AI for Cyber Defence in 2026: What 77% Adoption Actually Looks Like
Key takeaways
77% of organisations report using AI in cybersecurity, but adoption tracks company size and resources (WEF Global Cybersecurity Outlook 2026).
Organisations using AI extensively in security shortened breach times by about 80 days and cut average breach cost by $1.9 million.
The clearest gains are in threat intelligence, vulnerability detection and phishing defence; AI in recovery is still mostly conceptual.
WEF frames agent autonomy in four levels — assist, recommend, execute with override, execute independently — chosen by the risk and reversibility of each action.
Attackers now use AI for reconnaissance, malware and exploit generation, and the result is speed: work that took weeks can be done in minutes. In May 2026 the World Economic Forum and KPMG published Empowering Defenders: AI for Cybersecurity, a white paper built on case studies from partner organisations and workshops with 105 representatives of 84 organisations across 15 industries. It is one of the more concrete descriptions of what defensive AI does in practice.
Adoption is broad but uneven
According to the WEF Global Cybersecurity Outlook 2026, 94% of respondents see AI as the most significant driver of change in cybersecurity, and 77% of organisations report using AI in their security work. Adoption is closely tied to size: large companies with mature data and budgets lead, while smaller organisations, governments and NGOs lag because of cost, skills and data maturity.
The most common uses are phishing detection (52% of organisations), intrusion and anomaly detection (46%) and user-behaviour analytics (40%).
The measurable effects
The paper cites several outcomes that explain the momentum:
88% of security teams report time savings and more room for proactive work.
Organisations that use AI extensively in security shortened breach times by roughly 80 days and reduced average breach costs by $1.9 million.
76% of security professionals reported exhaustion in 2025; 53% of teams reported underfunding and 55% understaffing — the structural gap AI is expected to help close.
What the case studies show
The paper maps its cases to the six functions of the NIST Cybersecurity Framework 2.0 — govern, identify, protect, detect, respond and recover. A few examples illustrate the range:
Security design reviews. A storage company replaced manual threat modelling with three cooperating agents — one reviewing designs, one checking whether findings were actually fixed in code, one assembling release certification with a full audit trail — reporting three times the coverage and half the review time.
External attack surface. A professional services firm scanned more than 100,000 internet-facing sites with an agent that crawls each site, checks configuration and probes for injection flaws. Analysis time per site fell from about 15 minutes to under one; manual effort dropped by 93%.
Threat intelligence. A security vendor turned an investigation process that took roughly three weeks of manual work into about an hour of agent-assisted work with consistent, evidence-backed output.
Secure code. Google describes agents that search for unknown vulnerabilities and generate patches; every generated patch is reviewed by human researchers before it is submitted, and more than 100 critical issues have been fixed this way.
The concentration of cases in identify and detect is telling. AI is already strong at finding and correlating signals. Its role in recover — rebuilding systems after an incident — remains largely conceptual.
Four questions before deploying AI in security
The paper structures adoption as four steps, each with a question for executives:
Align. Does the use case support a business priority such as resilience, compliance or cost? Sometimes standard automation is the cheaper, lower-risk answer.
Ready. Are workflows documented and repeatable, is the security data complete and well structured, and can identity and access management handle machine and agent identities?
Validate. Is there a pilot with success criteria, fall-back plans and a clear go/no-go decision?
Scale and sustain. Is there an owner, monitoring for model drift and a way to retire what stops working?
For smaller companies the advice is pragmatic: focus on one or two use cases tied to the most critical risks, use AI already built into existing tools, and scale only what shows measurable benefit.
How much autonomy to give a security agent
The most useful part of the paper for engineering leaders is a four-level model of autonomy:
Level
What the AI does
Example
Assist
Processes and organises data; people decide
Summarising alerts
Recommend
Proposes an action; a person approves
Flags a malicious file, waits for "quarantine"
Execute, overridable
Acts on reversible decisions; people monitor
Blocks a suspicious IP; an admin can undo
Execute, independent
Acts without real-time human involvement
Coordinates DDoS mitigation under a supervisor agent
The deciding factors are risk and reversibility. High autonomy suits low-risk, reversible actions; irreversible, high-stakes actions keep a person in the loop even at the cost of speed.
The risks that come with agents
The paper is explicit that agentic AI expands the attack surface. Agents can be hijacked, can behave unexpectedly because of hallucinations or manipulated inputs, and can be deployed without approval or clear accountability. It also warns against over-reliance: heavy dependence on automation erodes the hands-on expertise needed when the automation fails. The recommendation is to simulate AI failures and keep security operations functional during an AI outage.
The workforce question follows. 54% of organisations name a shortage of skilled people as the main barrier to adopting AI in security, and the profile in demand is shifting from single-tool specialists to engineers who can work across tools and explain AI output to decision-makers.
What this means for 2027–2028
Gartner, quoted in the paper, expects 15% of day-to-day work decisions to be made autonomously by AI agents by 2028, and 88% of enterprises are already investing in agents. For security teams, the practical path is the one the case studies follow: start where AI is strongest — detection, triage, intelligence and code review — keep people accountable for irreversible actions, and measure the result in hours and incidents rather than in the number of tools deployed.