Only 8% of Organizations Regularly Practice AI Incident Response, ISACA Finds

Artificial intelligence is becoming part of everyday cybersecurity operations.

Organizations use it to support threat detection, automate routine security tasks, and manage increasingly complicated environments.

But a new report from ISACA raises an important question:

Are organizations preparing for security incidents involving AI itself?

According to ISACA's 2026 State of Cybersecurity research, only 8% of organizations represented in the survey regularly conduct AI-specific incident-response exercises.

Meanwhile, 64% have not conducted any AI-related incident-response exercises.

The data show that AI adoption is outpacing some organizations' preparations to manage its risks. ISACA

What did ISACA find?

ISACA's annual research gathered responses from more than 1,800 cybersecurity professionals worldwide.

The survey examined staffing, budgets, cybersecurity threats, operational obstacles, and AI's growing role in security work.

Several findings stand out.

Only 8% reported that their organizations regularly conduct AI-specific response exercises.

Another 17% said AI incidents are included inside broader cybersecurity exercises.

Sixteen percent reported plans to conduct such exercises in the future.

The survey also found that 48% of respondents either did not know whether their organization had an AI incident-response playbook or said no such playbook existed.

These are survey findings, not a comprehensive census of every organization. Nevertheless, they provide a useful picture of the preparedness challenges reported by information security professionals. ISACA

AI is already part of cybersecurity work.

The preparedness gap is especially notable because AI is no longer an unfamiliar technology within security operations.

ISACA found that only 13% of respondents reported not using AI in their security operations.

Among respondents using AI, common applications included automating threat identification and response, standard security tasks, and endpoint security.

The survey also found that cybersecurity experts are progressively involved in AI implementation and governance.

Fifty-one percent reported involvement in developing, onboarding, or implementing AI solutions, compared with 40% in 2025.

That means security teams are not simply protecting organizations that use AI.

Many are helping introduce and govern those systems themselves. ISACA

Why is AI incident response different?

Traditional cybersecurity incident-response programs address familiar risk categories, including unauthorized access, compromised systems, malware, and data exposure.

AI can bring in extra considerations.

An organization might need to investigate whether an AI system exposed sensitive information, whether an AI-enabled workflow produced an inappropriate action, or whether employees used an AI tool in ways that created security or privacy problems.

These situations can overlap with existing cybersecurity processes.

But they may also require different inquiries about accountability, system operation, oversight, and the ability to suspend or modify AI-enabled operations.

The challenge isn't necessarily creating an entirely separate security program.

It's making sure that existing processes account for the technologies the organization actually uses.

The skills gap cybersecurity candidates should notice

One of the most interesting findings concerns LLM security operations.

ISACA reports that 45% of respondents identified LLM SecOps as a cybersecurity skills gap.

That represents an increase of 12 percentage points from 2025 and 21 percentage points from 2024.

The finding is relevant to people pursuing professional certifications because it highlights how cybersecurity responsibilities continue to evolve.

A candidate studying security operations, risk management, governance, or incident response may increasingly encounter workplaces where AI systems are part of the environment being protected. ISACA

That doesn't mean every cybersecurity professional needs to become an AI engineer.

It does suggest that understanding AI-related risks and governance may become a useful complement to established cybersecurity knowledge.

What does this mean for CISM and CISSP candidates?

For CISM candidates, the research is particularly relevant to information security governance, risk management, and incident management.

The challenge isn't simply identifying a new threat.

It's deciding how an organization should prepare for that threat, assign responsibility, establish oversight, and evaluate readiness.

For CISSP candidates, the findings connect naturally toward broader security and risk-management principles.

AI systems present new scenarios, but many foundational questions remain familiar.

• What information needs protection?

• Who is responsible for decisions?

• How are risks evaluated?

• How does an organization determine whether its controls are working?

These are valuable questions regardless of the technology involved.

Candidates should still follow the current official exam outlines rather than assuming every newly reported industry trend is immediately added to a certification exam.

What can organizations learn from the findings?

One useful takeaway is that adopting a technology and preparing for its failure are different activities.

Organizations may have policies governing AI use without having practiced what occurs when something goes wrong.

A useful starting point is to examine whether existing risk-management and incident-response processes adequately cover AI-enabled systems.

The National Institute of Standards and Technology's AI Risk Management Framework delivers a broader structure for reviewing AI-related governance and risk.

Its four functions—Govern, Map, Measure, and Manage—can help organizations think systematically about AI risk throughout the technology lifecycle. NIST

What should certification candidates take away?

The ISACA findings are a signal that professional development doesn't stop at passing an exam.

Cybersecurity certifications deliver frameworks and fundamental knowledge.

Industry research helps professionals understand where those frameworks are being applied and where new challenges are emerging.

For candidates preparing for CISM, CISSP, CISA, or other cybersecurity credentials, AI governance and incident-response readiness are useful topics to follow.

Not because every cybersecurity professional needs to specialize in AI.

But since understanding emerging risks is part of becoming a well-rounded security professional.

The next generation of cybersecurity work will require people who understand both established security principles and the systems organizations are adopting today.