Study Finds Majority of Companies Still Unprepared for AI Security Incidents

According to a new report released by the global professional association ISACA, a striking 71 percent of organizations have never conducted a dedicated AI incident response exercise, despite the rapid expansion of artificial intelligence tools across business operations. The findings highlight a widening gap between the pace of AI adoption and the readiness of security teams to address potential breaches or malfunctions involving these systems.

ISACA surveyed a cross‑section of enterprises ranging from large multinational corporations to midsize firms in sectors such as finance, healthcare, and manufacturing. Respondents indicated that while AI technologies are being integrated into critical workflows—from predictive analytics to automated decision‑making—formalized response plans specific to AI‑related threats remain largely absent. Many participants cited limited resources, a lack of clear guidance, and the novelty of AI‑centric risks as primary obstacles.

The report places the current shortfall within a broader context of escalating pressure on security teams. As AI models become more sophisticated, the attack surface expands, offering adversaries new vectors for data exfiltration, model poisoning, and manipulation of algorithmic outcomes. Industry observers have warned that conventional incident response playbooks, which focus on traditional IT assets, may not adequately address the unique characteristics of AI systems, such as model versioning, training data provenance, and real‑time inference pipelines.

Experts note that the absence of routine AI incident drills could have tangible consequences. Without rehearsed procedures, organizations risk delayed detection, misattribution of failures, and ineffective containment measures. Moreover, regulatory bodies in several jurisdictions are beginning to draft requirements for AI governance, including provisions for risk assessment and response. Companies that fail to demonstrate proactive readiness may face heightened scrutiny, fines, or loss of stakeholder confidence.

In response to the report’s findings, ISACA recommends that firms embed AI considerations into existing security frameworks rather than treating them as an afterthought. Practical steps include mapping AI assets, defining roles for AI risk owners, and integrating scenario‑based exercises that simulate attacks on model integrity or data pipelines. The association also calls for collaboration with external partners, such as academic researchers and industry consortia, to share threat intelligence and best practices.

Looking ahead, the gap identified by ISACA is likely to narrow as organizations recognize the strategic importance of AI resilience. The report suggests that upcoming revisions to standards like NIST’s AI Risk Management Framework could provide clearer guidance, prompting more systematic adoption of AI‑specific incident response drills. Until then, the majority of enterprises remain vulnerable, underscoring the need for immediate action to align security preparedness with the accelerating tide of AI deployment.