Most Security Teams Are Holding Back on AI Agents for Cyber Defence

Companies are investing more than ever in agentic AI as a cyber defence tool, yet most security teams remain cautious about using it. Flashpoint's Enterprise Threat Intelligence Report: 2026, published on October 13, found that just 25% of cybersecurity teams are actively using agentic AI tools as part of their defence strategy. This is despite widespread discussion of the risks posed by offensive AI.

Of the remaining teams, 20% are running a closed pilot, and 35% are looking at adoption within the next 12 to 24 months. Another 20% have no plans to test the technology. Those using or piloting AI agents mostly assign them tasks such as information retrieval and alert prioritisation, along with more active work like blocking IP addresses, updating blacklists and monitoring suspicious traffic. Some organisations allow automated actions that directly affect security operations, but many are wary of giving an agent that much decision-making authority.

The concerns are practical. Some professionals worry about agents making wrong decisions, with one respondent saying, "An agent that's confidently wrong is worse than one that's slow." Other hurdles include data leakage, auditability, regulatory requirements, cost and how much control agents should have over security workflows. Flashpoint CEO Josh Lefkowitz said security leaders are ready to invest, but "aren't swayed by the hype."