Artificial intelligence is transforming the cybersecurity landscape, accelerating both the capabilities of defense teams and the activity of cybercriminals. However, having more technology does not guarantee an effective response.
The readiness of organizations also depends on their ability to coordinate professionals, share information and make decisions without delays. This is highlighted by Cisco’s Relentless Defense report, which places the proportion of Spanish organizations that meet the conditions to be considered “relentless defenders” at just 8%.
The study, prepared from a survey of 8,000 security professionals from 30 countries, including 200 participants in Spain, evaluates the ability of companies to protect their environments, detect threats, respond to incidents and remediate their consequences. To do this, it considers three dimensions: coverage, speed and operational friction, the latter understood as the obstacles that slow down the performance of the teams.
AI-powered attacks
The results reflect a worrying scenario. 93% of the Spanish organizations consulted have suffered at least one serious cybersecurity incident that has affected their activity during the last 12 months, compared to 91% of the world average. Furthermore, 32% of these incidents in Spain were related to attacks powered by artificial intelligence, a proportion that reaches 35% on a global scale.
Only 8% of Spanish companies belong to the category of “relentless defenders”
The average score of Spanish companies is 62 points out of 100, two less than the 64 points of the international average. Although the data shows the difficulties in responding to an increasingly complex threat environment, the percentage of organizations that stand out for their preparation is especially revealing: only 8% reach the category of Relentless Defenders, both in Spain and in all the countries analyzed.
The problem lies in coordination
For Ángel Ortiz, director of Cybersecurity at Cisco Spain, one of the main challenges is to overcome the internal barriers that prevent acting together. “AI is forcing us to transcend borders between areas that previously did not require connection: technology, security, human resources, legal and ethics,” he points out.
In his view, the organizations that advance are those that break down silos and remove internal barriers so that the right people can jointly make the right decisions from the beginning. The objective is to prioritize a unified defense and prevent the organizational structure from becoming an obstacle to an attack.
The data supports this concern. Only 39% of Spanish companies affirm that security, network and information technology professionals work as a single team, with shared tools and visibility. On a global scale, the proportion rises to 41%. This lack of coordination makes both the detection of threats and the subsequent response difficult.
Fragmentation also affects access to information. 35% of Spanish professionals surveyed acknowledge that they spend more time collecting and correlating data from different systems than dealing with threats. Additionally, 39% say they lose access to critical information because it is out of reach.
Added to these obstacles are the difficulties in translating technical metrics into business language. 41% of participants in Spain consider that the indicators they use are too technical to convince management, while 38% have problems translating business metrics into useful information for decision making. Cybersecurity, therefore, continues to need a greater connection with the organization’s priorities and objectives.
AI accelerates defense, but adoption remains limited
Artificial intelligence is already bringing tangible benefits to security professionals. Seven out of ten surveyed in Spain say that AI has improved the speed of threat detection by at least 25%. Regarding response and remediation, 86% report improvements of that magnitude, compared to 82% for the global average.
“We cannot continue operating on a human scale when AI attacks us,” says Ángel Ortiz, director of Cybersecurity at Cisco Spain
However, these advantages have not been widespread. Only 36% of Spanish organizations have widely implemented AI-based security capabilities. Adoption is highest in network security, while security operations and research have a lower degree of deployment, despite being areas where automation could significantly alleviate the workload.
The situation is especially significant in the case of AI agents. Only 25% of Spanish companies have widely implemented these agents in security operations. Additionally, only 46% are confident in their ability to detect and respond to a compromised AI agent. Data exposure, compromised systems, and third-party management are among the concerns holding back adoption.
The challenge is, therefore, to take advantage of AI to strengthen defenses without opening new avenues of exposure. This requires establishing specific controls, protecting both the use and development of these technologies and ensuring that employees can use them safely.
Less friction and more preparation
What distinguishes the best prepared organizations? According to Cisco, relentless defenders are not necessarily those who invest the most, but rather those who make the best use of their resources and get their teams to work in a coordinated way. 83% of these organizations operate as a single security team, with visibility and tools shared between security, networks and infrastructure, compared to 37% of the rest.
They also stand out in their ability to control AI: 86% apply consistent controls to AI agents and non-human identities, compared to 37% of other organizations. Likewise, 77% express great confidence in their ability to detect and respond to a compromised agent, compared to 39% of the rest.
The difference is also seen in the results. Among companies that increased their investment in security, relentless defenders were almost twice as likely to reduce incidents in Spain: 71%, compared to 34% of the rest of the organizations that increased their spending.
To improve these indicators, Ortiz defends the need to define responsibilities, adapt technology to the organization – and not the other way around -, move towards a unified vision and practice the response through exercises that allow checking if the procedures work. Automation and AI must also help collect and correlate information to accelerate detection and reaction.
“We cannot continue operating on a human scale when AI attacks us,” warns the manager, who considers it essential to incorporate artificial intelligence into security measures and reduce the fragmentation of tools and processes.
Relentless advocates are most often found in the technology and software, financial services, manufacturing, and retail sectors. They typically work in organizations with at least 1,000 employees. Their security operations are typically well-resourced, often with more than 50 security professionals.
The conclusion of the report prepared by Cisco is that cybersecurity must be addressed as a transversal responsibility, linked to governance, risk management and business decisions. In a scenario where attacks can be executed at machine speed, the advantage will not only depend on having better tools, but on getting technology, processes and people to act as a coordinated system.
