COGNIZANT RESEARCH
Cybersecurity's new AI baseline: Why higher spending and stronger controls still leave enterprises exposed
<p><br>
<span class="small">October 22, 2026</span></p>
<h2><span class="h6">Ninety-seven percent of enterprise security leaders increased their cybersecurity budgets over the past year, yet 83% experienced an AI-related security incident. Our new research explores why strong fundamentals and rising investment aren’t enough on their own and where the real threat vectors exist.</span></h2>
<h3><span style="font-weight: normal;" class="h4">Executive summary</span></h3>
<p>Across industries, enterprise security leaders are facing an uphill battle: Security investment is growing exponentially, but AI-related exposure continues to outpace it.</p>
<p>In our recent research, 97% of organizations increased their cybersecurity budgets over the past year, with 43% increasing them by more than 15%. Yet 83% still experienced an AI-related security incident in the last 24 months, and 86% report that AI has accelerated the rate of new vulnerabilities in their environment. Additionally, 82% have paused an AI deployment specifically over security concerns in the past year.</p>
<p>These numbers raise an immediate and pressing question: Why does exposure remain high, even in organizations where security fundamentals are in place?</p>
<p>Cognizant’s 2026 cybersecurity pulse poll surveyed 201 senior cybersecurity leaders from US-based organizations to understand the security challenges posed by AI. The findings point to a clear conclusion: Traditional security fundamentals remain essential, but they are no longer enough to address the complex and rapidly evolving risks of AI. No single security control or owner can address these risks alone.</p>
<p>Key findings from our research include:</p>
<ul>
<li><b>Security fundamentals significantly reduce incident rates, but no single capability is sufficient on its own.</b> Strong execution on any single fundamental, including visibility, detection, remediation, guardrails and a security harness, measurably lowers incident rates. But even businesses with best-in-class execution on any one of those levers are still highly exposed, with 67% to 78% experiencing an incident in the last two years, compared with the 83% sample average. In other words, enterprises can meaningfully improve their odds, but they can't fully close the gap through any single lever alone.<br>
<br>
</li>
<li><b>Security leaders' stated concerns are inversely related to where incidents are actually occurring.</b> The threat vectors security leaders rank lowest in concern, including context poisoning and prompt injection, show the highest incident rates in the sample, while more familiar threats such as phishing and shadow AI sit higher on the priority list and occur less frequently.<br>
<br>
</li>
<li><b>CISO ownership correlates with higher incident rates—but that's a visibility signal, not a vulnerability signal</b>. Organizations whose security function is led by a chief information security officer (CISO) report the highest incident rates in the sample; however, this is most likely a sign of stronger detection and reporting infrastructure rather than a weaker security posture. This underscores the idea that strong governance needs to be fortified with the foundational capabilities of visibility and detection underneath it.</li>
</ul>
Spend is up. Exposure is up faster.
#
<p><span class="small">Source: Cognizant<br>
Base: 201 senior cybersecurity leaders from US-based enterprises<br>
Figure 1</span></p>
<p>In this report, enterprise security leaders will learn what it will take to reduce exposure in the age of AI, including aligning their security attention with actual incident data, and integrating discovery, prioritization, remediation and governance into a single operating rhythm.</p>
<h3><span class="h4" style="font-weight: normal;">Getting above the cybersecurity hygiene floor</span></h3>
<p>For most of the past decade, "fix the fundamentals" has been a reliable enough security playbook on its own. Improve visibility, tighten detection and speed up remediation, and incident rates will decline in something close to a straight line.</p>
<p>To some degree, this is still true. In our research, organizations with stronger security fundamentals consistently performed better than the average. Those with complete visibility into their AI estate reported a 71% incident rate, meaning 71% have experienced a breach in the last 24 months. That is 12 percentage points below the 83% sample average (see Figure 2).</p>
<p>Organizations that detect incidents within 24 hours sit at 67%, and those with full remediation discipline (more than 75% of critical vulnerabilities patched within 30 days) bring the rate to 72%. Organizations with full guardrail coverage across autonomous agents are at 77%, and those with a fully implemented, centrally enforced AI security harness have a rate of 78%.</p>
<p>The bottom line: Investment combined with coordination and discipline yields results.</p>
