The cyber responders AI has not yet relieved
The most telling contrast in this year’s cybersecurity workforce research may be the gap between adoption and relief. ISSA and Omdia found that 83 per cent of organisations were using or planning to use AI for cybersecurity, while 68 per cent of professionals said the job had become harder over the previous two years. It captures the central puzzle: AI is being adopted partly to relieve security work while changing its volume and tempo.
For incident responders, the puzzle is practical. Their job is to decide who has been hit, which alerts are credible and what action is safe. If AI increases the number of signals, candidate flaws and investigations, the binding constraint becomes human attention. More tools do not automatically create more capacity, and faster detection does not automatically produce faster judgement.
A workload that keeps compounding
Axios reported a snapshot of that pressure. Justin Timothy, a threat intelligence consultant at GuidePoint Security, told the outlet that the previous month had felt like the longest year of his life and that he was already swamped before a period the article called Black October, as ransomware gangs returned from a summer lull. Troy Bettencourt, who leads Palo Alto Networks’ global digital forensics and incident response practice, said demand for his team’s services had climbed by double digits over six weeks and described a workload that keeps accumulating rather than a surge tied to one event such as SolarWinds. Investigations that once needed one consultant now required teams of five to 20 people, and the company moved staff from other projects into incident response as it prepared for attacks exploiting PHP vulnerabilities disclosed the previous week.
Those accounts show what named practitioners and executives told Axios. They do not measure the whole sector. The available account did not identify the PHP flaws or say whether they were being exploited. The demand figure came from the firm selling response services and was not independently corroborated. The report captures how people handling the work describe it, not a sector-wide audit.
Axios also described a distinct form of overload: validation. Samantha Lewis, identified as head of threat intelligence at a firm Axios rendered as Armadin, said her team was inundated with customer questions about exposure to AI-discovered flaws in foundational internet code. Staff spent days sorting hundreds of purported exploits, many of which did not work. That detail matters more than any single statistic. AI can generate candidates faster than humans can establish which are real, and the checking falls to people.
What the surveys can and cannot show
The wider survey record points in the same direction, with caveats. Information Age, published by the Australian Computer Society, reported that 68 per cent of ISACA respondents said their jobs had become more stressful over five years; 71 per cent blamed the increasingly complex threat landscape, up from 63 per cent a year earlier; and 52 per cent cited unrealistic expectations or too much work. The share saying people leave because of high work stress rose from 47 to 52 per cent. The ISACA survey covered about 1,800 professionals globally, including nearly 100 in Australia, but the figures come through Information Age, not directly from the ISACA report. They describe a global cohort, not a national incident-response measure.
ISSA and Omdia’s survey of 380 professionals, drawn from ISSA’s member list between 26 January and 18 February 2026, found that 53 per cent cited high job stress as the main reason they would leave the profession and only 2 per cent reported no job stress. It also reported that 44 per cent of teams had been diverted from strategic work to incident response, with 42 per cent carrying increased workloads and 37 per cent seeing higher burnout and attrition. The sample is self-selected and not representative. The RSA Conference blog, summarising a Seemplicity survey of 300 cybersecurity and IT professionals, reported an average of 10.8 extra hours a week, with 45 per cent logging 11 or more and one in five working more than 16 extra hours. Those figures come through a conference summary of vendor research, so treat them as reported signals, not precise measurements.
Different samples, questions and commissioning make direct comparison unsafe. The surveys do not show that burnout arrived with AI. ISACA respondents blamed complexity and unrealistic expectations; ISSA and Omdia respondents cited stress and workload; Axios’s responders described demand that predated the latest vulnerability scare. AI is part of the conditions, but the evidence does not establish it as the cause.
The double role of AI
AI appears in the record in two roles. One is as an accelerant. The RSA Conference blog, citing Darktrace’s annual State of AI Cybersecurity Report 2026, reported that 87 per cent of security professionals said AI was significantly increasing their team’s workload and 73 per cent said AI-powered threats were significantly affecting their organisation. Those are second-hand vendor figures and need care. The reported mechanism is plausible: more candidate flaws, more alerts, more investigations and more false leads can expand the queue before any tool shortens it. The consequence is not simply more attacks. It can mean more decisions per hour.
