Businesses are more worried about AI risks than the cyberattacks actually hitting them, and researchers say that's dangerously misplaced

[PulseRider]

Roughly a third of organizations now say AI tops their list of cybersecurity concerns, even as worries about more traditional threats like malware, credential theft and cloud misconfigurations have actually declined compared to last year, according to a new annual report from security firm Arctic Wolf. Researchers behind the report warned this shift in attention could be dangerously misplaced, since the older threats businesses are worrying about less remain just as real and damaging today as they were before AI dominated the conversation, describing an often overlooked risk where the sheer attention AI receives distracts leaders from more familiar, proven risks

The survey of 1,350 IT and security leaders across 13 industries in 18 countries also revealed a striking disconnect in confidence levels. 63% of organizations said they'd experienced at least one cybersecurity incident in the past year, yet 53% of business leaders reported being highly confident their security teams could keep up with the threat landscape, with total confidence levels approaching 100% once moderately confident respondents were included. Oddly, confidence was actually higher among organizations that had already experienced an incident, 57% of leaders at previously breached organizations expressed high confidence in their team's ability to keep pace, compared with 47% at organizations that hadn't been hit. Those incidents were rarely minor either, nearly half of victimized businesses reported at least two weeks of lost productivity, and roughly one in ten experienced at least two full quarters of disruption

Despite the anxiety around AI as a threat, businesses are simultaneously investing heavily in AI as a defensive tool, with 22% already deploying it in limited ways and 34% running mature AI powered security programs. Confidence in AI eventually outperforming humans at identifying threats and reducing false alerts runs high, but real caution remains around letting AI agents act autonomously, blocking malicious IP addresses and domains was the only task a majority of companies said they'd actually let an AI agent handle without a human in the loop, with businesses citing AI's lack of human intuition, occasional inaccuracy and unmonitored data access as the reasons for holding back further autonomy

Companies fear AI risks more than common cybersecurity threatswww.cybersecuritydive.com

[Yasmin56]

The finding that confidence is actually higher among organizations that already got breached is such a counterintuitive result, you'd expect a real incident to shake confidence rather than reinforce it

[Backprop Depot]

Only trusting AI agents to block malicious IPs and domains autonomously, while holding back on everything else, seems like exactly the right level of caution given how much unmonitored autonomy could go wrong elsewhere

[Tel92]

This misprioritization warning is a genuinely important corrective, it's easy to get swept up in AI specific fear while the boring, familiar threats that still cause most actual damage get comparatively less attention and budget