99.6% of respondents increased budgets for AI in cybersecurity automation in the past year, and 70% have human-in-the-loop or human-on-the-loop oversight.

Securonix, Inc., today released its research report, The Evolution of Cybersecurity Automation: Towards Human-Governed AI Execution. The report finds that investment in AI for cybersecurity has reached a tipping point. Its findings show that organizations are increasing AI adoption while emphasizing governance, human oversight and accountability to support effective, trusted security operations.

The study surveyed 1,000 cybersecurity professionals at organizations with between 2,000 and more than 50,000 employees across the US, UK, France and Australia. The findings show that automation and AI are widely used in cybersecurity operations. Almost every respondent (99.6%) reported that their budget for AI adoption in cybersecurity automation increased over the past year. The report describes cybersecurity automation as a baseline expectation: 96% said it was important and 63% rated it very important. AI adoption is also established, with 87% saying their organizations already use AI to some extent in cybersecurity automation.

At the same time, 53% favor a human-in-the-loop approach to their overall AI cybersecurity strategy. Across adoption levels, 13% say their organizations do not use AI in cybersecurity automation at all, while 16.4% report that AI dynamically orchestrates and adapts workflows with minimal human intervention and 17.2% describe operations as fully autonomous and AI-driven. For specific SOC use cases, 48% use a human-in-the-loop approach. On average, 32% say use cases such as alert triage and incident response will always require a human in the loop.

The Emerging Control Paradox

The report describes an emerging “control paradox” between current AI deployment and respondents’ expectations for human oversight. Organizations are deploying AI in areas such as alert triage, threat detection and incident response, while many respondents believe these functions will continue to require meaningful human involvement. Alert triage illustrates this tension: 35% believe it will always require human oversight, while 19% report that it is already fully autonomous in their organization.

“As cybersecurity budgets rise, leaders are investing in AI while keeping people involved in consequential decisions.” said Toby Weiss, CEO of Securonix “Our research found that 53% favor a human-in-the-loop approach, while 16.4% report workflows with minimal human intervention. Another 13% say they do not use AI in cybersecurity automation. The findings point to a clear priority: expansion of AI’s role in the SOC while setting boundaries that keep people accountable.”

The report says more than half of the budget for AI in cybersecurity automation is being diverted from sources outside the security team, indicating that organizations are prioritizing this investment alongside other potential areas of AI deployment.

Human-Approved AI Becomes the Dominant Model

Across individual SOC use cases, 13% report fully autonomous AI with no human approval.

The report recommends defining permissions, approval boundaries, escalation paths and accountability for each AI-enabled workflow.

Organizations are primarily measuring AI through security and operational outcomes, including faster threat detection and response, reduced investigative workload, improved analyst productivity and higher-quality detections. Tool consolidation and cost savings are the lowest-ranked AI success measures reported in the survey. While these factors remain relevant to broader technology purchasing decisions, respondents place greater emphasis on AI’s operational contribution than on its cost.

AI Reshapes Roles Across the SOC

AI is changing the cybersecurity workforce. Thirty-five percent of organizations are retraining analysts to focus on higher-value work such as investigation quality, decision-making and threat interpretation. A further 33% see new skills and roles emerging around AI governance, validation and oversight, while 31% are hiring more specialists as traditional cybersecurity roles evolve.

Different cybersecurity leaders also judge AI through the lens of their respective responsibilities. CISOs focus on governance, ethics and accountability, while Heads of SOC are most concerned with skills and workforce development. Heads of Incident Response are the most AI-forward and prioritize speed and faster resolution. Cyber Threat Intelligence leaders place greater emphasis on trust, validation and transparency. This divergence reinforces the need for a shared operating model that aligns operational, technical, governance and people priorities.

Ethics and Governance Move to the Fore

Ethical issues are the leading concern about using AI in cybersecurity, cited by 26% of respondents, followed by worries about limited visibility into third-party tools and dependence on a single AI provider, both cited by 24% of respondents.

Forty-two percent of respondents describe their AI governance as defined or managed, and 27% say it is optimized. These are respondents’ self-assessments of their organizations’ AI governance maturity.

The full report also sets out recommendations for building a human-governed, AI-enabled SOC, including investing in AI literacy and analyst development, establishing cross-functional governance, defining human approval policies and audit trails, and measuring AI through security outcomes that matter to the business.

To read The Evolution of Cybersecurity Automation: Towards Human-Governed AI Execution, visit https://www.securonix.com/resources/cybersecurity-automation-ai-2026-report/.

Research Methodology

Securonix surveyed 1,000 cybersecurity professionals from organizations with 2,000 to more than 50,000 employees in the US, UK, France and Australia in summer 2026. Respondents included CISOs, Heads of SOC, Heads of Cyber Threat Intelligence, Heads of Incident Response and Heads of Solutions Architecture. The sectors studied were Financial Services, Retail, Defense, Critical National Infrastructure and Healthcare.

About Securonix

Securonix is transforming security operations with the industry’s first Unified Defense SIEM with Agentic AI, built to decide and act across the threat lifecycle with a human-in-the-loop philosophy. Its cloud-native platform unifies detection, investigation, and response, while enabling Sam, the AI SOC Analyst, and a productivity-based AI operating model for the SOC, so organizations can measure and govern AI by the analyst work it delivers. Helping enterprises become Breach Ready and Board Ready, Securonix delivers accountable, outcome-driven security operations at scale. Recognized as a Leader in the Gartner® Magic Quadrant™ for SIEM and a Customers’ Choice by Gartner Peer Insights™, Securonix delivers trusted security operations for global enterprises. Learn more at www.securonix.com.

View source version on businesswire.com: https://www.businesswire.com/news/home/20261112330105/en/