Why EY cybersecurity is drawing attention in 2026
Recent EY cybersecurity research points to a practical gap in enterprise defense: organizations increasingly see AI as essential to cyber operations, but budgets, skills, governance and executive decision-making have not always caught up. EY’s 2026 AI in Cybersecurity Study, based on a December 2025 survey of 500 senior information security leaders, describes a market moving toward agentic and AI-assisted security operations while still working through funding, measurable returns and human oversight.
For enterprise risk leaders, the issue is not only whether AI-enabled security tools are improving. EY’s findings show a broader management challenge: cyber teams are being asked to respond at machine speed, while budgeting, training, governance and accountability often still move through slower organizational processes.
That makes EY cybersecurity research relevant beyond the consulting market. It offers a snapshot of how CISOs, boards and technology leaders are thinking about AI-enabled threats, security investment and operational resilience. For more coverage of cyber risk and enterprise security trends, visit the Cybersecurity section.
What the 2026 EY AI cybersecurity study found
EY’s 2026 AI in Cybersecurity Study focuses on senior security leaders that are using, or planning to use, AI in cyber operations. The findings show a clear tension: AI is being treated as a necessary defensive capability, but the infrastructure needed to control, measure and govern it remains uneven.
Budget pressure is one of the clearest signals. EY reported that 85% of senior security leaders using AI in cybersecurity said their current cybersecurity budget was insufficient to meet AI-enabled threats. At the same time, spending expectations are increasing. Two-thirds of surveyed leaders expected to spend at least $5 million on AI cyber solutions within two years, and 34% expected to spend at least $10 million over the same period.
The value picture is less settled. EY found that 46% of senior security leaders using agentic AI cybersecurity solutions reported savings of less than $1 million, while another 12% either were not tracking returns or had seen no savings. That does not prove AI security programs are failing. It suggests many are still early, under-measured or focused on operational gains that have not yet been converted into financial outcomes.
| EY 2026 signal | Reported data point | Why it matters |
|---|---|---|
| Budget pressure | 85% said current budgets were insufficient for AI-enabled threats | Security teams may be adopting AI faster than they can fund controls, integration and training |
| Rising spend | 67% expected to spend at least $5 million within two years | AI security is moving from experiment to planned budget line |
| Slow ROI | 46% reported less than $1 million in savings from agentic AI use | Executives need better metrics than tool adoption alone |
| Governance gap | Only 20% said AI cybersecurity governance was fully optimized and embedded | Policies, accountability and oversight may lag behind deployment |
Agentic security operations are moving from pilot to core function
The most forward-looking part of EY’s study concerns agentic AI, where systems can perform more autonomous tasks within defined controls. EY reported that security leaders expect several functions to become largely run through agentic systems within two years. The study listed advanced persistent threat detection rising from 30% today to 62% in two years, real-time fraud detection from 32% to 58%, identity and access management from 23% to 51%, third-party risk management from 25% to 50%, and data privacy and compliance from 27% to 48%.
Those figures should be read as expectations from surveyed leaders, not proof that every organization will successfully automate these functions. Still, they show where security teams believe AI can have the greatest operational impact: detection, identity, fraud monitoring, supplier risk and compliance workflows. These areas typically involve high event volumes, repeatable decision patterns and pressure to respond faster than manual processes allow.
Human oversight is not disappearing
Greater automation does not remove the need for skilled people. EY reported that 85% of senior security leaders said their organizations maintain mandatory human-in-the-loop requirements for all critical security decisions. The same study found that 90% reported difficulty recruiting and retaining cybersecurity professionals with expertise in AI-driven solutions and defenses.
This is one of the more practical lessons from the EY cybersecurity research. AI may improve analyst efficiency, triage alerts and accelerate investigations, but it also increases the need for people who understand model behavior, identity controls, data exposure, adversarial manipulation and legal accountability. The cyber workforce problem is therefore not only about headcount. It is increasingly about redesigning roles and skills for AI-enabled operations.
The C-suite disconnect remains a security risk
EY’s 2025 Cybersecurity Study, based on a survey conducted in December 2024 and January 2025 of 800 US C-level executives, adds another layer. The study found that 84% of C-suite leaders said their organization had experienced a cybersecurity incident in the previous three years. The same research also showed persistent disagreement between CISOs and other senior executives over exposure, budgets and the sources of cyber incidents.
For example, EY reported that 66% of CISOs were worried that their organization’s cyber threats were more advanced than their defenses, compared with 56% of the rest of the C-suite. CISOs were also more likely to believe senior leaders underestimated cyber threats. Budget perception was another fault line: 67% of CISOs said their current cybersecurity budget was at least seven figures, compared with 45% of other C-suite respondents.
This alignment gap can affect real security decisions. If a CISO sees risk accelerating but the broader executive team believes the program is adequately funded, the organization may delay investments in identity hardening, incident response, third-party monitoring or AI governance. EY also reported that only 18% of C-suite leaders said cybersecurity had a stand-alone budget, while 68% said it was part of the IT budget. That structure can make cyber spending compete with broader technology operations rather than being evaluated as enterprise risk management.
