DEFENDERS are still reluctant to deploy agentic AI as a core cybersecurity tool, even as organisations pour resources into AI for defence. The Enterprise Threat Intelligence Report: 2026 from Flashpoint finds only a quarter (25%) of security teams are actively using agentic AI within their active defence strategies.
While 75% have yet to fully explore deployment, the breakdown shows 20% running a closed pilot and a further 35% examining adoption in the next 12 to 24 months, with the remaining 20% having no plans to test AI agents at present.
Those using or piloting these agents perform tasks from information retrieval and alert prioritisation to more proactive actions such as blocking IP addresses, updating blacklists and monitoring suspicious traffic; some organisations have even allowed automated actions that can directly affect security operations, though many remain wary of granting AI broad decision‑making authority.
The report highlights substantial concerns about trusting agentic AI in defensive roles. Respondents warned that “an agent that’s confidently wrong is worse than one that’s slow,” underscoring the risk of erroneous decisions. Other barriers include data leakage, auditability, regulatory requirements and cost, plus questions over how much control AI agents should have over security workflows.
Despite cautious sentiment, leadership appears receptive to investment, with boards and funding providers largely keen to support exploration. More than half anticipate a meaningful budget rise to support investigation of agentic AI, with 35% foreseeing gains above 10% and a further 15% expecting increases of up to 10%; none expect reductions.