ISACA: 71% of Organizations Have Never Run an AI Incident Response Exercise

ISACA's 2026 State of Cyber report found that 71% of organizations have not run any AI incident response exercises, only 3% have mature AI-specific runbooks and 30% have not started preparing at all. Meanwhile 37% already use AI to automate threat detection and response, up eight percentage points from 2025.

• 71% of organizations have never rehearsed AI incident response; 3% have mature runbooks
• 37% use AI for automated threat detection and response, up 8 points year over year
• 54% of security pros helped implement AI tools, 60% contributed to AI policies
• 56% of security teams are understaffed and 55% underfunded