‘Rising threats and under-resourcing for cybersecurity is taking a toll on the people tasked with managing it’: Cyber teams are being pushed to breaking point – and AI is doing little to alleviate strain
An increasingly perilous threat landscape and lack of funding means cyber teams are being stretched too thin
Cybersecurity teams are being pushed to breaking point, according to new research, with sluggish workforce growth struggling to keep pace with a rising tide of attacks.
In a new survey from ISACA, more than one-third (38%) of European IT and cyber professionals said their organization has faced more attacks this year than all of 2025.
Yet despite escalating threats, more than half (56%) said they remain chronically understaffed and underfunded (55%).
Chris Dimitriadis, global chief strategy officer at ISACA, said the survey shows many organizations are struggling to adapt to an increasingly perilous threat landscape.
“The growing gap between rising threats and under-resourcing for cybersecurity is taking a toll on the people tasked with managing it,” he commented. “Too often we are seeing budgets being sunk into crisis response, but there’s still a distinct lack of investment in the workforce, training, and resources needed to prevent attacks and protect organizations in the first place.”
Dimitriadis added that better funding and a “clear path for improving cyber resilience” should be a C-suite priority.
Regardless of repeated warnings over cybersecurity threats, things are expected to deteriorate further, according to ISACA. More than half (54%) of cybersecurity professionals said they expect their organization to experience a serious cyber attack within the next year.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
Cybersecurity teams face evolving threats
The types of threats teams face are also expanding and accelerating, which is placing additional pressure on practitioners. Social engineering attacks ranked as the most common threat encountered by teams, cited by 46% of respondents.
Crucially, these techniques are now being supported and supercharged by AI, creating new risks for teams and allowing threat actors to ramp up and refine targeting.
The findings from ISACA follow analysis from Kaseya earlier this year, which specifically highlighted the use of AI in phishing attacks. Research from the firm warned that AI-generated phishing has now “become the baseline” for threat actors.
All told, ISACA said AI presents “difficult and serious challenges” for cybersecurity teams. Attacks that previously took days or weeks are now being automated at scale, allowing threat actors to “operate at the speed of intent”.
Fighting fire with fire
While AI-powered threats pose a serious risk for teams, ISACA noted that the technology is helping them keep pace with escalating threats.
In a statement, the association said AI’s “exponential growth has proved to be an aid” for practitioners – and use of the technology in frontline operations is expanding rapidly.
More than one-third (37%) of respondents now use AI to automate threat detection and response, for example. While this marks just an 8% increase compared to 2025 figures, it highlights a step in the right direction for teams.
“AI is also being used for endpoint security by 29% and to automate routine security tasks by 35%,” ISACA said in a statement.
Growing stress
This combination of pressures on cyber teams is having a direct impact on workforce morale, according to ISACA. Nearly three-quarters (72%) of respondents said their role is now more stressful compared to five years ago.
Threat landscape complexity was cited as the leading factor behind this, cited by 72% of practitioners. However, other reasons cited include unrealistic expectations and too much work (57%) and a lack of relevant skills training (35%).
Notably, while cyber professionals have raised repeated concerns on this front, ISACA said 21% of companies still take “no action” to mitigate burnout.
Burnout has been a long-running issue in the cybersecurity sector, and one that continues to plague organizations.
An April 2026 survey by the Information Systems Security Association (ISSA) aligns closely with ISACA’s research. Nearly seven-in-ten workers revealed their jobs have become more difficult over the last two years, for example.
Nearly half of cyber professionals said they are considering leaving their job, with 53% citing stress and 34% highlighting poor work-life balance.
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
Ross Kelly is ITPro's News & Analysis Editor, responsible for leading the brand's news output and in-depth reporting on the latest stories from across the business technology landscape. Ross was previously a Staff Writer, during which time he developed a keen interest in cyber security, business leadership, and emerging technologies.
He graduated from Edinburgh Napier University in 2016 with a BA (Hons) in Journalism, and joined ITPro in 2022 after four years working in technology conference research.
For news pitches, you can contact Ross at ross.kelly@futurenet.com, or on Twitter and LinkedIn.
-
AI skills investment could boost the UK economy by £80 billionNews Researchers are calling for a Skills Tax Credit to incentivize employers
-
ShinyHunters claims it hacked Clop ransomware rivalNews An attack on the cyber crime gang could prove dangerous for previous victims if data leaks, experts have warned
-
Anthropic’s Mythos AI tried to dupe devs in social engineering attack, collaborated with other agentsInter-agent collaboration is a serious cause for concern, says security expert
-
Anthropic joins OpenAI in admitting loss of control in cybersecurity testsThe company found Claude AI had escaped containment three times and targeted other organizations
-
'It delivers world-class performance at 50 percent of the cost of leading models': Microsoft unveils cut-price AI for security with latest in-house model launchNews Pairing the MAI security model with GPT-5.4 gives benchmark leading results at half the cost, according to the tech giant
-
The case for the channel in an AI-driven security marketIndustry Insights AI won't replace channel partners; SMB cybersecurity still relies on trust
-
Cisco just launched two cyber-focused small language models: Antares-350M and Antares-1B aim to supercharge codebase analysis – and they run at a “fraction of the compute expense” of popular frontier modelsNews The Antares models unveiled by Cisco aim to cut costs in codebase analysis
-
Cyber professionals are flocking to AI tools, but they’re getting tired of fixing mistakes and reviewing outputsNews Cyber pros are spending significantly more time validating AI outputs and deciding when to trust AI-generated recommendations
-
'It’s a marker of where extortion tradecraft is heading': Cyber experts say they've identified the first case of ‘agentic ransomware’ – but there’s a catchNews While the JadePuffer ransomware has alarm bells ringing, it still needed a human in the loop
-
Three quarters of firms have halted AI projects over safety and security concerns – and cyber pros think things will deteriorate as models like Claude Mythos improveNews AI has become a leading problem for enterprise security teams, they can't automate their way out of trouble