Thirty-eight percent of European IT and cybersecurity professionals say their organisation faced more cyberattacks this year than last, yet more than half report their teams are still understaffed (56%) and underfunded (55%), according to ISACA's 2026 State of Cybersecurity research.
The research also finds that 54% expect their organisation to face a cyberattack within the next year. Social engineering, the manipulation of people rather than technical systems, is now the most commonly reported attack type among European organisations, cited by 46% of respondents, with AI increasingly augmenting attacker capabilities in this category.
Seventy-two percent of practitioners report their role is more stressful now than five years ago, with the increasingly complex threat landscape cited by 72% as the direct cause. Unrealistic expectations and excessive workload are cited by 57%; insufficient training and skills by 35%. Despite this, 21% of organisations still take no action to mitigate burnout.
Preparedness for AI-specific incidents is the sharpest gap. Almost three-quarters (71%) of organisations have not conducted any AI-related incident response exercises. Just 3% have mature, formal runbooks for AI-specific incidents, and 30% have not begun to address their response to AI-related incidents at all.
AI is also expanding the capabilities of security teams: 37% now use AI to automate threat detection and response, up eight percentage points from 2025; 35% automate routine security tasks; and 29% use it for endpoint security. Sixty percent of cyber professionals have been involved in developing policies governing AI use within their organisation. European security teams can access the full ISACA 2026 State of Cybersecurity research through ISACA's website.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
