COMMENTARY: Cybersecurity Awareness Month is a time for enterprises to review risks, patch systems, and test backups. But for this year, it’s better to go beyond these usual tasks.
For the next 12 months, expect budgets for AI to increasingly come under scrutiny, focusing on tangible ROI and what spending needs to be reined in. In the meantime, the cybersecurity threat landscape will continue to accelerate, driven by AI. According to Mandiant’s M-Trends 2026 survey, the median time between initial access and the handoff to a secondary threat group fell from more than eight hours in 2022 to just 22 seconds in 2025.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
Going forward, security teams will need to have an honest conversation about the best use of AI, the risks, what the threat model is internally, and whether or not the current budget and staffing plans are going to be enough.
AI spending faces a reckoning
While AI spending is likely to remain robust, there will be more accountability for the expenditures. A key part of this is “tokenomics.” AI agents consume large amounts of model resources, which has resulted in unexpected large bills. In some cases, enterprises have hit their annual budget limits within a few months.
The EY 2026 AI Pulse Survey supports this. In the survey, 82% of the respondents said that they were concerned about token usage and 37% plan to re-evaluate their AI priorities and investments.
A way to address the costs is to implement systems to route prompts to less expensive models, such as with harnesses. Employee training will also be critical.
Related reading:
Another factor with ROI is headcount, which is in terms of employee hours absorbed and translated into the cost of an FTE. For example, in a security operations center (SOC), AI may handle tier-1 and tier-2 alert triage while tier-3 analysts focus on more complex incidents.
This can lead to consolidation of security vendors or reduction of managed services providers.
Enterprise should also track metrics that measure the qualitative aspects of ROI like the false positive rate, detection coverage and analyst capacity.
Finally, enterprises need to calculate the payback. AI often involves heavy upfront investments during the first couple years. So leaders need to be patient with expected returns.
The agentic AI threat landscape is reshaping security
The AI threat landscape is evolving rapidly as agents gain greater autonomy and access to enterprise systems. The 2026 Cloud Security Alliance survey shows that 65% of organizations experienced at least one AI-agent-related incident during the prior year. They suffered from exposure of sensitive data (61%), disruption of operations (43%), and financial loss (35%).
But AI presents many other risks. One is the model supply chain. Open-source models downloaded from Hugging Face or other repositories may be poisoned or contain a hidden backdoor for scraping data. Once the model is integrated into an agentic workflow, the compromise may cascade into other systems and data.
Another emerging danger with the AI threat landscape is a confidence gap. It’s common for security teams to assume that detection and response (EDR), security information and event management (SIEM), and MITRE ATT&CK coverage provide sufficient protection. But inevitably there are gaps because agents can attack faster than a human attacker. This is why tools may not identify the threat or respond in time. Security teams therefore need a new class of behavioral detections designed specifically for AI-driven attacks.
How enterprises should prepare
To manage through this new world, enterprises should focus on the following:
- Be honest about the organization’s AI inventory. You cannot secure what you cannot see. Enterprises need to specify where their tools are hosted, the data stored and where it’s going, and what models are being used.
- Bolster vulnerability management: The rapid expansion of AI infrastructure, models, frameworks and integrations is creating a growing number of vulnerabilities and potential attack paths. Enterprises need to staff their teams with employees who have the skills to understand how to respond and deal with the threats.
- Leverage rigorous software supply-chain controls to AI models: Before a model is embedded in a development pipeline, teams need to verify its source, review the provenance and licensing, test the integrity, and evaluate it for malicious code, backdoors or unexpected behavior. These reviews should continue after deployment because models, dependencies and integrations change over time.
Conclusion
AI has reached an inflection point. So for this Cybersecurity Awareness Month, leaders need to identify where AI delivers real value, eliminate waste, and invest in the people and controls to manage autonomous systems. The organizations best prepared for the next phase will be those that treat AI as critical infrastructure that must be continuously measured, monitored, and secured.
