Skip to content

Topic

AI in Security Operations

Use of AI to absorb repetitive defensive work such as log review, alert triage, and evidence collection, and its effect on security roles.

Current stories

securityOne report1 publisher

Malware's best tricks against AI analysis tools worked in about 35% of Talos test runs

Cisco Talos says the best text that malware authors plant to steer AI analysis tools tipped results their way in about 35% of test runs. The text has to sit in plaintext, so each attempt also gives defenders a string to hunt for.

Reality

Evidence55
Adoption25
Hype gap+5
Incentives40
Confidence55
securityConfirmed2 publishers

A quarter of security staff polled by Swimlane say AI has limited their skill-building

Swimlane surveyed 500 US and UK security staff and found 24% say AI has limited their ability to build skills. Satisfaction barely differs between those who say AI helps their skills and those who say it hurts, so morale scores cannot show whether juniors are learning.

Reality

Evidence50
Adoption50
Hype gap+15
Incentives65
Confidence55
securityOne report1 publisher

72.7% of SANS hunters who caught nation-state intruders saw them abuse native admin tools

SANS's 2026 hunting survey found 72.7% of hunters who caught nation-state actors saw them living off the land, against 63.4% for ransomware crews. Hunters rank data quality as their top barrier, so detecting misused admin tools starts with the telemetry those hunts depend on.

Publishers:intel471.com

Reality

Evidence50
Adoption45
Hype gap+10
Incentives60
Confidence50
investOne report1 publisher

AI ranks first for net-new security dollars in a year budgets grew 5%

IANS and Artico Search surveyed more than 500 security executives and found 69% putting AI first for net-new dollars in a year when only 45% of security budgets grew at all. At least 24 of those points sit in organizations where the budget held flat or shrank.

Publishers:prnewswire.com

Reality

Evidence42
Adoption38
Hype gap+30
Incentives72
Confidence45
securityOne report1 publisher

Arctic Wolf counts nine security duties drawing 13 to 15 hours a week each

Arctic Wolf's 2026 survey puts nine standing security duties at 13 to 15 hours a week each, close to three full-time people of work before an incident arrives. A manager can use that count in a budget review on its own.

Publishers:arcticwolf.com

Reality

Evidence42
Adoption30
Hype gap+18
Incentives85
Confidence52
leadershipOne report1 publisher

FedRAMP's staffing conditions make federal SaaS revenue a hiring decision

Corelight's CISO writes that customers now grade suppliers on how their own security operations use AI, while FedRAMP gates federal SaaS sales on round-the-clock support and US-based employees. A June directive adds a 72-hour clock.

Publishers:forbes.com

Reality

Evidence33
Adoption
Not scored
Hype gap+22
Incentives76
Confidence54
securityOne report1 publisher

Gremlin reports clearing nine times as many vulnerabilities with the same staff

Frederic Bull says his team processed just over nine times the vulnerability volume in a year without adding headcount and cut time to remediate by 5%, a self-reported figure with no absolute counts behind it.

Reality

Evidence26
Adoption22
Hype gap+34
Incentives58
Confidence48
securityOne report1 publisher

Breached organizations drop back to old habits inside six months, ManageEngine survey of 700 leaders finds

Every one of the 700 IT and security leaders ManageEngine surveyed had already been through a breach. Eight percent said security became a permanent priority afterward, and 80 percent said the heightened focus faded within six months.

Reality

Evidence45
Adoption35
Hype gap+12
Incentives70
Confidence55
securityOne report1 publisher

Check Point moves OpenAI models into the step that decides what gets patched

Four Check Point workflows now route decisions through OpenAI's frontier cyber models, including one that builds its own exploit material, and the announcement puts a stage label on only one of them.

Reality

Evidence32
Adoption18
Hype gap+40
Incentives88
Confidence55
securityOne report1 publisher

96% of security teams run AI at triage level. The autonomous SOC case rests on 24 respondents.

SentinelOne's 451 Research survey of 611 practitioners finds AI returns arriving at the bottom of the maturity ladder. It leaves the top of the ladder almost entirely unmeasured.

Publishers:sentinelone.com

Reality

Evidence22
Adoption38
Hype gap+58
Incentives90
Confidence66
securityOne report1 publisher

Count the refusals: Talos turns model guardrails into a procurement number

Cisco Talos argues hosted frontier models tax defenders with refusals on deobfuscation and exploit analysis, and that the fix starts with logging denials as a continuity metric.

Reality

Evidence24
Adoption14
Hype gap+38
Incentives72
Confidence41
securityOne report1 publisher

Levi Strauss lost corporate files through three laptops and no malware

This week's disclosures turned on human trust and third-party exposure: social engineering at Levi Strauss, warehouse disruption at CEVA Logistics, and an AI agent that walked through an auth gap.

Reality

Evidence38
Adoption46
Hype gap+18
Incentives55
Confidence42