AI is reshaping cybersecurity roles, workflows and decision-making while increasing the importance of human judgment, validation and governance, according to new research from ISC2.

Approximately two-thirds of participants spent more time deciding when to trust or act on AI-generated recommendations (65%) and reviewing or validating AI outputs (63%) over the past year.

Based on a survey of 856 cybersecurity professionals who use AI in their roles, the research shows that while AI is improving efficiency and enabling more strategic work, it is also introducing new risks, increasing accountability pressures and accelerating changes to early-career pathways.

While nearly half of cybersecurity professionals (48%) report that AI has reduced workplace stress, almost one-third (32%) say it has increased stress levels. Those experiencing higher stress are significantly more likely than those with decreased stress to spend additional time deciding when to trust AI-generated recommendations (76% versus 57%) and reviewing or validating AI outputs (74% versus 57%).

When AI-recommended actions lead to incorrect outcomes, half of the participants (50%) say their organisations hold human decision-makers ultimately accountable. Nearly 9 out of 10 (89%) respondents report having experienced AI recommendations that lead to incorrect outcomes at their organisations.

The research also finds that many cybersecurity professionals believe AI is changing early-career pathways. While 56% of participants say AI has reduced the need for entry-level roles, 53% believe AI is creating new entry-level opportunities and 48% say AI makes them feel more optimistic about their long-term career prospects.

“AI is not replacing cybersecurity professionals; it is changing what the profession requires of them,” said ISC2 CEO Scott Beale, CC.

“As AI takes on more repetitive tasks, as well as performing some complex cybersecurity analysis at speed and scale, cybersecurity roles are shifting toward higher-value work, from asking the right questions to validating findings, interpreting outputs and applying human judgment. This evolution is not limited to entry-level roles. It changes how work is distributed across security teams, making continued investment in governance, validation practices, mentoring and skills development essential at every level.”

The research found that AI is having a mixed impact on work-related stress, with 48% reporting lowered stress due to the tech, while 32% say stress has increased. Those reporting increased stress were significantly more likely than those with decreased stress to have spent more time deciding when to trust or act on AI recommendations (76% versus 57%) and reviewing or validating AI outputs (74% versus 57%).

The technology is raising concerns, including ver-reliance on AI (62%), undetected errors scaling across systems (61%) and reduced human judgment at critical decision points (56%).

Recommended reading

• Cybersecurity in 2024 | The High Cost of Innovation
• AI Adoption Outpacing AI Skills in Cybersecurity
• CISOs Seeing More Impact from AI Cyber Threats
• AI in Cybersecurity | Navigating the Promises and Risks
• IT and Security Leaders Admit Hardware Cybersecurity Gap

Humans are not just in the loop when it comes to AI: they hold the ultimate responsibility. When AI-recommended actions lead to incorrect outcomes, half of participants (50%) say their organisations hold human decision-makers ultimately accountable. Another 21% say accountability varies depending on the severity of the issue, while others reported ambiguity (10%) or a lack of clear ownership (8%) when AI recommendations are incorrect.

Over the past year, nearly half (48%) report spending less time on tasks that do not involve AI, signaling a shift toward AI-assisted workflows. Responses on hands-on work are split: 35% report less time, 32% more time and 33% no change.

Still, foundational cybersecurity skills remain essential. Nearly two-thirds (62%) do not believe that AI has reduced the need for foundational cybersecurity skills, compared to just 26% who say it has.

Throughout this transformation, governance and trust frameworks remain critical. Around four in five say it is very important to establish when to trust AI outputs(82%), knowing when to  override decisions (80%) and having clear governance frameworks in place (80%).