AI in cybersecurity is now a budget line, a threat and a governance problem at the same time. Enterprises use it to speed up defence. Meanwhile, they must also defend the AI systems they have just deployed.
This guide covers six enterprise trends, with the numbers behind them. Each figure comes from a named report, and the sources are linked at the end.
Why AI in Cybersecurity Is Moving From Pilot to Platform
Security teams face more alerts than people. In addition, attackers now use AI to move faster. As a result, vendors are building AI into existing products instead of selling it as a separate tool.
Gartner expects the AI-amplified security market to grow from $49 billion in 2025 to $160 billion by 2029. Notably, it describes this as existing products adding AI, not new spending. It also expects over 75% of enterprises to use such products by 2028, up from under 25% in 2025.
Trend 1: AI Cuts Breach Costs and Response Time
IBM’s 2025 Cost of a Data Breach report puts the global average at $4.44 million, down 9% from the year before. Organizations that used AI and automation extensively saved $1.9 million on average. Furthermore, they shortened the breach lifecycle by 80 days.
The average lifecycle is still 241 days. So the gain is real, yet most firms have not captured it.
Trend 2: AI in Cybersecurity Makes the SOC Human-Supervised
McKinsey describes a “human supervised but machine operated” model for security operations. Agents would handle alert triage, remediation and identity workflows. In its survey, 35% of respondents expect AI agents to replace tier-one SOC analysts within three years.
Gartner takes a more measured view. It says AI changes the skill mix of analysts instead of simply cutting headcount. Therefore, teams need human review and training alongside the tooling.
Trend 3: Agentic AI Expands the Attack Surface
Agents choose which data and systems to touch. Consequently, risk moves past login and into multistep workflows. McKinsey warns that agents can pick up unintended permissions through policy drift or tool chaining.
Its survey found that over 75% of large enterprises want protection against AI input manipulation. About 30% doubt that their current vendors can address AI risks. If you build agents yourself, our agentic AI production checklist covers the controls to test first.
Trend 4: Shadow AI Raises the Cost of a Breach
Unsanctioned AI tools are an expensive blind spot. IBM found that organizations with high shadow AI had breaches costing $670,000 more. Of the organizations that suffered AI-related breaches, 97% had no AI access controls.
Employee behaviour matches this. A Gartner survey of 175 employees found that 57% use personal GenAI accounts for work. Meanwhile, 33% admitted uploading sensitive data to unsanctioned tools.
Trend 5: Identity Now Includes AI Agents
Traditional identity systems assumed a human at the keyboard. Agents break that assumption. Gartner lists identity and access management for AI agents among its 2026 trends, and McKinsey points to governance of nonhuman identities as a major growth area.
- Inventory every agent and the permissions it holds.
- Issue short-lived credentials instead of static keys.
- Log agent actions so they can be audited later.
- Review high-privilege agents on a fixed schedule.
Trend 6: Governance Lags Adoption
IBM reports that 63% of breached organizations lack an AI governance policy or are still writing one. Of those with a policy, only 34% regularly audit for unsanctioned AI. Clearly, policy without checks changes little.
Spending is also shifting. McKinsey projects the AI share of security budgets rising from about 4% to 15%, while total budgets grow only about 2.5% a year. Put differently, AI spending will come out of other lines.
What to Do Next With AI in Cybersecurity
- Measure your breach lifecycle first, then set an AI-driven reduction target.
- Find shadow AI with a discovery audit, not a survey.
- Treat every agent as an identity with its own permissions.
- Keep a human in the loop for high-impact SOC actions.
- Ask vendors how they secure their own AI, not just what it detects.
Start with the audit. Almost every other step depends on knowing which AI tools are already in use.
Final Thoughts
AI in cybersecurity cuts costs for the firms that deploy it well. However, it also creates new assets to protect. The winners will do both at once. They will automate defence and govern the AI that does the work.
Sources: IBM Cost of a Data Breach 2025 (via Help Net Security); McKinsey on securing the agentic enterprise; Gartner 2026 trends (as summarised by Software Strategies Blog).
