New Research from Kai: UK CISOs Face a Widening AI Security Gap as Attackers Gain the Advantage

59% of UK CISOs say attackers already hold the advantage, while 67% take more than a week to remediate critical vulnerabilities

SAN JOSE, Calif., Sept. 21, 2026 /PRNewswire/ -- Kai, the company behind the first agentic AI cybersecurity platform designed to execute security work end-to-end at machine speed with human expert accuracy, today announced UK findings from its inaugural 2026 State of Autonomous Defense Report.

According to the survey of 100 UK CISOs, a growing gap is emerging between the speed of AI-powered attacks and the ability of security teams to respond. As AI makes it faster and easier for attackers to find and exploit vulnerabilities, many UK organisations are still relying on manual processes that can take days or weeks. The findings point to a looming challenge for defenders: security operations built around human speed may not be able to keep pace as attackers become faster and more automated. If organisations fail to close vulnerabilities quickly, attackers could strike before defenders have a chance to act, increasing the risk of a major security incident.

While UK CISOs recognise the need to move toward machine-led security, many organisations aren't there yet. Barriers including trust, governance and operational readiness could slow that transition as attackers continue to accelerate their use of AI.

"AI is changing the speed of cyberattacks, and security teams can't afford to fall further behind," said Nick Degnan, Chief Revenue Officer at Kai. "The concern is that attackers are getting faster while many defenders are still operating with processes built for a different era. UK organisations know they need to change, but moving from human-led to machine-led security takes trust, governance and a willingness to let machines take on more of the work. The longer that transition takes, the more room attackers have to pull ahead."

UK CISOs understand the AI threat, but many security processes remain human-led

UK security leaders overwhelmingly acknowledge that AI has changed the threat landscape. Nearly all UK CISOs (94%) say their organisation is prepared to defend against AI-accelerated vulnerability exploitation, yet only one-third (33%) describe themselves as very prepared.

That confidence comes as UK CISOs see attackers gaining the upper hand. Fifty-nine percent believe attackers currently have the advantage given current levels of AI adoption and advancement, compared with just 13% who believe defenders have the advantage. As attackers increasingly leverage AI to accelerate exploitation, many UK organisations continue to rely on human-led security workflows that struggle to keep pace.

Slow remediation leaves a growing window for attackers

The research found that vulnerability management remains heavily dependent on manual effort, leaving UK organisations exposed and security teams under pressure. More than half (54%) of UK organisations report their vulnerability and exposure management processes are at least half manual, while 67% require more than one week to remediate critical vulnerabilities. More than half (54%) say at least one-quarter of known vulnerabilities go unremediated for more than 30 days.

These operational challenges are taking a measurable toll on UK security teams. Eighty-four percent of UK CISOs say vulnerability and exposure management contributes at least moderately to security team burnout, including 19% who describe it as a major contributor.

The findings suggest it's not just the threat landscape creating risk, but the operating model itself.

UK organisations want more automation, but barriers remain

While UK organisations increasingly see automation as essential to keeping pace with AI-powered threats, confidence in autonomous decision-making has yet to catch up. More than half (51%) of UK CISOs identify lack of trust in automated decisions as one of the biggest barriers to broader automation adoption in vulnerability and exposure management, followed by governance or compliance concerns (45%) and skills or talent gaps (45%).

UK organisations are already embracing automation for lower-risk activities such as vulnerability prioritisation (57%) and asset discovery and inventory (55%). However, only 32% currently permit automated remediation actions without human approval, underscoring that most organisations remain cautious about letting machines change the environment.

UK CISOs are also clear about what would give them greater confidence in machine-led security. More than half point to vendor accountability and liability protections (54%), auditability and explainability (53%), and regulatory clarity (52%) as factors that would increase their confidence in allowing machine-led systems to execute remediation actions without human approval.

UK organisations are moving toward machine-led security, but attackers are moving faster

Despite today's challenges, the research shows UK organisations are further ahead in adopting machine-led approaches. Today, 46% of UK organisations describe their vulnerability and exposure management approach as mostly or primarily machine-led, compared with 35% of organisations globally.

The foundations for further adoption are also being put in place. Ninety-four percent of UK CISOs say their organisation's governance approach is either already designed to support machine-led security actions or is being adapted for greater machine-led operation.

Looking ahead 12 to 18 months, 40% expect humans to supervise machine-led systems that lead prioritisation and execution, while 25% expect most vulnerability and exposure management workflows to be machine-led and 14% expect autonomous security operations to become the primary operating model.

The findings suggest UK organisations are not waiting for machine-led security to become a future reality. Many are already putting it into practice, while adapting governance and operating models for a more autonomous approach to cyber defence. But as attackers gain speed through AI, the pressure to make that transition is only growing.

Read the full 2026 UK State of Autonomous Defense Report here.

Methodology

The Kai Survey was conducted by Wakefield Research among 500 CISOs at private sector companies with a minimum annual revenue of $500 million, including 100 CISOs in the United Kingdom. The research was conducted in four markets between June 15 and June 29, 2026, using an email invitation and an online survey. All UK findings cited in this release are based on the 100 UK respondents.

About Kai

Kai is the AI company rebuilding cybersecurity for the machine-speed era. Trusted by Fortune 500 and Global 2000 enterprises, the Kai Autonomous Defense Platform replaces fragmented tools and human-limited workflows with agentic AI that works continuously across cyber asset management, application security, infrastructure vulnerability management, and detection engineering. It contextualises, reasons, and acts at machine speed and enterprise scale. What takes human-led teams weeks, Kai executes in hours, driving risk toward zero through Auto Remediation. Human defenders don't just keep up. They become superhuman.

Media contact: kai@inkhouse.com