A new Sophos report, “Beyond the Hype: The Business Reality of AI for Cybersecurity,” surveyed 400 IT leaders on their use of AI in security. While 65% have adopted generative AI (GenAI) capabilities, a significant 89% express concerns about potential flaws in these tools negatively impacting their organization’s cybersecurity.
Concurrently released research from Sophos X-Ops, “Cybercriminals Still Not Getting on Board the AI Train (Yet),” reveals a subtle shift in how cybercriminals utilize AI. While skepticism remains, some are employing GenAI to automate tasks like crafting mass emails and analyzing data. Others are integrating it into spam and social engineering toolkits.
Chester Wisniewski, director, global field CTO, Sophos, commented: “The mantra should be ‘trust but verify’ regarding generative AI tools. We haven’t taught machines to think; we’ve provided them with the context to speed up data processing. While these tools offer incredible potential to accelerate security workloads, human oversight remains crucial.”
With AI embedded in 98% of the surveyed organizations’ cybersecurity infrastructure, IT leaders express concerns about over-reliance on AI. 87% of respondents fear a resulting lack of cybersecurity accountability.
Organizations of different sizes prioritize GenAI differently. While large enterprises focus on improved protection, smaller organizations (50-99 employees) prioritize reducing burnout among their cybersecurity teams.
Across all organization sizes, 84% of leaders worry about pressure to reduce cybersecurity staff due to unrealistic expectations about AI’s ability to replace human operators.
Key Findings:
Difficulties in Quantifying Costs: 75% of IT leaders find it challenging to quantify the costs of GenAI in cybersecurity products.
Anticipated Savings: Despite 80% believing GenAI will significantly increase cybersecurity tool costs, 87% believe the technology will ultimately lower overall cybersecurity expenditure.