Cybersecurity benchmark pressures in 2026 expose capacity gaps

At a glance

What this is: Secureframe's 2026 benchmark preview shows cybersecurity urgency outpacing staffing, budgets, and manual operating capacity.

Why it matters: Identity, NHI, and broader security programmes all depend on repeatable governance work, so capacity gaps quickly become control gaps, audit drag, and slower buyer assurance.

By the numbers:

• 93% of respondents said cybersecurity is a top or major priority within their organization.
• Three quarters of organizations still allocate 15% or less of their annual budget to security and compliance.

Context

Cybersecurity programmes often fail first at capacity, not intent. When teams carry too few staff and too little budget, even well-defined controls become difficult to evidence, maintain, and improve across the year. That is the governance gap this benchmark preview surfaces, and it is relevant to identity operations wherever review cycles, approvals, and access decisions depend on sustained human effort.

For identity, NHI, and adjacent security domains, the signal is clear: the control model may exist on paper, but the operating model is under strain. Manual evidence collection, fragmented ownership, and reactive compliance work make it harder to keep pace with certification demands, customer assurance requests, and expanding attack pressure.

Key questions

Q: What breaks when cybersecurity programmes have too few staff to sustain governance work?

A: Control ownership becomes brittle, evidence goes stale, and review cycles slip behind operational reality. The practical failure is not only slower compliance. It is that access reviews, documentation, and exception handling become person-dependent, which makes security posture harder to verify and easier to drift out of sync with policy.

Q: Why do small security teams struggle to keep control evidence current across frameworks?

A: Because the same people often have to manage operations, collect evidence, answer questionnaires, and prepare for audits. When those tasks are handled manually, documentation competes with actual control maintenance, and the programme starts optimising for the next deadline instead of continuous assurance.

Q: What should organisations measure to know whether automation is reducing risk?

A: Measure revoke timeliness, exception volume, access recertification failures, and the percentage of grants that match actual job function or workload need. If automation increases throughput but the review process cannot still explain why access exists, the control is operationally efficient but not governance effective.

Q: Should security teams prioritise automation or additional headcount first?

A: That depends on where the biggest bottleneck sits. If work is repetitive and well-defined, automation usually delivers the fastest relief. If the programme lacks named owners or decision capacity, headcount or role redesign may be the first fix because automation cannot compensate for missing accountability.

Technical breakdown

Why cybersecurity benchmarks now expose operating-model strain

Benchmark data is most useful when it reveals where security expectations outgrow delivery capacity. In this case, the issue is not whether organisations recognise risk. It is whether they can sustain the work required to prove control effectiveness, update evidence, and keep pace with changing obligations. That matters because governance frameworks assume regular human follow-through. When security and compliance are run by very small teams, the gap between policy and execution widens quickly, especially across multi-framework environments.

Practical implication: Measure whether your control ownership model can still function if one or two people are unavailable.

How manual compliance work creates control drift

Manual audit preparation consumes time that should be spent on control validation, exception handling, and remediation. Collecting evidence by hand also increases inconsistency, because different teams may interpret the same requirement differently across frameworks. Over time, that produces control drift: the written standard remains stable, but the way it is evidenced and maintained becomes uneven. In identity-heavy programmes, that drift can affect joiner-mover-leaver processes, access reviews, and privileged access tracking just as much as it affects broader GRC workflows.

Practical implication: Centralize evidence and standardize control mappings so repetitive reporting work does not degrade governance quality.

AI adoption changes both the attack surface and the response model

The report shows organisations are using AI in defensive workflows while also worrying about AI-powered attacks. That duality matters because automation is no longer just an efficiency play. It is becoming part of the control architecture itself. For teams managing identities, secrets, and access decisions, the question is whether AI is being used to reduce repetitive workload without introducing new trust problems in evidence handling, policy drafting, or monitoring. The governance challenge is not AI adoption alone, but whether it is bounded and reviewable.

Practical implication: Treat AI-assisted security work as governed automation with defined review points, not as an informal productivity shortcut.

Threat narrative

Attacker objective: The objective is to exploit organisational capacity gaps so security teams cannot verify, prove, or sustain controls quickly enough to prevent misuse or loss of trust.

