SANS 2024 AI Survey: AI and Its Growing Role in Cybersecurity: Lessons Learned and Path Forward

The SANS 2024 AI Survey, published by SANS Institute in September 2024, measured how organizations are adopting artificial intelligence within their cybersecurity strategies and the impact of that adoption on security operations and the workforce. The survey was conducted in March and April 2024, drawing on responses from security professionals across technology, cybersecurity, banking and finance, and government sectors.

Key findings:

• Despite growing adoption, 39% of organizations using AI report facing significant shortcomings in detecting or responding to cyber threats
• 71% of those shortcomings stem from AI systems generating false positives that lead to alert fatigue
• 82% of organizations are concerned about AI's impact on offensive cybersecurity tactics, such as automated vulnerability exploitation or advanced phishing
• Only 43% of organizations are currently using AI in their cybersecurity strategy, while 38% still have no active deployment
• 44% cite a significant skills gap as a top challenge in integrating AI, more than any other barrier
• 42% report difficulty trusting AI decisions due to a lack of transparency
• 61% say AI decisions need more transparency, and the same share want further refinement of AI algorithms to cut false positives
• Only 23% of organizations using AI in red team operations report doing so extensively, with most limited to simulating attacks
• 82% of organizations using AI find it useful for improving threat detection in the SOC
• 58% recognize that AI's effectiveness is heavily dependent on the quality and relevance of its training data
• 69% say the cybersecurity team plays a role in enabling and governing AI use across the enterprise, but only 34% test AI systems for adversarial attacks and model vulnerabilities
• 48% report AI has influenced job satisfaction among cybersecurity professionals, with 71% of those citing automation of tedious tasks as the driver

The findings point to an industry moving faster on AI adoption than on AI governance: organizations are already using AI for threat detection, incident response, and red team simulation, but transparency, training data quality, and skills gaps remain largely unresolved. The gap between enthusiasm for AI's efficiency gains and the immaturity of testing, auditing, and trust-building practices suggests governance is lagging behind deployment. Respondents were drawn primarily from the technology, cybersecurity, banking and finance, and government sectors, spanning organizations from fewer than 1,000 employees to more than 50,000, with roles concentrated among security administrators and analysts, security managers and directors, and security architects.