ISC2 Research Finds AI Is Reshaping Cybersecurity Roles and Increasing Human Oversight

Cybersecurity professionals reporting higher work-related stress from AI are significantly more likely to spend time validating outputs and deciding when to trust AI recommendations

ISC2 the world’s leading nonprofit member organization for cybersecurity professionals released findings from its Rethinking AI’s Impact on Cybersecurity Roles report, revealing that artificial intelligence (AI) is reshaping cybersecurity roles, workflows and decision-making while increasing the importance of human judgment, validation and governance. Approximately two-thirds of participants spent more time deciding when to trust or act on AI-generated recommendations (65%) and reviewing or validating AI outputs (63%) over the past year.

Based on a survey of 856 cybersecurity professionals who use AI in their roles, the research shows that while AI is improving efficiency and enabling more strategic work, it is also introducing new risks, increasing accountability pressures and accelerating changes to early-career pathways.

While nearly half of cybersecurity professionals (48%) report that AI has reduced workplace stress, almost one-third (32%) say it has increased stress levels. Those experiencing higher stress are significantly more likely than those with decreased stress to spend additional time deciding when to trust AI-generated recommendations (76% versus 57%) and reviewing or validating AI outputs (74% versus 57%). When AI-recommended actions lead to incorrect outcomes, half of the participants (50%) say their organizations hold human decision-makers ultimately accountable. Nearly 9 out of 10 (89%) respondents report having experienced AI recommendations that lead to incorrect outcomes at their organizations.

The research also finds that many cybersecurity professionals believe AI is changing early-career pathways. While 56% of participants say AI has reduced the need for entry-level roles, 53% believe AI is creating new entry-level opportunities and 48% say AI makes them feel more optimistic about their long-term career prospects.

“AI is not replacing cybersecurity professionals; it is changing what the profession requires of them,” said ISC2 CEO Scott Beale, CC. “As AI takes on more repetitive tasks, as well as performing some complex cybersecurity analysis at speed and scale, cybersecurity roles are shifting toward higher-value work, from asking the right questions to validating findings, interpreting outputs and applying human judgment. This evolution is not limited to entry-level roles. It changes how work is distributed across security teams, making continued investment in governance, validation practices, mentoring and skills development essential at every level.”

Also Read: CIO Influence Interview with Hugo Dozois-Caouette, CTO and Co-founder at MaintainX

Additional findings from the report include:

• AI’s impact on work-related stress is mixed. 48% report lowered stress due to AI, while 32% say stress has increased. Those reporting increased stress were significantly more likely than those with decreased stress to have spent more time deciding when to trust or act on AI recommendations (76% versus 57%) and reviewing or validating AI outputs (74% versus 57%).
• AI raises significant concerns. Top concerns include over-reliance on AI (62%), undetected errors scaling across systems (61%) and reduced human judgment at critical decision points (56%).
• Accountability remains human-led. When AI-recommended actions lead to incorrect outcomes, half of participants (50%) say their organizations hold human decision-makers ultimately accountable. Another 21% say accountability varies depending on the severity of the issue, while others reported ambiguity (10%) or a lack of clear ownership (8%) when AI recommendations are incorrect.
• AI is changing how cybersecurity professionals spend their time. Over the past year, nearly half (48%) report spending less time on tasks that do not involve AI, signaling a shift toward AI-assisted workflows. Responses on hands-on work are split: 35% report less time, 32% more time and 33% no change.
• Foundational cybersecurity skills remain essential. Nearly two-thirds (62%) do not believe that AI has reduced the need for foundational cybersecurity skills, compared to just 26% who say it has.
• Governance and trust frameworks are critical. Around 4 in 5 say it is very important to establish when to trust AI outputs(82%), knowing when to  override decisions (80%) and having clear governance frameworks in place (80%).