<p>However, while strong execution in any one area can reduce incident rates, even the strongest performers remained highly exposed, with incident rates ranging from 67% to 78%. We call this the “cyber hygiene floor:” the baseline that organizations will struggle to exceed, even with the best fundamentals in place.</p>
Despite best-case execution, incident rates remain above 67%
#
<p><span class="small">Source: Cognizant<br>
Base: 201 senior cybersecurity leaders from US-based enterprises<br>
Figure 2<br>
<br>
</span>While AI hasn't completely broken the playbook, it has added enough velocity and attack surface to the enterprise estate that no single fundamental can keep pace by itself anymore.</p>
<p>Consider: Complete visibility tells an organization what exists; it doesn't guarantee that what's found gets prioritized correctly. Fast detection shortens the window between an incident and a response; it doesn't prevent the incident from happening in the first place. Full guardrail coverage limits what an agent can do once it's compromised; it doesn't close the door the agent walked through.</p>
<p>In an AI estate that's expanding and changing faster than any of these isolated functions typically operate, the seams between them are where exposure accumulates.</p>
<p>The cyber hygiene floor is a wake-up call to enterprises that have delayed broader technology modernization because the business case wasn't clear enough to prioritize it. AI adoption and frontier models are surfacing vulnerabilities that were previously undetected, buried in legacy code, unsupported dependencies and architectures that were never designed for the speed at which exposure now moves.</p>
<p>The cyber hygiene floor is also evidence that security improvement and technology modernization need to be treated as a single backlog: knowing what exists, prioritizing what matters, remediating faster and governing consistently across the estate rather than running five separate initiatives that compete for the same budget cycle.</p>
<h3><span style="font-weight: normal;" class="h4">Closing the attention gap</span></h3>
<p>The second pattern in the data suggests that security attention is not always aligned with where incidents are occurring. Security leaders express the most concern about threats that use AI to amplify existing attack techniques, such as agentic AI-driven attacks and phishing. But the highest incident rates are associated with threats that target enterprise AI systems directly, like prompt injection, context poisoning and data poisoning (see Figure 3).</p>
<p>This attention gap is significant. For example, only 38% of cybersecurity leaders identify prompt injection as a top concern, yet 93% report experiencing it. Similarly, just 26% cite context poisoning as a top concern, while 92% report having experienced it.</p>
<p><b>Where the attention goes vs. where the exposure sits</b></p>
#
<p><span class="small">Source: Cognizant<br>
Base: 201 senior cybersecurity leaders from US-based enterprises<br>
Figure 3</span><br>
</p>
<p>Security leaders are right to worry about these new AI-injected threat vectors. Agentic AI threats and AI-accelerated phishing are legitimate and fast-growing risks, and it would be reasonable to expect them to keep climbing.</p>
<p>However, this concern should also extend to the less high-profile but increasingly sophisticated threat vectors that turn the enterprise's own AI systems into an attack surface. Whether it’s their higher incident rates or because they're markers of a more complex and faster-moving threat landscape, the conclusion for security leaders is the same: These vectors deserve more operational attention than their current position on the priority list reflects.</p>
<p><b>The visibility gap, unpacked</b></p>
#
<p><span class="small">Source: Cognizant<br>
Base: 201 senior cybersecurity leaders from US-based enterprises<br>
Figure 4</span></p>
<p>Another reason attention and exposure point are, in some cases, inversely related, is that an organization can't accurately assess a threat vector if it doesn't have a complete picture of where that vector could operate in the first place. Only 38% of enterprises report complete visibility into every AI model, agent and tool operating in their environment, including shadow AI; 59% have visibility with some gaps, and 3% have no visibility. The underlying issue is asset inventory, a familiar challenge to security teams, now applied to an estate that moves at AI speed rather than traditional IT speed.</p>
<h3><span class="h4" style="font-weight: normal;">Filling in with structure and governance</span></h3>
<p>Our study also looked at governance: Who is running the security program, and what difference does that make to security outcomes? The data requires careful reading.</p>
<p>CISO-led organizations report the highest incident rates in the sample, at 93% (see Figure 5). Taken in isolation, that looks like a strike against dedicated security leadership. However, when considering the pace of AI-driven attacks captured elsewhere in this report, the higher rate more likely indicates stronger detection.</p>
