- Flashpoint's 2026 threat intelligence report found 25% of surveyed security teams actively use agentic AI for defense, while 20% run closed pilots.
- The report suggests boards appear keen: 35% of respondents expect their overall cybersecurity budget to rise by over 10%, and none expect a cut.
- Leaders should decide which actions an AI agent may take alone, which need approval, and how each action is logged.
The hard part of putting AI into a security team is not building the tool. It is deciding what the tool may do without asking. Among the hurdles a new report lists, that one stands out.
Flashpoint published its Enterprise Threat Intelligence Report: 2026 on October 13. Infosecurity Magazine covered the findings. Just 25% of cybersecurity teams surveyed are actively using agentic AI in their cyber defense. Agentic AI means software that takes steps on its own rather than only answering questions.
Where teams stand today
The rest of the picture is mixed. Another 20% run a closed pilot. Some 35% say they are weighing adoption sometime in the coming one to two years. The final 20% have no plans to test agentic AI in defense.
Infosecurity Magazine attributes the reluctance mainly to concerns over effectiveness. The coverage does not give the survey's sample size or method. Treat the figures as a snapshot of the respondents, not of every security team.
Funding signals and caution
The report suggests boards and funders appear keen on the technology. Of those surveyed, 35% expect their cybersecurity budget to rise by more than 10% over the next 12 months. Another 15% expect a rise of up to 10%. No respondent expected a cut.
These figures cover overall cybersecurity budgets, not agentic AI spending alone. The source links the expected rise to investigating agentic AI, but it does not say how much money goes to it.
Flashpoint's founder and CEO, Josh Lefkowitz, said security leaders are ready to invest but "aren't swayed by the hype." He said they want to know where the tools improve their work and where human judgment must stay in the process.
This shows a tension executives should expect to manage. Interest from the top may run ahead of confidence from the people who must live with the tool's mistakes.
Authority is the question to settle
The tasks teams hand to agents form a rough ladder. At the bottom sit information retrieval and alert prioritization. Higher up, the report names tasks that change things: blocking IP addresses, updating blacklists, and watching for suspicious traffic. At the top, some organizations let AI take automated action that directly affects security operations.
The lesson here is that each rung changes who carries the risk. A weak summary of an alert wastes an analyst's time. A wrong block can cut off a legitimate customer or partner. The report says many organizations are wary of giving an agent that kind of decision-making power.
One respondent put it plainly: "An agent that's confidently wrong is worse than one that's slow." It is a useful test for any proposal. Speed only helps if the decision behind it is right, or if a person can reverse it quickly.
Think of a new hire on probation. A company gives them read access first, then limited tasks, then approval rights as they earn them. Respondents seem to want the same path for software.
What else holds teams back
Wrong decisions are not the only worry. The report also names data leakage, auditability, regulatory requirements and cost. It adds the question of how much control agents should have over security workflows.
Auditability deserves attention from executives. If an agent blocks traffic or changes a list, someone must later explain why. A tool that cannot show its reasoning and its actions is hard to defend to a regulator or a board.
Questions to put to your security team
Ask which actions an AI agent may take alone today, which need a person's approval, and which are off limits. Ask who signs off when that line moves.
Ask whether every agent action is logged in a form an auditor can read, and whether it can be undone. Ask what data the agent sees and where that data goes.
Ask how the team will measure value. Flashpoint's CEO said buyers want to know where the tools improve work and whether the output can be trusted. A pilot with clear measures answers both.
Funding a tool is easy. Granting it authority is a decision, and it deserves its own owner, its own limits and its own review.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Infosecurity Magazine.
