Only 25 percent actively use agentic AI in cyber defense, Flashpoint survey finds
A new Flashpoint survey shows a clear gap between leadership's willingness to invest and practitioners' caution: 35 percent expect budget increases of over 10 percent, while only a quarter have agents in operation.
It is not a lack of money or interest keeping agentic AI out of cyber defense. It is trust in what the agents actually do when given the power to act.
In The Enterprise Threat Intelligence Report: 2026, published on October 13, 2026, the analysis firm Flashpoint finds that only 25 percent of cybersecurity teams actively use agentic AI tools as part of their active cyber defense. At the same time, the survey paints a picture of an industry on the move: 20 percent of respondents are running a closed pilot project, 35 percent are examining possible adoption over the next 12 to 24 months, and 20 percent have no plans to test agentic AI at all (Infosecurity Magazine).
The budgets point upward — even without deployment
The contrast lies in the numbers on resources. 35 percent of respondents expect their cybersecurity budget to increase by more than 10 percent over the next 12 months, a further 15 percent expect an increase of up to 10 percent, and not a single respondent expects a decrease (Infosecurity Magazine).
Flashpoint's founder and CEO Josh Lefkowitz describes the situation as follows:
"The opportunity for agentic AI on the defense side is significant, and our research shows security leaders are ready to invest. But they are not swayed by the hype." (Infosecurity Magazine)
It is worth noting that this is a claim from the company behind the report, which itself sells threat intelligence to the market it is surveying. But it points to the core: the willingness to invest exists; adoption lags.
What teams actually let the agents do
Among those using or piloting AI agents, the tasks fall into two categories. The low-risk ones are information retrieval and alert prioritization — classic assistant tasks where a mistake costs time, not an incident. The more active tasks include blocking IP addresses, updating blacklists, and monitoring suspicious traffic (Infosecurity Magazine).
It is in this second category that the caution has concrete meaning. An agent that blocks an IP address can, at worst, cut a legitimate customer or a critical service off the network. An agent that updates a blacklist based on a wrong conclusion changes the organization's actual security posture — in one direction, without anyone approving the change.
Why the teams are holding back
Infosecurity Magazine's summary of the report points to several hurdles: concern that the agents will make wrong decisions, data leakage, auditability, regulatory requirements, costs — and the question of how much control the agents should have over security workflows (Infosecurity Magazine).
One anonymous respondent in the survey perhaps put the whole matter most precisely:
"An agent that's confidently wrong is worse than one that's slow." (Infosecurity Magazine)
It is worth emphasizing that these hurdles are listed, but not ranked with figures in the available source material. We know the teams are holding back, but not to what extent each individual concern weighs against the others. Nor do we know anything about the survey's methodology — the number of respondents, composition, or geography are not described in the available information, and all the figures reach us via Infosecurity Magazine's secondary coverage, not from the primary report.
The context that justifies the caution
Independently of the survey, there are relevant examples of what can go wrong with autonomous agents.
The security firm Mandiant's report AI Risk and Resilience, based on observations from Mandiant and Google Threat Intelligence Group, warns that a poisoned data source, a model dependency, or an extension hook can transform a trusted agent into a channel for internal reconnaissance, lateral movement, or autonomous escape from a sandbox (Help Net Security).
Mandiant also brings a case study that involves no attacker at all: An accounting agent fell into a runaway execution loop and made more than 15,000 costly API calls in under an hour, generating roughly $50,000 in cloud charges (Help Net Security).
This is not the same type of risk as a security agent blocking the wrong IP — but it illustrates the underlying problem: autonomous systems operating at the intersection of domain networks, payment systems, and cloud solutions can escalate errors faster than humans can react. In cyber defense, where the agent's actions directly affect the network, the stakes are higher.
The time that is not on the defenders' side
The caution still costs something. According to data from VulnCheck, the median time from a CVE's publication to confirmed exploitation has fallen from 120 days in 2025 to 80 days in the first half of 2026 — a reduction of one third (CSO Online).
VulnCheck suggests that this potentially reflects the role of AI agents in attacks — an interpretation, not an established causal relationship. But the direction points the same way as the broader discussion about offensive agentic AI: the attack side is getting faster, while the defense side is still in the pilot phase.
Open questions
What remains to be answered is not whether agentic AI is coming to cyber defense — the pilots and the survey's 12–24-month horizons suggest it is, for a significant share. The question is where the line falls for human involvement. Should an agent be able to block an IP address on its own? Does it need approval from an analyst? How is a decision made in 300 milliseconds audited?
The Flashpoint report suggests that security leaders are asking these questions — but the available material does not provide the answers. Until vendors can demonstrate auditable decision paths and clear human checkpoints, most of the market remains in what is probably one of the most self-aware implementation strategies in the history of cybersecurity: examining instead of installing.