According to the “2026 State of AI Agents in Security and Network Operations” report, prepared by Cybersecurity Insiders and Netskope based on a survey of 921 security, network and IT professionals, security and network operations teams detect incidents more effectively, but do not always have the necessary resources to investigate and resolve them. The study quantifies this gap and analyzes the potential for AI agents to reduce it through appropriate governance.
In fact, 81% of teams say their workload has grown over the past year, but only 11% are able to keep up consistently. As a result, 42% of organizations leave alerts, cases or tickets uninvestigated, and 24% admit that sensitive data, systems or users are left exposed for longer than necessary.
Main conclusions of the study
Some of the most interesting data revealed by the report are the following:
· More pending work: 45% attribute burnout, turnover or unfilled vacancies to operational limitations; 40% resolve incidents more slowly than expected.
· Gap between detection and resolution: 60% indicate that they have improved their ability to detect threats or network problems in the last two years, compared to 49% who see improvements in response and resolution.
· Fragmented tools: only 9% consider their security and networking tools to be highly integrated; 51% identify the dispersion of information as the main obstacle to resolving incidents quickly.
· Expanding AI agents: 29% already use them in production, 56% consider using them to expand the equipment’s capacity and 47% plan to incorporate them into specific workflows over the next year.
· Limited autonomy: 68% would not allow an agent to make operational changes alone: 38% discard those changes and 30% require prior human approval.
· Pending governance: only 9% report having very high confidence in their ability to govern AI agents; 45% admit to having little or no confidence.
Triage as a starting point
The report identifies alert classification and prioritization—or triage—as one of the most promising initial applications. 46% of respondents consider it an important source of manual labor, another 46% feel comfortable delegating this task to an agent, and 48% expect to obtain significant value from it. This usage allows you to organize cases and gather evidence for review without giving the agent permission to modify systems.
Adoption is still in an early phase: 53% of organizations are evaluating or testing agents and 7% of the total have extended them to various workflows. For this technology to truly reduce the burden on analysts, the study recommends measuring the time saved, the cases investigated and the results obtained against a documented starting situation.
The potential of agents also depends on their access to reliable information. Respondents indicate as priorities that agents share the context of each case between tools and teams (55%), that they integrate openly with existing systems (51%) and that they are subject to a common governance model (46%).
Security teams detect incidents more effectively, but do not always have the resources necessary to investigate and resolve them
The study proposes moving forward gradually: assigning each agent an identity and limited permissions, maintaining a common record of evidence and actions, requiring approval for high-impact changes, and defining who can stop their activity and direct recovery in the event of an error. Delegating tasks can expand operational capacity, but the responsibility for decisions still lies with individuals.
Recommendations for operating with agents
· Measure the benefit. Start with a limited process and compare the time saved and the cases investigated with the initial situation.
· Ensure the context. Verify sources and gather relevant data in the same case.
· Maintain traceability. Record evidence, approvals, actions and results under a single identifier until closing.
· Limit autonomy. Give each agent their own identity and minimal access; Require human approval for high-impact changes.
· Assign responsible persons. Define who authorizes exceptions, can stop the agent, and directs recovery.
· Test before expanding. Rehearse manipulated inputs, failures and recovery; increase permissions only if it demonstrates safety and effectiveness.
In conclusion, AI agents can help security and network teams investigate more cases and reduce manual tasks, but their adoption should not be measured only by the speed of execution. The report emphasizes that its value depends on verifiable results, shared information and clear limits of action. The priority is to expand operational capacity without giving up human supervision or responsibility for each decision.
The study “2026 State of AI Agents in Security and Network Operations” was prepared by Cybersecurity Insiders with the support of Netskope based on a survey conducted in 2026 among 921 professionals. The results reflect the experiences and expectations stated by the participants.
