to security-relevant data.

Oxford Economics conducted the research in July and August 2025, surveying CISOs in Australia, France, Germany, India, Japan, New Zealand, Singapore, the UK, and the US. The findings suggest security functions are moving toward AI-enabled operations while remaining cautious about autonomous decision-making and maintaining an emphasis on governance and human oversight.