The other role is as a promised relief. Axios reported that the workload was pushing security firms to use AI and automation to find weaknesses and speed investigations. Swimlane’s survey of 500 security workers in the US and UK, reported by TechCentral.ie from a Cybersecurity Dive report, found that 62 per cent said AI was helping them develop skills and 92 per cent of that group reported higher job satisfaction. Even among the 24 per cent who said AI limited their skills development, 91 per cent reported higher satisfaction. But the same survey found that 47 per cent expected SOC analyst careers to be harder to get, about half would trust their instincts over an AI recommendation when it conflicted with evidence, and about one in five worried their team would become overly reliant on AI. The survey was vendor-commissioned and leaders and practitioners were not paired within the same organisations, so it cannot settle whether AI reduces burnout.
CSO Online illustrates how far interpretations diverge. It reported a survey of 1,001 CISOs in the US and UK, without identifying the provider, in which 50 per cent agreed that the arrival of Anthropic Mythos and similar cyber-capable models had made them consider leaving the profession, while 25 per cent disagreed. Sixty per cent said board pressure to adopt AI was outpacing their ability to govern and secure its use. Christine Gadsby, a former CISO and BlackBerry chief security advisor, described the role’s burden as extending to personal liability. Yet the same article recorded counterviews: Mike Privette, a former CISO, said the Mythos effect was overstated and frontier models had spotlighted problems that already existed; Omar Khawaja of Databricks and Carnegie Mellon said the models changed how well, how fast and how much security work was needed, not what needed to be done. He recommended lower-risk uses such as anomaly finding and triage before automating response.
From resilience to operating model
The leadership layer matters because it shapes whether AI relieves or redistributes strain. ISSA and Omdia reported that full-time CISO appointments fell from 76 to 63 per cent in a year and virtual CISOs tripled from 5 to 16 per cent. CSO Online, citing IDC analyst Chris Kissel, put average CISO tenure at 18 months, an analyst estimate rather than a measured series. Oliver Legg, a cybersecurity recruiter at Aspiron Search, told CSO Online that candidates now ask first about indemnification and directors and officers coverage rather than budget and headcount, an anecdotal observation. This is not proof of collapse, but it is evidence that accountability and authority are misaligned in ways that can push experienced people out and leave less experienced staff more vulnerable to burnout.
Readiness is another operating-model question. Information Age reported that 64 per cent of ISACA respondents’ organisations had conducted no AI-related incident response exercises, only 20 per cent had AI-specific runbooks and 8 per cent ran regular AI-specific exercises. These are self-reported and second-hand. They still suggest a gap between adoption and preparation. Reported recommendations point the same way: lower-risk adoption, clear human validation, leadership commitment and realistic staffing. ISSA and Omdia found that 39 per cent named leadership commitment as the top driver of job satisfaction, above compensation. The RSA Conference blog characterised the causes of burnout as organisational and said individual wellbeing practices only ease symptoms. None is a tested cure for burnout.
The unresolved test
The retention paradox is the hardest part to reconcile. Seemplicity’s respondents overwhelmingly said they would choose the career again, and Swimlane’s workers often reported that AI improved satisfaction. Affection for the work is not the same as a sustainable load. Nor is higher satisfaction proof that hours, recovery or decision quality have improved. The unresolved question is therefore not whether AI belongs in security operations. It is whether organisations will use it to reduce the queue, protect attention and make validation tractable, or simply to demand more throughput from the same people. The evidence supports the question; it does not yet answer it.
A queue that grows faster than it can be checked is an old problem in a new costume. Deciding which of several hundred reported weaknesses deserves attention is a skill before it is a tool: it means understanding how a vulnerability is scoped, why a plausible report differs from a working one, and where human validation has to sit. Those questions belong to internet vulnerabilities as a field of study, with broader foundations in how systems and evidence are assessed. The Hack Academy’s online cybersecurity training programme lists internet vulnerabilities and cybersecurity fundamentals as subject areas, and combines self-paced learning with practical exercises, for readers who want to look more closely at how a reported weakness earns trust.