Organizations have never had a greater awareness of cyber risk. Yet turning that awareness into operational intensity has never been a challenge. The 2026 Bitdefender Cybersecurity Assessment confirms this to be the case, as this year’s findings reveal a series of surprising inconsistencies.
Here are a few examples, based on an independent survey of 1,200 IT and cybersecurity professionals in six countries.
- IT and security the leaders believed they have enough visibility into the use of AI for workers, while many leading doctors disagree.
- Security teams understand the importance of reducing the attack surface, yet often lack the skills, resources, or strategy to do so.
- AI dominates cybersecurity discussions, but in some cases, it’s drawing attention to attack techniques that tend to cause more damage.
- Although organizations say they recognize the importance of transparency after a breach, many experts still report pressure to remain silent, even if a breach is not reported.
Together, these findings point to an industry struggling with a new reality: the gap between awareness and resilience.
AI Has Been Both a Huge Priority and a Huge Blind Spot
Artificial intelligence has become a part of everyday business operations, whether or not security teams are organized for it. Yet visibility into that use remains incredibly inconsistent.
While 51.8% of respondents believe they have full visibility into authorized and unauthorized AI use, 47.4% admit they have only partial visibility or no visibility into Shadow AI tools or personal AI accounts used for work.
The disconnect is even more pronounced when comparing leadership and employees. About 58% of managers believe they have complete visibility, while only 45.9% of employees agree.
The implication: many organizations may be making strategic decisions based on an incomplete picture of their exposure to AI.
Majority Agree on Attack Space Reduction Issues—Few Can’t Accomplish It
Reducing unnecessary exposure has become one of the most widely accepted cybersecurity priorities. Actually doing it is another matter.
Respondents identified maintaining strict and exception policies (38%), fear of disrupting business operations (35.4%), and limited resources (34.6%) as major barriers to reducing the attack surface. Another 33.8% expressed uncertainty about what legal tools individual users need, with that number rising to 48.8% among US organizations.
The challenge is not to convince anyone of the importance of reducing the attack surface; instead, it’s about finding a way to do it efficiently, without disrupting productivity or creating additional workload.
AI Dominates Attention, Traditional Threats Are Ignored
In this year’s survey, security experts ranked AI-related threats as their top three cybersecurity concerns. These include: Automated malware (55.9%), public LLM data leaks (53.5%), and AI-driven evasion techniques (52.5%), all ranked as high or extreme risks by respondents.
Yet today’s alarming intelligence paints a very different picture.
Rather than inventing entirely new attack strategies, adversaries are increasingly using AI to improve existing strategies, such as making phishing campaigns more believable, automated re-recognition, and speeding up attack execution.
Meanwhile, one of the most common attack methods today continues to receive relatively little attention.
Bitdefender Labs recently found that 84% of the most sophisticated attacks have achieved Living Off the Land (LOTL) techniques by abusing legitimate tools that already exist within the environment. Yet only one in five survey respondents ranked LOTL attacks among their top three concerns.
This suggests that while AI needs attention, organizations cannot afford to forget the threats that are already effective today.
Transparency Remains One of Cybersecurity’s Toughest Challenges
Perhaps the most surprising discovery this year isn’t about hackers at all.
It’s about the culture of the organization.
More than half (55.2%) of respondents who experienced a breach within the past twelve months said they were instructed to keep the incident confidential despite the fact that religious authorities should have been notified.
The figure rises to 68.6% in the United States.
These findings raise important questions about governance, compliance and trust. Successfully responding to a cyber incident is no longer measured solely by technical assistance. Increasingly, resilience includes transparency, accountability, and confidence in decision-making when incidents occur.
Awareness Is No Longer Enough
Taken one by one, each discovery is interesting. Taken together, they reveal something much greater.
Organizations understand today’s cyber risks better than ever. They know that AI introduces new exposure. They see the importance of reducing the attack surface. They appreciate the need for transparency and rigor.
What remains is the challenge of applying that understanding while balancing productivity, complexity, compliance, and limited resources.
That is the real challenge of defining cybersecurity in 2026.
See How Your Organization Compares
To check the full results, compare regional trends, and rate your organization against 1,200 cybersecurity professionals worldwide:
Because the organizations that are best prepared for tomorrow’s threats won’t just understand risk—it will be those that are able to turn that understanding into resilience.