1. Entry occurs through AI-powered phishing, deepfakes, or adaptive social engineering that can scale faster than many teams can inspect manually.
2. Escalation follows when under-resourced security functions cannot consistently validate access, exceptions, or control exceptions across business units.
3. Impact is slower detection, weaker evidence quality, and reduced buyer confidence when organisations cannot demonstrate current security posture reliably.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Capacity is now a security control variable, not an operational detail. This benchmark preview shows that the limiting factor in many programmes is no longer awareness of risk but the ability to sustain governance work at pace. When more than half of teams have one or fewer full-time security staff, the control environment becomes fragile even if policy coverage looks adequate. Practitioners should treat staffing depth, review cadence, and control ownership as part of the control design itself.

Manual assurance processes create a hidden identity governance debt. The article's strongest signal is not only about compliance overhead. It is about the accumulation of unreviewed, spreadsheet-driven, and person-dependent work that delays access validation, evidence production, and exception resolution. In identity and NHI programmes, that debt shows up as slower offboarding, weaker certification evidence, and less reliable privilege governance. Practitioners should assume manual evidence paths will eventually distort the quality of governance decisions.

AI will not remove governance pressure unless the underlying control model is already disciplined. The report captures a useful tension: teams are adopting AI to handle repetitive work while attackers are using AI to scale manipulation. That means the programme question is no longer whether to automate, but which decisions can be safely automated and which still require explicit review. The field should expect AI to widen the gap between mature and immature operating models, not close it by default.

Cybersecurity buyer assurance is becoming a control outcome. The report's revenue findings show that security posture is now tied directly to sales motion, which raises the stakes for identity, compliance, and evidence quality. Buyers are effectively testing whether organisations can prove governance on demand. Practitioners should expect assurance requests to keep expanding beyond certifications into continuous proof of control operation.

What this signals

Benchmark-driven governance is becoming a programme design issue. Security teams should expect leadership to ask not only whether controls exist, but whether the organisation can keep them operational under sustained pressure. That shifts the focus from point-in-time compliance to whether the programme can still function when staffing is tight and obligations keep growing.

Identity and NHI programmes are especially exposed to this pressure. Joiner-mover-leaver processes, access reviews, privileged access oversight, and evidence retention all fail quietly when execution depends on too few people. The practical response is to simplify control ownership, reduce manual handoffs, and treat repeatable governance work as an automation candidate.

AI-assisted security work needs bounded supervision. Teams that use AI to draft evidence, support monitoring, or accelerate reporting should define where human approval is still required. Otherwise, the programme risks trading manual delay for unreviewable output.

For practitioners

• Map capacity against control ownership Compare staffing, budget, and named control owners across core security and identity processes to identify where a single person is carrying too many responsibilities.
• Automate repetitive evidence collection Use automation to gather recurring audit evidence, standardize documentation, and reduce the time spent assembling the same proof for multiple frameworks.
• Standardize multi-framework control mapping Create one control library that maps common requirements once, then reuses that mapping for audits, trust centres, and customer assurance requests.
• Define which AI-assisted tasks stay reviewable Allow AI to help with drafting, collection, and monitoring, but keep explicit human review for sensitive access decisions, exceptions, and final assurance outputs.

Key takeaways

• The central issue is not lack of cyber awareness but a mismatch between security expectations and the capacity available to execute them.
• The benchmark preview points to a programme reality where small teams, limited budgets, and manual work make continuous assurance difficult to sustain.
• Automation helps most when it reduces repetitive evidence work without weakening ownership, review, or control consistency.

Key terms

• Control Drift: Control drift is the gradual weakening or inconsistency of a control over time as systems, workflows, or business rules change. It often appears as different interpretations, missed exceptions, or uneven enforcement across applications, and it usually becomes visible only when monitoring spans the full process.
• Assurance Workload: Assurance workload is the recurring effort required to prove that security controls are operating as intended. It includes evidence collection, documentation, questionnaire responses, and audit preparation, and it becomes a governance risk when it consumes the same teams responsible for running the controls.
• Governance Capacity: Governance capacity is the practical ability of a programme to maintain control ownership, reviews, evidence, and exception handling over time. It is not just headcount. It is the combination of people, process, and tooling needed to keep security decisions reliable under pressure.
• Buyer-driven assurance: A compliance strategy shaped by the requirements of the customer rather than by internal preference or certification prestige. In regulated markets, buyer-driven assurance determines which framework should come next, because deal terms often dictate the minimum acceptable control posture.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and compliance practitioners turn identity controls into repeatable operating practice across the programme.