Adopting AI is a major priority for businesses - but employees are falling behind on education

Nearly all security professionals agree automation reduces response timesOnly around half are currently using AI in key cybersecurity workflowsMany organizations have now experienced deepfake phishing attacks

Most (91%) UK security teams now agree that while adopting the next generation of agentic AI is a priority, many companies are still struggling with uniform AI adoption due to the same old challenges.

For years, now, AI adoption has been held back by a skills shortages and poor policy enforcement, and new research from Ivanti shows those barriers are yet to be broken down.

In fact, a shortage of skills was cited as the number one barrier for AI in cybersecurity as attacks continue to rise.

AI's role in cybersecurity is a mixed one

On one front, cybersecurity teams agree that artificial intelligence improves how they respond to attacks. Most (93%) say that automation reduces response times, and security professionals are more likely to believe that defenders use AI as effectively as attackers.

However actual deployment tells a different story – barely more than half (56%) use AI for cloud security policy enforcement, and even less use it in incident response workflows (47%), threat intelligence correlation (45%) and vulnerability response and remediation (45%).

On the flip side, attackers have also gained access to AI's power to democratize attack sophistication. Three in four (76%) UK organizations have faced deepfake attacks, and half have experienced personalized deepfake phishing.

When it comes to skill sets, it's not just blue-collar workers that are lacking. Just one-third (32%) believe their CEO could reliability identify a deepfake, highlighting the need for a much more comprehensive upskilling effort.

Ivanti Chief Security Officer Daniel Spicer described the "year-over-year widening imbalance in an organizations’ ability to defend their data, people and networks against the evolving threat landscape" as a Cybersecurity Readiness Deficit.