Coverage
What are you protecting?
25%
Relentless Defense
A global report about cybersecurity in the AI era.
We asked 8,000 security practitioners what they would change in their defense today.
Six in ten named an organizational barrier rather than a technical limitation.
With AI reshaping the threat landscape, we wanted to understand how well organizations can actually defend themselves.
Speed
How fast can you defend?
25%
Friction
What gets in your way?
50%
Friction carries half the score because practitioners pointed us there. We asked them what would’ve made the biggest difference in their last incident, and six out of ten pointed to something in their organization that slowed them down — disconnected teams, fragmented data, skill gaps.
We found four kinds of defenders, grouping them on a total defense score that combines coverage, speed and friction.
8%
39%
41%
12%
Relentless
Established
Reactive
Exposed
Relentless Defenders continuously optimize their systems and how they work to defend against an ever-changing threat landscape.
Relentless Defenders work smarter and prioritize budgets differently. That’s something any organization can do.
Knowing what to defend isn't the same as being able to defend it
Coverage
Security teams know what to protect. Few protect consistently.
The goal isn't simply to identify risks. Organizations need the ability to act on them quickly and consistently. Visibility without enforcement creates a false sense of security.
Chief Security Officer, India
Global average
Relentless Defenders
Overall score on Coverage
71% 87%Consistent controls across environments
44% 74%Strong identity controls across employees
44% 70%Active protection across 95% of endpoints (laptops, mobile devices, servers and IoT devices)
20% 51%Comprehensive visibility across AI tool usage
38% 61%Speed
Attacks move in minutes. Few can respond fast enough.
Earlier, faster detection combined with a clear, well-practiced incident response plan and defined communication roles would have most improved the team’s response.
Head of Security, Switzerland
Global average
Relentless Defenders
Overall score on Speed
71% 87%Can update controls in real time
14% 45%Take a day or longer to update controls
60% 21%Can have new controls live within six months
21% 52%Continuous automated threat detection as the defaults
30% 69%Friction
Organizations are getting in their own way.
Friction is where all organizations struggle the most. It gets in the way even when teams have the tools and the ability to act.
Relentless Defenders are the ones who managed to reduce friction and work as one team.
Having a more centralized communication protocol would have made the biggest difference. Information was initially fragmented across different teams, and single source of truth would have streamlined our decision making and allowed for a much faster, more coordinated response during the critical first hour.
Director of Security, Philippines
Global average
Relentless Defenders
Overall score on Friction
57% 81%Operate as one coordinated team, with shared visibility and tools (across security, network and infrastructure)
41% 83%Have clear metrics, aligned with the business
58% 95%Have unified security data, one real-time view
58% 98%Every second counts. Friction costs.
Disclaimer: This is a visual representation of a security incident scenario for illustrative purposes only. It does not depict an actual Cisco product interface or screenshot.
Anomalous lateral movement detected on FIN-WKS-0442. Pattern matches known ransomware precursor behavior
Recommended action: Isolate host. Confidence: 71%. Awaiting human authorization.
You're the incident lead. The agent is waiting on you.
AI is making the environment harder, and the defenders sharper
Two things can be true at the same time. More than a third of incidents in the last year involved AI. And defenders who use AI report faster detection, faster response, less operational burden.
Still, fewer than half of organizations have deployed AI-powered capabilities extensively in any single domain, because they are still not confident they can control AI. Here is where the Relentless Defenders cut ahead.
Relentless Defenders are deploying AI more, but they also have more controls in place
Deploy
Have deployed AI agents extensively
Relentless Defenders
65%Other
Defenders
Control
Have governance over their AI agents
Relentless Defenders
86%Other
Defenders
Trust
Are confident they’d detect a compromised agent
Relentless Defenders
77%Other
Defenders
And they’re the ones seeing the better payoffs
Faster detection
AI improved detection speed by more than 50%
Relentless Defenders
79%Other
Defenders
Faster response
AI improved response and remediation speed by more than 50%
Relentless Defenders
78%Other
Defenders
Reduced burden
AI significantly reduced operational burden
Relentless Defenders
51%Other
Defenders
Better at everything, everywhere, all at once
Relentless Defenders increased spending and reported better outcomes
71% saw incidents go down
The global average also increased spending but saw mixed results
41% saw fewer incidents
45% saw incidents rise or stay the same anyway
Most organizations are spending more on cybersecurity, but not everyone has the same outcome. The Relentless Defenders are better at organizing themselves. Whatever the capability, from AI and identity to visibility and vulnerability management, it only holds if the team uses it consistently and friction doesn't weigh them down.
Relentless Defenders
83%
Other Defenders
37%
They operate as one team — a single coordinated security function with shared visibility across security, network and IT
Relentless Defenders
63%
Other Defenders
32%
They invest in people — heavily upskilling the team they already have
Relentless Defenders
72%
Other Defenders
41%
They apply controls consistently across every environment and every user — data, network, applications, including contractors, third parties, admins and developers
What needs to change
In practitioners’ own words
-
Fix ownership before you fix tools.
The biggest difference would have been clearer communication channels. During the incident, there was confusion about who was leading the response, which delayed our actions.
Director of Security, Netherlands -
Build one picture, not multiple.
Integrate security data across silos for real-time, unified visibility to enable faster, smarter response.
Director of Security, Canada -
Rehearse, don’t just document
Make cybersecurity a continuous, practiced discipline, not just a checklist.
Chief Security Officer, Malaysia -
Let AI take the first ten minutes.
Predictive patching — AI analyzing global threat telemetry to predict which vulnerabilities are likely to be weaponized first.
CISO, United States -
Design for the easiest path, not just the compliant one.
Designing security tools that work with human psychology, not against it. Making the secure way the easiest way to do a job.
Chief Security Officer, Singapore
The advantage belongs to defenders who keep adapting
-
01
Relentless Defenders are optimizing the whole system.
-
02
Established Defenders are scaling on solid foundations.
-
03
Reactive Defenders are connecting fragmented capabilities.
-
04
Exposed Defenders are still building the basics.
Where does that leave you?
Select your market to see how organizations score and what’s holding them back.
Scorecard
Global
Overall Score
64/100Relentless
8%
Friction
57%
Coverage
72%
Speed
71%
Additional resources
-
8 Years of Security Research in 8 Weeks: Transforming Cybersecurity with AI
Cisco is sharing our insights from scanning 1.8 billion lines of code to help tip the scale in favor of cyber defenders through actionable, AI-driven precision.
-
In the AI Era, Cyber Defense Needs a New Playbook
AI is changing the speed of cyber risk. Cisco's executive brief outlines how organizations need to move from current operating models to continuous defense.
-
The Hidden Costs of Downtime 2026. A $600 Billion wake-up call
Discover the financial impact of downtime in 2026. Research shows a $600 billion annual cost to the Global 2000. Download the report to protect your business.
-
No time to wait: The accelerating impact of AI on campus and branch networks
Research finds enterprise networks under increasing strain and AI-driven traffic set to triple in three years, as genAI and Agentic AI deployments expand.