Topic starter
11/11/2026 6:04 pm
TL;DR: AI risk and identity phishing gaps are leaving most security teams short of the skills needed to respond effectively, according to Barracuda. Security operations now depend on human judgement, governance, and visibility because automation cannot compensate for weak capability.
Editorial analysis by NHI Mgmt Group, based on content published by Barracuda: “Cybersecurity skills gap report: AI risk tops the list”.
By the numbers:
- 68% of organizations report skills gaps related to AI risks.
- 67% report skills gaps in advanced identity and phishing threats.
- 67% say security teams are under pressure and struggling to scale.
Key questions
Q: Why do OAuth attacks bypass MFA so often?
A: OAuth attacks bypass MFA because the attacker is not asking the user to log in again after the token is issued.
Q: How should security teams govern AI use cases across multiple business units?
A: Security teams should require a single inventory of AI use cases, models, and agents with consistent ownership, lifecycle stage, and risk metadata.
Q: How can security teams detect AI-driven phishing?
A: Security teams can detect AI-driven phishing by focusing on behaviour, not writing style alone.
Practitioner guidance
- Strengthen identity-led detection coverage Prioritise detection rules and triage playbooks for BEC, OAuth abuse, MFA bypass, and other identity-driven attack paths that often look like normal user activity.
- Define human approval boundaries for AI-assisted operations Document which security actions AI may recommend, which actions it may execute, and which decisions must remain with an analyst or incident lead.
- Build visibility across identity and security data Unify evidence from identity, email, applications, cloud services, and endpoint telemetry so analysts can reconstruct attacks without jumping between disconnected tools.
Bottom line: AI risk and identity-led phishing now expose a security capability problem that staffing alone does not solve.
Glossary terms: Business email compromise, OAuth Abuse, MFA Bypass, Security Operations Center (SOC)
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Capability, not head count, is the real security constraint: The report shows that teams are being asked to secure larger and more AI-enabled environments without the skills or visibility needed to do it well. That means staffing counts alone no longer explain resilience or failure. The decisive question is whether the organisation can combine technical depth, business understanding, and operational judgement into a working security model.
A question worth separating out:
Q: Can reactive security models keep pace with expanding digital operations?
A: Reactive security models struggle to keep pace with expanding digital operations because they wait for alerts, incidents, or manual reviews before acting. Modern environments need continuous control enforcement, asset visibility, automated detection, and policy-based response across cloud, endpoints, applications, and identities, including service accounts and API tokens.
👉 Read our full editorial: AI risk and phishing gaps expose cybersecurity capability limits