<p>Rather than experiencing more incidents, CISO-led organizations are far better equipped to put the systems in place that make fast-moving attacks visible. A lower reported rate under CEO or CIO ownership isn't necessarily indicative of a safer program; it may indicate a program with less capacity to see what's already happening inside it.</p>
<p><b>Awareness is half the battle</b></p>
#
<p><span class="small">Source: Cognizant<br>
Base: 201 senior cybersecurity leaders from US-based enterprises<br>
Figure 5</span></p>
<p>The reporting gap extends beyond detection into financial measurement. Sixty-two percent of respondents say they can formally quantify their AI security exposure in terms a CFO would recognize, such as revenue continuity, regulatory exposure and remediation cost. But more than one-third struggle to do so. An organization that cannot translate its security posture into business terms cannot direct investment toward actual security threats. This widespread accounting gap may help explain why spending is rising almost universally while exposure continues to outpace it.</p>
<p>This is also where the cyber hygiene floor, the visibility gap and the attention gap converge into a single operating question. An organization with a clear security leader but incomplete visibility will still miss incidents. An organization with strong visibility but no clear security leader will surface problems that nobody has the mandate to act on. And an organization that has both but hasn't corrected for where its security threats actually are, will keep over-indexing on the vectors that feel most urgent while the real threats keep driving incidents. All three gaps must be closed, and closing one without the others will shift the exposure rather than reduce it.</p>
<p><b>Closing the security gap</b></p>
#
<p><span class="small">Source: Cognizant<br>
Figure 6</span></p>
<h3><span class="h4" style="font-weight: normal;">Where this leaves enterprise security leadership</span></h3>
<p><span style="font-weight: normal;">The organizations closing the gap are connecting discovery, prioritization, remediation and governance into a single operating rhythm. Discovery creates visibility into what exists and where exposure sits. That visibility sharpens prioritization, prioritization accelerates remediation and governance ensures guardrails are applied consistently across the estate. The opportunity is not simply to strengthen each discipline but to make them work as one connected system.</span></p>
<p>The organizations most likely to move their incident rates in the coming year won't always be the ones that spend the most or the ones that name a single new owner for AI security and consider the problem solved. They'll be the ones that treat visibility, detection, remediation, guardrails and governance as inputs to one system rather than five separate scorecards—and that go back and check, with real data, whether their attention is truly focused on their greatest areas of exposure.</p>
<p>Moving forward, enterprise security leaders will need to consider a new set of guiding principles:</p>
<ul>
<li><b>Compare where security attention is going with where incidents are actually landing</b>, and be honest about the gap between the two.<br>
<br>
</li>
<li><b>Treat governance ownership and detection infrastructure as a single investment,</b> not two. A governance model is only as good as the visibility underneath it.<br>
<br>
</li>
<li><b>Deploy AI with a cyber-first mindset,</b> building the visibility and remediation capabilities into the deployment process itself rather than patching it in after incidents force the issue.</li>
</ul>
<p>The new security landscape also has ramifications for enterprise leadership:</p>
<ul>
<li><b>Cybersecurity leaders</b> should treat AI exposure as a business operating risk, not just a technical security problem. The cyber hygiene floor persists regardless of how well any single control is run.<br>
<br>
</li>
<li><b>Boards </b>should ask whether AI security reporting is built on visibility and detection speed or on a genuine but incomplete picture, since the two can look identical from the outside.<br>
<br>
</li>
<li><b>CIOs and CISOs</b> should measure whether controls are connected across the estate, not only whether each control exists in isolation.<br>
<br>
</li>
<li><b>CFOs </b>should press for a clearer link between cyber exposure, business interruption, regulatory risk and remediation cost so that incremental investment can be directed toward closing the actual gap rather than reinforcing whichever control is easiest to fund.</li>
</ul>
Jump to a section
Executive summary #spy-1
Getting above the cybersecurity hygiene floor #spy-2
Closing the attention gap #spy-3
Filling in with structure and governance #spy-4
Where this leaves enterprise security leadership #spy-5
<h5>Authors<br>
</h5>
