If we want to know where the industry is actually going, we have to look past the firewalls and focus on the people running them.

The Elephant in the Server Room: Burnout

Let’s start with arguably the most honest takeaway: everyone is exhausted. Sixty-eight percent of pros say their jobs are more stressful today than they were just five years ago. Why? Because threat actors are simply outpacing team capacity. It’s a relentless game of catch-up that’s starting to take a toll.

This isn’t just about “bad days” at the office; it’s a full-blown retention crisis. Half of the organizations surveyed are struggling to keep the staff they have. And when you look at why people are walking away, the top two reasons are high stress (52%) and a lack of clear career growth (47%). With 60% of organizations reporting unfilled positions, we’re essentially asking a shrinking group of people to defend an ever-expanding digital frontier. We aren’t losing people because they can't do the work — we’re losing them because the work has become unsustainable.

“Nearly half of the industry has no “playbook” for an AI compromise or a sensitive data leak through an LLM.”

Soft Skills are the New Hard Skills

For a long time, the “perfect” candidate was a technical wizard who lived in the command line. But the 2026 data shows a massive shift in what managers actually want. Today, adaptability is the number one trait employers look for — even beating out technical experience.

There’s a growing realization that technical skills have a shorter shelf life than they used to. As tools evolve, the ability to think critically and solve problems under pressure is what actually keeps a company safe. The irony? These “soft skills” are the biggest gap in the workforce right now (57%).

We’re also struggling to keep up with the “technical treadmill.” The skills gap for “LLM SecOps” — the specialized knowledge needed to secure Large Language Models — jumped from 33% to 45% in just a year. To cope, 35% of teams are now leaning on AI as their primary way to close these technical gaps. It’s a smart bridge to a more automated future, but it’s leading us into a strange paradox.

The AI Paradox: High Speed, No Brakes

AI adoption isn’t a trend anymore; it’s the baseline. Only 13% of teams aren’t using it yet. We’re using AI for the heavy lifting — threat detection, routine tasks, and endpoint security. But while we’re building our shields with AI, we’re remarkably unprepared for when the bad guys use it to sharpen their swords.

Here is the scary part: only 8% of organizations are actually regularly practicing what to do when an AI incident strikes. Nearly half of the industry has no “playbook” for an AI compromise or a sensitive data leak through an LLM. It’s like driving a high-performance race car without checking to see if the brakes work. Among companies that were compromised this year, 16% believe those specific attacks were AI-driven. That lack of preparedness is a ticking time bomb.

A Seat at the Table

It’s not all bad news. Cybersecurity is finally getting the respect it deserves at the top. Three-quarters of organizations now have a CISO. While many still report to the CIO, a full 25% now report directly to the CEO. In companies without a CISO, the most common line of reporting is to the CTO.

This shift is why 3 in 4 respondents feel their security strategy finally aligns with the business goals. We’re no longer the “department of no” hidden in the basement. But — and there’s always a but — that respect hasn’t fully reached the checkbook. Half of the industry still feels underfunded, and staffing shortages remain the greatest hurdle to doing proper risk assessments.

The Path Forward

ISACA’s 2026 State of Cyber report makes one thing very clear: we cannot “tool” our way out of this. More software won’t fix a staffing shortage, and a faster processor won’t stop social engineering — which is still the leading cause of breaches (38%).

The organizations that survive the next year will be the ones that treat cybersecurity as a human-centric discipline. That means investing in soft skills, creating workloads that don’t fry people’s brains, and moving past the AI hype to actually practice for the day it fails. The tech is moving at breakneck speed, but the most important part of the security stack is still the person behind the keyboard.