Human risk is becoming an AI governance issue
EY’s 2024 Human Risk in Cybersecurity Survey adds a workforce perspective to the executive findings. The survey, fielded in March 2024 among 1,000 US employees who use a work-issued computer, found that almost 80% of respondents were concerned about AI being used in cyberattacks, while 39% were not confident they knew how to use AI responsibly. EY also reported that more than 90% said organizations should regularly update training to keep pace with AI’s role in cyber threats, while 62% said their employers had prioritized education about responsible AI use.
The key point is that AI-related cyber risk sits at the intersection of technology, behavior and governance. Deepfakes, synthetic phishing messages, impersonation attacks and AI-assisted social engineering all depend on human judgment at some stage. Training therefore cannot remain a once-a-year compliance exercise. It needs to reflect how employees use collaboration tools, generative AI platforms, customer data, privileged access and approval workflows in daily operations.
There is also a cultural challenge. If employees are anxious about AI-enabled attacks but unsure how to use AI responsibly, organizations can end up with both risky experimentation and defensive hesitation. A stronger model is to define approved tools, prohibited data uses, escalation paths, verification steps for unusual requests and realistic simulations that build confidence rather than blame.
What security leaders can take from EY’s findings
EY’s findings do not point to a single product answer. They point to an operating model agenda. Security leaders can use the research as a checklist for where AI-era cyber programs need to mature.
- Separate AI adoption from AI readiness. Buying AI-enabled security tools is not the same as having the data quality, workflow integration, staffing and governance needed to use them safely.
- Move budget discussions from cost to risk and value. If cybersecurity remains buried inside IT spending, boards may struggle to see how security supports revenue protection, operational resilience and regulatory readiness.
- Define where human approval is mandatory. High-impact actions such as account lockouts, privilege changes, legal notifications and third-party escalations should have clear human-in-the-loop rules.
- Measure outcomes, not only deployment. Useful metrics include detection time, containment time, false positive reduction, incident recurrence, identity exposure, control coverage and analyst productivity.
- Make AI governance operational. Policies should connect to logging, model oversight, access control, data classification, vendor review and audit evidence.
The strongest programs will likely connect these items rather than treat them as separate workstreams. For example, a company introducing agentic threat detection should also update incident response playbooks, define analyst override rights, review data access permissions, monitor model performance and brief executives on residual risk. Without that full chain, AI can create new blind spots even as it improves speed.
A timeline of EY cybersecurity signals
| Date or period | EY cybersecurity signal | What it indicates |
|---|---|---|
| March 2024 | EY Human Risk in Cybersecurity Survey was fielded among US employees | AI-related cyber anxiety and responsible-use uncertainty were already visible at workforce level |
| December 2024 to January 2025 | EY surveyed US C-level executives for its 2025 Cybersecurity Study | CISO and C-suite disconnects remained material across risk perception, budgets and incident sources |
| March 26, 2026 | EY announced it was rated a Leader in The Forrester Wave for Cybersecurity Consulting Services, Q1 2026 | Analyst coverage placed EY among major cybersecurity consulting providers, especially in AI-enabled transformation and integrated compliance contexts |
| 2026 study based on December 2025 research | EY released its AI in Cybersecurity Study 2026 | Security leaders expected rapid growth in AI-enabled and agentic cyber functions, while reporting budget, ROI, talent and governance gaps |
The timeline shows why the topic remains timely as of October 2026. EY’s research has moved from workforce anxiety and executive alignment toward a more specific question: how to govern AI-enabled defense when attackers, defenders and business units are all adopting AI at the same time.
Frequently asked questions
What does EY cybersecurity refer to?
EY cybersecurity generally refers to EY’s cybersecurity consulting, managed services, research and related advisory capabilities. In industry coverage, it is often discussed in connection with cyber transformation, governance, risk and compliance, identity, cloud security, threat detection, data protection, privacy and AI-enabled security operations.
What is the key takeaway from EY’s 2026 AI cybersecurity study?
The key takeaway is that security leaders increasingly view AI as essential to cyber defense, but many organizations have not fully solved the budget, governance, skills and ROI issues required to scale it responsibly. The study suggests that AI security maturity depends as much on operating discipline as on technology selection.
Why does the C-suite disconnect matter in cybersecurity?
Cybersecurity decisions require fast agreement on risk, funding and accountability. If CISOs and other executives disagree about exposure, budgets or incident sources, organizations may underfund controls, delay response planning or measure the wrong outcomes. EY’s 2025 study shows that this disconnect remains a practical enterprise risk.
Will AI replace cybersecurity analysts?
EY’s findings do not support a simple replacement narrative. They suggest AI can improve efficiency and automate parts of detection, fraud monitoring, identity workflows and compliance. However, the same research emphasizes human-in-the-loop oversight and highlights difficulty recruiting professionals with AI cybersecurity expertise. The near-term trend is role redesign, not full replacement.
What should boards ask after reading EY cybersecurity research?
Boards should ask whether the organization has a clear AI security budget, defined human approval points, measurable cyber outcomes, an embedded AI governance framework and a workforce training plan that reflects AI-enabled social engineering and data risk. These questions turn the research into practical oversight.