A leadership brief on the dual-use forces pushing security teams to govern AI now — the same technology defending the enterprise is arming the adversary. Validated against market, SOC, and attack data for CISOs and security executives.
A SOC analyst who used to spend a shift triaging alerts now spends it hunting the 10% AI can't yet resolve alone. A phishing campaign built and personalized by AI reaches an inbox faster than the awareness training meant to catch it. Same technology, opposite sides of the same fight — and the gap between them is measured in days, not years.
The question for security leaders is no longer whether AI belongs in the security operations center — adoption has already answered that. It's whether the organization is governing AI as fast as it's deploying it, on both the defense and the attack surface. This report examines the signals driving that race, and the operating discipline that keeps pace with it.
Built to forward — use the rail on the left to send this to your CISO, CIO, or board and bring the case for backing your AI initiative.
82.6% of phishing emails detected between September 2024 and February 2025 used AI — a 53.5% year-on-year increase[1] — and 42% of phishing breaches are now agentic, meaning the attacking system adapts its own tactics in real time.[2] Generative-AI-facilitated fraud losses are projected to climb from $12.3 billion in 2023 to $40 billion by 2027.[1]
74% of IT leaders experienced an AI-related breach in the past year — yet 76% of organizations still haven't decided which team owns AI security.
— HiddenLayer AI Threat Landscape survey, 2025
That ownership gap, not a lack of tooling, is the central governance risk facing security leadership today.
The global AI-in-cybersecurity market is projected to grow from $44.24 billion in 2026 to $213.17 billion by 2034 — a 21.7% CAGR.[3] Gartner forecasts that by 2027, more than 40% of all cybersecurity spending will be directly tied to AI-related capabilities, up from just 8% in 2023.[4] Financial services leads sector adoption with an 82% AI-integration rate, driven by regulatory pressure and the value of the data at stake.[5]
Shadow AI exposure. 20% of organizations have already experienced a breach via unsanctioned "shadow AI" tools, at an average cost of $4.63 million per incident[2] — and only 22% conduct adversarial AI testing to find these gaps before attackers do.[2]
Ownership ambiguity. With 76% of organizations still undecided on who owns AI security,[6] governance gaps persist not from lack of budget but from lack of a named accountable owner.
Skills pressure. AI skills are now the top capability gap cybersecurity teams report, cited by 41% of professionals.[2]
Regulatory clock. The EU AI Act's cybersecurity-relevant provisions reach full compliance in August 2026[2] — institutions without a governance structure in place inherit compliance risk on top of breach risk.
In the modern AI-enabled SOC, AI now handles roughly 90% of alert triage, detects threats 50% faster, reduces analyst workload by 60%, and cuts false positives by 38%.[2] Organizations using AI detection average 51 days to detect a breach, versus 181 days for those still relying primarily on signature-based tools — a more than 3x improvement.[2]
AI doesn't replace the security analyst — it clears the noise so the analyst can spend the shift on the alerts that actually matter.
SOC triage and alert prioritization. The highest-confidence starting point — the largest deployed base today, with immediate analyst-hours payback.
Behavioral threat detection. Baselining normal activity to catch anomalous logins, lateral movement, and privilege escalation that signature-based tools miss entirely.
Phishing and social-engineering defense. The most urgent ground, given how fast attackers have weaponized the same generative tools.
Adversarial AI testing. The most under-deployed use case today at just 22% adoption[2] — and the fastest-growing, with demand projected to rise 35% by 2028.
Deepfake-related fraud losses reached $1.1 billion globally in 2025, tripling from $360 million in 2024,[1] with executive-impersonation deepfakes alone causing $217 million in fraudulent transfer losses.[1] The organizations avoiding these losses share a pattern: a named AI security owner, routine adversarial testing, and detection tooling upgraded on the same cycle as the threats it defends against — not a one-time deployment left to age.
Attackers are already agentic; most defenders are not yet. Budget commitment, SOC automation, and skills investment are converging fast, but the organizations still debating who owns AI security are the ones most exposed to the next shadow-AI incident.
The organizations that close this gap first won't just defend against AI-native attacks — they'll set the operating standard the rest of the industry has to match.
Download the PDF, forward it to your leadership team, and bring your organization's AI initiative to the Executive Accelerator.