Artificial intelligence is fundamentally altering the landscape of cybersecurity, shifting the daily responsibilities of security teams from repetitive tasks to complex decision-making processes. A new survey from ISC2, a global nonprofit membership association of certified cybersecurity professionals, reveals that AI is not replacing workers but rather demanding a higher level of accountability and judgment from them.

The study, which polled 856 cybersecurity professionals across various industries, found that 65% of respondents have spent more time during the past year deciding when to trust or act on AI-generated recommendations. Additionally, 63% reported spending more time reviewing or validating AI outputs. This trend underscores a growing reliance on AI tools for tasks such as threat detection, incident analysis, and vulnerability assessment, while simultaneously highlighting the need for human oversight and critical evaluation.

Accountability in the Age of AI

Perhaps the most striking finding is that nearly nine in ten respondents (89%) said they have experienced AI recommendations that led to incorrect outcomes. This high rate of error raises serious questions about the reliability of AI systems in a domain where mistakes can have severe consequences. Even more telling, 50% of respondents stated that human decision-makers are ultimately held accountable when these errors occur. This creates a paradox: cybersecurity professionals are expected to act on AI outputs but are still held responsible for any failures, even when those outputs are flawed or poorly explained.

"AI is not replacing cybersecurity professionals; it is changing what the profession requires of them," said Scott Beale, CEO of ISC2, in a statement accompanying the survey. "As AI takes on more repetitive tasks, cybersecurity roles are shifting toward higher-value work, from asking the right questions to validating findings, interpreting outputs, and applying human judgment." This evolution demands a new set of competencies, including the ability to assess AI-generated insights critically and to communicate risks to non-technical stakeholders.

Trust, Stress, and Error Concerns

The survey also paints a nuanced picture of AI's psychological impact. While 48% of respondents said AI has reduced workplace stress—likely by automating routine tasks—32% reported that it has increased stress, often due to the pressure of vetting AI outputs and the fear of undetected errors. The top concerns cited were overreliance on AI recommendations (62% of respondents) and the potential for undetected errors to scale rapidly across systems (61%). These fears are not unfounded; in a fast-moving cyber incident, a single unchecked AI recommendation could trigger a cascade of actions affecting thousands of endpoints.

Moreover, many professionals are expected to operate with insufficient understanding of how AI models work. Nearly a quarter of respondents (24%) said they are often or very often expected to act on AI-generated outputs without fully understanding how those outputs were produced. This lack of transparency, often referred to as the "black box" problem, exacerbates the accountability gap. Without explainable AI, professionals must rely on trust in the system rather than on their own informed judgment.

Governance and Oversight as Critical Needs

In response to these challenges, an overwhelming majority of cybersecurity professionals emphasize the importance of governance and oversight. The survey found that 80% of respondents believe governance frameworks—including clear policies on when to trust AI outputs and when to override recommendations—are critical for effective AI use. Similarly, 82% cited "determining when to trust AI outputs" and 80% "understanding when to override recommendations" as essential skills. These numbers suggest that the industry is moving toward a model of "human-in-the-loop" decision-making, where AI augments rather than replaces human expertise.

Governance is not just about internal policies; it also involves regulatory compliance, ethical considerations, and vendor accountability. As AI becomes more embedded in security operations centers, organizations must establish robust validation practices, invest in explainable AI technologies, and ensure that cybersecurity teams have the authority to question or override AI-driven decisions without fear of repercussions.

Impacts on Cybersecurity Careers and Skills

The survey also sheds light on how AI is reshaping career trajectories and skill requirements. Notably, 56% of respondents said AI has reduced the need for entry-level positions, likely because automation can handle tasks that were previously assigned to junior analysts. However, 53% believe AI is simultaneously creating new types of entry-level roles, such as AI validation specialists or governance analysts. This dual effect suggests that while some traditional roles may shrink, new opportunities are emerging for those who can adapt.

Despite these shifts, foundational cybersecurity skills remain as important as ever. Nearly two-thirds (62%) of respondents said AI has not reduced the need for core cybersecurity skills, including network security, cryptography, incident response, and risk assessment. Instead, AI is creating a demand for hybrid skills that combine technical cybersecurity knowledge with data science, machine learning literacy, and ethical reasoning. "This evolution is not limited to entry-level roles," Beale noted. "It changes how work is distributed across security teams, making continued investment in governance, validation practices, mentoring, and skills development essential at every level."

Almost half (48%) of survey respondents said AI has made them more optimistic about their long-term cybersecurity careers. This optimism likely stems from the perception that AI will free them from mundane tasks and elevate their role to more strategic advisory positions. However, the remaining 52% who are either pessimistic or neutral indicates a significant portion of the workforce remains uncertain about AI's long-term implications.

Building a Resilient AI-Enabled Security Team

To navigate this transition effectively, organizations must take proactive steps. First, they need to invest in training and mentorship programs that help current employees develop the skills to work alongside AI tools. Second, they should implement formal governance structures that define roles and responsibilities for AI oversight. Third, leaders must foster a culture where questioning AI outputs is encouraged, not punished. Finally, partnerships between cybersecurity teams and AI vendors can push for greater transparency and explainability in AI models.

The ISC2 survey clearly shows that the cybersecurity profession is at a tipping point. AI is not a panacea; it is a powerful but imperfect tool that demands more from its users. As one respondent summarized: "The days of just reacting to alerts are over. Now we have to think, validate, question, and then decide. It's harder, but it's also more rewarding."

Source: Network World News