Prophet Security's State of AI in Security Operations 2026 survey of over 250 CISOs and SOC leaders explores daily AI adoption, tooling challenges, and automation limits.
The findings cover how teams handle alert triage, data privacy roadblocks, internal tool abandonment rates, and the strict human oversight policies governing security automation.
According to a survey by Prophet Security, which gathered the opinions of more than 250 security managers, 40% of teams use artificial intelligence tools on a daily basis, 56% are testing them, while only 4% have no intention of using them.
What is needed for artificial intelligence to work?
A team’s readiness to use such tools depends on whether it faces the problems they can solve and whether it has the necessary data and operating rules. Automated systems typically take the first line of defense, examining and investigating security alerts as they arise.
To do their job properly, they need access to multiple sources, such as event logging systems, computer security programs, identity management services, remote services platforms, email, and core office applications. They also need important background information, such as information about the importance of machines, user roles, any key people in the company, business departments, and known non-hazardous activities.
Obstacles and human supervision
Despite the benefits, challenges remain. 44% of teams cited privacy and how AI models are trained as the biggest hurdles. Additionally, several attempts to build in-house tools by companies themselves were ultimately abandoned or replaced by commercial products.
↳
READ ALSO
HACKS.GR / RELATED
AI Unlocked
Elon Musk publicly admitted that the cost of Grok Bot is unsustainable
↗
When it comes to decision control, teams remain cautious. 57% require human approval before closing an alert. When it comes to response actions, 44% let AI suggest solutions that humans then execute, 30% allow it to handle low-risk cases autonomously, and no team gives it full and unlimited autonomy.
Why teams are turning to automation
The need for help is great, as the workload often exceeds the capabilities of staff. According to the survey, 60% of respondents said that an alert they had previously ignored or missed later developed into a serious problem, such as a security breach or outage. Up to 40% of organizations had been forced to disable certain controls simply because they did not have enough staff to monitor them, while a complete investigation takes an average of 75 minutes, with alerts waiting almost an hour for someone to open them.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)