Topic starter
24/06/2026 9:00 pm
TL;DR: AI tools are already in use across IT infrastructure for 60% of organisations, according to Netwrix research from a survey of 2,150 IT professionals across 121 countries. The real issue is not AI adoption itself but the governance gap between fast-moving AI use and incident response, identity control, and recovery discipline, with 51% reporting an incident requiring a dedicated security response and 75% reporting financial damage.
Editorial analysis by NHI Mgmt Group, based on content published by Netwrix: “2025 Cybersecurity Trends Report”.
By the numbers:
- 60% of organisations are already leveraging AI tools in their IT infrastructure.
- 51% of respondents confirmed experiencing a security incident in the past 12 months that demanded a dedicated response from security teams, not just an automated remediation.
- 75% of respondents reported financial damage due to attacks.
Key questions
Q: How should security teams govern AI in cybersecurity operations?
A: Security teams should govern AI in cybersecurity operations as a workflow control, not just a detection feature.
Q: Why do incidents involving AI tools often need dedicated security response?
A: Because automated remediation rarely resolves the full scope of access, data, or configuration impact on its own.
Q: What breaks when AI adoption outpaces governance?
A: What breaks first is attribution.
Practitioner guidance
- Map AI-enabled IT workflows Document where AI tools influence configuration, triage, remediation, or access decisions so the security team knows which workflows require governance and human oversight.
- Separate automation from authority Review which actions remain automated and which still depend on privileged human approval, especially where AI tooling can trigger changes in production systems.
- Update incident runbooks Add decision points for access review, escalation, and chain-of-custody checks when an incident involves AI-supported operational workflows.
Bottom line: AI adoption in IT infrastructure is no longer speculative, but the governance model around it is still immature in many organisations.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:56 am
AI adoption has outpaced the governance model that supports it: The report shows AI tools are already embedded in IT infrastructure, but the operating assumptions behind incident response and access control have not kept up. That is not a tooling problem alone. It is a sign that identity, approval, and recovery processes still treat AI-enabled operations as exceptional rather than normal, which is now a programme design flaw.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can teams reduce financial damage from AI-enabled incidents?
A: They need to shorten the path from detection to containment by clarifying privilege scope, recovery ownership, and escalation authority before an incident occurs. Financial damage rises when teams cannot quickly isolate affected workflows or verify which AI-assisted actions were legitimate. The faster the organisation can prove control, the less likely the incident is to spread into business loss.
👉 Read our full editorial: AI adoption is exposing cybersecurity response gaps in IT teams