89% of IT Leaders Concerned About GenAI’s Impact on Cybersecurity, Sophos Survey Reveals

Sophos, a leading global cybersecurity solutions provider, has released a new report titled “Beyond the Hype: The Business Reality of AI for Cybersecurity.” The survey, which gathered insights from 400 IT leaders, highlights both the opportunities and risks of integrating generative artificial intelligence (GenAI) into cybersecurity strategies.

The Rising Concerns Over GenAI in Cybersecurity

Despite 65% of surveyed IT leaders acknowledging their adoption of GenAI in cybersecurity, an overwhelming 89% expressed concern that flaws in GenAI tools could introduce significant security risks. The apprehension stems from potential vulnerabilities, inaccuracies, and an over-reliance on AI-driven systems, which could leave organizations exposed to cyber threats.

In a complementary study, “Cybercriminals Still Not Fully on Board the AI Train (Yet),” Sophos X-Ops found that while there has been some experimentation with AI among cybercriminals, skepticism still dominates. Many cybercriminal forums continue to focus on traditional hacking methods like malware development and network access trading rather than AI-powered tools.

The Role of Human Oversight in AI-Driven Security

Chester Wisniewski, Global Field CTO at Sophos, emphasized the importance of human oversight in AI-driven security measures. He stated, “As with many other things in life, the mantra should be ‘trust but verify’ regarding generative AI tools. We have not actually taught the machines to think; we have simply provided them the context to speed up the processing of large quantities of data.” Wisniewski underscored that while AI has the potential to significantly accelerate security workflows, human intelligence remains crucial to ensuring effectiveness and accuracy.

The Beyond the Hype report reinforces this, highlighting that 99% of organizations assess the quality of AI capabilities in cybersecurity tools before adoption. However, the lack of transparency from vendors and limited AI knowledge among IT teams create a blind spot, making risk assessment difficult.

How Cybercriminals Are Experimenting with AI

While cybercriminals have been slow to fully adopt AI, some have started using generative AI for low-level tasks such as:

• Automating spam and phishing emails (Sophos X-Ops Report)
• Using AI-driven translation tools to improve social engineering campaigns targeting multiple languages
• Experimenting with AI-generated text and images for fraud schemes, particularly in Chinese-language scams known as ‘sha zhu pan’ fraud

Despite these developments, many AI-related discussions on cybercrime forums remain aspirational rather than practical. Cybercriminals continue to prioritize tried-and-tested hacking techniques over the speculative use of AI for more complex attacks.

The Risk of Over-Reliance on AI

Sophos’ survey found that AI is embedded in some capacity within the cybersecurity infrastructure of 98% of organizations. However, 87% of IT leaders voiced concerns over an over-reliance on AI, fearing that it could lead to a decline in cybersecurity accountability. The concern is that as AI tools become more advanced, human decision-making and oversight could diminish, increasing the likelihood of security lapses.

A recent IBM report highlights the rise in identity-based cyberattacks, revealing how attackers are increasingly using AI-driven strategies to compromise security in the Middle East and Africa.

The Beyond the Hype report further emphasizes this risk, with 84% of IT leaders concerned about the pressure to reduce cybersecurity professional headcount due to unrealistic expectations of AI replacing human expertise.

The Impact of AI on Workforce and Burnout

The survey also revealed differing priorities in GenAI adoption across various organizational sizes:

• Large Enterprises (1,000+ employees): Prioritize improved security protections.
• Small Businesses (50-99 employees): Rank reducing burnout among cybersecurity professionals as the top benefit.

However, across all organizations, 84% of leaders worry about pressure to reduce cybersecurity staffing due to unrealistic expectations of AI’s ability to replace human operators. This concern highlights the industry’s struggle to balance AI efficiency with the indispensable expertise of cybersecurity professionals.

A growing number of cybersecurity professionals advocate for Human Risk Management (HRM) as a crucial component in addressing cybercrime, emphasizing that technology alone is not enough.

Key Insights from the Beyond the Hype Report

• Unclear Cost Structures: 75% of IT leaders find it challenging to quantify the costs of integrating GenAI into cybersecurity products.
• Cost vs. Savings Debate: While 80% anticipate that GenAI will drive up the cost of cybersecurity tools, 87% believe that long-term savings from AI efficiencies will offset these expenses.
• Financial Risk Awareness: Despite expectations of price increases, many organizations see GenAI as a way to lower overall cybersecurity costs, with 87% of respondents believing the savings will fully offset the investment.
• Operational Risks: AI’s widespread use may lead to over-reliance, with 87% of organizations concerned about a lack of cybersecurity accountability if AI is allowed to operate without human oversight.

Meanwhile, Sophos has expanded its Managed Detection and Response (MDR) services, enhancing AI-driven workflows to improve threat detection and response capabilities.

Final Thoughts

As organizations continue integrating AI into their cybersecurity strategies, the Sophos survey underscores the need for a balanced approach. While GenAI offers promising advancements, its risks—ranging from security vulnerabilities to workforce reductions—necessitate careful management and human oversight. The findings reinforce that AI should augment, rather than replace, cybersecurity professionals to maintain a robust security posture.