Organizations are racing to deploy AI for cybersecurity defense, but a critical gap between adoption and operational maturity is leaving most teams unprepared for the complexity they've created. According to the 2026 SANS AI Survey, 78% of organizations now actively use AI in their cybersecurity operations, up from 50% just one year earlier. Yet only 27% describe their AI deployments as mature production environments, while 76% of security teams have taken on governance responsibilities for enterprise AI despite more than half lacking formal audit frameworks to support that role.

Why Is the Gap Between AI Adoption and Readiness Growing So Fast?

The survey, which gathered responses from 536 cybersecurity and IT practitioners and 57 senior security leaders worldwide, paints a picture of organizations moving faster than their infrastructure can support. The jump in AI adoption happened in just 12 months, but the operational challenges are only now becoming visible as teams scale their deployments beyond pilot projects.

One of the most telling findings is the rise in reported shortcomings. Sixty-three percent of practitioners now report significant gaps in AI-driven threat detection and response, up from 45% a year earlier. This jump reflects a troubling reality: as more organizations rely on AI at scale, the limitations of their implementations become harder to ignore.

Dave Shackleford, a senior instructor at SANS, explained the pattern in the report: "What stands out to me is the jump from 45% to 63% of practitioners reporting real shortcomings in AI threat detection and response, and I don't read that as AI getting worse so much as teams finally running it at a scale where the cracks show." He added that this mirrors historical patterns with other major security tool shifts, where technology outpaces the discipline needed to run it well.

What's Driving the Governance Crisis?

The governance gap is perhaps the most alarming finding. While 50% of security leaders surveyed believe they have a formal AI governance program in place, practitioners tell a different story. Over 44% of organizations describe themselves as in the early stages of writing AI governance policy, and some claim both a formal program and early-stage policy simultaneously, suggesting confusion about what governance actually means.

The problem is structural. Security teams are being asked to govern enterprise AI without the tools, frameworks, or visibility to do so effectively. Trust in AI decisions has now replaced "wiring AI into existing systems" as the top barrier to integration, affecting 40% of respondents. Teams cannot confidently deploy AI if they cannot validate its outputs or understand when it fails.

Matt Bromiley, the report's author and a SANS certified instructor, emphasized the urgency: "For two years now, we've asked security teams where they actually stand with AI. Both years, the honest answer has been some version of moving fast and working it out as we go. What's changed in 2026 is how much weight is now sitting behind that answer." He stressed that the next 12 months will be critical for organizations looking to close their readiness gap.

How Are Attackers Exploiting This Immaturity?

While defenders scramble to mature their AI deployments, adversaries are already weaponizing the technology. Seventy-eight percent of organizations reported confirmed or suspected AI-enabled attacks in the past year, and 95% of respondents believe threat actors are using AI. The most common attack types involve deepfakes, vulnerability exploitation, phishing, and adversarial attacks on AI models themselves.

Attackers are not relying on a single method. Instead, they are folding AI into nearly every stage of the attack lifecycle, from reconnaissance and vulnerability discovery to exploitation and deepfake-driven social engineering. This distributed approach makes defense significantly harder, especially for organizations still piloting their own AI tools.

What Are Organizations Getting Right in AI Defense?

Despite the governance gaps, some defensive practices are proving effective. Security teams report that behavioral detection, user awareness training, and human analyst review remain their most reliable controls against AI-driven threats. These findings suggest that human expertise is still the anchor holding the defense together.

• Behavioral Detection: Nearly half of practitioners name behavioral detection as their most effective control against AI-enabled attacks, suggesting that monitoring for unusual patterns remains more reliable than automated threat detection alone.
• User Awareness Training: Forty-five percent of practitioners rely on user awareness training as a key defense, indicating that human judgment and skepticism remain critical even as AI tools proliferate.
• Human Analyst Review: Thirty-nine percent of practitioners cite human analyst review as essential, underscoring that AI recommendations require human validation before action.

Bromiley reinforced this point: "You can't fix these gaps without people who can catch what the tools miss. The teams that invest in upskilling now are also the ones positioned to get more out of the AI they have already bought, because the people running it know when to trust it and when to step in."

How to Close the AI Readiness Gap: A Three-Point Strategy

• Build AI Validation Infrastructure: Organizations should implement precision, recall, and continuous comparison metrics rather than simply deploying more tools. This means measuring how well AI actually performs against real-world threats and adjusting accordingly.
• Operationalize Governance: Governance must be embedded into review processes, approvals, audit trails, and model-use visibility, with clear, measurable controls rather than documented policies alone. Sensitive-data access and AI data exposure should be treated as core controls, not afterthoughts.
• Treat Workforce Development as an Immediate Operational Need: Organizations must equip existing staff with the knowledge to validate AI outputs, override inaccurate recommendations, and implement effective governance, rather than waiting for new hires to fill skills gaps.

What Does This Mean for the Future of AI in Cybersecurity?

The debate over whether AI belongs in cybersecurity has essentially ended. The real question now is whether governance, oversight, and operational processes can keep pace with rapid deployment. The SANS survey suggests they are not, at least not yet.

Organizations are also shifting their priorities. Sixty-three percent said their focus has moved toward using AI for defense, including 22% reporting a significant shift. In contrast, only 16% said their priority moved toward defending against AI-enabled attacks, while the remainder reported no change or viewed the two priorities as inseparable. This imbalance is concerning given that 78% of organizations have already experienced AI-enabled attacks.

The coming year will test whether organizations can build the governance, validation, and workforce capabilities needed to match their AI ambitions. Those that invest now in upskilling, operationalizing governance, and building validation infrastructure will likely emerge with more effective AI defenses. Those that continue to move fast and work it out as they go may find themselves increasingly vulnerable to the sophisticated, AI-powered attacks already underway.